| // Copyright 2026 The BoringSSL Authors | |
| // | |
| // Licensed under the Apache License, Version 2.0 (the "License"); | |
| // you may not use this file except in compliance with the License. | |
| // You may obtain a copy of the License at | |
| // | |
| // https://www.apache.org/licenses/LICENSE-2.0 | |
| // | |
| // Unless required by applicable law or agreed to in writing, software | |
| // distributed under the License is distributed on an "AS IS" BASIS, | |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| // See the License for the specific language governing permissions and | |
| // limitations under the License. | |
| #ifndef BSSL_PKI_ENCODE_CERTIFICATE_H_ | |
| #define BSSL_PKI_ENCODE_CERTIFICATE_H_ | |
| #include <stdint.h> | |
| #include <openssl/base.h> | |
| #include <openssl/pool.h> | |
| #include <openssl/span.h> | |
| #include "signature_algorithm.h" | |
| BSSL_NAMESPACE_BEGIN | |
| // Returns an MTC CA certificate encoded according to | |
| // draft-ietf-plants-merkle-tree-certs-07, Section 5.5, or nullptr on error. | |
| // The certificate is allocated from `pool` (which may be null). `ca_id` | |
| // contains the DER encoding of the relative OID of the CA's ID, and | |
| // `ca_cosign_sigalg` and `ca_cosign_key` (a DER-encoded SubjectPublicKeyInfo) | |
| // describe the CA cosigner algorithm and key. Its allowed serial number range | |
| // is set to `min_serial`..`max_serial`, inclusive, which is empty if | |
| // `min_serial` > `max_serial`. The certificate is unsigned (RFC 9925). | |
| OPENSSL_EXPORT UniquePtr<CRYPTO_BUFFER> EncodeMtcCaCertificate( | |
| Span<const uint8_t> ca_id, SignatureAlgorithm ca_cosign_sigalg, | |
| Span<const uint8_t> ca_cosign_key, uint64_t min_serial, uint64_t max_serial, | |
| CRYPTO_BUFFER_POOL *pool); | |
| BSSL_NAMESPACE_END | |
| #endif // BSSL_PKI_ENCODE_CERTIFICATE_H_ |