crypto/default/x509_certificate.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_

#include <memory>
#include <string>
#include <utility>
#include <variant>
#include <vector>

#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/strings/string_view.h"
#include "absl/time/time.h"
#include "crypto/algorithms.h"
#include "openssl/base.h"
#include "openssl/x509.h"
#include "tink/signature/ecdsa_parameters.h"
#include "tink/signature/ed25519_parameters.h"
#include "tink/signature/rsa_ssa_pss_parameters.h"

namespace credentio {

// Class encapsulating the OpenSSL X.509 certificate.
class X509Certificate {
 public:
  using TinkKeyParameters = std::variant<crypto::tink::EcdsaParameters,
                                         crypto::tink::RsaSsaPssParameters,
                                         crypto::tink::Ed25519Parameters>;

  explicit X509Certificate(bssl::UniquePtr<X509> cert)
      : cert_(std::move(cert)) {}
  std::string GetSubject() const;
  std::string GetIssuer() const;
  std::string DebugString() const;
  static absl::StatusOr<std::unique_ptr<X509Certificate>> Create(
      absl::string_view der);
  absl::Status IsValidC2paCertificate(bool is_leaf) const;
  // Verifies a raw signature extracted from a COSE_Sign1 message using the
  // public key encapsulated by this `X509Certificate` instance. This is for use
  // with COSE signatures only, so ECDSA signatures must be in IEEE P1363 (not
  // DER) format. Returns an OK status if the verification is successful.
  absl::Status VerifyCoseSignature(absl::string_view signature,
                                   absl::string_view data,
                                   SigningAlgorithm algorithm) const;
  absl::StatusOr<absl::Time> StartTime() const;
  absl::StatusOr<absl::Time> EndTime() const;
  absl::StatusOr<std::vector<TinkKeyParameters>> GetPemKeyParams(
      SigningAlgorithm algorithm) const;
  absl::StatusOr<std::string> GetSerialNumberHex() const;
  absl::StatusOr<std::string> GetAssuranceLevel() const;
  absl::StatusOr<std::string> GetConformingProductId() const;

 private:
  bssl::UniquePtr<X509> cert_;
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_X509_CERTIFICATE_H_