14ce06407Schristos=pod 24ce06407Schristos 34ce06407Schristos=head1 NAME 44ce06407Schristos 54ce06407SchristosX509_cmp, X509_NAME_cmp, 64ce06407SchristosX509_issuer_and_serial_cmp, X509_issuer_name_cmp, X509_subject_name_cmp, 74ce06407SchristosX509_CRL_cmp, X509_CRL_match 84ce06407Schristos- compare X509 certificates and related values 94ce06407Schristos 104ce06407Schristos=head1 SYNOPSIS 114ce06407Schristos 124ce06407Schristos #include <openssl/x509.h> 134ce06407Schristos 144ce06407Schristos int X509_cmp(const X509 *a, const X509 *b); 154ce06407Schristos int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b); 164ce06407Schristos int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b); 174ce06407Schristos int X509_issuer_name_cmp(const X509 *a, const X509 *b); 184ce06407Schristos int X509_subject_name_cmp(const X509 *a, const X509 *b); 194ce06407Schristos int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b); 204ce06407Schristos int X509_CRL_match(const X509_CRL *a, const X509_CRL *b); 214ce06407Schristos 224ce06407Schristos=head1 DESCRIPTION 234ce06407Schristos 244ce06407SchristosThis set of functions are used to compare X509 objects, including X509 254ce06407Schristoscertificates, X509 CRL objects and various values in an X509 certificate. 264ce06407Schristos 274ce06407SchristosThe X509_cmp() function compares two B<X509> objects indicated by parameters 28*b0d17251SchristosI<a> and I<b>. The comparison is based on the B<memcmp> result of the hash 294ce06407Schristosvalues of two B<X509> objects and the canonical (DER) encoding values. 304ce06407Schristos 314ce06407SchristosThe X509_NAME_cmp() function compares two B<X509_NAME> objects indicated by 32*b0d17251Schristosparameters I<a> and I<b>. The comparison is based on the B<memcmp> result of the 33*b0d17251Schristoscanonical (DER) encoding values of the two objects using L<i2d_X509_NAME(3)>. 34*b0d17251SchristosThis procedure adheres to the matching rules for Distinguished Names (DN) 35*b0d17251Schristosgiven in RFC 4517 section 4.2.15 and RFC 5280 section 7.1. 36*b0d17251SchristosIn particular, the order of Relative Distinguished Names (RDNs) is relevant. 37*b0d17251SchristosOn the other hand, if an RDN is multi-valued, i.e., it contains a set of 38*b0d17251SchristosAttributeValueAssertions (AVAs), its members are effectively not ordered. 394ce06407Schristos 404ce06407SchristosThe X509_issuer_and_serial_cmp() function compares the serial number and issuer 41*b0d17251Schristosvalues in the given B<X509> objects I<a> and I<b>. 424ce06407Schristos 434ce06407SchristosThe X509_issuer_name_cmp(), X509_subject_name_cmp() and X509_CRL_cmp() functions 444ce06407Schristosare effectively wrappers of the X509_NAME_cmp() function. These functions compare 454ce06407Schristosissuer names and subject names of the X<509> objects, or issuers of B<X509_CRL> 464ce06407Schristosobjects, respectively. 474ce06407Schristos 484ce06407SchristosThe X509_CRL_match() function compares two B<X509_CRL> objects. Unlike the 494ce06407SchristosX509_CRL_cmp() function, this function compares the whole CRL content instead 504ce06407Schristosof just the issuer name. 514ce06407Schristos 524ce06407Schristos=head1 RETURN VALUES 534ce06407Schristos 54*b0d17251SchristosThe B<X509> comparison functions return B<-1>, B<0>, or B<1> if object I<a> is 55*b0d17251Schristosfound to be less than, to match, or be greater than object I<b>, respectively. 564ce06407Schristos 574ce06407SchristosX509_NAME_cmp(), X509_issuer_and_serial_cmp(), X509_issuer_name_cmp(), 58*b0d17251SchristosX509_subject_name_cmp(), X509_CRL_cmp(), and X509_CRL_match() 59*b0d17251Schristosmay return B<-2> to indicate an error. 604ce06407Schristos 614ce06407Schristos=head1 NOTES 624ce06407Schristos 634ce06407SchristosThese functions in fact utilize the underlying B<memcmp> of the C library to do 644ce06407Schristosthe comparison job. Data to be compared varies from DER encoding data, hash 654ce06407Schristosvalue or B<ASN1_STRING>. The sign of the comparison can be used to order the 664ce06407Schristosobjects but it does not have a special meaning in some cases. 674ce06407Schristos 684ce06407SchristosX509_NAME_cmp() and wrappers utilize the value B<-2> to indicate errors in some 694ce06407Schristoscircumstances, which could cause confusion for the applications. 704ce06407Schristos 714ce06407Schristos=head1 SEE ALSO 724ce06407Schristos 734ce06407SchristosL<i2d_X509_NAME(3)>, L<i2d_X509(3)> 744ce06407Schristos 754ce06407Schristos=head1 COPYRIGHT 764ce06407Schristos 77*b0d17251SchristosCopyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved. 784ce06407Schristos 794ce06407SchristosLicensed under the Apache License 2.0 (the "License"). You may not use 804ce06407Schristosthis file except in compliance with the License. You can obtain a copy 814ce06407Schristosin the file LICENSE in the source distribution or at 824ce06407SchristosL<https://www.openssl.org/source/license.html>. 834ce06407Schristos 844ce06407Schristos=cut 85