cert.h

Go to the documentation of this file.

/*
BSD 3-Clause License
 
Copyright (c) 2022, Stable Cloud Computing, Inc.
 
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
 
1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.
 
2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
 
3. Neither the name of the copyright holder nor the names of its
   contributors may be used to endorse or promote products derived from
   this software without specific prior written permission.
 
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef _SCC_CRYPTO_CERT_H
#define _SCC_CRYPTO_CERT_H
 
#include <map>
#include <memory>
#include <set>
#include <system_error>
#include <fstream>
#include <algorithm>
#include <crypto/der.h>
#include <crypto/rsa.h>
#include <crypto/ecc.h>
#include <crypto/bignum.h>
 
namespace scc::crypto {
 
enum KeyAlgoType
{
    unknown = 0,
    rsa,            
    ec_p192r1,      
    ec_p224r1,      
    ec_p256r1,      
    ec_p384r1,      
    ec_p521r1,      
};
 
struct PublicKeyCert
{
    PublicKeyCert() {}
    virtual ~PublicKeyCert() {}
 
    oid_value algorithm_id;             
    BasePtr parameters;                 
    std::vector<uint8_t> public_key;    
 
    KeyAlgoType type() const;
 
    void parse(const BasePtr);
    void parse(const DerDocument& doc)
    {
        parse(doc.root_ptr());
    }
 
    BasePtr dump() const;
 
    std::string str() const;
 
    void get(RsaPublicKey& key) const;
    void set(const RsaPublicKey& key);
 
    void get(EccGfpPoint&) const;
    void set(const KeyAlgoType&, const EccGfpPoint&);
};
 
struct RsaPublicKeyCert
{
    static void parse(const BasePtr&, RsaPublicKey&);
    static void parse(const DerDocument& doc, RsaPublicKey& key)
    {
        parse(doc.root_ptr(), key);
    }
 
    static BasePtr dump(const RsaPublicKey&);
};
 
struct RsaPrivateKeyCert
{
    static void parse(const BasePtr&, RsaPrivateKey&);
    static void parse(const DerDocument& doc, RsaPrivateKey& key)
    {
        parse(doc.root_ptr(), key);
    }
 
    static BasePtr dump(const RsaPrivateKey&);
};
 
struct EcParametersCert
{
    static void parse(const BasePtr&, KeyAlgoType&);
    static void parse(const DerDocument& doc, KeyAlgoType& alg)
    {
        parse(doc.root_ptr(), alg);
    }
    
    static BasePtr dump(const KeyAlgoType&);
};
 
struct EcPublicKeyCert
{
    static void parse(const BasePtr&, const KeyAlgoType&, EccGfpPoint&);
    static void parse(const DerDocument& doc, const KeyAlgoType& alg, EccGfpPoint& p)
    {
        parse(doc.root_ptr(), alg, p);
    }
    static void parse(const void*, int, const KeyAlgoType&, EccGfpPoint&);
    static void parse(const std::vector<char>& v, const KeyAlgoType& a, EccGfpPoint& p)
    {
        parse(v.data(), v.size(), a, p);
    }
    static void parse(const std::vector<uint8_t>& v, const KeyAlgoType& a, EccGfpPoint& p)
    {
        parse(v.data(), v.size(), a, p);
    }
 
    static BasePtr dump(const EccGfpPoint&);
    static void dump(const EccGfpPoint&, std::vector<char>&);
    static void dump(const EccGfpPoint&, std::vector<uint8_t>&);
};
 
struct EcPrivateKeyCert
{
    static void parse(const BasePtr&, Bignum&, KeyAlgoType&, EccGfpPoint&);
    static void parse(const DerDocument& doc, Bignum& priv, KeyAlgoType& alg, EccGfpPoint& pub)
    {
        parse(doc.root_ptr(), priv, alg, pub);
    }
 
    static BasePtr dump(const Bignum&, const KeyAlgoType&, const EccGfpPoint&);
};
 
struct DirectoryString : public std::string
{
    enum class Type
    {
        printable,
        utf8,
        universal,
        bmp,
        teletex,
        ia5,
        visible,
    };
 
    DirectoryString::Type type;
 
    DirectoryString() : type(DirectoryString::Type::printable) {}
    DirectoryString(const std::string& b, DirectoryString::Type t = Type::printable) : type(t)
    {
        assign(b);
    }
    DirectoryString(const BasePtr& b)
    {
        parse(b);
    }
    virtual ~DirectoryString() {}
 
    int compare(const DirectoryString& b) const
    {
        return std::string::compare(b);
    }
 
    bool operator==(const DirectoryString& b) const { return compare(b) == 0; }
    bool operator!=(const DirectoryString& b) const { return compare(b) != 0; }
 
    void parse(BasePtr);
 
    std::string str() const;
 
    BasePtr dump() const;
};
 
enum class AttributeType
{
    unknown,
    name,                       
    surname,                    
    given_name,                 
    generation_qualifier,       
    common_name,                
    locality_name,              
    state_or_province_name,     
    organization_name,          
    organizational_unit_name,   
    title,                      
    dn_qualifier,               
    country_name,               
    serial_number,              
    pseudonym,                  
    organization_id,            
    street_address,             
    domain_component,           
    email_address,              
};
 
using RDNPair = std::pair<oid_value, DirectoryString>;
 
struct RDNComp
{
    bool operator()(const RDNPair& lhs, const RDNPair& rhs) const
    {
        return lhs.first < rhs.first;
    }
};
 
struct RelativeDistinguishedName : public std::set<RDNPair, RDNComp>
{
    RelativeDistinguishedName() {}
    RelativeDistinguishedName(BasePtr b)
    {
        parse(b);
    }
    virtual ~RelativeDistinguishedName() {}
 
    void parse(BasePtr);
    BasePtr dump() const;
    std::string str() const;
 
    static AttributeType type(const oid_value&);
 
    static const oid_value name;
    static const oid_value surname; 
    static const oid_value given_name; 
    static const oid_value generation_qualifier; 
    static const oid_value common_name; 
    static const oid_value locality_name; 
    static const oid_value state_or_province_name; 
    static const oid_value organization_name; 
    static const oid_value organizational_unit_name; 
    static const oid_value title; 
    static const oid_value dn_qualifier; 
    static const oid_value country_name; 
    static const oid_value serial_number; 
    static const oid_value pseudonym; 
    static const oid_value organization_id; 
    static const oid_value street_address; 
    static const oid_value domain_component; 
    static const oid_value email_address; 
};
 
struct GeneralName
{
    enum class Type : int
    {
        other_name = 0,                     // base_val
        rfc822_name = 1,                    // string_val
        dns_name = 2,                       // string_val
        x400_address = 3,                   // base_val
        directory_name = 4,                 // name_val
        edi_party_name = 5,                 // base_val
        uniform_resource_identifier = 6,    // string_val
        ip_address = 7,                     // string_val
        registered_id = 8,                  // oid_val
    };
 
    Type type;                              
 
    GeneralName(Type t = Type::directory_name);
    virtual ~GeneralName() {}
 
    BasePtr base;
    std::string string_val;
    std::vector<RelativeDistinguishedName> name_val;
    oid_value oid_val;
 
    void clear()
    {
        string_val.clear();
        name_val.clear();
        oid_val.clear();
        base.reset();
    }
 
    bool compare(const GeneralName& b) const
    {
        if (type != b.type)     return false;
 
        switch (type)
        {
        case Type::registered_id:
            return oid_val == b.oid_val;
        case Type::rfc822_name:
        case Type::dns_name:
        case Type::uniform_resource_identifier:
        case Type::ip_address:
            return string_val.compare(b.string_val) == 0;
        case Type::directory_name:
            return name_val == b.name_val;
        case Type::other_name:
        case Type::x400_address:
        case Type::edi_party_name:
            return false;       // not possible to compare raw elements
        }
        return false;
    }
 
    bool operator==(const GeneralName& b) const { return compare(b); }
    bool operator!=(const GeneralName& b) const { return !compare(b); }
 
    void parse(BasePtr);
    BasePtr dump();
    std::string str(bool = false) const;
};
 
enum class ExtType
{
    subject_alternative_name,               // oid = {2, 5, 29, 17}
    authority_key_identifier,               // oid = {2, 5, 29, 35}
    subject_key_identifier,                 // oid = {2, 5, 29, 14}
    issuer_alternative_name,                // oid = {2, 5, 29, 18}
    basic_constraints,                      // oid = {2, 5, 29, 19}
    key_usage,                              // oid = {2, 5, 29, 15}
    extended_key_usage,                     // oid = {2, 5, 29, 37}
/*
    Not implemented:
 
    certificate_policies,                   // oid = {2, 5, 29, 32}
    policy_mappings,                        // oid = {2, 5, 29, 33}
    subject_directory_attributes,           // oid = {2, 5, 29, 9}
    name_constraints,                       // oid = {2, 5, 29, 30}
    policy_constraints,                     // oid = {2, 5, 29, 36}
    crl_distribution_points,                // oid = {2, 5, 29, 31}
    inhibit_any_policy,                     // oid = {2, 5, 29, 54}
    freshest_crl,                           // oid = {2, 5, 29, 46}
    authority_information_access,           // oid = {1, 3, 6, 1, 5, 5, 7, 1, 1}
    subject_information_access,             // oid = {1, 3, 6, 1, 5, 5, 7, 1, 11}
    signed_certificate_timestamp_list,      // oid = {1, 3, 6, 1, 4, 1, 11129, 2, 4, 2}
*/
};
 
class ExtBase;
using ExtBasePtr = std::shared_ptr<ExtBase>;
 
struct ExtBase
{   
    oid_value oid;              
    bool critical;              
    BasePtr value;              
 
    ExtBase(bool crit = false) : critical(crit) {}
    virtual ~ExtBase() {}
 
    virtual std::string name() const { return "ExtUnknown"; }
    virtual std::string str(bool = false) const;
    virtual void parse() {}
    virtual void dump() {}
    virtual bool implemented() const {  return false; }
 
    static ExtBasePtr create(BasePtr);
    
    BasePtr dump_seq();
 
    static oid_value find_oid(ExtType);
};
 
struct ExtSubjectAlternativeName : public ExtBase
{
    ExtSubjectAlternativeName(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::subject_alternative_name);
    }
    virtual ~ExtSubjectAlternativeName() {}
 
    std::string name() const { return "ExtSubjectAlternativeName"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtSubjectAlternativeName);
    }
    static ExtSubjectAlternativeName& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtSubjectAlternativeName: invalid cast");
        return *dynamic_cast<ExtSubjectAlternativeName*>(b.get());
    }
 
    std::vector<GeneralName> names;             
};
 
struct ExtAuthorityKeyIdentifier : public ExtBase
{
    ExtAuthorityKeyIdentifier(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::authority_key_identifier);
    }
    virtual ~ExtAuthorityKeyIdentifier() {}
 
    std::string name() const { return "ExtAuthorityKeyIdentifier"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtAuthorityKeyIdentifier);
    }
    static ExtAuthorityKeyIdentifier& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtAuthorityKeyIdentifier: invalid cast");
        return *dynamic_cast<ExtAuthorityKeyIdentifier*>(b.get());
    }
 
    std::vector<char> key_identifier;                   
    std::vector<GeneralName> authority_cert_issuer;     
    Bignum authority_cert_serial_number;                
};
 
 
struct ExtSubjectKeyIdentifier : public ExtBase
{
    ExtSubjectKeyIdentifier(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::subject_key_identifier);
    }
    virtual ~ExtSubjectKeyIdentifier() {}
 
    std::string name() const { return "ExtSubjectKeyIdentifier"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtSubjectKeyIdentifier);
    }
    static ExtSubjectKeyIdentifier& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtSubjectKeyIdentifier: invalid cast");
        return *dynamic_cast<ExtSubjectKeyIdentifier*>(b.get());
    }
 
    std::vector<char> key_identifier;
};
 
struct ExtIssuerAlternativeName : public ExtBase
{
    ExtIssuerAlternativeName(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::issuer_alternative_name);
    }
    virtual ~ExtIssuerAlternativeName() {}
 
    std::string name() const { return "ExtIssuerAlternativeName"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtIssuerAlternativeName);
    }
    static ExtIssuerAlternativeName& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtIssuerAlternativeName: invalid cast");
        return *dynamic_cast<ExtIssuerAlternativeName*>(b.get());
    }
 
    std::vector<GeneralName> names;
};
 
struct ExtBasicConstraints : public ExtBase
{
    ExtBasicConstraints(bool crit=false, bool ca=false, unsigned plen=0) : ExtBase(crit), conditional_access(ca), max_path_len(plen)
    {
        oid = ExtBase::find_oid(ExtType::basic_constraints);
    }
    virtual ~ExtBasicConstraints() {}
 
    std::string name() const { return "ExtBasicConstraints"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtBasicConstraints);
    }
    static ExtBasicConstraints& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtBasicConstraints: invalid cast");
        return *dynamic_cast<ExtBasicConstraints*>(b.get());
    }
 
    bool conditional_access;                
    Bignum max_path_len;                    
};
 
struct ExtKeyUsage : public ExtBase
{
    ExtKeyUsage(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::key_usage);
        clear();
    }
    virtual ~ExtKeyUsage() {}
 
    std::string name() const { return "ExtKeyUsage"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtKeyUsage);
    }
    static ExtKeyUsage& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtKeyUsage: invalid cast");
        return *dynamic_cast<ExtKeyUsage*>(b.get());
    }
 
    void clear()
    {
        digital_signature = false;
        content_commitment = false;
        key_encipherment = false;
        data_encipherment = false;
        key_agreement = false;
        key_cert_sign = false;
        crl_sign = false;
        encipher_only = false;
        decipher_only = false;
    }
 
    bool digital_signature;     
    bool content_commitment;    
    bool key_encipherment;      
    bool data_encipherment;     
    bool key_agreement;         
    bool key_cert_sign;         
    bool crl_sign;              
    bool encipher_only;         
    bool decipher_only;         
};
 
struct ExtExtendedKeyUsage : public ExtBase
{
    ExtExtendedKeyUsage(bool crit=false) : ExtBase(crit)
    {
        oid = ExtBase::find_oid(ExtType::extended_key_usage);
        clear();
    }
    virtual ~ExtExtendedKeyUsage() {}
 
    std::string name() const { return "ExtExtendedKeyUsage"; }
    virtual std::string str(bool = false) const;
    virtual void parse();
    virtual void dump();
    virtual bool implemented() const {  return true; }
 
    static bool is_castable(ExtBasePtr b)
    {
        return typeid(*b) == typeid(ExtExtendedKeyUsage);
    }
    static ExtExtendedKeyUsage& cast(ExtBasePtr b)
    {
        if (b == nullptr || !is_castable(b))    throw std::runtime_error("ExtExtendedKeyUsage: invalid cast");
        return *dynamic_cast<ExtExtendedKeyUsage*>(b.get());
    }
 
    void clear()
    {
        server_auth = false;
        client_auth = false;
        code_signing = false;
        email_protection = false;
        time_stamping = false;
        ocsp_signing = false;
        additional_usage_ids.clear();
    }
 
    bool permit_any;        
    bool server_auth;       
    bool client_auth;       
    bool code_signing;      
    bool email_protection;  
    bool time_stamping;     
    bool ocsp_signing;      
 
    std::vector<oid_value> additional_usage_ids;        
};
 
#if 0
 
class ExtSignedCertificateTimestampList : public ExtBase
{
    static int struct_size(const void*, unsigned int);
    bool add_sct(const void*, int, std::string&);
    int dump_scts(std::vector<char>&);
public:
    std::string name() const { return "ExtSignedCertificateTimestampList"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    std::vector<char> val;
 
    enum class HashAlgorithm : int
    {
        none = 0,
        md5,
        sha1,
        sha224,
        sha256,
        sha384,
        sha512,
    };
 
    enum class SigAlgorithm : int
    {
        anonymous = 0,
        rsa,
        dsa,
        ecdsa,
    };
 
    struct SCT
    {
        std::vector<char> log_id;       
        uint64_t timestamp;             
        HashAlgorithm hash;             
        SigAlgorithm sig_algo;          
        std::vector<char> signature;    
    };
 
    std::vector<SCT> sct_list;
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtAuthorityInformationAccess : public ExtBase
{
public:
    std::string name() const { return "ExtAuthorityInformationAccess"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtCertificatePolicies : public ExtBase
{
public:
    std::string name() const { return "ExtCertificatePolicies"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    enum class PolicyQualifierId
    {
        cps,            
        unotice,        
    };
 
    struct DisplayText
    {
        enum Type
        {
            ia5_string,
            visible_string,
            bmp_string,
            utf8_string,
        };
        Type type;
        std::string string;
 
        DisplayText() : type(Type::ia5_string) {}
    };
 
    struct NoticeReference
    {
        DisplayText organization;
        std::vector<Bignum> notice_numbers;
    };
 
    struct UserNotice
    {
        NoticeReference notice_ref;
        DisplayText explicit_text;
    };
 
    struct PolicyQualifierInfo
    {
        PolicyQualifierId id;
        std::string cps_qual;                           
        UserNotice user_notice;                         
    };
 
    struct PolicyInfo
    {
        oid_value policy_qualifier_id;
        std::vector<PolicyQualifierInfo> policy_qualifiers;
    };
 
    std::vector<PolicyInfo> certificate_policies;
 
    //DerSequence val;          ///< Does not interpret contents.
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtPolicyMappings : public ExtBase
{
public:
    std::string name() const { return "ExtPolicyMappings"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtSubjectDirectoryAttributes : public ExtBase
{
public:
    std::string name() const { return "ExtSubjectDirectoryAttributes"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    std::vector<std::pair<AttributeType, DirectoryString>> directory_attributes;
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtNameConstraints : public ExtBase
{
public:
    std::string name() const { return "ExtNameConstraints"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtPolicyConstraints : public ExtBase
{
public:
    std::string name() const { return "ExtPolicyConstraints"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtCrlDistributionPoints : public ExtBase
{
public:
    std::string name() const { return "ExtCrlDistributionPoints"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtInhibitAnyPolicy : public ExtBase
{
public:
    std::string name() const { return "ExtInhibitAnyPolicy"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    Bignum val;
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
class ExtFreshestCrl : public ExtBase
{
public:
    std::string name() const { return "ExtFreshestCrl"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
 
class ExtSubjectInformationAccess : public ExtBase
{
public:
    std::string name() const { return "ExtSubjectInformationAccess"; }
    static const oid_value s_oid;
    oid_value oid() const { return s_oid; }
 
    DerSequence val;            
 
    std::string str() const;
    bool parse(std::string&);
    void dump();
};
 
 
#endif
 
enum class X509SignatureAlgo : int
{
    unknown         = 0x0,
    rsa_md5         = 0x01,     
    rsa_sha1        = 0x02,     
    rsa_sha224      = 0x03,     
    rsa_sha256      = 0x04,     
    rsa_sha384      = 0x05,     
    rsa_sha512      = 0x06,     
    ecdsa_sha1      = 0x10,     
    ecdsa_sha224    = 0x20,     
    ecdsa_sha256    = 0x30,     
    ecdsa_sha384    = 0x40,     
    ecdsa_sha512    = 0x50,     
};
 
struct X509Cert
{
    X509Cert() {}
    virtual ~X509Cert() {}
 
    Bignum serial_number;                               
    std::vector<RelativeDistinguishedName> issuer;      
    std::chrono::system_clock::time_point valid_start;  
    std::chrono::system_clock::time_point valid_end;    
    std::vector<RelativeDistinguishedName> subject;     
    std::vector<char> issuer_unique_id;                 
    std::vector<char> subject_unique_id;                
    std::vector<ExtBasePtr> extensions;                 
 
    ExtBasePtr find_ext(ExtType t) const
    {
        auto it = std::find_if(extensions.begin(), extensions.end(), [&t](auto& i)
        {
            return i->oid == ExtBase::find_oid(ExtType::subject_alternative_name);
        });
        ExtBasePtr ret;
        if (it != extensions.end()) ret = *it;
        return ret;
    }
 
    PublicKeyCert public_key;                           
 
    std::vector<char> cert_bin;                         
    oid_value sig_algo_oid;                             
    oid_value sig_algo_params;                          
    std::vector<uint8_t> signature;                     
 
    bool bin_compare(const X509Cert& other) const
    {
        return cert_bin == other.cert_bin;
    }
 
    X509SignatureAlgo sig_algo() const;
 
    void parse(const DerDocument&);
 
    std::string str(bool = false) const;
 
    bool validate(const X509Cert&) const;
 
    bool validate() const
    {
        return validate(*this);
    }
 
    bool validate(const RsaPublicKey&) const;
    
    bool validate(const EccGfpPoint&) const;
 
    BasePtr dump_cert() const;
 
    void sign_and_dump(DerDocument&, const RsaPrivateKey&, const X509SignatureAlgo&);
 
    void sign_and_dump(DerDocument&, const KeyAlgoType&, const Bignum&, Bignum&, const X509SignatureAlgo&);
 
};
 
struct CertBundle : std::vector<std::shared_ptr<X509Cert>>
{
    CertBundle() {}
    CertBundle(std::istream& s)
    {
        parse(s);
    }
    virtual ~CertBundle() {}
 
    void parse(std::istream& s);
};
 
}   // namespace
 
std::ostream& operator<<(std::ostream&, const scc::crypto::X509Cert&);
std::ostream& operator<<(std::ostream&, const scc::crypto::KeyAlgoType&);
std::ostream& operator<<(std::ostream&, const scc::crypto::X509SignatureAlgo&);
 
#endif