X509CertificateToXmlDoc (String function): Difference between revisions

From m204wiki
Jump to navigation Jump to search
m (→‎See also: add item)
Line 24: Line 24:
<var>[[DerToXmlDoc (String function)|DerToXmlDoc]]</var>, except that <var>X509CertificateToXmlDoc</var> understands the semantics of the certificate tags, so it provides more meaningful XML element names. Contrast the [[DerToXmlDoc (String function)#Examples|DerToXmlDoc example]] with the <var>X509CertificateToXmlDoc</var> [[X509CertificateToXmlDoc (String function)#Examples|example]], below.  
<var>[[DerToXmlDoc (String function)|DerToXmlDoc]]</var>, except that <var>X509CertificateToXmlDoc</var> understands the semantics of the certificate tags, so it provides more meaningful XML element names. Contrast the [[DerToXmlDoc (String function)#Examples|DerToXmlDoc example]] with the <var>X509CertificateToXmlDoc</var> [[X509CertificateToXmlDoc (String function)#Examples|example]], below.  
<li><var>X509CertificateToXmlDoc</var> is a complete implementation of the PKCS standards for X509 certificates.  
<li><var>X509CertificateToXmlDoc</var> is a complete implementation of the PKCS standards for X509 certificates.  
<li>While <var>X509CertificateToXmlDoc</var> is a complete implementation of the PKCS standard, the <var>&lt;RelativeDistinguishedName&gt;</var> element can contain a wide variety of attributes that <var>X509CertificateToXmlDoc</var> does not understand. Under Model 204 7.6, and earlier, this would result in a parse exception but under 7.7 and later, such attributes are added as <var>&lt;unknown&gt;</var> elements with an <var>&lt;ObjectIdentifier&gt;</var> elemnt that indicates the ASN.1 object identifier. One should generally not try to use such elements as, if/when <var>X509CertificateToXmlDoc</var> adds support for it, the element name will change to a proper name. If such an element is of interest, contact Rocket Software technical support.
<li>Currently, no method is available to produce a DER stream from an <var>XmlDoc</var> nor to validate the signature on a certificate.
<li>Currently, no method is available to produce a DER stream from an <var>XmlDoc</var> nor to validate the signature on a certificate.
</ul>
</ul>

Revision as of 01:56, 4 June 2016

Convert BER encoded X.509 certificate to XML (String class)

[Introduced in Sirius Mods 8.0]

X509 is a general authentication framework that establishes standard formats for for public-key certificates, certificate revocation lists (CRLs), and more. X509CertificateToXmlDoc converts a string (Longstring) that contains a certificate to an XmlDoc. DER (Distinguished Encoding Rules), a subset of BER (Basic Encoding Rules, provide a way to uniquely encode an Abstract Syntax Notation One (ASN.1) type value as a string of eight-bit octets.

Syntax

%doc = string:X509CertificateToXmlDoc Throws InvalidBerData

Syntax terms

%docAn XmlDoc object variable to contain the decoded value of the method object, string.
string A DER encoded string that contains the contents of a digital certificate.
Note: This method fails if the XML representation of string is longer than 650 characters.

Exceptions

X509CertificateToXmlDoc can throw the following exception:

InvalidBerData
If the method encounters non-BER-conforming data, properties of the exception object may indicate the position and description of the error.

Usage notes

  • X509CertificateToXmlDoc is very similar to DerToXmlDoc, except that X509CertificateToXmlDoc understands the semantics of the certificate tags, so it provides more meaningful XML element names. Contrast the DerToXmlDoc example with the X509CertificateToXmlDoc example, below.
  • X509CertificateToXmlDoc is a complete implementation of the PKCS standards for X509 certificates.
  • While X509CertificateToXmlDoc is a complete implementation of the PKCS standard, the <RelativeDistinguishedName> element can contain a wide variety of attributes that X509CertificateToXmlDoc does not understand. Under Model 204 7.6, and earlier, this would result in a parse exception but under 7.7 and later, such attributes are added as <unknown> elements with an <ObjectIdentifier> elemnt that indicates the ASN.1 object identifier. One should generally not try to use such elements as, if/when X509CertificateToXmlDoc adds support for it, the element name will change to a proper name. If such an element is of interest, contact Rocket Software technical support.
  • Currently, no method is available to produce a DER stream from an XmlDoc nor to validate the signature on a certificate.

Examples

  1. In the following example, the PemToString method loads Longstring %ls with the contents of a base64 encoded Certificate. The Longstring is then converted to an XmlDoc whose contents are printed:

    ... text to %sl = new raw -----BEGIN X509 CERTIFICATE----- MIIDyjCCArICBQG6t2wFMA0GCSqGSIb3DQEBBAUAMIGpMQswCQYDVQQGEwJVUzEL MAkGA1UECBMCTUExEjAQBgNVBAcTCUNhbWJyaWRnZTEdMBsGA1UEChMUU2lyaXVz IFNvZnR3YXJlIEluYy4xHTAbBgNVBAsTFFNvZnR3YXJlIERldmVsb3BtZW50MTsw OQYDVQQDEzJzaXJpdXN8c2lyaXVzLXNvZnR3YXJlLmNvbXx3d3cuc2lyaXVzLXNv ... 3YJysceP8RdU9u6KMFca9AaXKIiBhDClAq0jXk/0ew4xlXJM8bRUXEVVWPGjXiP6 owT5jqCxVO6YyYMabVa1+fIu7g2EKOW26+2xdOBoti8wUHV5u/v7EhX4gl1SFRA0 HDqjT/PVYzAkLPr7LrMVUtPaE6ostjP4uLKr5K8IUz/Q7oab+sHeiTGk9qhflTMA K7EE6AGXgEWr5q18Xc0= -----END X509 CERTIFICATE----- end text %ls = %sl:pemToString('X509 CERTIFICATE') %ls:x509certificateToXmldoc:print ...

    The result is shown below:

    <Certificate> <tbsCertificate> <version>0</version> <serialNumber>7427550213</serialNumber> <signature> <algorithm name="md5WithRSAEncryption"> 1.2.840.113549.1.1.4 </algorithm> <parameters/> </signature> <issuer> <RelativeDistinguishedName> <countryName>US</countryName> </RelativeDistinguishedName> <RelativeDistinguishedName> <stateOrProvinceName type="PrintableString"> MA </stateOrProvinceName> </RelativeDistinguishedName> <RelativeDistinguishedName> <localityName type="PrintableString"> Cambridge </localityName> </RelativeDistinguishedName> <RelativeDistinguishedName> <organizationName type="PrintableString"> Sirius Software Inc. </organizationName> </RelativeDistinguishedName> <RelativeDistinguishedName> <organizationalUnitName type="PrintableString"> Software Development </organizationalUnitName> </RelativeDistinguishedName> <commonName type="PrintableString"> sirius|sirius-software.com|www.sirius-software.com </commonName> </RelativeDistinguishedName> </issuer> <validity> <notBefore type="UTCTime"> 20120129174641.000Z </notBefore> <notAfter type="UTCTime"> 20130129174641.000Z </notAfter> </validity> <subject> <RelativeDistinguishedName> <countryName>US</countryName> </RelativeDistinguishedName> <RelativeDistinguishedName> <stateOrProvinceName type="PrintableString"> MA </stateOrProvinceName> </RelativeDistinguishedName> <RelativeDistinguishedName> ... </RelativeDistinguishedName> </subject> <subjectPublicKeyInfo> <algorithm> <algorithm name="rsaEncryption"> 1.2.840.113549.1.1.1 </algorithm> <parameters/> </algorithm> <subjectPublicKey bits="2144"> 308201080282010100AEB80E3AE26B644C90081484D304F327CFD79BE9ACA168 ... ... 1046851C2ED4C04DD9020103 </subjectPublicKey> </subjectPublicKeyInfo> </tbsCertificate> <signatureAlgorithm> <algorithm name="md5WithRSAEncryption"> 1.2.840.113549.1.1.4 </algorithm> <parameters/> </signatureAlgorithm> <signatureValue bits="2048"> 0A35414FEEDD883CB4195B1D3F5164E2108A1C3A1CC0C38E3170 ... ... 002BB104E801978045ABE6AD7C5DCD </signatureValue> </Certificate>

  2. To load a client certificate, you might do the following:

    %string = %(System):ClientCertificate(RequestCertificate=true) %doc = %string:X509CertificateToXmlDoc

See also

String methods:

Stringlist methods:

System methods:

Socket methods:

Background information:

Retrieved from "https://m204wiki.rocketsoftware.com/index.php?title=X509CertificateToXmlDoc_(String_function)&oldid=84459"