X509CertificateToXmlDoc (String function)

Convert BER encoded X.509 certificate to XML (String class)

[Introduced in Sirius Mods 8.0]

X509 is a general authentication framework that establishes standard formats for for public-key certificates, certificate revocation lists (CRLs), and more. X509CertificateToXmlDoc converts a string (Longstring) that contains a certificate to an XmlDoc. DER (Distinguished Encoding Rules), a subset of BER (Basic Encoding Rules, provide a way to uniquely encode an Abstract Syntax Notation One (ASN.1) type value as a string of eight-bit octets.

Syntax

%doc = string:X509CertificateToXmlDoc Throws InvalidBerData

Syntax terms

%doc	An XmlDoc object variable to contain the decoded value of the method object, string.
string	A DER encoded string that contains the contents of a digital certificate.

Usage notes

• Prior to version 7.7 of Model 204, input to this method that created any element in the result XmlDoc with a text child whose length exceeded 650 characters produced an error. As of version 7.7, that restriction is removed, and the lengths of the created text nodes are not restricted.
• X509CertificateToXmlDoc is very similar to DerToXmlDoc, except that X509CertificateToXmlDoc understands the semantics of the certificate tags, so it provides more meaningful XML element names. Contrast the DerToXmlDoc example with the X509CertificateToXmlDoc example, below.
• X509CertificateToXmlDoc is a complete implementation of the PKCS standards for X509 certificates.
• While X509CertificateToXmlDoc is a complete implementation of the PKCS standard, the <RelativeDistinguishedName> element can contain a wide variety of attributes that X509CertificateToXmlDoc does not understand. Under Model 204 7.6 and earlier, this results in a parse exception, but under 7.7 and later, such attributes are added as <unknown> elements with an <ObjectIdentifier> element that indicates the ASN.1 object identifier.

  Note: You are advised not to use an <unknown> element in your programs, since future updates to the X509CertificateToXmlDoc method may add support for the element, in which case the element name will change to a proper name. If such an element is of interest, contact Rocket Software technical support.

• Currently, no method is available to produce a DER stream from an XmlDoc nor to validate the signature on a certificate.

Examples

1. In the following example, the PemToString method loads Longstring %ls with the contents of a base64 encoded Certificate. The Longstring is then converted to an XmlDoc whose contents are printed:

   ... text to %sl = new raw -----BEGIN X509 CERTIFICATE----- MIIDyjCCArICBQG6t2wFMA0GCSqGSIb3DQEBBAUAMIGpMQswCQYDVQQGEwJVUzEL MAkGA1UECBMCTUExEjAQBgNVBAcTCUNhbWJyaWRnZTEdMBsGA1UEChMUU2lyaXVz IFNvZnR3YXJlIEluYy4xHTAbBgNVBAsTFFNvZnR3YXJlIERldmVsb3BtZW50MTsw OQYDVQQDEzJzaXJpdXN8c2lyaXVzLXNvZnR3YXJlLmNvbXx3d3cuc2lyaXVzLXNv ... 3YJysceP8RdU9u6KMFca9AaXKIiBhDClAq0jXk/0ew4xlXJM8bRUXEVVWPGjXiP6 owT5jqCxVO6YyYMabVa1+fIu7g2EKOW26+2xdOBoti8wUHV5u/v7EhX4gl1SFRA0 HDqjT/PVYzAkLPr7LrMVUtPaE6ostjP4uLKr5K8IUz/Q7oab+sHeiTGk9qhflTMA K7EE6AGXgEWr5q18Xc0= -----END X509 CERTIFICATE----- end text %ls = %sl:pemToString('X509 CERTIFICATE') %ls:x509certificateToXmldoc:print ...

   The result is shown below:

   <Certificate> <tbsCertificate> <version>0</version> <serialNumber>7427550213</serialNumber> <signature> <algorithm name="md5WithRSAEncryption"> 1.2.840.113549.1.1.4 </algorithm> <parameters/> </signature> <issuer> <RelativeDistinguishedName> <countryName>US</countryName> </RelativeDistinguishedName> <RelativeDistinguishedName> <stateOrProvinceName type="PrintableString"> MA </stateOrProvinceName> </RelativeDistinguishedName> <RelativeDistinguishedName> <localityName type="PrintableString"> Cambridge </localityName> </RelativeDistinguishedName> <RelativeDistinguishedName> <organizationName type="PrintableString"> Sirius Software Inc. </organizationName> </RelativeDistinguishedName> <RelativeDistinguishedName> <organizationalUnitName type="PrintableString"> Software Development </organizationalUnitName> </RelativeDistinguishedName> <commonName type="PrintableString"> sirius|sirius-software.com|www.sirius-software.com </commonName> </RelativeDistinguishedName> </issuer> <validity> <notBefore type="UTCTime"> 20120129174641.000Z </notBefore> <notAfter type="UTCTime"> 20130129174641.000Z </notAfter> </validity> <subject> <RelativeDistinguishedName> <countryName>US</countryName> </RelativeDistinguishedName> <RelativeDistinguishedName> <stateOrProvinceName type="PrintableString"> MA </stateOrProvinceName> </RelativeDistinguishedName> <RelativeDistinguishedName> ... </RelativeDistinguishedName> </subject> <subjectPublicKeyInfo> <algorithm> <algorithm name="rsaEncryption"> 1.2.840.113549.1.1.1 </algorithm> <parameters/> </algorithm> <subjectPublicKey bits="2144"> 308201080282010100AEB80E3AE26B644C90081484D304F327CFD79BE9ACA168 ... ... 1046851C2ED4C04DD9020103 </subjectPublicKey> </subjectPublicKeyInfo> </tbsCertificate> <signatureAlgorithm> <algorithm name="md5WithRSAEncryption"> 1.2.840.113549.1.1.4 </algorithm> <parameters/> </signatureAlgorithm> <signatureValue bits="2048"> 0A35414FEEDD883CB4195B1D3F5164E2108A1C3A1CC0C38E3170 ... ... 002BB104E801978045ABE6AD7C5DCD </signatureValue> </Certificate>

2. To load a client certificate, you might do the following:

   %string = %(System):ClientCertificate(RequestCertificate=true) %doc = %string:X509CertificateToXmlDoc

See also

String methods:

• CertificateRequest
• ClientCertificateRequest
• SignedCertificate
• DerToXmlDoc
• RSAPrivateKeyToXmlDoc
• X509CertificateToXmlDoc
• X509CrlToXmlDoc
• Multiple cryptographic cipher methods

Stringlist methods:

• AppendCertificateInfo
• AppendCertificateRequest
• AppendCertificateRequestInfo
• AppendClientCertificateRequest
• AppendEncryptedSecurityData
• AppendGeneratedPrivateKey
• AppendPemData
• AppendPrivateKeyInfo
• AppendSignedCertificate
• AppendSignedClientCertificate
• CheckCertificate
• CheckCertificateRequest
• PemToString

System methods:

• ClientCertificate
• GeneratedPrivateKey

Socket methods:

• Certificate

Background information:

• "Abstract Syntax Notation One"
• "A Layman's Guide to a Subset of ASN.1, BER, and DER"

Float class String class Unicode class	List of Float methods List of String methods List of Unicode methods List of Intrinsic methods	Float methods syntax String methods syntax Unicode methods syntax
Notation conventions for methods