NAME

       ssl_crl_cache_api - API for a TLS CRL (Certificate Revocation List) cache.

DESCRIPTION

       When  TLS  performs  certificate  path  validation  according  to  RFC  5280   it should also perform CRL
       validation checks. To enable the CRL checks the application needs access to CRLs. A database of CRLs  can
       be  set  up  in  many different ways. This module provides the behavior of the API needed to integrate an
       arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide
       a simple default implementation of a CRL cache.

DATA TYPES

       crl_cache_ref() = any()

              Reference to the CRL cache.

       dist_point() = #'DistributionPoint'{}

              For description see  X509 certificates records

       logger_info() =
           {logger:level(),
            Report :: #{description => string(), reason => term()},
            logger:metadata()}

              Information for ssl applications use of  Logger(3erl)

EXPORTS

       Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL
       Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL | {LoggerInfo, FreshCRL}

              Types:

                  DistributionPoint =  dist_point()
                  CRL = [public_key:der_encoded()]
                  FreshCRL = [public_key:der_encoded()]
                  LoggerInfo = {logger,  logger_info() }}

              fun fresh_crl/2  will be used as input option update_crl to public_key:pkix_crls_validate/3

              It is possible to return logger info that will be used  by  the  TLS  connection  to  produce  log
              events.

       Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs | {LoggerInfo, CRLs}
       Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs
       Module:lookup(DistributionPoint, DbHandle) -> not_available | CRLs

              Types:

                  DistributionPoint =  dist_point()
                  Issuer = public_key:issuer_name()
                  DbHandle =  crl_cache_ref()
                  CRLs = [public_key:der_encoded()]
                  LoggerInfo = {logger,  logger_info() }}

              Lookup  the  CRLs belonging to the distribution point  Distributionpoint. This function may choose
              to only look in the cache or to follow distribution point links depending  on  how  the  cache  is
              administrated.

              The  Issuer  argument  contains  the  issuer  name  of the certificate to be checked. Normally the
              returned CRL should be issued by this issuer, except if the cRLIssuer field  of  DistributionPoint
              has a value, in which case that value should be used instead.

              In  an  earlier  version of this API, the lookup function received two arguments, omitting Issuer.
              For compatibility, this is still supported: if there is  no  lookup/3  function  in  the  callback
              module, lookup/2 is called instead.

              It  is  possible  to  return  logger  info  that will be used by the TLS connection to produce log
              events.

       Module:select(Issuer, DbHandle) -> CRLs | {LoggerInfo, CRLs}
       Module:select(Issuer, DbHandle) -> CRLs

              Types:

                  Issuer = public_key:issuer_name() | list()
                  DbHandle =  cache_ref()
                  LoggerInfo = {logger,  logger_info() }

              Select the CRLs in the cache that are issued by Issuer unless the value is a  list  of  so  called
              general names, see  X509 certificates records, originating form #'DistributionPoint'.cRLissuer and
              representing  different  mechanism  to  obtain  the  CRLs.  The  cache  callback  needs to use the
              appropriate entry to retrieve the CRLs or return an empty list if it does not exist.

              It is possible to return logger info that will be used  by  the  TLS  connection  to  produce  log
              events.

Ericsson AB                                       ssl 10.9.1.3                           ssl_crl_cache_api(3erl)