• Home
Name Date Size #Lines LOC

..--

internal/04-Jul-2025-9,1466,256

DIR_METADATAD04-Jul-2025105 76

README.mdD04-Jul-20252.1 KiB4636

asn1_util.ccD04-Jul-202512 KiB384235

asn1_util.hD04-Jul-20253.8 KiB8530

caching_cert_verifier.ccD04-Jul-20257.7 KiB204109

caching_cert_verifier.hD04-Jul-20256 KiB15081

caching_cert_verifier_unittest.ccD04-Jul-202513.4 KiB359287

cert_database.ccD04-Jul-20252.1 KiB6638

cert_database.hD04-Jul-20253.4 KiB10143

cert_database_mac.ccD04-Jul-20252.7 KiB9357

cert_database_unittest.ccD04-Jul-20252.9 KiB9570

cert_net_fetcher.hD04-Jul-20253.1 KiB9542

cert_status_flags.ccD04-Jul-20252.1 KiB5942

cert_status_flags.hD04-Jul-20251.3 KiB4017

cert_status_flags_list.hD04-Jul-20251.9 KiB4820

cert_type.hD04-Jul-2025900 2912

cert_verifier.ccD04-Jul-20256 KiB165134

cert_verifier.hD04-Jul-20259.7 KiB239101

cert_verifier_unittest.ccD04-Jul-20255.7 KiB141109

cert_verify_proc.ccD04-Jul-202533.5 KiB880609

cert_verify_proc.hD04-Jul-202514.3 KiB349179

cert_verify_proc_android.ccD04-Jul-202515.4 KiB382259

cert_verify_proc_android.hD04-Jul-20251.3 KiB4326

cert_verify_proc_android_unittest.ccD04-Jul-202513.9 KiB340239

cert_verify_proc_blocklist.incD04-Jul-202532.1 KiB448445

cert_verify_proc_builtin.ccD04-Jul-202555.7 KiB1,4021,014

cert_verify_proc_builtin.hD04-Jul-20251.4 KiB4427

cert_verify_proc_builtin_unittest.ccD04-Jul-202583.4 KiB2,1131,603

cert_verify_proc_ios.ccD04-Jul-202520.1 KiB519381

cert_verify_proc_ios.hD04-Jul-20251.6 KiB5227

cert_verify_proc_unittest.ccD04-Jul-2025233 KiB5,9874,202

cert_verify_result.ccD04-Jul-20252.2 KiB7352

cert_verify_result.hD04-Jul-20253.8 KiB10234

client_cert_verifier.hD04-Jul-20251.1 KiB4323

coalescing_cert_verifier.ccD04-Jul-202518.6 KiB492276

coalescing_cert_verifier.hD04-Jul-20253.2 KiB8741

coalescing_cert_verifier_unittest.ccD04-Jul-202523.8 KiB597373

crl_set.ccD04-Jul-202514.4 KiB462305

crl_set.hD04-Jul-20255.3 KiB13353

crl_set_fuzzer.ccD04-Jul-20251 KiB3422

crl_set_unittest.ccD04-Jul-20259.6 KiB228179

ct_log_response_parser.ccD04-Jul-20254.3 KiB13199

ct_log_response_parser.hD04-Jul-2025994 3317

ct_log_response_parser_unittest.ccD04-Jul-20255.8 KiB162120

ct_log_verifier.ccD04-Jul-202511.2 KiB320198

ct_log_verifier.hD04-Jul-20254 KiB10350

ct_log_verifier_unittest.ccD04-Jul-202530.3 KiB764537

ct_log_verifier_util.ccD04-Jul-2025766 2917

ct_log_verifier_util.hD04-Jul-2025600 239

ct_objects_extractor.ccD04-Jul-202516.1 KiB428307

ct_objects_extractor.hD04-Jul-20252.9 KiB6624

ct_objects_extractor_unittest.ccD04-Jul-20257.3 KiB193136

ct_policy_enforcer.ccD04-Jul-2025744 2918

ct_policy_enforcer.hD04-Jul-20252.9 KiB9246

ct_policy_status.ccD04-Jul-2025919 3121

ct_policy_status.hD04-Jul-20251.3 KiB3815

ct_sct_to_string.ccD04-Jul-20252.1 KiB7967

ct_sct_to_string.hD04-Jul-20251.2 KiB3716

ct_serialization.ccD04-Jul-202514 KiB414335

ct_serialization.hD04-Jul-20254.1 KiB10242

ct_serialization_unittest.ccD04-Jul-20259.9 KiB274198

ct_signed_certificate_timestamp_log_param.ccD04-Jul-20253 KiB9764

ct_signed_certificate_timestamp_log_param.hD04-Jul-20251.2 KiB3414

ct_verifier.hD04-Jul-20251.7 KiB4521

decode_signed_certificate_timestamp_fuzzer.ccD04-Jul-2025827 2817

do_nothing_ct_verifier.ccD04-Jul-2025709 2716

do_nothing_ct_verifier.hD04-Jul-20252.9 KiB6921

ev_root_ca_metadata.ccD04-Jul-20254.6 KiB166116

ev_root_ca_metadata.hD04-Jul-20252.4 KiB8246

ev_root_ca_metadata_unittest.ccD04-Jul-20253.5 KiB9453

known_roots.ccD04-Jul-20251.5 KiB5637

known_roots.hD04-Jul-2025649 2611

known_roots_unittest.ccD04-Jul-20251.2 KiB4429

merkle_audit_proof.ccD04-Jul-20251.3 KiB4224

merkle_audit_proof.hD04-Jul-20251.5 KiB4922

merkle_audit_proof_unittest.ccD04-Jul-20252 KiB5235

merkle_consistency_proof.ccD04-Jul-2025652 2414

merkle_consistency_proof.hD04-Jul-20251 KiB4221

merkle_tree_leaf.ccD04-Jul-20251.7 KiB5538

merkle_tree_leaf.hD04-Jul-20252.3 KiB7027

merkle_tree_leaf_unittest.ccD04-Jul-20254 KiB13191

mock_cert_net_fetcher.ccD04-Jul-20251.5 KiB4831

mock_cert_net_fetcher.hD04-Jul-20252.3 KiB7042

mock_cert_verifier.ccD04-Jul-20257.2 KiB227183

mock_cert_verifier.hD04-Jul-20254.2 KiB12673

mock_client_cert_verifier.ccD04-Jul-20251.1 KiB4226

mock_client_cert_verifier.hD04-Jul-20251.8 KiB5627

multi_log_ct_verifier.ccD04-Jul-20256.6 KiB191142

multi_log_ct_verifier.hD04-Jul-20252.5 KiB7444

multi_log_ct_verifier_unittest.ccD04-Jul-20258.7 KiB244190

multi_threaded_cert_verifier.ccD04-Jul-20259.4 KiB260185

multi_threaded_cert_verifier.hD04-Jul-20252.7 KiB8150

multi_threaded_cert_verifier_unittest.ccD04-Jul-202514.6 KiB396312

nss_cert_database.ccD04-Jul-202523.7 KiB683492

nss_cert_database.hD04-Jul-202514.6 KiB361147

nss_cert_database_chromeos.ccD04-Jul-20255.3 KiB150108

nss_cert_database_chromeos.hD04-Jul-20252.9 KiB7739

nss_cert_database_chromeos_unittest.ccD04-Jul-202514.3 KiB375267

nss_cert_database_unittest.ccD04-Jul-202554.5 KiB1,3721,028

nss_profile_filter_chromeos.ccD04-Jul-20254.2 KiB11682

nss_profile_filter_chromeos.hD04-Jul-20251.8 KiB5124

nss_profile_filter_chromeos_unittest.ccD04-Jul-20258.6 KiB216174

root_cert_list_generated.hD04-Jul-2025130.5 KiB3,2883,265

root_store.protoD04-Jul-20252.7 KiB7156

scoped_nss_types.hD04-Jul-2025629 2916

sct_auditing_delegate.hD04-Jul-2025870 3118

sct_status_flags.ccD04-Jul-2025559 2415

sct_status_flags.hD04-Jul-20251.6 KiB5016

signed_certificate_timestamp.ccD04-Jul-20253.2 KiB9877

signed_certificate_timestamp.hD04-Jul-20254.5 KiB15287

signed_certificate_timestamp_and_status.ccD04-Jul-2025828 2614

signed_certificate_timestamp_and_status.hD04-Jul-20251.1 KiB3923

signed_certificate_timestamp_unittest.ccD04-Jul-20251.7 KiB6240

signed_tree_head.ccD04-Jul-20252.1 KiB6144

signed_tree_head.hD04-Jul-20251.8 KiB6137

symantec_certs.ccD04-Jul-202515.3 KiB241226

symantec_certs.hD04-Jul-20251.8 KiB4314

symantec_certs_unittest.ccD04-Jul-20252.2 KiB5938

test_keychain_search_list_mac.ccD04-Jul-20251.4 KiB5635

test_keychain_search_list_mac.hD04-Jul-20251.4 KiB4922

test_root_certs.ccD04-Jul-20253.6 KiB13396

test_root_certs.hD04-Jul-20255.7 KiB17084

test_root_certs_android.ccD04-Jul-2025709 3118

test_root_certs_builtin.ccD04-Jul-2025409 209

test_root_certs_ios.ccD04-Jul-20251.5 KiB6042

test_root_certs_unittest.ccD04-Jul-202512.7 KiB301212

time_conversions.ccD04-Jul-20251,022 3221

time_conversions.hD04-Jul-20251.2 KiB4323

time_conversions_unittest.ccD04-Jul-20254.3 KiB12396

x509_cert_types.ccD04-Jul-20253.4 KiB9779

x509_cert_types.hD04-Jul-20252.1 KiB6330

x509_cert_types_unittest.ccD04-Jul-20254 KiB10283

x509_certificate.ccD04-Jul-202526.9 KiB767562

x509_certificate.hD04-Jul-202514.6 KiB345137

x509_certificate_fuzztest.ccD04-Jul-2025516 2211

x509_certificate_net_log_param.ccD04-Jul-2025723 2818

x509_certificate_net_log_param.hD04-Jul-2025617 2612

x509_certificate_unittest.ccD04-Jul-202558.5 KiB1,4261,086

x509_util.ccD04-Jul-202520.5 KiB578481

x509_util.hD04-Jul-20257.9 KiB210103

x509_util_android.ccD04-Jul-2025636 2311

x509_util_apple.ccD04-Jul-20256.2 KiB180145

x509_util_apple.hD04-Jul-20253.3 KiB8340

x509_util_apple_unittest.ccD04-Jul-20258.6 KiB206159

x509_util_nss.ccD04-Jul-202514.7 KiB456369

x509_util_nss.hD04-Jul-20258.1 KiB18170

x509_util_nss_unittest.ccD04-Jul-202517.1 KiB449361

x509_util_unittest.ccD04-Jul-202544.3 KiB807699

x509_util_win.ccD04-Jul-20254.8 KiB13395

x509_util_win.hD04-Jul-20252.9 KiB7231

README.md

1# Certificate verification
2
3This directory contains the core code for verifying server certificates.
4Limited support is also included for verifying client certificates, but only to
5the extent they chain to a server-supplied set of issuers.
6
7Server certificate verification emphasizes the standards/policy for
8publicly trusted certificates:
9
10 * Basic X.509 digital certificates
11 * RFC 5280
12 * CA/Browser Forum Baseline Requirements
13 * CRLSets
14 * Certificate Transparency
15
16The core logic of certificate verification is implemented synchronously, as it
17may need to integrate with synchronous OS-provided APIs. This synchronous
18implementation is performed through the [CertVerifyProc](cert_verify_proc.h)
19interface, which is a thread-agnostic/thread-safe interface that can be used to
20verify certificates synchronously on arbitrary worker threads.
21
22The top-level interface for verifying server certificates is the asynchronous
23[CertVerifier](cert_verifier.h).
24
25[MultiThreadedCertVerifier](multi_threaded_cert_verifier.h) is an
26implementation of `CertVerifier` that executes `CertVerifyProc` synchronously
27on worker threads.
28
29[CertVerifyProcBuiltin](cert_verify_proc_builtin.h) is a cross-platform
30implementation which implements path building internally. It only relies on
31platform integrations for obtaining user and enterprise configured trusted root
32certificates. The publicly trusted root certificates are supplied by the
33[Chrome Root Store](../data/ssl/chrome_root_store/README.md).
34
35The other `CertVerifyProc` implementations are for integrating
36with the underlying platform's certificate verification library.
37There are 2 platform implementations:
38[CertVerifyProcAndroid](cert_verify_proc_android.h) and
39[CertVerifyProcIOS](cert_verify_proc_ios.h).
40
41Browser-specific policy checks are applied even when using the platform's
42certificate verifier. For instance, a certificate chain the OS deemed valid
43could ultimately be rejected by `CertVerifyProc` since it independently
44checks the chain for CRLSet revocation, use of weak keys, Baseline Requirements
45validity, name constraints, weak signature algorithms, and more.
46