x509-parser

You can generate self-signed X.509 certificates using RSA-PSS padding for testing purposes with OpenSSL. The following commands generate DER-encoded certificates using SHA-256, SHA-384, and SHA-512 respectively.

Key flags used:

• -sigopt rsa_padding_mode:pss: Specifies RSA-PSS padding.
• -sigopt rsa_pss_saltlen:-1: Sets the salt length to the maximum possible.
• -outform der: Ensures the output is in DER format.

# Generate SHA-256 certificate
openssl req -new -x509 -newkey rsa:2048 -keyout /dev/null -nodes -sigopt rsa_padding_mode:pss -sha256 -sigopt rsa_pss_saltlen:-1 -outform der -out self_signed_sha256.der -batch

# Generate SHA-384 certificate
openssl req -new -x509 -newkey rsa:2048 -keyout /dev/null -nodes -sigopt rsa_padding_mode:pss -sha384 -sigopt rsa_pss_saltlen:-1 -outform der -out self_signed_sha384.der -batch

# Generate SHA-512 certificate
openssl req -new -x509 -newkey rsa:2048 -keyout /dev/null -nodes -sigopt rsa_padding_mode:pss -sha512 -sigopt rsa_pss_saltlen:-1 -outform der -out self_signed_sha512.der -batch

The X509CertificateVisitor trait implements the Visitor pattern to allow traversing the components of an X509Certificate without manual field access.

Key Behaviors:

• Generic vs. Specific Extension Visiting: The visitor provides a generic visit_extension method for any X509Extension. It also provides specific methods for standard extensions (e.g., visit_extension_aki for AuthorityKeyIdentifier).
• Conditional Execution: A specific extension method is only called if the extension's OID is correct and the content is successfully parsed into the expected type.
• Redundancy: A specific method can be called multiple times if the extension appears multiple times in the certificate. Implementations should be aware that they might visit the same extension multiple times.
• Error Handling: If an extension is malformed or cannot be parsed, visit_extension_parse_error is invoked.

use x509_parser::prelude::*;
use x509_parser::visitor::X509CertificateVisitor;

#[derive(Debug, Default)]
struct MyVisitor {
    issuer: String,
    is_ca: bool,
}

impl X509CertificateVisitor for MyVisitor {
    fn visit_issuer(&mut self, name: &X509Name<'_>) {
        self.issuer = name.to_string();
    }

    fn visit_extension_basic_constraints(&mut self, bc: &BasicConstraints) {
        self.is_ca = bc.ca;
    }
}

// Usage:
// let mut visitor = MyVisitor::default();
// x509.walk(&mut visitor);

The CertificateRevocationListVisitor trait allows you to traverse a CertificateRevocationList (CRL) by implementing specific callback methods. This is useful for extracting specific data (like revoked certificate serial numbers) or inspecting extensions without manually navigating the entire tree structure.

Key Behaviors

• Extension Dispatch: The visitor provides both generic methods (e.g., visit_extension) and specific methods for recognized extensions (e.g., visit_extension_aki). A specific method is only called if the extension OID matches and the content is successfully parsed.
• Redundancy: Some methods are redundant by design (e.g., visit_revoked_certificates vs visit_revoked_certificate). If you implement a trait that provides multiple visitor methods, be aware that the same extension might be visited multiple times.
• Execution: Use the .walk(&mut visitor) method on a CertificateRevocationList instance to begin traversal.

use asn1_rs::num_bigint::BigUint;
use x509_parser::prelude::*;
use x509_parser::visitor::CertificateRevocationListVisitor;

#[derive(Debug, Default)]
struct RevokedCertsVisitor {
    certificates: Vec<BigUint>,
}

impl CertificateRevocationListVisitor for RevokedCertsVisitor {
    fn visit_revoked_certificate(&mut self, certificate: &RevokedCertificate<'_>) {
        self.certificates.push(certificate.user_certificate.clone());
    }
}