1.\" $OpenBSD: X509_cmp.3,v 1.2 2020/06/12 12:15:59 schwarze Exp $ 2.\" full merge up to: OpenSSL ea5d4b89 Jun 6 11:42:02 2019 +0800 3.\" 4.\" This file is a derived work. 5.\" The changes are covered by the following Copyright and license: 6.\" 7.\" Copyright (c) 2019 Ingo Schwarze <schwarze@openbsd.org> 8.\" 9.\" Permission to use, copy, modify, and distribute this software for any 10.\" purpose with or without fee is hereby granted, provided that the above 11.\" copyright notice and this permission notice appear in all copies. 12.\" 13.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 14.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 15.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 16.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 17.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20.\" 21.\" The original file was written by Paul Yang <yang.yang@baishancloud.com>. 22.\" Copyright (c) 2019 The OpenSSL Project. All rights reserved. 23.\" 24.\" Redistribution and use in source and binary forms, with or without 25.\" modification, are permitted provided that the following conditions 26.\" are met: 27.\" 28.\" 1. Redistributions of source code must retain the above copyright 29.\" notice, this list of conditions and the following disclaimer. 30.\" 31.\" 2. Redistributions in binary form must reproduce the above copyright 32.\" notice, this list of conditions and the following disclaimer in 33.\" the documentation and/or other materials provided with the 34.\" distribution. 35.\" 36.\" 3. All advertising materials mentioning features or use of this 37.\" software must display the following acknowledgment: 38.\" "This product includes software developed by the OpenSSL Project 39.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 40.\" 41.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 42.\" endorse or promote products derived from this software without 43.\" prior written permission. For written permission, please contact 44.\" openssl-core@openssl.org. 45.\" 46.\" 5. Products derived from this software may not be called "OpenSSL" 47.\" nor may "OpenSSL" appear in their names without prior written 48.\" permission of the OpenSSL Project. 49.\" 50.\" 6. Redistributions of any form whatsoever must retain the following 51.\" acknowledgment: 52.\" "This product includes software developed by the OpenSSL Project 53.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)" 54.\" 55.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 56.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 57.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 58.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 59.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 60.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 61.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 62.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 63.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 64.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 65.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 66.\" OF THE POSSIBILITY OF SUCH DAMAGE. 67.\" 68.Dd $Mdocdate: June 12 2020 $ 69.Dt X509_CMP 3 70.Os 71.Sh NAME 72.Nm X509_cmp , 73.Nm X509_NAME_cmp , 74.Nm X509_issuer_and_serial_cmp , 75.Nm X509_issuer_name_cmp , 76.Nm X509_subject_name_cmp , 77.Nm X509_CRL_cmp , 78.Nm X509_CRL_match 79.Nd compare X.509 certificates and related values 80.\" The function name_cmp() is intentionally undocumented. 81.\" It was a mistake to make it public in the first place, 82.\" and it is no longer part of the public API in OpenSSL 1.1. 83.Sh SYNOPSIS 84.In openssl/x509.h 85.Ft int 86.Fo X509_cmp 87.Fa "const X509 *a" 88.Fa "const X509 *b" 89.Fc 90.Ft int 91.Fo X509_NAME_cmp 92.Fa "const X509_NAME *a" 93.Fa "const X509_NAME *b" 94.Fc 95.Ft int 96.Fo X509_issuer_and_serial_cmp 97.Fa "const X509 *a" 98.Fa "const X509 *b" 99.Fc 100.Ft int 101.Fo X509_issuer_name_cmp 102.Fa "const X509 *a" 103.Fa "const X509 *b" 104.Fc 105.Ft int 106.Fo X509_subject_name_cmp 107.Fa "const X509 *a" 108.Fa "const X509 *b" 109.Fc 110.Ft int 111.Fo X509_CRL_cmp 112.Fa "const X509_CRL *a" 113.Fa "const X509_CRL *b" 114.Fc 115.Ft int 116.Fo X509_CRL_match 117.Fa "const X509_CRL *a" 118.Fa "const X509_CRL *b" 119.Fc 120.Sh DESCRIPTION 121.Fn X509_cmp 122compares two X.509 certificates using 123.Xr memcmp 3 124on the SHA1 hashes of their canonical (DER) representations as generated with 125.Xr X509_digest 3 . 126.Pp 127.Fn X509_NAME_cmp 128compares two X.501 129.Vt Name 130objects using their canonical (DER) representations generated with 131.Xr i2d_X509_NAME 3 . 132.Pp 133.Fn X509_issuer_and_serial_cmp 134compares the 135.Fa issuer 136and 137.Fa serialNumber 138fields of two 139.Vt TBSCertificate 140structures, using 141.Fn X509_NAME_cmp 142for the 143.Fa issuer 144fields. 145.Pp 146.Fn X509_issuer_name_cmp 147compares the 148.Fa issuer 149fields of two 150.Vt TBSCertificate 151structures using 152.Fn X509_NAME_cmp . 153.Pp 154.Fn X509_subject_name_cmp 155compares the 156.Fa subject 157fields of two 158.Vt TBSCertificate 159structures using 160.Fn X509_NAME_cmp . 161.Pp 162.Fn X509_CRL_cmp 163is misnamed; it only compares the 164.Fa issuer 165fields of two 166.Vt TBSCertList 167structures using 168.Fn X509_NAME_cmp . 169.Pp 170.Fn X509_CRL_match 171compares two certificate revocation lists using 172.Xr memcmp 3 173on the SHA1 hashes of their canonical (DER) representations as generated with 174.Xr X509_CRL_digest 3 . 175.Sh RETURN VALUES 176All these functions return 0 to indicate a match or a non-zero value 177to indicate a mismatch. 178.Pp 179.Fn X509_NAME_cmp , 180.Fn X509_issuer_and_serial_cmp , 181.Fn X509_issuer_name_cmp , 182.Fn X509_subject_name_cmp 183and 184.Fn X509_CRL_cmp 185may return -2 to indicate an error. 186.Sh SEE ALSO 187.Xr i2d_X509_NAME 3 , 188.Xr X509_CRL_new 3 , 189.Xr X509_digest 3 , 190.Xr X509_NAME_new 3 , 191.Xr X509_new 3 192.Sh STANDARDS 193RFC 5280: Internet X.509 Public Key Infrastructure Certificate 194and Certificate Revocation List (CRL) Profile 195.Bl -dash -compact -offset indent 196.It 197section 4.1: Basic Certificate Fields 198.It 199section 5.1: CRL Fields 200.El 201.Sh HISTORY 202.Fn X509_issuer_and_serial_cmp , 203.Fn X509_issuer_name_cmp , 204and 205.Fn X509_subject_name_cmp 206first appeared in SSLeay 0.5.1 and 207.Fn X509_NAME_cmp 208and 209.Fn X509_CRL_cmp 210in SSLeay 0.8.0. 211These functions have been available since 212.Ox 2.4 . 213.Pp 214.Fn X509_cmp 215first appeared in OpenSSL 0.9.5 and has been available since 216.Ox 2.7 . 217.Pp 218.Fn X509_CRL_match 219first appeared in OpenSSL 1.0.0 and has been available since 220.Ox 4.9 . 221.Sh BUGS 222For 223.Fn X509_NAME_cmp , 224.Fn X509_issuer_and_serial_cmp , 225.Fn X509_issuer_name_cmp , 226.Fn X509_subject_name_cmp 227and 228.Fn X509_CRL_cmp , 229the return value -2 sometimes indicates a mismatch and sometimes an error. 230