113d40330Schristos=pod 213d40330Schristos 313d40330Schristos=head1 NAME 413d40330Schristos 513d40330SchristosSCT_validate, SCT_LIST_validate, SCT_get_validation_status - 613d40330Schristoschecks Signed Certificate Timestamps (SCTs) are valid 713d40330Schristos 813d40330Schristos=head1 SYNOPSIS 913d40330Schristos 1013d40330Schristos #include <openssl/ct.h> 1113d40330Schristos 1213d40330Schristos typedef enum { 1313d40330Schristos SCT_VALIDATION_STATUS_NOT_SET, 1413d40330Schristos SCT_VALIDATION_STATUS_UNKNOWN_LOG, 1513d40330Schristos SCT_VALIDATION_STATUS_VALID, 1613d40330Schristos SCT_VALIDATION_STATUS_INVALID, 1713d40330Schristos SCT_VALIDATION_STATUS_UNVERIFIED, 1813d40330Schristos SCT_VALIDATION_STATUS_UNKNOWN_VERSION 1913d40330Schristos } sct_validation_status_t; 2013d40330Schristos 2113d40330Schristos int SCT_validate(SCT *sct, const CT_POLICY_EVAL_CTX *ctx); 2213d40330Schristos int SCT_LIST_validate(const STACK_OF(SCT) *scts, CT_POLICY_EVAL_CTX *ctx); 2313d40330Schristos sct_validation_status_t SCT_get_validation_status(const SCT *sct); 2413d40330Schristos 2513d40330Schristos=head1 DESCRIPTION 2613d40330Schristos 2713d40330SchristosSCT_validate() will check that an SCT is valid and verify its signature. 2813d40330SchristosSCT_LIST_validate() performs the same checks on an entire stack of SCTs. 2913d40330SchristosThe result of the validation checks can be obtained by passing the SCT to 3013d40330SchristosSCT_get_validation_status(). 3113d40330Schristos 3213d40330SchristosA CT_POLICY_EVAL_CTX must be provided that specifies: 3313d40330Schristos 3413d40330Schristos=over 2 3513d40330Schristos 3613d40330Schristos=item * 3713d40330Schristos 3813d40330SchristosThe certificate the SCT was issued for. 3913d40330Schristos 4013d40330SchristosFailure to provide the certificate will result in the validation status being 4113d40330SchristosSCT_VALIDATION_STATUS_UNVERIFIED. 4213d40330Schristos 4313d40330Schristos=item * 4413d40330Schristos 4513d40330SchristosThe issuer of that certificate. 4613d40330Schristos 4713d40330SchristosThis is only required if the SCT was issued for a pre-certificate 4813d40330Schristos(see RFC 6962). If it is required but not provided, the validation status will 4913d40330Schristosbe SCT_VALIDATION_STATUS_UNVERIFIED. 5013d40330Schristos 5113d40330Schristos=item * 5213d40330Schristos 5313d40330SchristosA CTLOG_STORE that contains the CT log that issued this SCT. 5413d40330Schristos 5513d40330SchristosIf the SCT was issued by a log that is not in this CTLOG_STORE, the validation 5613d40330Schristosstatus will be SCT_VALIDATION_STATUS_UNKNOWN_LOG. 5713d40330Schristos 5813d40330Schristos=back 5913d40330Schristos 6013d40330SchristosIf the SCT is of an unsupported version (only v1 is currently supported), the 6113d40330Schristosvalidation status will be SCT_VALIDATION_STATUS_UNKNOWN_VERSION. 6213d40330Schristos 6313d40330SchristosIf the SCT's signature is incorrect, its timestamp is in the future (relative to 6413d40330Schristosthe time in CT_POLICY_EVAL_CTX), or if it is otherwise invalid, the validation 6513d40330Schristosstatus will be SCT_VALIDATION_STATUS_INVALID. 6613d40330Schristos 6713d40330SchristosIf all checks pass, the validation status will be SCT_VALIDATION_STATUS_VALID. 6813d40330Schristos 6913d40330Schristos=head1 NOTES 7013d40330Schristos 7113d40330SchristosA return value of 0 from SCT_LIST_validate() should not be interpreted as a 7213d40330Schristosfailure. At a minimum, only one valid SCT may provide sufficient confidence 7313d40330Schristosthat a certificate has been publicly logged. 7413d40330Schristos 7513d40330Schristos=head1 RETURN VALUES 7613d40330Schristos 7713d40330SchristosSCT_validate() returns a negative integer if an internal error occurs, 0 if the 7813d40330SchristosSCT fails validation, or 1 if the SCT passes validation. 7913d40330Schristos 8013d40330SchristosSCT_LIST_validate() returns a negative integer if an internal error occurs, 0 8113d40330Schristosif any of SCTs fails validation, or 1 if they all pass validation. 8213d40330Schristos 8313d40330SchristosSCT_get_validation_status() returns the validation status of the SCT. 8413d40330SchristosIf SCT_validate() or SCT_LIST_validate() have not been passed that SCT, the 8513d40330Schristosreturned value will be SCT_VALIDATION_STATUS_NOT_SET. 8613d40330Schristos 8713d40330Schristos=head1 SEE ALSO 8813d40330Schristos 8913d40330SchristosL<ct(7)> 9013d40330Schristos 9113d40330Schristos=head1 HISTORY 9213d40330Schristos 9313d40330SchristosThese functions were added in OpenSSL 1.1.0. 9413d40330Schristos 9513d40330Schristos=head1 COPYRIGHT 9613d40330Schristos 9713d40330SchristosCopyright 2016 The OpenSSL Project Authors. All Rights Reserved. 9813d40330Schristos 99*b0d17251SchristosLicensed under the Apache License 2.0 (the "License"). You may not use 10013d40330Schristosthis file except in compliance with the License. You can obtain a copy 10113d40330Schristosin the file LICENSE in the source distribution or at 10213d40330SchristosL<https://www.openssl.org/source/license.html>. 10313d40330Schristos 10413d40330Schristos=cut 105