Memory-managed wrapper type.

Type class for types which can be safely cast to TlsCertificate, for instance with toTlsCertificate.

Cast to TlsCertificate, for types for which this is known to be safe. For general casts, use castTo.

Gets the value of TlsCertificate:dnsNames.

Since: 2.70

Gets the value of TlsCertificate:ipAddresses.

Since: 2.70

Gets the TlsCertificate representing cert's issuer, if known

Since: 2.28

Returns the issuer name from the certificate.

Since: 2.70

Returns the time at which the certificate became or will become invalid.

Since: 2.70

Returns the time at which the certificate became or will become valid.

Since: 2.70

Returns the subject name from the certificate.

Since: 2.70

Check if two TlsCertificate objects represent the same certificate. The raw DER byte data of the two certificates are checked for equality. This has the effect that two certificates may compare equal even if their TlsCertificate:issuer, TlsCertificate:privateKey, or TlsCertificate:privateKeyPem properties differ.

Since: 2.34

Creates one or more GTlsCertificates from the PEM-encoded data in file. If file cannot be read or parsed, the function will return Nothing and set error. If file does not contain any PEM-encoded certificates, this will return an empty list and not set error.

Since: 2.28

Creates a TlsCertificate from the data in file.

As of 2.72, if the filename ends in .p12 or .pfx the data is loaded by tlsCertificateNewFromPkcs12 otherwise it is loaded by tlsCertificateNewFromPem. See those functions for exact details.

If file cannot be read or parsed, the function will return Nothing and set error.

Since: 2.28

Creates a TlsCertificate from the data in file.

If file cannot be read or parsed, the function will return Nothing and set error.

Any unknown file types will error with IOErrorEnumNotSupported. Currently only .p12 and .pfx files are supported. See tlsCertificateNewFromPkcs12 for more details.

Since: 2.72

Creates a TlsCertificate from the PEM-encoded data in certFile and keyFile. The returned certificate will be the first certificate found in certFile. As of GLib 2.44, if certFile contains more certificates it will try to load a certificate chain. All certificates will be verified in the order found (top-level certificate should be the last one in the file) and the TlsCertificate:issuer property of each certificate will be set accordingly if the verification succeeds. If any certificate in the chain cannot be verified, the first certificate in the file will still be returned.

If either file cannot be read or parsed, the function will return Nothing and set error. Otherwise, this behaves like tlsCertificateNewFromPem.

Since: 2.28

Creates a TlsCertificate from the PEM-encoded data in data. If data includes both a certificate and a private key, then the returned certificate will include the private key data as well. (See the TlsCertificate:privateKeyPem property for information about supported formats.)

The returned certificate will be the first certificate found in data. As of GLib 2.44, if data contains more certificates it will try to load a certificate chain. All certificates will be verified in the order found (top-level certificate should be the last one in the file) and the TlsCertificate:issuer property of each certificate will be set accordingly if the verification succeeds. If any certificate in the chain cannot be verified, the first certificate in the file will still be returned.

Since: 2.28

Creates a TlsCertificate from a PKCS #11 URI.

An example pkcs11Uri would be pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01

Where the token’s layout is:

Object 0:
  URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=private%20key;type=private
  Type: Private key (RSA-2048)
  ID: 01

Object 1:
  URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=Certificate%20for%20Authentication;type=cert
  Type: X.509 Certificate (RSA-2048)
  ID: 01

In this case the certificate and private key would both be detected and used as expected. pkcsUri may also just reference an X.509 certificate object and then optionally privateKeyPkcs11Uri allows using a private key exposed under a different URI.

Note that the private key is not accessed until usage and may fail or require a PIN later.

Since: 2.68

Creates a TlsCertificate from the data in data. It must contain a certificate and matching private key.

If extra certificates are included they will be verified as a chain and the TlsCertificate:issuer property will be set. All other data will be ignored.

You can pass as single password for all of the data which will be used both for the PKCS 12 container as well as encrypted private keys. If decryption fails it will error with TlsErrorBadCertificatePassword.

This constructor requires support in the current TlsBackend. If support is missing it will error with IOErrorEnumNotSupported.

Other parsing failures will error with TlsErrorBadCertificate.

Since: 2.72

This verifies cert and returns a set of TlsCertificateFlags indicating any problems found with it. This can be used to verify a certificate outside the context of making a connection, or to check a certificate against a CA that is not part of the system CA database.

If cert is valid, TlsCertificateFlagsNoFlags is returned.

If identity is not Nothing, cert's name(s) will be compared against it, and TlsCertificateFlagsBadIdentity will be set in the return value if it does not match. If identity is Nothing, that bit will never be set in the return value.

If trustedCa is not Nothing, then cert (or one of the certificates in its chain) must be signed by it, or else TlsCertificateFlagsUnknownCa will be set in the return value. If trustedCa is Nothing, that bit will never be set in the return value.

GLib guarantees that if certificate verification fails, at least one error will be set in the return value, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask TlsCertificateFlagsExpired if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate.

Because TLS session context is not used, TlsCertificate may not perform as many checks on the certificates as TlsConnection would. For example, certificate constraints may not be honored, and revocation checks may not be performed. The best way to verify TLS certificates used by a TLS connection is to let TlsConnection handle the verification.

Since: 2.28

Construct a GValueConstruct with valid value for the “certificate” property. This is rarely needed directly, but it is used by new.

Get the value of the “certificate” property. When overloading is enabled, this is equivalent to

get tlsCertificate #certificate

Construct a GValueConstruct with valid value for the “certificate-pem” property. This is rarely needed directly, but it is used by new.

Get the value of the “certificate-pem” property. When overloading is enabled, this is equivalent to

get tlsCertificate #certificatePem

Construct a GValueConstruct with valid value for the “issuer” property. This is rarely needed directly, but it is used by new.

Get the value of the “issuer” property. When overloading is enabled, this is equivalent to

get tlsCertificate #issuer

Get the value of the “issuer-name” property. When overloading is enabled, this is equivalent to

get tlsCertificate #issuerName

Get the value of the “not-valid-after” property. When overloading is enabled, this is equivalent to

get tlsCertificate #notValidAfter

Get the value of the “not-valid-before” property. When overloading is enabled, this is equivalent to

get tlsCertificate #notValidBefore

Construct a GValueConstruct with valid value for the “password” property. This is rarely needed directly, but it is used by new.

Construct a GValueConstruct with valid value for the “pkcs11-uri” property. This is rarely needed directly, but it is used by new.

Get the value of the “pkcs11-uri” property. When overloading is enabled, this is equivalent to

get tlsCertificate #pkcs11Uri

Construct a GValueConstruct with valid value for the “pkcs12-data” property. This is rarely needed directly, but it is used by new.

Construct a GValueConstruct with valid value for the “private-key” property. This is rarely needed directly, but it is used by new.

Get the value of the “private-key” property. When overloading is enabled, this is equivalent to

get tlsCertificate #privateKey