Struct SolidSyslogMbedTlsPemBufferCredentialsConfig¶

ClassList > SolidSyslogMbedTlsPemBufferCredentialsConfig

Where this backend's material lives.

#include <SolidSyslogMbedTlsPemBufferCredentials.h>

struct SolidSyslogMbedTlsPemBufferCredentialsConfig
{
    struct SolidSyslogMbedTlsPemBuffer CaPem;
    struct SolidSyslogMbedTlsPemBuffer ClientCertPem;
    struct SolidSyslogMbedTlsPemBuffer ClientKeyPem;
    struct mbedtls_ctr_drbg_context* Rng;
    const char* const * PeerFingerprints;
    size_t PeerFingerprintCount;
};

Public Attributes Documentation¶

CaPem¶

Trust anchors the peer certificate must chain to; an unsupplied buffer installs none, which leaves the peer authorised only if the stream has another means to do it.

struct SolidSyslogMbedTlsPemBuffer SolidSyslogMbedTlsPemBufferCredentialsConfig::CaPem;

ClientCertPem¶

Leaf certificate (plus intermediates) for mutual TLS.

struct SolidSyslogMbedTlsPemBuffer SolidSyslogMbedTlsPemBufferCredentialsConfig::ClientCertPem;

Certificate and key are all-or-nothing - supplying one without the other is reported.

ClientKeyPem¶

Private key matching ClientCertPem.

struct SolidSyslogMbedTlsPemBuffer SolidSyslogMbedTlsPemBufferCredentialsConfig::ClientKeyPem;

Must not be encrypted: no password can be supplied.

PeerFingerprintCount¶

size_t SolidSyslogMbedTlsPemBufferCredentialsConfig::PeerFingerprintCount;

PeerFingerprints¶

Fingerprints of certificates the peer may present, any one of which authorises it.

const char* const* SolidSyslogMbedTlsPemBufferCredentialsConfig::PeerFingerprints;

Each is the RFC 5425 §4.2.2 form: the IANA hash name, a colon, then the digest of the DER certificate as colon-separated hexadecimal bytes in either case, e.g. sha-256:E1:2D:.... sha-256 and sha-1 are accepted; a sha-1 pin is reported on every connection. A pin in any other form is reported when the stream opens and that attempt fails. NULL with a count of zero pins no peer; a count with no list behind it, or a NULL pin in one, is reported at Create, which returns the Null credentials. The array and the strings must outlive the credentials.

Rng¶

Seeded CTR-DRBG.

struct mbedtls_ctr_drbg_context* SolidSyslogMbedTlsPemBufferCredentialsConfig::Rng;

Mbed TLS requires one to parse a private key, and it also checks the key against its certificate; required - a NULL is reported at SolidSyslogMbedTlsPemBufferCredentials_Create. The stream takes its own handshake RNG separately, and the same one serves both.

The documentation for this class was generated from the following file Platform/MbedTls/Interface/SolidSyslogMbedTlsPemBufferCredentials.h