Changes between Version 27 and Version 28 of CertMgr

Timestamp:

May 31, 2007, 2:00:33 AM (17 years ago)

Author:

wehlhard

Comment:

documentation!

CertMgr

@@ -43 +43 @@
  * char * get_signer_unique_id - returns a unique identifier for the key used to sign the certificate
 
+=== struct CertificatePool ===
+ * char * name - the pool identifier
+ * CertificateScheme * scheme - certificate type this pool is filled with
+ * gboolean exists_in_pool(unique_id) - checks for the presence of a given cert in the pool (see get_unique_id above) (may take Certificate instead of unique_id?)
+ * Certificate * retrieve_certificate(unique_id)
+ * store_certificate(Certificate) - overwrites previous certificate by unique_id if it exists
+
+=== struct CertificateAuthorizer ===
+ * char * name - unique identifier ("tls_peers", "silc_servers", etc.)
+ * CertificateScheme * scheme - certificate type this authorizer works with
+ * bless_certificate - forces the certificate's authorization (just calls CertificatePool->store_certificate, most likely)
+ * gboolean certificate_is_valid (Certificate) - returns whether a certificate can be verified as usable.
+  * Perhaps it should also take an expected_values argument of the same form as the return value from get_verification_data(Certificate) to specify some values to check (such as Common Name, which maybe ought to be optional?)
+
 == SslOps Additions ==
  * get_peer_certificates - fetches as much of the certificate chain as the peer is willing to provide off of the wire and exports the certificates as several "x509" Certificate instances.
 
 == Key Store ==
-The API for this hasn't been decided yet. However, the organization will look something like this:
-~/.purple/certificates/cert_scheme_name/cert_unique_id(.pem?)
+Managed by a CertificatePool.
+
+The API for this hasn't been totally decided yet. However, the organization will look something like this:
+~/.purple/certificates/cert_scheme_name/cert_pool/cert_unique_id(.pem?)
 So an example X.509 certificate might be stored as:
-~/.purple/certificates/x509/gmail_com_1234567890abcdef1234567890abcdef.pem
-Some metadata may be necessary for each certificate.
+~/.purple/certificates/x509/tls_servers/gmail_com_1234567890abcdef1234567890abcdef.pem
+The keystore logic will be left mostly up to the relevant CertificatePool; these are only guidelines for how the CertificatePools should run their backends.
 
 == Miscellaneous API changes ==