4.1.1.8 Verifying a certificate in the context of TLS session

When operating in the context of a TLS session, the trusted certificate authority list may also be set using:

int gnutls_certificate_set_x509_trust_file (gnutls_certificate_credentials_t cred, const char * cafile, gnutls_x509_crt_fmt_t type)

int gnutls_certificate_set_x509_trust_dir (gnutls_certificate_credentials_t cred, const char * ca_dir, gnutls_x509_crt_fmt_t type)

int gnutls_certificate_set_x509_crl_file (gnutls_certificate_credentials_t res, const char * crlfile, gnutls_x509_crt_fmt_t type)

int gnutls_certificate_set_x509_system_trust (gnutls_certificate_credentials_t cred)

These functions allow the specification of the trusted certificate authorities, either via a file, a directory or use the system-specified certificate authories. Unless the authorities are application specific, it is generally recommended to use the system trust storage (see gnutls_certificate_set_x509_system_trust).

Unlike the previous section it is not required to setup a trusted list, and the function gnutls_certificate_verify_peers3 is used to verify the peer’s certificate chain and identity. The reported verification status is identical to the verification functions described in the previous section. Note that in certain cases it is required to check the marked purpose of the end certificate (e.g. GNUTLS_KP_TLS_WWW_SERVER); in these cases the more advanced gnutls_certificate_verify_peers should be used instead.

There is also the possibility to pass some input to the verification functions in the form of flags. For gnutls_x509_trust_list_verify_crt2 the flags are passed directly, but for gnutls_certificate_verify_peers3, the flags are set using gnutls_certificate_set_verify_flags. All the available flags are part of the enumeration gnutls_certificate_verify_flags shown in Figure 4.3.