1 //! PKIX X.509 Certificate Extensions (RFC 5280) 2 3 pub mod certpolicy; 4 pub mod constraints; 5 pub mod crl; 6 pub mod name; 7 8 mod access; 9 mod authkeyid; 10 mod keyusage; 11 mod policymap; 12 #[cfg(feature = "sct")] 13 pub mod sct; 14 15 use crate::attr::AttributeTypeAndValue; 16 17 pub use access::{AccessDescription, AuthorityInfoAccessSyntax, SubjectInfoAccessSyntax}; 18 pub use authkeyid::AuthorityKeyIdentifier; 19 pub use certpolicy::CertificatePolicies; 20 use const_oid::{AssociatedOid, ObjectIdentifier}; 21 pub use constraints::{BasicConstraints, NameConstraints, PolicyConstraints}; 22 pub use crl::{ 23 BaseCrlNumber, CrlDistributionPoints, CrlNumber, CrlReason, FreshestCrl, 24 IssuingDistributionPoint, 25 }; 26 pub use keyusage::{ExtendedKeyUsage, KeyUsage, KeyUsages, PrivateKeyUsagePeriod}; 27 pub use policymap::{PolicyMapping, PolicyMappings}; 28 29 #[cfg(feature = "sct")] 30 pub use sct::{ 31 Error, HashAlgorithm, SerializedSct, SignatureAlgorithm, SignatureAndHashAlgorithm, 32 SignedCertificateTimestamp, SignedCertificateTimestampList, Version, 33 }; 34 35 pub use const_oid::db::rfc5280::{ 36 ID_CE_INHIBIT_ANY_POLICY, ID_CE_ISSUER_ALT_NAME, ID_CE_SUBJECT_ALT_NAME, 37 ID_CE_SUBJECT_DIRECTORY_ATTRIBUTES, ID_CE_SUBJECT_KEY_IDENTIFIER, 38 }; 39 40 use alloc::vec::Vec; 41 42 use der::asn1::OctetString; 43 44 /// SubjectKeyIdentifier as defined in [RFC 5280 Section 4.2.1.2]. 45 /// 46 /// ```text 47 /// SubjectKeyIdentifier ::= KeyIdentifier 48 /// ``` 49 /// 50 /// [RFC 5280 Section 4.2.1.2]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2 51 #[derive(Clone, Debug, PartialEq, Eq)] 52 pub struct SubjectKeyIdentifier(pub OctetString); 53 54 impl AssociatedOid for SubjectKeyIdentifier { 55 const OID: ObjectIdentifier = ID_CE_SUBJECT_KEY_IDENTIFIER; 56 } 57 58 impl_newtype!(SubjectKeyIdentifier, OctetString); 59 impl_extension!(SubjectKeyIdentifier, critical = false); 60 impl_key_identifier!( 61 SubjectKeyIdentifier, 62 (|result: &[u8]| Ok(Self(OctetString::new(result)?))) 63 ); 64 65 /// SubjectAltName as defined in [RFC 5280 Section 4.2.1.6]. 66 /// 67 /// ```text 68 /// SubjectAltName ::= GeneralNames 69 /// ``` 70 /// 71 /// [RFC 5280 Section 4.2.1.6]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6 72 #[derive(Clone, Debug, Default, PartialEq, Eq)] 73 pub struct SubjectAltName(pub name::GeneralNames); 74 75 impl AssociatedOid for SubjectAltName { 76 const OID: ObjectIdentifier = ID_CE_SUBJECT_ALT_NAME; 77 } 78 79 impl_newtype!(SubjectAltName, name::GeneralNames); 80 81 impl crate::ext::AsExtension for SubjectAltName { critical(&self, subject: &crate::name::Name, _extensions: &[super::Extension]) -> bool82 fn critical(&self, subject: &crate::name::Name, _extensions: &[super::Extension]) -> bool { 83 // https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6 84 // Further, if the only subject identity included in the certificate is 85 // an alternative name form (e.g., an electronic mail address), then the 86 // subject distinguished name MUST be empty (an empty sequence), and the 87 // subjectAltName extension MUST be present. If the subject field 88 // contains an empty sequence, then the issuing CA MUST include a 89 // subjectAltName extension that is marked as critical. When including 90 // the subjectAltName extension in a certificate that has a non-empty 91 // subject distinguished name, conforming CAs SHOULD mark the 92 // subjectAltName extension as non-critical. 93 94 subject.is_empty() 95 } 96 } 97 98 /// IssuerAltName as defined in [RFC 5280 Section 4.2.1.7]. 99 /// 100 /// ```text 101 /// IssuerAltName ::= GeneralNames 102 /// ``` 103 /// 104 /// [RFC 5280 Section 4.2.1.7]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.7 105 #[derive(Clone, Debug, Default, PartialEq, Eq)] 106 pub struct IssuerAltName(pub name::GeneralNames); 107 108 impl AssociatedOid for IssuerAltName { 109 const OID: ObjectIdentifier = ID_CE_ISSUER_ALT_NAME; 110 } 111 112 impl_newtype!(IssuerAltName, name::GeneralNames); 113 impl_extension!(IssuerAltName, critical = false); 114 115 /// SubjectDirectoryAttributes as defined in [RFC 5280 Section 4.2.1.8]. 116 /// 117 /// ```text 118 /// SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF AttributeSet 119 /// ``` 120 /// 121 /// [RFC 5280 Section 4.2.1.8]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.8 122 #[derive(Clone, Debug, Default, PartialEq, Eq)] 123 pub struct SubjectDirectoryAttributes(pub Vec<AttributeTypeAndValue>); 124 125 impl AssociatedOid for SubjectDirectoryAttributes { 126 const OID: ObjectIdentifier = ID_CE_SUBJECT_DIRECTORY_ATTRIBUTES; 127 } 128 129 impl_newtype!(SubjectDirectoryAttributes, Vec<AttributeTypeAndValue>); 130 impl_extension!(SubjectDirectoryAttributes, critical = false); 131 132 /// InhibitAnyPolicy as defined in [RFC 5280 Section 4.2.1.14]. 133 /// 134 /// ```text 135 /// InhibitAnyPolicy ::= SkipCerts 136 /// ``` 137 /// 138 /// [RFC 5280 Section 4.2.1.14]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.14 139 #[derive(Copy, Clone, Debug, Default, PartialEq, Eq)] 140 pub struct InhibitAnyPolicy(pub u32); 141 142 impl AssociatedOid for InhibitAnyPolicy { 143 const OID: ObjectIdentifier = ID_CE_INHIBIT_ANY_POLICY; 144 } 145 146 impl_newtype!(InhibitAnyPolicy, u32); 147 impl_extension!(InhibitAnyPolicy, critical = true); 148