目录

Certificate Framework Overview

The certificate framework shields the differences between third-party certificate algorithm libraries. It provides the capabilities of parsing and validating a certificate, certificate extensions, and a certificate revocation list (CRL), and validating a certificate chain.

You can use the APIs provided by the certificate framework to achieve rapid development.

The certificate framework provides the capabilities of processing certificates and CRL data, but does not provide the capabilities of generating or issuing certificates or CRLs. Certificates and CRLs are issued by a certificate authority (CA) rather than a single application.

Basic Concepts

Device Certificate Kit provides capabilities related to X.509 certificate parsing, serialization, X.509 certificate signature verification, X.509 Certificate Revocation List (CRL) handling, and certificate chain validation.

Before you get started, familiarity with the basic certificate concepts is helpful, which include but are not limited to the following:

Digital certificates, the X.509 digital certificate standard, certificate chains, TBS (To Be Signed, the data structure within an X.509 certificate that is signed, typically containing fields such as the version number, serial number, signature algorithm identifier, issuer, validity period, subject, subject public key information, and extensions), and CRL (Certificate Revocation List).

Certificate Specifications

The following describes certificate specifications.

[h2]Certificate Chain Validation

Because the device-side system time is not trusted, certificate chain validation does not include checking the certificate validity period. If you need to check the time validity of a certificate, use the checkValidityWithDate() method of the X.509 certificate.

[h2]Certificate Format

Currently, only the certificates in DER and PEM formats are supported.

[h2]X.509 Certificate Structure

Certificate example:

[h2]X.509 CRL Structure

CRL example:

Constraints

The certificate framework depends on the basic algorithm capabilities of the Crypto Architecture Kit, which does not support multi-thread concurrent operations. For details, see Constraints.

Development

You can use the certificate framework to implement the following functionalities. Before you start, be sure to familiarize yourself with Certificate Specifications.

The following table lists the classes provided by the certificate framework. Based on the classes, you can learn the related APIs.

Name Class Description
X.509 Certificate X509Cert Provides capabilities such as X.509 certificate parsing, serialization, signature verification, and certificate information query.
Certificate Extension CertExtension Provides access to extension fields in X.509 certificates, such as whether it is a CA, CRL distribution points, and other fields.
X.509 Certificate Revocation List X509CRL Provides capabilities such as X.509 CRL parsing, serialization, and information query.
Certificate chain validator CertChainValidator Verifies the certificate chain (excluding the certificate validity period) and queries the certificate chain algorithm name.
Certificate and CRL collection CertCRLCollection Queries certificates and certificate revocation lists (CRLs).
X.509 Certificate Chain X509CertChain Provides certificate chain validation and certificate list retrieval capabilities.