Ocamlnet 4 Reference Manual : Nettls_support

# Module Nettls_support

    module Nettls_support: sig .. end

Support types and functions for TLS

    type credentials = [ `Anonymous | `X509 of Netx509.x509_certificate ]

The types of credentials

    type raw_credentials = [ `Anonymous | `X509 of string ]

The encoded credentials:

- ``X509 s`: The X509 certificate in DER encoding
- ``Anonymous`: no certificate or other key is available

    type cred_type = [ `Anonymous | `X509 ]

The type of credential types

    class type tls_session_props = object .. end

Direct access to TLS properties of a session

    val get_tls_session_props : Netsys_crypto_types.tls_endpoint -> tls_session_props

Get the session properties for an endpoint for which the handshake is already done

    val get_tls_user_name : tls_session_props -> string

Get the "user name" of client certificates. It is determined as follows:

- if there is a subjectAltName with an email address (i.e. rfc822 type), this address is returned
- if there is a subjectAltName using the directory name format, it is checked whether there is a "uid", "email", or "cn" name component
- otherwise, it is checked whether there is a "uid", "email", or "cn" name component in the subject

Raises `Not_found` if nothing approriate is found.

    val squash_file_tls_endpoint : (module Netsys_crypto_types.FILE_TLS_ENDPOINT) ->
           (module Netsys_crypto_types.TLS_ENDPOINT)

Coerce a file endpoint to a normal endpoint

    val is_endpoint_host : string -> tls_session_props -> bool

`is_endpoint_host name props`: checks whether `name` matches the certificate of the endpoint in `props`.

In particular, this function checks the DNS alternate name, and the common name of the subject. The certificate name can use wildcards.

Returns true if `name` could be verified this way.

NB. This doesn't check SNI (`addressed_server`), because this is the peer's task.