crypto/default/x509_certificate.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_

#include <memory>
#include <string>
#include <utility>
#include <vector>

#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "crypto/algorithms.h"
#include "openssl/base.h"
#include "openssl/x509.h"
#include "tink/signature/signature_pem_keyset_reader.h"

namespace credentio {

// Class encapsulating the OpenSSL X.509 certificate.
class X509Certificate {
 public:
  explicit X509Certificate(bssl::UniquePtr<X509> cert)
      : cert_(std::move(cert)) {}
  std::string GetSubject() const;
  std::string GetIssuer() const;
  std::string DebugString() const;
  static absl::StatusOr<std::unique_ptr<X509Certificate>> Create(
      absl::string_view der);
  absl::Status IsValidC2paCertificate(bool is_leaf) const;
  // Verifies a signature using the public key encapsulated by this
  // `X509Certificate` instance.
  // Returns an OK status if the verification is successful.
  absl::Status VerifySignature(absl::string_view signature,
                               absl::string_view data,
                               SigningAlgorithm algorithm) const;
  absl::StatusOr<absl::Time> StartTime() const;
  absl::StatusOr<absl::Time> EndTime() const;
  absl::StatusOr<std::vector<crypto::tink::PemKeyParams>> GetPemKeyParams(
      SigningAlgorithm algorithm) const;
  absl::StatusOr<std::string> GetSerialNumberHex() const;
  absl::StatusOr<std::string> GetAssuranceLevel() const;
  absl::StatusOr<std::string> GetConformingProductId() const;

 private:
  bssl::UniquePtr<X509> cert_;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_