Struct SolidSyslogMbedTlsHandleCredentialsConfig¶

ClassList > SolidSyslogMbedTlsHandleCredentialsConfig

#include <SolidSyslogMbedTlsHandleCredentials.h>

struct SolidSyslogMbedTlsHandleCredentialsConfig
{
    struct mbedtls_x509_crt* CaChain;
    struct mbedtls_x509_crt* ClientCertChain;
    struct mbedtls_pk_context* ClientKey;
    struct mbedtls_ctr_drbg_context* Rng;
    const char* const * PeerFingerprints;
    size_t PeerFingerprintCount;
};

Detailed Description¶

Where this backend's material lives.

Every handle is caller-built and caller-owned, and must stay valid for the lifetime of the credentials.

Public Attributes Documentation¶

CaChain¶

Trust anchors the peer certificate must chain to; NULL installs none, which leaves the peer authorised only if the stream has another means to do it.

struct mbedtls_x509_crt* SolidSyslogMbedTlsHandleCredentialsConfig::CaChain;

ClientCertChain¶

Leaf certificate (plus intermediates) for mutual TLS; NULL means no client credential.

struct mbedtls_x509_crt* SolidSyslogMbedTlsHandleCredentialsConfig::ClientCertChain;

Certificate and key are all-or-nothing - supplying one without the other is reported.

ClientKey¶

Private key matching ClientCertChain; NULL means no client credential.

struct mbedtls_pk_context* SolidSyslogMbedTlsHandleCredentialsConfig::ClientKey;

PeerFingerprintCount¶

size_t SolidSyslogMbedTlsHandleCredentialsConfig::PeerFingerprintCount;

PeerFingerprints¶

Fingerprints of certificates the peer may present, any one of which authorises it.

const char* const* SolidSyslogMbedTlsHandleCredentialsConfig::PeerFingerprints;

Each is the RFC 5425 §4.2.2 form: the IANA hash name, a colon, then the digest of the DER certificate as colon-separated hexadecimal bytes in either case, e.g. sha-256:E1:2D:.... sha-256 and sha-1 are accepted; a sha-1 pin is reported on every connection. A pin in any other form is reported when the stream opens and that attempt fails. NULL with a count of zero pins no peer; a count with no list behind it, or a NULL pin in one, is reported at Create, which returns the Null credentials. The array and the strings must outlive the credentials.

Rng¶

Seeded CTR-DRBG, used to check the client key against its certificate; required - a NULL is reported at SolidSyslogMbedTlsHandleCredentials_Create.

struct mbedtls_ctr_drbg_context* SolidSyslogMbedTlsHandleCredentialsConfig::Rng;

The stream takes its own handshake RNG separately, and the same one serves both.

The documentation for this class was generated from the following file Platform/MbedTls/Interface/SolidSyslogMbedTlsHandleCredentials.h