API

`#crypto/x509`

import: #crypto/x509

counts: 5 fns, 6 methods, 4 types, 39 consts, 0 ifaces

Parse certificates and verify (Ed25519, RSA SHA-256, SM2-with-SM3). No issuance.

`const unknown_signature_algorithm`

XuAPI

pub const unknown_signature_algorithm = 0

Purpose

`crypto/x509` subset: ParseCertificate, CheckSignatureFrom, Certificate.Verify with a CertPool. Signature check is Ed25519 , RSA PKCS1v15 SHA-256 (D4 rsa), ECDSA P-256/P-384/P-521 with the matching SHA-2 digest, and SM2-with-SM3 (, Xu additional). This is not a complete RFC 5280 implementation. Current path building is a bounded (≤8) candidate backtrack with BasicConstraints/pathLen, CA KeyUsage, AKI/SKI, EKU, DNS/IP NameConstraints, a partial policy set, and CRL-if-present. Missing: other NameConstraints types, a full policy tree, delta CRL/OCSP, and certificate/key issuance APIs. Do not treat Verify passing as "full RFC 5280". Value `0`.

Parameters

none

`const md5_with_rsa`

XuAPI

pub const md5_with_rsa = 2

Purpose

Public constant `md5_with_rsa`. Value `2`.

Parameters

none

`const sha1_with_rsa`

XuAPI

pub const sha1_with_rsa = 3

Purpose

Public constant `sha1_with_rsa`. Value `3`.

Parameters

none

`const sha256_with_rsa`

XuAPI

pub const sha256_with_rsa = 4

Purpose

Public constant `sha256_with_rsa`. Value `4`.

Parameters

none

`const sha384_with_rsa`

XuAPI

pub const sha384_with_rsa = 5

Purpose

Public constant `sha384_with_rsa`. Value `5`.

Parameters

none

`const sha512_with_rsa`

XuAPI

pub const sha512_with_rsa = 6

Purpose

Public constant `sha512_with_rsa`. Value `6`.

Parameters

none

`const ecdsa_with_sha256`

XuAPI

pub const ecdsa_with_sha256 = 10

Purpose

Public constant `ecdsa_with_sha256`. Value `10`.

Parameters

none

`const ecdsa_with_sha384`

XuAPI

pub const ecdsa_with_sha384 = 11

Purpose

Public constant `ecdsa_with_sha384`. Value `11`.

Parameters

none

`const ecdsa_with_sha512`

XuAPI

pub const ecdsa_with_sha512 = 12

Purpose

Public constant `ecdsa_with_sha512`. Value `12`.

Parameters

none

`const pure_ed25519`

XuAPI

pub const pure_ed25519 = 16

Purpose

Public constant `pure_ed25519`. Value `16`.

Parameters

none

`const sm2_with_sm3`

XuAPI

pub const sm2_with_sm3 = 20

Purpose

Public constant `sm2_with_sm3`. Value `20`.

Parameters

none

`const unknown_public_key_algorithm`

XuAPI

pub const unknown_public_key_algorithm = 0

Purpose

Public constant `unknown_public_key_algorithm`. Value `0`.

Parameters

none

`const rsa`

XuAPI

pub const rsa = 1

Purpose

Public constant `rsa`. Value `1`.

Parameters

none

`const dsa`

XuAPI

pub const dsa = 2

Purpose

Public constant `dsa`. Value `2`.

Parameters

none

`const ecdsa`

XuAPI

pub const ecdsa = 3

Purpose

Public constant `ecdsa`. Value `3`.

Parameters

none

`const ed25519`

XuAPI

pub const ed25519 = 4

Purpose

Public constant `ed25519`. Value `4`.

Parameters

none

`const sm2`

XuAPI

pub const sm2 = 5

Purpose

Public constant `sm2`. Value `5`.

Parameters

none

`const key_usage_digital_signature`

XuAPI

pub const key_usage_digital_signature = 1

Purpose

RFC 5280 KeyUsage bit positions, aligned with crypto/x509. Value `1`.

Parameters

none

`const key_usage_content_commitment`

XuAPI

pub const key_usage_content_commitment = 2

Purpose

Public constant `key_usage_content_commitment`. Value `2`.

Parameters

none

`const key_usage_key_encipherment`

XuAPI

pub const key_usage_key_encipherment = 4

Purpose

Public constant `key_usage_key_encipherment`. Value `4`.

Parameters

none

`const key_usage_data_encipherment`

XuAPI

pub const key_usage_data_encipherment = 8

Purpose

Public constant `key_usage_data_encipherment`. Value `8`.

Parameters

none

`const key_usage_key_agreement`

XuAPI

pub const key_usage_key_agreement = 16

Purpose

Public constant `key_usage_key_agreement`. Value `16`.

Parameters

none

`const key_usage_cert_sign`

XuAPI

pub const key_usage_cert_sign = 32

Purpose

Public constant `key_usage_cert_sign`. Value `32`.

Parameters

none

`const key_usage_crl_sign`

XuAPI

pub const key_usage_crl_sign = 64

Purpose

Public constant `key_usage_crl_sign`. Value `64`.

Parameters

none

`const key_usage_encipher_only`

XuAPI

pub const key_usage_encipher_only = 128

Purpose

Public constant `key_usage_encipher_only`. Value `128`.

Parameters

none

`const key_usage_decipher_only`

XuAPI

pub const key_usage_decipher_only = 256

Purpose

Public constant `key_usage_decipher_only`. Value `256`.

Parameters

none

`struct Certificate`

XuAPI

pub struct Certificate {
    pub raw string
    pub raw_tbs_certificate string
    pub raw_subject_public_key_info string
    pub raw_subject string
    pub raw_issuer string
    pub signature string
    pub signature_algorithm int
    pub public_key_algorithm int
    pub public_key string
    pub version int
    pub serial_number big.Int
    pub serial_bytes string
    pub issuer pkix.Name
    pub subject pkix.Name
    pub not_before time.Time
    pub not_after time.Time
    pub is_ca bool
    pub basic_constraints_valid bool
    pub max_path_len int
    pub max_path_len_zero bool
    pub key_usage int
    pub key_usage_present bool
    pub subject_key_id string
    pub authority_key_id string
    pub ext_key_usage []int
    pub ext_key_usage_present bool
    pub has_unknown_ext_key_usage bool
    pub permitted_dns_domains []string
    pub excluded_dns_domains []string
    pub permitted_ip_ranges []string
    pub excluded_ip_ranges []string
    pub name_constraints_present bool
    pub name_constraints_unsupported bool
    pub certificate_policies []string
    pub certificate_policies_present bool
    pub policy_mapping_issuers []string
    pub policy_mapping_subjects []string
    pub policy_mappings_present bool
    pub require_explicit_policy int
    pub inhibit_policy_mapping int
    pub policy_constraints_present bool
    pub inhibit_any_policy int
    pub inhibit_any_policy_present bool
    pub has_unhandled_critical_extension bool
    pub dns_names []string
    pub ip_addresses []string
}

Purpose

Public struct `Certificate`.

Parameters

raw string: field (string)
raw_tbs_certificate string: field (string)
raw_subject_public_key_info string: field (string)
raw_subject string: field (string)
raw_issuer string: field (string)
signature string: field (string)
signature_algorithm int: field (int)
public_key_algorithm int: field (int)
public_key string: field (string)
version int: field (int)
serial_number big.Int: field (big.Int)
serial_bytes string: Canonical unsigned DER serial bytes (leading sign padding removed). Revocation checks use this representation to avoid integer-width drift.
issuer pkix.Name: field (pkix.Name)
subject pkix.Name: field (pkix.Name)
not_before time.Time: field (time.Time)
not_after time.Time: field (time.Time)
is_ca bool: field (bool)
basic_constraints_valid bool: field (bool)
max_path_len int: 1 means absent/unlimited. max_path_len_zero distinguishes an explicit pathLenConstraint=0 from the absent default, matching shape.
max_path_len_zero bool: field (bool)
key_usage int: field (int)
key_usage_present bool: field (bool)
subject_key_id string: field (string)
authority_key_id string: field (string)
ext_key_usage []int: field ([]int)
ext_key_usage_present bool: field (bool)
has_unknown_ext_key_usage bool: field (bool)
permitted_dns_domains []string: field ([]string)
excluded_dns_domains []string: field ([]string)
permitted_ip_ranges []string: Raw RFC 5280 iPAddress constraints: address || mask (8 or 32 bytes).
excluded_ip_ranges []string: field ([]string)
name_constraints_present bool: field (bool)
name_constraints_unsupported bool: field (bool)
certificate_policies []string: field ([]string)
certificate_policies_present bool: field (bool)
policy_mapping_issuers []string: field ([]string)
policy_mapping_subjects []string: field ([]string)
policy_mappings_present bool: field (bool)
require_explicit_policy int: field (int)
inhibit_policy_mapping int: field (int)
policy_constraints_present bool: field (bool)
inhibit_any_policy int: field (int)
inhibit_any_policy_present bool: field (bool)
has_unhandled_critical_extension bool: Safe fail-closed marker for critical extensions this subset does not yet process. Path validation rejects such certificates.
dns_names []string: field ([]string)
ip_addresses []string: Raw network-order addresses from subjectAltName iPAddress entries. IPv4 values contain 4 bytes and IPv6 values contain 16 bytes, matching the representation used by package net.

`struct CertPool`

XuAPI

pub struct CertPool {
    pub certs []Certificate
}

Purpose

Public struct `CertPool`.

Parameters

certs []Certificate: field ([]Certificate)

`struct VerifyOptions`

XuAPI

pub struct VerifyOptions {
    pub dns_name string
    pub current_time time.Time
    pub roots CertPool
    pub intermediates CertPool
    pub key_usages []int
    pub certificate_policies []string
    pub revocation_lists []string
    pub revocation_mode int
}

Purpose

Public struct `VerifyOptions`.

Parameters

dns_name string: field (string)
current_time time.Time: field (time.Time)
roots CertPool: field (CertPool)
intermediates CertPool: field (CertPool)
key_usages []int: Empty defaults to ServerAuth, matching crypto/x509 VerifyOptions.
certificate_policies []string: Empty is the RFC 5280 anyPolicy initial-policy-set.
revocation_lists []string: DER-encoded CRLs supplied by the caller. Revocation is disabled by default; parsing inside each candidate edge avoids owning-struct moves.
revocation_mode int: field (int)

`new_cert_pool`

XuAPI

pub fn new_cert_pool() CertPool

Purpose

Construct cert pool.

Parameters

none

Returns

CertPool — a value of this type

`(&mut CertPool) add`

XuAPI

pub fn (p &mut CertPool) add(c Certificate)

Purpose

Method on `&mut CertPool`: add.

Parameters

p &mut CertPool: receiver &mut CertPool (exclusive borrow)
c Certificate: byte or character code (Certificate)

`append_certificates`

XuAPI

pub fn append_certificates(p &mut CertPool, pem_data &string) int

Purpose

append_certificates adds every CERTIFICATE PEM block that can be parsed. Unknown or malformed blocks are skipped, matching the useful part of AppendCertsFromPEM contract while keeping the subset's explicit count for diagnostics. The scanner keeps an offset into the original bundle and only copies one PEM block at a time. In particular, it does not repeatedly copy encoding/pem.Block.rest, which would make large system bundles quadratic.

Parameters

p &mut CertPool: p (exclusive borrow; type &mut CertPool)
pem_data &string: pem_data (borrowed; caller keeps it; type &string)

Returns

int — a value of this type

`system_cert_pool`

XuAPI

pub fn system_cert_pool() CertPool

Purpose

system_cert_pool probes the environment override first, then the native platform trust source, then conventional Unix PEM bundles. The native adapter only supplies opaque DER records; parsing and trust policy remain in this package. An empty pool is returned when no source is readable, so TLS callers fail closed instead of silently disabling verification.

Parameters

none

Returns

CertPool — a value of this type

`parse_certificate`

XuAPI

pub fn parse_certificate(der string) Certificate

Purpose

Parse as certificate. Throws on failure.

Parameters

der string: der (string)

Returns

Certificate — a value of this type

`(&Certificate) check_signature`

XuAPI

pub fn (c &Certificate) check_signature(algo int, signed &string, signature &string) int

Purpose

Method on `&Certificate`: check signature. Throws on failure.

Parameters

c &Certificate: receiver &Certificate (borrow)
algo int: algo (int)
signed &string: signed (borrowed; caller keeps it; type &string)
signature &string: signature (borrowed; caller keeps it; type &string)

Returns

int — a value of this type

`(&Certificate) check_signature_from`

XuAPI

pub fn (c &Certificate) check_signature_from(parent &Certificate) int

Purpose

Method on `&Certificate`: check signature from. Throws on failure.

Parameters

c &Certificate: receiver &Certificate (borrow)
parent &Certificate: parent (borrowed; caller keeps it; type &Certificate)

Returns

int — a value of this type

`(&Certificate) verify_with_pools`

XuAPI

pub fn (c &Certificate) verify_with_pools(dns_name string, current_time time.Time, roots &CertPool, intermediates &CertPool) int

Purpose

Method on `&Certificate`: verify with pools. Throws on failure.

Parameters

c &Certificate: receiver &Certificate (borrow)
dns_name string: dns_name (string)
current_time time.Time: current_time (time.Time)
roots &CertPool: roots (borrowed; caller keeps it; type &CertPool)
intermediates &CertPool: intermediates (borrowed; caller keeps it; type &CertPool)

Returns

int — a value of this type

`(&Certificate) verify_options`

XuAPI

pub fn (c &Certificate) verify_options(opts &VerifyOptions) int

Purpose

verify_options borrows reusable verification inputs. This is the preferred form for callers that validate repeatedly against one pool or CRL set. Throws on failure.

Parameters

c &Certificate: receiver &Certificate (borrow)
opts &VerifyOptions: opts (borrowed; caller keeps it; type &VerifyOptions)

Returns

int — a value of this type

`(&Certificate) verify`

XuAPI

pub fn (c &Certificate) verify(opts VerifyOptions) int

Purpose

verify retains the original consuming API for source compatibility.

Parameters

c &Certificate: receiver &Certificate (borrow)
opts VerifyOptions: opts (VerifyOptions)

Returns

int — a value of this type

`const ext_key_usage_any`

XuAPI

pub const ext_key_usage_any = 0

Purpose

ExtendedKeyUsage values match crypto/x509 where the API overlaps. Value `0`.

Parameters

none

`const ext_key_usage_server_auth`

XuAPI

pub const ext_key_usage_server_auth = 1

Purpose

Public constant `ext_key_usage_server_auth`. Value `1`.

Parameters

none

`const ext_key_usage_client_auth`

XuAPI

pub const ext_key_usage_client_auth = 2

Purpose

Public constant `ext_key_usage_client_auth`. Value `2`.

Parameters

none

`const ext_key_usage_code_signing`

XuAPI

pub const ext_key_usage_code_signing = 3

Purpose

Public constant `ext_key_usage_code_signing`. Value `3`.

Parameters

none

`const ext_key_usage_email_protection`

XuAPI

pub const ext_key_usage_email_protection = 4

Purpose

Public constant `ext_key_usage_email_protection`. Value `4`.

Parameters

none

`const ext_key_usage_ipsec_end_system`

XuAPI

pub const ext_key_usage_ipsec_end_system = 5

Purpose

Public constant `ext_key_usage_ipsec_end_system`. Value `5`.

Parameters

none

`const ext_key_usage_ipsec_tunnel`

XuAPI

pub const ext_key_usage_ipsec_tunnel = 6

Purpose

Public constant `ext_key_usage_ipsec_tunnel`. Value `6`.

Parameters

none

`const ext_key_usage_ipsec_user`

XuAPI

pub const ext_key_usage_ipsec_user = 7

Purpose

Public constant `ext_key_usage_ipsec_user`. Value `7`.

Parameters

none

`const ext_key_usage_time_stamping`

XuAPI

pub const ext_key_usage_time_stamping = 8

Purpose

Public constant `ext_key_usage_time_stamping`. Value `8`.

Parameters

none

`const ext_key_usage_ocsp_signing`

XuAPI

pub const ext_key_usage_ocsp_signing = 9

Purpose

Public constant `ext_key_usage_ocsp_signing`. Value `9`.

Parameters

none

`const revocation_off`

XuAPI

pub const revocation_off = 0

Purpose

Public constant `revocation_off`. Value `0`.

Parameters

none

`const revocation_if_present`

XuAPI

pub const revocation_if_present = 1

Purpose

Public constant `revocation_if_present`. Value `1`.

Parameters

none

`const revocation_require`

XuAPI

pub const revocation_require = 2

Purpose

Public constant `revocation_require`. Value `2`.

Parameters

none

`struct RevocationList`

XuAPI

pub struct RevocationList {
    pub raw string
    pub raw_tbs string
    pub raw_issuer string
    pub signature string
    pub signature_algorithm int
    pub this_update time.Time
    pub next_update time.Time
    pub next_update_present bool
    pub authority_key_id string
    pub number int
    pub revoked_serials []string
    pub has_unhandled_critical_extension bool
}

Purpose

Public struct `RevocationList`.

Parameters

raw string: field (string)
raw_tbs string: field (string)
raw_issuer string: field (string)
signature string: field (string)
signature_algorithm int: field (int)
this_update time.Time: field (time.Time)
next_update time.Time: field (time.Time)
next_update_present bool: field (bool)
authority_key_id string: field (string)
number int: field (int)
revoked_serials []string: field ([]string)
has_unhandled_critical_extension bool: field (bool)

`parse_revocation_list`

XuAPI

pub fn parse_revocation_list(der string) RevocationList

Purpose

Parse as revocation list. Throws on failure.

Parameters

der string: der (string)

Returns

RevocationList — a value of this type