$Web Cert Info - Revision history

ELowell: /* Usage notes */

2016-08-31T17:30:48Z

Usage notes

← Older revision		Revision as of 17:30, 31 August 2016
Line 24:		Line 24:
	==Usage notes==		==Usage notes==
	<ul>		<ul>
	<li><var class="product">[[Janus Network Security]]</var> ~~does not accept any~~ client certificates that ~~were not~~ signed by a trusted ~~certifying authority~~ (CA) ~~- a trusted CA is one~~ whose certificate ~~was~~ added to a port ~~with~~ the <var>JANUS ADDCA</var> command. ~~As such~~, a <var>$Web_Cert_Info</var> for level 1 is guaranteed to return information already in a ~~"known" certifying authority~~ certificate.</li>		<li><var class="product">[[Janus Network Security]]</var> accepts only client certificates that are signed by a trusted Certifying Authority (CA), whose signing certificate has been added to the port via the <var>[[JANUS ADDCA]]</var> command. Therefore, a <var>$Web_Cert_Info</var> call for level 1 (the signer) is guaranteed to return information already in a trusted CA certificate.</li>

	<li>If a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).		<li>If a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).
	<p>		<p>

Alan at 14:25, 31 August 2016

2016-08-31T14:25:54Z

← Older revision		Revision as of 14:25, 31 August 2016
Line 2:		Line 2:
	<span class="pageSubtitle">Retrieve client certificate information</span>		<span class="pageSubtitle">Retrieve client certificate information</span>

	<var>$Web_Cert_Info</var> retrieves information about the client or certificate signer from a received client certificate.		<var>$Web_Cert_Info</var> retrieves information about the client or certificate signer from a received client certificate. The OO equivalent of this function is the [[X509CertificateToXmlDoc (String function)]], which provides certificate information in a more structured format. Use of the X509 methods is strongly recommended over the $function approach.

	==Syntax==		==Syntax==

Alan: /* Usage notes */

2016-08-30T20:04:02Z

Usage notes

← Older revision		Revision as of 20:04, 30 August 2016
Line 24:		Line 24:
	==Usage notes==		==Usage notes==
	<ul>		<ul>
	<li><var class="product">[[Janus Network Security]]</var> does not accept any client certificates that were not signed by a trusted certifying authority~~, that~~ is one whose certificate was added to a port with the <var>JANUS ADDCA</var> command. As such, a <var>$Web_Cert_Info</var> for level 1 is guaranteed to return information already in a "known" certifying authority certificate.</li>		<li><var class="product">[[Janus Network Security]]</var> does not accept any client certificates that were not signed by a trusted certifying authority (CA) - a trusted CA is one whose certificate was added to a port with the <var>JANUS ADDCA</var> command. As such, a <var>$Web_Cert_Info</var> for level 1 is guaranteed to return information already in a "known" certifying authority certificate.</li>

	<li>If a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).		<li>If a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).

JAL: add 7.7 maximum length

2016-08-29T22:41:39Z

add 7.7 maximum length

← Older revision		Revision as of 22:41, 29 August 2016
Line 53:		Line 53:

	<tr><th>LOCALITY</th>		<tr><th>LOCALITY</th>
	<td>The city, town, or village in which the subject resides or works. <var>LOCALITY</var>		<td>The city, town, or village in which the subject resides or works. <var>LOCALITY</var> can be abbreviated <var>LOC</var>.</td></tr>
	can be abbreviated <var>LOC</var>.</td></tr>

	<tr><th>STATE</th>		<tr><th>STATE</th>
Line 63:		Line 62:

	<tr><th>VALIDITYDATE</th>		<tr><th>VALIDITYDATE</th>
	<td>The date on which the subject's or signer's certificate became valid. Janus Network Security will not accept a client certificate where the subject's or signer's certificate is not yet valid, so use of this field is largely informational. <var>VALIDITYDATE</var> is returned as a date string in <code>YYYYMMDDHHMISS</code> format. <var>VALIDITYDATE</var> can be abbreviated <var>VALIDDATE</var> or <var>VDATE</var>, or it can be requested as <var>VALIDITYTIME</var>, <var>VALIDTIME</var>, or <var>VTIME</var>.</td></tr>		<td>The date on which the subject's or signer's certificate became valid. Janus Network Security will not accept a client certificate where the subject's or signer's certificate is not yet valid, so use of this field is largely informational. <var>VALIDITYDATE</var> is returned as a date string in <code>YYYYMMDDHHMISS</code> format.
			<p>
			<var>VALIDITYDATE</var> can be abbreviated <var>VALIDDATE</var> or <var>VDATE</var>, or it can be requested as <var>VALIDITYTIME</var>, <var>VALIDTIME</var>, or <var>VTIME</var>.</p></td></tr>

	<tr><th>EXPIRATIONDATE</th>		<tr><th>EXPIRATIONDATE</th>
	<td>The date on which the subject's or signer's certificate becomes invalid. Janus Network Security will not accept a client certificate where the subject's or signer's certificate is no longer valid, so use of this field is largely informational, though it might prove useful in providing a warning to a user whose certificate is going to expire soon. <var>EXPIRATIONDATE</var> can be abbreviated <var>EXPIRYDATE</var>, <var>EXPDATE</var>, or <var>EDATE</var>, or it can be requested as <var>EXPIRATIONTIME</var>, <var>EXPIRYTIME</var>, <var>EXPTIME</var>, or <var>ETIME</var>.</td></tr>		<td>The date on which the subject's or signer's certificate becomes invalid. Janus Network Security will not accept a client certificate where the subject's or signer's certificate is no longer valid, so use of this field is largely informational, though it might prove useful in providing a warning to a user whose certificate is going to expire soon.
			<p>
			<var>EXPIRATIONDATE</var> can be abbreviated <var>EXPIRYDATE</var>, <var>EXPDATE</var>, or <var>EDATE</var>, or it can be requested as <var>EXPIRATIONTIME</var>, <var>EXPIRYTIME</var>, <var>EXPTIME</var>, or <var>ETIME</var>.</p></td></tr>

	<tr><th>SERIALNUMBER</th>		<tr><th>SERIALNUMBER</th>
	<td>The serial number of the subject's certificate as assigned by the signer. Certifying authorities should assign a unique serial number to each certificate they sign. The assigned serial number could be a number that goes up by one for each certificate signed by a certifying authority, or it could be a number derived from the date and time, for example. <var>SERIALNUMBER</var> is returned as a hexadecimal string with an even number of hexadecimal digits. Since the signer's certificate is generally "self-signed," it often does not have a serial number, that is, the level 1 serial number is usually returned as a null.<br /><~~br /~~>While <var>SERIALNUMBER</var> doesn't have any particular significance from an application level, it can be used as an extra piece of identifying information for a client certificate. <var>SERIALNUMBER</var> can be abbreviated <var>SERIALNUM</var>, <var>SERNUMBER</var>, <var>SERNUM</var>, <var>SERIAL</var> or <var>SER</var>.</td></tr>		<td>The serial number of the subject's certificate as assigned by the signer. Certifying authorities should assign a unique serial number to each certificate they sign. The assigned serial number could be a number that goes up by one for each certificate signed by a certifying authority, or it could be a number derived from the date and time, for example.
			<p>
			<var>SERIALNUMBER</var> is returned as a hexadecimal string with an even number of hexadecimal digits. Since the signer's certificate is generally "self-signed," it often does not have a serial number, that is, the level 1 serial number is usually returned as a null.</p>
			<p>
			While <var>SERIALNUMBER</var> doesn't have any particular significance from an application level, it can be used as an extra piece of identifying information for a client certificate. <var>SERIALNUMBER</var> can be abbreviated <var>SERIALNUM</var>, <var>SERNUMBER</var>, <var>SERNUM</var>, <var>SERIAL</var> or <var>SER</var>.</p></td></tr>

	<tr><th>PRIVATEKEYLENGTH</th>		<tr><th>PRIVATEKEYLENGTH</th>
	<td>The length of the private key used by the signer or the client. Private key lengths are usually expressed in terms of number of bits, so <var>PRIVATEKEYLENGTH</var> returns a decimal number string, such as "~~512~~" or "~~1024~~".<~~br /><br /~~> This value could be used to determine a "level of trustworthiness" of a client certificate, where a ~~512~~-bit certificate is considered somewhat weak (though probably strong enough for all but the most extreme security requirements), and a ~~1024~~-bit certificate is considered strong. Janus Network Security will not accept certificates that indicate private keys shorter than 512 bits or longer than 2048 bits. Generally, client certificates use either a ~~512~~-bit or a ~~1024~~-bit key. <var>PRIVATEKEYLENGTH</var> can be abbreviated <var>PRIVATEKEYL</var>, <var>PKEYLENGTH</var>, or <var>PKEYL</var>.</td></tr>		<td>The length of the private key used by the signer or the client. Private key lengths are usually expressed in terms of number of bits, so <var>PRIVATEKEYLENGTH</var> returns a decimal number string, such as "1024" or "2048".
			<p>
			This value could be used to determine a "level of trustworthiness" of a client certificate, where a 1024-bit certificate is considered somewhat weak (though probably strong enough for all but the most extreme security requirements), and a 2048-bit certificate is considered strong. Janus Network Security will not accept certificates that indicate private keys shorter than 512 bits or longer than 4096 (as of version 7.7 of Model 204; formerly 2048 bits). Generally, client certificates use either a 1024-bit or a 2048-bit key. </p>
			<p>
			<var>PRIVATEKEYLENGTH</var> can be abbreviated <var>PRIVATEKEYL</var>, <var>PKEYLENGTH</var>, or <var>PKEYL</var>.</p></td></tr>

	<tr><th>TEMPORARYKEYLENGTH</th>		<tr><th>TEMPORARYKEYLENGTH</th>
	<td>The length of the temporary or "ephemeral" private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>TEMPORARYKEYLENGTH</var> always returns a 0. It is simply included here for compatibility with the equivalent Janus Sockets function (<var>[[$Sock_Cert_Info]]</var>) or Socket object method (<var>[[CertInfo (Socket function)\|CertInfo]]</var>). <var>TEMPORARYKEYLENGTH</var> can be abbreviated <var>TEMPORARYKEYL</var>, <var>TEMPKEYLENGTH</var> or <var>TEMPKEYL</var>.</td></tr>		<td>The length of the temporary or "ephemeral" private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>TEMPORARYKEYLENGTH</var> always returns a 0. It is simply included here for compatibility with the equivalent Janus Sockets function (<var>[[$Sock_Cert_Info]]</var>) or Socket object method (<var>[[CertInfo (Socket function)\|CertInfo]]</var>).
			<p>
			<var>TEMPORARYKEYLENGTH</var> can be abbreviated <var>TEMPORARYKEYL</var>, <var>TEMPKEYLENGTH</var> or <var>TEMPKEYL</var>.</p></td></tr>

	<tr><th>PERMANENTKEYLENGTH</th>		<tr><th>PERMANENTKEYLENGTH</th>
	<td>The length of the permanent private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>PERMANENTKEYLENGTH</var> always returns a the same value as <var>PRIVATEKEYLENGTH</var>. It is simply included here for compatibility with the equivalent Janus Sockets function (<var>[[$Sock_Cert_Info]]</var>) or Socket object method (<var>[[CertInfo ~~(Socket function)\|CertInfo]]~~</var>). <var>PERMANENTKEYLENGTH</var> can be abbreviated <var>PERMANENTKEYL</var>, <var>PERMKEYLENGTH</var>, or <var>PERMKEYL</var>.</td></tr>		<td>The length of the permanent private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>PERMANENTKEYLENGTH</var> always returns a the same value as <var>PRIVATEKEYLENGTH</var>. It is simply included here for compatibility with the equivalent Janus Sockets function (<var>$Sock_Cert_Info</var>) or Socket object method (<var>CertInfo</var>).
			<p>
			<var>PERMANENTKEYLENGTH</var> can be abbreviated <var>PERMANENTKEYL</var>, <var>PERMKEYLENGTH</var>, or <var>PERMKEYL</var>.</p></td></tr>

	<tr><th>MD5HASH</th>		<tr><th>MD5HASH</th>
	<td>The MD5 hash or "digest" of the subject or issuer certificate. The MD5 hash of a certificate is shown by some browsers when displaying certificate information. An MD5 hash is always a 16-byte value, so <var>MD5HASH</var> always returns a 32-character hexadecimal string. Since it is basically impossible for any two different certificates to have the same MD5 hash, the <var>MD5HASH</var> value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the MD5 hash of the certificate can be used a primary unique key to locate the certificate. <var>MD5HASH</var> can be abbreviated <var>MD5</var>.</td></tr>		<td>The MD5 hash or "digest" of the subject or issuer certificate. The MD5 hash of a certificate is shown by some browsers when displaying certificate information. An MD5 hash is always a 16-byte value, so <var>MD5HASH</var> always returns a 32-character hexadecimal string.
			<p>
			Since it is basically impossible for any two different certificates to have the same MD5 hash, the <var>MD5HASH</var> value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the MD5 hash of the certificate can be used a primary unique key to locate the certificate. </p>
			<p>
			<var>MD5HASH</var> can be abbreviated <var>MD5</var>.</p></td></tr>

	<tr><th>SHAHASH</th>		<tr><th>SHAHASH</th>
	<td>The SHA hash or "digest" of the subject or issuer certificate. The SHA hash of a certificate is shown by some browsers when displaying certificate information. An SHA hash is always a 20-byte value, so <var>SHAHASH</var> always returns a 40-character hexadecimal string. Since it is basically impossible for any two different certificates to have the same SHA hash, the <var>SHAHASH</var> value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the SHA hash of the certificate can be used a primary unique key to locate the certificate. <var>SHAHASH</var> can be abbreviated <var>SHA</var>.</td></tr>		<td>The SHA hash or "digest" of the subject or issuer certificate. The SHA hash of a certificate is shown by some browsers when displaying certificate information. An SHA hash is always a 20-byte value, so <var>SHAHASH</var> always returns a 40-character hexadecimal string.
			<p>
			Since it is basically impossible for any two different certificates to have the same SHA hash, the <var>SHAHASH</var> value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the SHA hash of the certificate can be used a primary unique key to locate the certificate. </p>
			<p>
			<var>SHAHASH</var> can be abbreviated <var>SHA</var>.</p></td></tr>
	</table>		</table>

	[[Category:Janus Web Server $functions\|$Web_Cert_Info]]		[[Category:Janus Web Server $functions\|$Web_Cert_Info]]

JAL: link repair

2016-08-29T22:10:17Z

link repair

← Older revision		Revision as of 22:10, 29 August 2016
Line 24:		Line 24:
	==Usage notes==		==Usage notes==
	<ul>		<ul>
	<li><var class="product">[[~~Media:jansslr.pdf\|~~Janus Network Security]]</var> does not accept any client certificates that were not signed by a trusted certifying authority, that is one whose certificate was added to a port with the <var>JANUS ADDCA</var> command. As such, a <var>$Web_Cert_Info</var> for level 1 is guaranteed to return information already in a "known" certifying authority certificate.</li>		<li><var class="product">[[Janus Network Security]]</var> does not accept any client certificates that were not signed by a trusted certifying authority, that is one whose certificate was added to a port with the <var>JANUS ADDCA</var> command. As such, a <var>$Web_Cert_Info</var> for level 1 is guaranteed to return information already in a "known" certifying authority certificate.</li>

	<li>~~As of ''[[Sirius Mods]]'' 7.7, if~~ a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).		<li>If a Janus SSL server program issues <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var>, the returned string will be null if the server port definition includes the <var>SSLCLCERT</var> or <var>SSLCLCERTR</var> parameter. Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the initial server-client handshake that establishes the SSL connection. The <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call in this case would be a second request for a certificate, and a client certificate may only be requested once for an SSL session (whether or not the request successfully gets a certificate in return).
	<p>		<p>
	If neither of those <var>JANUS DEFINE</var> parameters are specified, a server's <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call will cause an SSL renegotiation (that is, a new handshake) that requests a digital certificate from the client. This allows a port to require a client certificate for some content, but not for other content.</p>		If neither of those <var>JANUS DEFINE</var> parameters are specified, a server's <var>$Web_Cert_Info</var> or <var>$Web_Cert_Levels</var> call will cause an SSL renegotiation (that is, a new handshake) that requests a digital certificate from the client. This allows a port to require a client certificate for some content, but not for other content.</p>

JAL: add link

2015-08-28T20:08:23Z

add link

Show changes

JAL at 22:41, 5 June 2013

2013-06-05T22:41:06Z

← Older revision		Revision as of 22:41, 5 June 2013
Line 5:		Line 5:

	==Syntax==		==Syntax==
	<p class="syntax"><span class="term">%~~INFO~~</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, [<span class="term">level</span>] )		<p class="syntax"><span class="term">%info</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, [<span class="term">level</span>] )
	</p>		</p>

Admin: /* Syntax */

2013-04-16T02:18:25Z

Syntax

← Older revision		Revision as of 02:18, 16 April 2013
Line 5:		Line 5:

	==Syntax==		==Syntax==
	<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, <span class="term">level</span> )		<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, [<span class="term">level</span>] )
	</p>		</p>

JALWiccan: Automatically generated page update

2013-04-16T02:03:39Z

Automatically generated page update

← Older revision		Revision as of 02:03, 16 April 2013
Line 5:		Line 5:

	==Syntax==		==Syntax==
	<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, level )		<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, <span class="term">level</span> )
	</p>		</p>

JALWiccan: Automatically generated page update

2013-04-16T01:39:56Z

Automatically generated page update

← Older revision		Revision as of 01:39, 16 April 2013
Line 5:		Line 5:

	==Syntax==		==Syntax==
	<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( item, level )		<p class="syntax"><span class="term">%INFO</span> = <span class="literal">$Web_Cert_Info</span>( <span class="term">item</span>, level )
	</p>		</p>