1 // Copyright 2013 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_CERT_CT_VERIFIER_H_ 6 #define NET_CERT_CT_VERIFIER_H_ 7 8 #include <string_view> 9 10 #include "base/time/time.h" 11 #include "net/base/net_export.h" 12 #include "net/cert/signed_certificate_timestamp_and_status.h" 13 14 namespace net { 15 16 class NetLogWithSource; 17 class X509Certificate; 18 19 // Interface for verifying Signed Certificate Timestamps over a certificate. 20 class NET_EXPORT CTVerifier { 21 public: 22 virtual ~CTVerifier() = default; 23 24 // Verifies SCTs embedded in the certificate itself, SCTs embedded in a 25 // stapled OCSP response, and SCTs obtained via the 26 // signed_certificate_timestamp TLS extension on the given |cert|. 27 // A certificate is permitted but not required to use multiple sources for 28 // SCTs. It is expected that most certificates will use only one source 29 // (embedding, TLS extension or OCSP stapling). If no stapled OCSP response 30 // is available, |stapled_ocsp_response| should be an empty string. If no SCT 31 // TLS extension was negotiated, |sct_list_from_tls_extension| should be an 32 // empty string. |output_scts| will be cleared and filled with the SCTs 33 // present, if any, along with their verification results. 34 virtual void Verify(X509Certificate* cert, 35 std::string_view stapled_ocsp_response, 36 std::string_view sct_list_from_tls_extension, 37 base::Time current_time, 38 SignedCertificateTimestampAndStatusList* output_scts, 39 const NetLogWithSource& net_log) const = 0; 40 }; 41 42 } // namespace net 43 44 #endif // NET_CERT_CT_VERIFIER_H_ 45