IBM Certificate Library, Version 1.0

The files required for the IBM Certificate Library, Version 1.0 are:

• ibmcl.so
• ibmcl.h

This module is used in conjunction with one of the IBM Software Service Cryptographic Providers. This module performs X.509 Version 3 certificate operations. It provides a library of functions needed for creating, signing, verifying, and querying a certificate. The current version does not support X.509 Version 3 extensions. The IBM CL expects X.509 Version 3 signed certificates in ASN/DER-encoded format. It uses a set of object identifiers (OIDs) to exchange certificate information with the application. The list of supported OIDs is defined in the file, ibmcl.h, which should be included in every application that uses the services of IBM CL.

This example demonstrates the purpose and use of OIDs. If an application asks for the version of a given certificate, the CL builds the version object that is returned to the application as follows:

CSSM_FIELD_PTR   p_version;

/* p_version is a pointer to a generic structure containing FieldOid and
FieldValue. FieldOid contains a number that indicates the type of the field, 
e.g. version, serial number, etc. FieldValue contains the actual data.
*/


/* allocate memory for p_version for the sizeof(CSSM_FIELD)...*/

 /* allocate memory for p_version->FieldOid for the sizeof(CSSM_OID)...*/
      P_version->FieldOid.Length=sizeof(unit32);
  * allocate memory for p_version->FieldOid.Data for the sizeof(unit32)...*/
      *(unit32 *)p_version->FieldOid.Data=IBMCL_OID_VERSION;

 /* allocate memory for p_version->FieldValue for the sizeof(CSSM_DATA)...*/
      P_version->FieldValue.Length=Version.length;
  /* allocate memory for p_version->FieldValue.Data for the sizeof(Version.Data)...*/
  Copy(Version.value, p_version->FieldValue.Data);

All fields are returned as unsigned character arrays, which in turn need to be cast to the appropriate type. The OID indicates the type of the field and the structure it should be cast to. This example shows an instance where OID is used to build the relevant data structure:

CSSM_FIELD_PTR     p_field;
X500Name      *p_name;

/* call a CL function to obtain some field in the Cert */

switch ( *p_field->FieldOid.Data) {
    case IBMCL_OID_VERSION:
    break;
case IBMCL_OID_ISSUER_NAME:
    /* cast to the correct structure */
    p_name = (X500Name *) p_field->FieldValue.Data;
    break;
default:
    break;
}

The IBM CL functions in Table 1 comply with the information in Certificate Library Services API. Most of the functions return error codes that are specific to this implementation and not defined in the OCSF API. These error codes are defined in ibmcl.h and described as part of supported API functions. Also note that function arguments Scope and ScopeSize are ignored. Moreover, in order to construct an X.500, the name-only country name (C), organization name (O), organization name unit (OU), and common name (CN) are supported.