oracular (3) ssl_crl_cache_api.3erl.gz

NAME

       ssl_crl_cache_api - API for a TLS CRL (Certificate Revocation List) cache.

DESCRIPTION

       When  TLS  performs  certificate  path  validation  according  to  RFC  5280   it should also perform CRL
       validation checks. To enable the CRL checks the application needs access to CRLs. A database of CRLs  can
       be  set  up  in  many different ways. This module provides the behavior of the API needed to integrate an
       arbitrary CRL cache with the erlang ssl application. It is also used by the application itself to provide
       a simple default implementation of a CRL cache.

DATA TYPES

       crl_cache_ref() = any()

              Reference to the CRL cache.

       dist_point() = #'DistributionPoint'{}

              For description see  X509 certificates records

       logger_info() =
           {logger:level(),
            Report :: #{description => string(), reason => term()},
            logger:metadata()}

              Information for ssl applications use of  Logger(3erl)

EXPORTS

       Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL
       Module:fresh_crl(DistributionPoint, CRL) -> FreshCRL | {LoggerInfo, FreshCRL}

              Types:

                  DistributionPoint =  dist_point()
                  CRL = [public_key:der_encoded()]
                  FreshCRL = [public_key:der_encoded()]
                  LoggerInfo = {logger,  logger_info() }}

              fun fresh_crl/2  will be used as input option update_crl to public_key:pkix_crls_validate/3

              It  is  possible  to  return  logger  info  that will be used by the TLS connection to produce log
              events.

       Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs | {LoggerInfo, CRLs}
       Module:lookup(DistributionPoint, Issuer, DbHandle) -> not_available | CRLs
       Module:lookup(DistributionPoint, DbHandle) -> not_available | CRLs

              Types:

                  DistributionPoint =  dist_point()
                  Issuer = public_key:issuer_name()
                  DbHandle =  crl_cache_ref()
                  CRLs = [public_key:der_encoded()]
                  LoggerInfo = {logger,  logger_info() }}

              Lookup the CRLs belonging to the distribution point  Distributionpoint. This function  may  choose
              to  only  look  in  the  cache or to follow distribution point links depending on how the cache is
              administrated.

              The Issuer argument contains the issuer name of  the  certificate  to  be  checked.  Normally  the
              returned  CRL  should be issued by this issuer, except if the cRLIssuer field of DistributionPoint
              has a value, in which case that value should be used instead.

              In an earlier version of this API, the lookup function received two  arguments,  omitting  Issuer.
              For  compatibility,  this  is  still  supported:  if there is no lookup/3 function in the callback
              module, lookup/2 is called instead.

              It is possible to return logger info that will be used  by  the  TLS  connection  to  produce  log
              events.

       Module:select(Issuer, DbHandle) -> CRLs | {LoggerInfo, CRLs}
       Module:select(Issuer, DbHandle) -> CRLs

              Types:

                  Issuer = public_key:issuer_name() | list()
                  DbHandle =  cache_ref()
                  LoggerInfo = {logger,  logger_info() }

              Select  the  CRLs  in  the cache that are issued by Issuer unless the value is a list of so called
              general names, see  X509 certificates records, originating form #'DistributionPoint'.cRLissuer and
              representing  different  mechanism  to  obtain  the  CRLs.  The  cache  callback  needs to use the
              appropriate entry to retrieve the CRLs or return an empty list if it does not exist.

              It is possible to return logger info that will be used  by  the  TLS  connection  to  produce  log
              events.