construct X.509 valid policy
**ptree, int *pexplicit_policy,
unsigned int flags);
performs those parts of Basic Certification Path Validation described in RFC
5280 section 6.1 that are related to the construction of the valid policy
The certs input argument contains the prospective certification path according to RFC 5280 paragraph 6.1.1(a), starting with the target certificate and ending with the trust anchor.
The policy_oids input argument contains the user-initial-policy-set according to RFC 5280 section 6.1.1(c). It specifies a set of certificate policies acceptable to the certificate user.
The flags argument can contain zero or more of the following constants, OR'ed together:
- Set initial-explicit-policy as defined by RFC 5280 paragraph 6.1.1(f). It requires the path to be valid for at least one of the policy_oids.
- Set initial-any-policy-inhibit as defined by RFC 5280 paragraph 6.1.1(g). It causes the anyPolicy OID to be skipped if it is encountered in a certificate.
- Set initial-policy-mapping-inhibit as defined by RFC 5280 paragraph 6.1.1(e). It disables policy mapping in the certification path.
Upon success and in some cases of failure, the storage location
pointed to by pexplicit_policy is set to 1 if
X509_V_FLAG_EXPLICIT_POLICY was requested.
Otherwise, it is set to 0.
In many cases of success and in a few cases of failure, a pointer to the valid_policy_tree output value mentioned in RFC 5280 section 6.1.6 is returned in *ptree. It contains one level for each of the certs, in reverse order: level 0 corresponds to the trust anchor, the last level corresponds to the target certificate. Level 0 is initialized to contain a single node with a valid_policy of anyPolicy and an empty qualifier_set.
If a policy tree is returned, the
reference count of each of the certs is incremented by
1. In that case, the caller is responsible for calling
to release all memory used by the tree and to
decrement the reference counts of the certificates referenced from it by 1.
If tree is a
X509_policy_tree_free() has no effect.
X509_policy_check() returns these
- Validation failed because
X509_V_FLAG_EXPLICIT_POLICYwas requested but the resulting policy tree or the resulting user policy set would have been empty. In this case, *pexplicit_policy is set to 1. If the resulting tree is empty, *ptree is set to
NULL; otherwise, it is set to the resulting tree.
- At least one of the certs contains invalid or
inconsistent extensions. *ptree is set to
NULLand *pexplicit_policy to 0.
- Internal error. For example, setting up the policy caches failed, or
memory allocation failed while constructing the tree.
*ptree is set to
NULLand *pexplicit_policy may or may not be set.
- Validation succeeded and *ptree and
*pexplicit_policy have been set. In the special
cases that the certs argument contains exactly one
certificate or that
X509_V_FLAG_EXPLICIT_POLICYwas not requested and at least one of the certificates contains no certificate policies or the resulting policy tree would have been empty, *ptree is set to
NULLand *pexplicit_policy to 0.
ASN1_OBJECT_new(3), OBJ_nid2obj(3), STACK_OF(3), X509_check_purpose(3), X509_check_trust(3), X509_new(3), X509_policy_tree_get0_policies(3), X509_policy_tree_level_count(3), X509_verify_cert(3)
RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 6.1: Basic Path Validation
X509_policy_tree_free() first appeared in OpenSSL
0.9.8 and have been available since OpenBSD 4.5.