path: root/lib/ssl/doc/src/ssl_crl_cache_api.xml

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE erlref SYSTEM "erlref.dtd">

<erlref>
  <header>
    <copyright>
      <year>2015</year><year>2015</year>
      <holder>Ericsson AB. All Rights Reserved.</holder>
    </copyright>
    <legalnotice>
      The contents of this file are subject to the Erlang Public License,
      Version 1.1, (the "License"); you may not use this file except in
      compliance with the License. You should have received a copy of the
      Erlang Public License along with this software. If not, it can be
      retrieved online at http://www.erlang.org/.

      Software distributed under the License is distributed on an "AS IS"
      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
      the License for the specific language governing rights and limitations
      under the License.
    </legalnotice>
    <title>ssl_crl_cache_api</title>
    <file>ssl_crl_cache_api.xml</file>
  </header>
  
  <module>ssl_crl_cache_api</module>
  <modulesummary>API for a SSL/TLS CRL (Certificate Revocation List) cache.</modulesummary>
  <description>
    <p>
      When SSL/TLS performs certificate path validation according to
      <url href="http://www.ietf.org/rfc/rfc5280.txt">RFC 5280 </url>
      it should also perform CRL validation checks. To enable the CRL
      checks the application needs access to CRLs. A database of CRLs
      can be set up in many different ways. This module provides the
      behavior of the API needed to integrate an arbitrary CRL cache
      with the erlang ssl application. It is also used by the
      application itself to provide a simple default implementation of
      a CRL cache.
    </p>
  </description>
  
  <section>
    <title>Common Data Types</title>
    
    <p>The following data types are used in the functions below:
    </p>
    
    <p><c>cache_ref() = opaque()</c></p> 
    <p> dist_point() = #'DistributionPoint'{} see <seealso
    marker="public_key:cert_records"> X509 certificates records</seealso></p>
  </section>
  
  <funcs>
    <func>
      <name>lookup(DistributionPoint, DbHandle) -> not_available | CRLs </name>
      <fsummary> </fsummary>
      <type>
        <v> DistributionPoint = dist_point() </v>
	<v> DbHandle  = cache_ref() </v>
	<v> CRLs = [<seealso
	   marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
	</type>
	<desc> <p>Lookup the CRLs belonging to the distribution point <c> Distributionpoint </c> </p>.
	This function may choose to only look in the cache or to follow distribution point
	links depending on how the cache is administrated.
	</desc>
    </func>
    
    <func>
      <name>select(Issuer, DbHandle) -> CRLs </name>
      <fsummary>Select the CRLs in the cache that are issued by <c>Issuer</c></fsummary>
      <type>
	<v> Issuer = <seealso
	marker="public_key:public_key">public_key:issuer_name()</seealso></v>
	<v> DbHandle  = cache_ref() </v>
	</type>
	<desc>
	  <p>Select the CRLs in the cache that are issued by <c>Issuer</c> </p>
	</desc>
    </func>
    
    <func>
      <name>fresh_crl(DistributionPoint, CRL) -> FreshCRL</name>
      <fsummary> <c>fun fresh_crl/2 </c> will be used as input option <c>update_crl</c> to
      public_key:pkix_crls_validate/3 </fsummary>
      <type>
	<v> DistributionPoint = dist_point() </v>
	<v> CRL = [<seealso
	marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
	<v> FreshCRL = [<seealso
	marker="public_key:public_key">public_key:der_encoded()</seealso>] </v>
      </type>
      <desc>
	<p> <c>fun fresh_crl/2 </c> will be used as input option <c>update_crl</c> to
	<seealso marker="public_key#pkix_path_validation-3">public_key:pkix_crls_validate/3 </seealso> </p>
      </desc>
    </func>
  </funcs>
</erlref>