1
#pragma once
2
 
3
#include <workerd/jsg/jsg.h>
4
 
5
#include <openssl/x509.h>
6
 
7
namespace workerd::api {
8
 
9
class CryptoKey;
10
 
11
class X509Certificate: public jsg::Object {
12
 public:
13
  X509Certificate(X509* cert): cert_(kj::disposeWith<X509_free>(cert)) {}
14
 
15
  static kj::Maybe<jsg::Ref<X509Certificate>> parse(jsg::Lock& js, kj::Array<const kj::byte> raw);
16
 
17
  kj::Maybe<kj::String> getSubject();
18
  kj::Maybe<kj::String> getSubjectAltName();
19
  kj::Maybe<kj::String> getInfoAccess();
20
  kj::Maybe<kj::String> getIssuer();
21
  kj::Maybe<jsg::Ref<X509Certificate>> getIssuerCert();
22
  kj::Maybe<kj::String> getValidFrom();
23
  kj::Maybe<kj::String> getValidTo();
24
  kj::Maybe<kj::Array<kj::String>> getKeyUsage();
25
  kj::Maybe<kj::Array<const char>> getSerialNumber();
26
  jsg::JsUint8Array getRaw(jsg::Lock& js);
27
  kj::Maybe<jsg::Ref<CryptoKey>> getPublicKey(jsg::Lock& js);
28
  kj::Maybe<kj::String> getPem();
29
  kj::Maybe<kj::String> getFingerprint();
30
  kj::Maybe<kj::String> getFingerprint256();
31
  kj::Maybe<kj::String> getFingerprint512();
32
  bool getIsCA();
33
 
34
  struct CheckOptions {
35
    jsg::Optional<kj::String> subject;
36
    jsg::Optional<bool> wildcards;
37
    jsg::Optional<bool> partialWildcards;
38
    jsg::Optional<bool> multiLabelWildcards;
39
    jsg::Optional<bool> singleLabelSubdomains;
40
    JSG_STRUCT(subject, wildcards, partialWildcards, multiLabelWildcards, singleLabelSubdomains);
41
  };
42
  kj::Maybe<kj::String> checkHost(kj::String name, jsg::Optional<CheckOptions> options);
43
 
44
  kj::Maybe<kj::String> checkEmail(kj::String email, jsg::Optional<CheckOptions> options);
45
 
46
  kj::Maybe<kj::String> checkIp(kj::String ip, jsg::Optional<CheckOptions> options);
47
 
48
  bool checkIssued(jsg::Ref<X509Certificate> other);
49
 
50
  bool checkPrivateKey(jsg::Ref<CryptoKey> privateKey);
51
 
52
  bool verify(jsg::Ref<CryptoKey> publicKey);
53
 
54
  jsg::JsObject toLegacyObject(jsg::Lock& js);
55
 
56
  JSG_RESOURCE_TYPE(X509Certificate) {
57
    JSG_STATIC_METHOD(parse);
58
    JSG_READONLY_PROTOTYPE_PROPERTY(subject, getSubject);
59
    JSG_READONLY_PROTOTYPE_PROPERTY(subjectAltName, getSubjectAltName);
60
    JSG_READONLY_PROTOTYPE_PROPERTY(infoAccess, getInfoAccess);
61
    JSG_READONLY_PROTOTYPE_PROPERTY(issuer, getIssuer);
62
    JSG_READONLY_PROTOTYPE_PROPERTY(issuerCert, getIssuerCert);
63
    JSG_READONLY_PROTOTYPE_PROPERTY(validFrom, getValidFrom);
64
    JSG_READONLY_PROTOTYPE_PROPERTY(validTo, getValidTo);
65
    JSG_READONLY_PROTOTYPE_PROPERTY(fingerprint, getFingerprint);
66
    JSG_READONLY_PROTOTYPE_PROPERTY(fingerprint256, getFingerprint256);
67
    JSG_READONLY_PROTOTYPE_PROPERTY(fingerprint512, getFingerprint512);
68
    JSG_READONLY_PROTOTYPE_PROPERTY(keyUsage, getKeyUsage);
69
    JSG_READONLY_PROTOTYPE_PROPERTY(serialNumber, getSerialNumber);
70
    JSG_READONLY_PROTOTYPE_PROPERTY(pem, getPem);
71
    JSG_READONLY_PROTOTYPE_PROPERTY(raw, getRaw);
72
    JSG_READONLY_PROTOTYPE_PROPERTY(publicKey, getPublicKey);
73
    JSG_READONLY_PROTOTYPE_PROPERTY(isCA, getIsCA);
74
    JSG_METHOD(checkHost);
75
    JSG_METHOD(checkEmail);
76
    JSG_METHOD(checkIp);
77
    JSG_METHOD(checkIssued);
78
    JSG_METHOD(checkPrivateKey);
79
    JSG_METHOD(verify);
80
    JSG_METHOD(toLegacyObject);
81
  }
82
 
83
 private:
84
  kj::Own<X509> cert_;
85
  kj::Maybe<jsg::Ref<X509Certificate>> issuerCert_;
86
};
87
 
88
}  // namespace workerd::api
89
 
90
KJ_DECLARE_NON_POLYMORPHIC(X509);
91
 
92
#define EW_CRYPTO_X509_ISOLATE_TYPES api::X509Certificate, api::X509Certificate::CheckOptions