crypto/x509-utils: Add helper functions for certificate store
Introduce new helper functions for x509 certificate, which will be used by the certificate store: qcrypto_x509_convert_cert_der() - converts a certificate from PEM to DER format These functions provide support for certificate format conversion. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Farhan Ali <alifm@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-4-zycai@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>
Zhuoying Cai committed
Jul 30, 2026 at 17:45 UTC
0246d8fd2b1b51a91de68956b76a626a2936f7ce
2 files changed
+70
crypto/x509-utils.c
+49
@@ -82,6 +82,46 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
82
return ret;
83
}
84
85
+int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size,
86
+ uint8_t **result, size_t *resultlen,
87
+ Error **errp)
88
+{
89
+ int ret = -1;
90
+ int rc;
91
+ gnutls_x509_crt_t crt;
92
+ gnutls_datum_t datum = {.data = cert, .size = size};
93
+ gnutls_datum_t datum_der = {.data = NULL, .size = 0};
94
+
95
+ rc = gnutls_x509_crt_init(&crt);
96
+ if (rc < 0) {
97
+ error_setg(errp, "Failed to initialize certificate: %s", gnutls_strerror(rc));
98
+ return ret;
99
+ }
100
+
101
+ rc = gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM);
102
+ if (rc != 0) {
103
+ error_setg(errp, "Failed to import certificate: %s", gnutls_strerror(rc));
104
+ goto cleanup;
105
+ }
106
+
107
+ rc = gnutls_x509_crt_export2(crt, GNUTLS_X509_FMT_DER, &datum_der);
108
+ if (rc != 0) {
109
+ error_setg(errp, "Failed to convert certificate to DER format: %s",
110
+ gnutls_strerror(rc));
111
+ goto cleanup;
112
+ }
113
+
114
+ *resultlen = datum_der.size;
115
+ *result = g_memdup2(datum_der.data, datum_der.size);
116
+
117
+ ret = 0;
118
+
119
+cleanup:
120
+ gnutls_x509_crt_deinit(crt);
121
+ g_free(datum_der.data);
122
+ return ret;
123
+}
124
+
125
#else /* ! CONFIG_GNUTLS */
126
127
int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
@@ -94,4 +134,13 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
134
return -1;
135
}
136
137
+int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size,
138
+ uint8_t **result,
139
+ size_t *resultlen,
140
+ Error **errp)
141
+{
142
+ error_setg(errp, "GNUTLS is required to export X.509 certificate");
143
+ return -1;
144
+}
145
+
146
#endif /* ! CONFIG_GNUTLS */
include/crypto/x509-utils.h
+21
@@ -19,4 +19,25 @@ int qcrypto_get_x509_cert_fingerprint(uint8_t *cert, size_t size,
19
size_t *resultlen,
20
Error **errp);
21
22
+/**
23
+ * qcrypto_x509_convert_cert_der
24
+ * @cert: pointer to the raw certificate data in PEM format
25
+ * @size: size of the certificate
26
+ * @result: output location for the allocated buffer for the certificate
27
+ * in DER format
28
+ * (the function allocates memory which must be freed by the caller)
29
+ * @resultlen: pointer to the size of the buffer (will be updated with the
30
+ * actual size of the DER-encoded certificate)
31
+ * @errp: error pointer
32
+ *
33
+ * Convert the given @cert from PEM to DER format.
34
+ *
35
+ * Returns: 0 on success,
36
+ * -1 on error.
37
+ */
38
+int qcrypto_x509_convert_cert_der(uint8_t *cert, size_t size,
39
+ uint8_t **result,
40
+ size_t *resultlen,
41
+ Error **errp);
42
+
43
#endif