SecureBlackbox 2020 iOS Edition

Questions / Feedback?

CRLManager Class

Properties   Methods   Events   Configuration Settings   Errors  

The CRLManager class supports the importing, exporting, and validation of Certificate Revocation Lists (CRLs).

Syntax

SecureBlackboxCRLManager
SecureBlackboxCRLManagerSwift

Remarks

CRLs store information about revoked certificates, i.e., certificates that have been identified as invalid for any number of reasons by the issuing certificate authority (CA). CRLs identify certificates by their serial numbers. Therefore, by knowing the certificate's SerialNumber, its validity status can be checked against a CRL.

Each CRL corresponds to one issuing point, and each Certificate Authority (CA) certificate can have a corresponding CRL which contains information about the certificates signed with this CA certificate.

CAs are not required to issue CRLs if other revocation or certificate status mechanisms are provided. Each CRL must contain the date by which the next CRL will be issued. This date is specified by the NextUpdate field.

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

- CACertBytesReturns raw certificate data in DER format.
- CACertHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
- CRLBytesReturns raw CRL data in DER format.
- CRLCAKeyIDA unique identifier (fingerprint) of the CA certificate's private key, if present in the CRL.
- CRLEntryCountReturns the number of certificate status entries in the CRL.
- CRLHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
- CRLIssuerThe common name of the CRL issuer (CA), typically a company name.
- CRLIssuerRDNA collection of information, in the form of [OID, Value] pairs, uniquely identifying the CRL issuer.
- CRLLocationThe URL that the CRL was downloaded from.
- CRLNextUpdateThe planned time and date of the next version of this CRL to be published.
- CRLSigAlgorithmThe public key algorithm that was used by the CA to sign this CRL.
- CRLTBSThe to-be-signed part of the CRL (the CRL without the signature part).
- CRLThisUpdateThe date and time at which this version of the CRL was published.
- entryCountThe number of items in the CRL.
- CRLEntryInfoCertStatusReturns the status of the certificate.
- CRLEntryInfoHandleAllows to get or set a 'handle', a unique identifier of the underlying property object.
- CRLEntryInfoRevocationDateThe time and date when the certificate gets revoked or cancelled.
- CRLEntryInfoRevocationReasonSpecifies the reason for certificate revocation.
- CRLEntryInfoSerialNumberThe certificate serial number.
- externalCryptoCustomParamsCustom parameters to be passed to the signing service (uninterpreted).
- externalCryptoDataAdditional data to be included in the async state and mirrored back by the requestor.
- externalCryptoExternalHashCalculationSpecifies whether the message hash is to be calculated at the external endpoint.
- externalCryptoHashAlgorithmSpecifies the request's signature hash algorithm.
- externalCryptoKeyIDThe ID of the pre-shared key used for DC request authentication.
- externalCryptoKeySecretThe pre-shared key used for DC request authentication.
- externalCryptoMethodSpecifies the asynchronous signing method.
- externalCryptoModeSpecifies the external cryptography mode.
- externalCryptoPublicKeyAlgorithmProvide public key algorithm here if the certificate is not available on the pre-signing stage.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

- addAdds a new revoked certificate entry.
- clearEmpties the CRL.
- configSets or retrieves a configuration setting.
- downloadDownloads a CRL from the specified location.
- getCertEntryIndexReturns the index of the CRL item by the certificate's serial number.
- loadLoads a CRL from a byte array.
- loadFromFileLoads a CRL from a file.
- removeRemoves the specified entry from the CRL.
- saveSaves the CRL to a byte array.
- saveToFileSaves the CRL to a file.
- selectEntryFetches revocation information about the selected certificate from the CRL.
- validateValidates the CRL signature.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

- onErrorInformation about errors during CRL management.
- onExternalSignHandles remote or external signing initiated by the SignExternal method or other source.
- onNotificationThis event notifies the application about an underlying control flow event.

Configuration Settings


The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.

CheckKeyIntegrityBeforeUseEnables or disable private key integrity check before use.
CookieCachingSpecifies whether a cookie cache should be used for HTTP(S) transports.
CookiesGets or sets local cookies for the class (supported for HTTPClient, RESTClient and SOAPClient only).
DefDeriveKeyIterationsSpecifies the default key derivation algorithm iteration count.
EnableClientSideSSLFFDHEEnables or disables finite field DHE key exchange support in TLS clients.
GlobalCookiesGets or sets global cookies for all the HTTP transports.
HttpUserAgentSpecifies the user agent name to be used by all HTTP clients.
LogDestinationSpecifies the debug log destination.
LogDetailsSpecifies the debug log details to dump.
LogFileSpecifies the debug log filename.
LogFiltersSpecifies the debug log filters.
LogFlushModeSpecifies the log flush mode.
LogLevelSpecifies the debug log level.
LogMaxEventCountSpecifies the maximum number of events to cache before further action is taken.
LogRotationModeSpecifies the log rotation mode.
MaxASN1BufferLengthSpecifies the maximal allowed length for ASN.1 primitive tag data.
MaxASN1TreeDepthSpecifies the maximal depth for processed ASN.1 trees.
OCSPHashAlgorithmSpecifies the hash algorithm to be used to identify certificates in OCSP requests.
UseOwnDNSResolverSpecifies whether the client classes should use own DNS resolver.
UseSharedSystemStoragesSpecifies whether the validation engine should use a global per-process copy of the system certificate stores.
UseSystemOAEPAndPSSEnforces or disables the use of system-driven RSA OAEP and PSS computations.
UseSystemRandomEnables or disables the use of the OS PRNG.

Copyright (c) 2022 /n software inc. - All rights reserved.
SecureBlackbox 2020 iOS Edition - Version 20.0 [Build 8166]