|
SharkSSL C/C++ Reference
TLS, cryptography, certificates, and PSA integration
|
Certificate signing is separate from installing an identity for TLS. Use the optional ASN.1/CSR utilities to construct requests and the APIs in SharkSslCSR.h to issue certificates under an explicit issuer policy. A certificate signing request (CSR) proves possession of a key; it does not authorize the names or privileges requested by the applicant.
| Task | API and responsibility |
|---|---|
| Construct a request | SharkSslASN1Create_CSR for the native path; the RSA, ECDSA, and EdDSA PSA consumer headers supply key-handle CSR constructors. |
| Sign a request | SharkSslCert_signCSR with a SharkSslCertProfile; PSA signing variants use provider-owned private keys. The profile selects the issued certificate's purpose. |
| Accept an imported issuer chain | SharkSslCert_validateCAChain checks the bounded chain against a caller-selected trusted root, expected issuer key, and current time. Select the root from trusted configuration. |
| Check the issued identity | SharkSslCert_validateIssuedIdentity checks the expected key, typed SAN set, issuer, and timestamps. The issuer must already belong to a validated chain. Purpose and revocation policy remain application checks. |
| Install a TLS identity | SharkSsl_addCertificate or SharkSsl_addCertificatePSA. This configures a TLS object; it does not perform enrollment or renew a certificate. |
Enable SHARKSSL_ENABLE_CSR_SIGNING and link src/util/SharkSslCSR.c with its crypto dependencies. The caller supplies a SharkSslCertProfile, validity timestamps, serial number, issuer, and signing key. The approveSANs callback must accept only the enrollment identity authorized by the application. A zero callback result means acceptance. Its borrowed CSR pointers remain valid only during the call.
Use the exact profile's rules for CA versus leaf certificates, self-signed identities, path length, and OPC UA purposes. The implementation validates requested extensions but builds the issued extensions from the selected profile. It does not blindly copy the applicant's requested privileges.
On successful native signing, the positive return value is the allocated SharkSSL certificate size and the output pointer is non-NULL. Check both: failure leaves the output NULL and normally returns a negative value, but an ASN.1 encoding failure can return 1. The caller releases a successful allocation with baFree. PSA signing variants return a certificate containing no private key and retain the provider's key ownership.