class: GTlsCertificateCtors

[254:14] static extends: object

Alternate constructors for GTlsCertificate. Usage: GTlsCertificateCtors.<name>(...). The primary constructor lives directly on GTlsCertificate.

Methods

newFromFileWithPassword (string file, string password)

Creates a #GTlsCertificate from the data in @file. If @file cannot be read or parsed, the function will return %NULL and set @error. Any unknown file types will error with %G_IO_ERROR_NOT_SUPPORTED. Currently only .p12 and .pfx files are supported. See g_tls_certificate_new_from_pkcs12() for more details.
- @p file is file containing a certificate to import.
- @p password is password for PKCS #12 files.
- @r A new GTlsCertificate.
newFromFiles (string cert_file, string key_file)

Creates a #GTlsCertificate from the PEM-encoded data in @cert_file and
- @key_file. The returned certificate will be the first certificate found in @cert_file. As of GLib 2.44, if @cert_file contains more certificates it will try to load a certificate chain. All certificates will be verified in the order found (top-level certificate should be the last one in the file) and the #GTlsCertificate:issuer property of each certificate will be set accordingly if the verification succeeds. If any certificate in the chain cannot be verified, the first certificate in the file will still be returned. If either file cannot be read or parsed, the function will return %NULL and set @error. Otherwise, this behaves like g_tls_certificate_new_from_pem().
- @p cert_file is file containing one or more PEM-encoded certificates to import.
- @p key_file is file containing a PEM-encoded private key to import.
- @r A new GTlsCertificate.
newFromPem (string data, int length)

Creates a #GTlsCertificate from the PEM-encoded data in @data. If @data includes both a certificate and a private key, then the returned certificate will include the private key data as well. (See the #GTlsCertificate:private-key-pem property for information about supported formats.) The returned certificate will be the first certificate found in
- @data. As of GLib 2.44, if @data contains more certificates it will try to load a certificate chain. All certificates will be verified in the order found (top-level certificate should be the last one in the file) and the #GTlsCertificate:issuer property of each certificate will be set accordingly if the verification succeeds. If any certificate in the chain cannot be verified, the first certificate in the file will still be returned.
- @p data is PEM-encoded certificate data.
- @p length is the length of @data, or -1 if it's 0-terminated..
- @r A new GTlsCertificate.
newFromPkcs11Uris (string pkcs11_uri, string private_key_pkcs11_uri)

Creates a #GTlsCertificate from a PKCS #11 URI. An example @pkcs11_uri would be pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01 Where the token’s layout is: |[ Object 0: URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=private%20key;type=private Type: Private key (RSA-2048) ID: 01 Object 1: URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=Certificate%20for%20Authentication;type=cert Type: X.509 Certificate (RSA-2048) ID: 01 ]| In this case the certificate and private key would both be detected and used as expected. @pkcs_uri may also just reference an X.509 certificate object and then optionally
- @private_key_pkcs11_uri allows using a private key exposed under a different URI. Note that the private key is not accessed until usage and may fail or require a PIN later.
- @p pkcs11_uri is A PKCS #11 URI.
- @p private_key_pkcs11_uri is A PKCS #11 URI.
- @r A new GTlsCertificate.
newFromPkcs12 (list data, string password)

Creates a #GTlsCertificate from the data in @data. It must contain a certificate and matching private key. If extra certificates are included they will be verified as a chain and the #GTlsCertificate:issuer property will be set. All other data will be ignored. You can pass as single password for all of the data which will be used both for the PKCS #12 container as well as encrypted private keys. If decryption fails it will error with %G_TLS_ERROR_BAD_CERTIFICATE_PASSWORD. This constructor requires support in the current #GTlsBackend. If support is missing it will error with %G_IO_ERROR_NOT_SUPPORTED. Other parsing failures will error with %G_TLS_ERROR_BAD_CERTIFICATE.
- @p data is DER-encoded PKCS #12 format certificate data.
- @p length is the length of @data.
- @p password is optional password for encrypted certificate data.
- @r A new GTlsCertificate.

class: GTlsCertificateMeta

[402:14] static extends: object

Generated metadata helpers for TlsCertificate class surfaces.

Methods

properties ()

Returns property metadata for TlsCertificate.
- @r A list.

class: GTlsCertificate

[16:7] extends: object

A certificate used for TLS authentication and encryption. This can represent either a certificate only (eg, the certificate received by a client from a server), or the combination of a certificate and a private key (which is needed when acting as a [iface@Gio.TlsServerConnection]).

Members

handleObj
lib
retainedCallbacks
signalHandlerNames
signalSetterHandlers

Methods

GTlsCertificate (file = null)

Creates a #GTlsCertificate from the data in @file. As of 2.72, if the filename ends in .p12 or .pfx the data is loaded by g_tls_certificate_new_from_pkcs12() otherwise it is loaded by g_tls_certificate_new_from_pem(). See those functions for exact details. If @file cannot be read or parsed, the function will return %NULL and set
- @error. ``
- @p file is file containing a certificate to import.
toNativeHandle (Source)

Normalizes a constructor argument into a raw pointer carrier. Accepts a raw NativeHandle, a raw NativeBuffer returned from fn.call(...), another generated wrapper exposing handle(), or null. Returns null when the argument carries no pointer.
- @p Source is the raw handle, raw buffer, wrapper, or null.
- @r A raw pointer carrier or null when no pointer is present.
getLib ()

Returns the opened native library for this generated wrapper.
- @r The opened native library.
handle ()

Returns the wrapped NativeHandle.
- @r The wrapped NativeHandle.
isNull ()

Returns true when the wrapped handle is null.
- @r A bool.
describe ()

Returns a small string for debugging generated wrappers.
- @r A string.
asObject ()

Wraps this handle as GObject.
- @r A GObject object.
get_dns_names ()

Gets the value of #GTlsCertificate:dns-names.
- @r A #GPtrArray of #GBytes elements, or %NULL if it's not available..
get_ip_addresses ()

Gets the value of #GTlsCertificate:ip-addresses.
- @r A #GPtrArray of #GInetAddress elements, or %NULL if it's not available..
get_issuer ()

Gets the #GTlsCertificate representing @cert's issuer, if known
- @r The certificate of @cert's issuer, or %NULL if @cert is self-signed or signed with an unknown certificate..
get_issuer_name ()

Returns the issuer name from the certificate.
- @r The issuer name, or %NULL if it's not available..
get_not_valid_after ()

Returns the time at which the certificate became or will become invalid.
- @r The not-valid-after date, or %NULL if it's not available..
get_not_valid_before ()

Returns the time at which the certificate became or will become valid.
- @r The not-valid-before date, or %NULL if it's not available..
get_subject_name ()

Returns the subject name from the certificate.
- @r The subject name, or %NULL if it's not available..
is_same (object cert_two)

Check if two #GTlsCertificate objects represent the same certificate. The raw DER byte data of the two certificates are checked for equality. This has the effect that two certificates may compare equal even if their #GTlsCertificate:issuer, #GTlsCertificate:private-key, or #GTlsCertificate:private-key-pem properties differ.
- @p cert_two is second certificate to compare.
- @r whether the same or not.
verify (object identity, object trusted_ca)

This verifies @cert and returns a set of #GTlsCertificateFlags indicating any problems found with it. This can be used to verify a certificate outside the context of making a connection, or to check a certificate against a CA that is not part of the system CA database. If @cert is valid, %G_TLS_CERTIFICATE_NO_FLAGS is returned. If @identity is not %NULL, @cert's name(s) will be compared against it, and %G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return value if it does not match. If @identity is %NULL, that bit will never be set in the return value. If @trusted_ca is not %NULL, then @cert (or one of the certificates in its chain) must be signed by it, or else %G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If
- @trusted_ca is %NULL, that bit will never be set in the return value. GLib guarantees that if certificate verification fails, at least one error will be set in the return value, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask %G_TLS_CERTIFICATE_EXPIRED if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate. Because TLS session context is not used, #GTlsCertificate may not perform as many checks on the certificates as #GTlsConnection would. For example, certificate constraints may not be honored, and revocation checks may not be performed. The best way to verify TLS certificates used by a TLS connection is to let #GTlsConnection handle the verification.
- @p identity is the expected peer identity.
- @p trusted_ca is the certificate of a trusted authority.
- @r the appropriate #GTlsCertificateFlags.