Check-in [3a8336467a]
EuroTcl/OpenACS 11 - 12 JULY 2024, VIENNA
Overview
Comment:Refactored X509 status to improve readability by using macros for common operations.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | status_x509
Files: files | file ages | folders
SHA3-256: 3a8336467ac80304151de3ae2eda1477d4d2859b14c4327f4e8b7d6bdea5eb4e
User & Date: bohagan on 2023-08-14 03:16:19
Other Links: branch diff | manifest | tags
Context
2023-08-19
18:04
Optimized CiphersObjCmd to use method variable. check-in: 543e7ab6d3 user: bohagan tags: status_x509
2023-08-14
03:16
Refactored X509 status to improve readability by using macros for common operations. check-in: 3a8336467a user: bohagan tags: status_x509
2023-08-13
01:00
Added get CA list to connection status check-in: c95df396da user: bohagan tags: status_x509
Changes

Modified generic/tlsX509.c from [2c04105453] to [2bf827806d].

11
12
13
14
15
16
17
18
19


20
21


22
23
24
25


26
27
28
29




30
31


32



33
34


35
36


37
38
39
40
41
42

43
44
45

46
47
48
49
50
51
52
53
54
55

56

57
58
59

60
61
62
63
64
65
66
11
12
13
14
15
16
17


18
19


20
21




22
23




24
25
26
27


28
29
30
31
32
33


34
35


36
37
38
39
40
41
42

43
44
45

46
47
48
49
50
51
52
53
54
55

56
57
58
59
60

61
62
63
64
65
66
67
68







-
-
+
+
-
-
+
+
-
-
-
-
+
+
-
-
-
-
+
+
+
+
-
-
+
+

+
+
+
-
-
+
+
-
-
+
+





-
+


-
+









-
+

+


-
+







#include <openssl/x509v3.h>
#include <openssl/asn1.h>
#include "tlsInt.h"

/* Define maximum certificate size. Max PEM size 100kB and DER size is 24kB. */
#define CERT_STR_SIZE 32768

/*
 *  Ensure these are not macros - known to be defined on Win32
/* Common macros */
#define LAPPEND_STR(interp, obj, text, value, size) {\
 */
#ifdef min
    if (text != NULL) Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(text, -1)); \
    Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(value, size)); \
#undef min
#endif

#ifdef max
}
#define LAPPEND_INT(interp, obj, text, value) {\
#undef max
#endif

static int min(int a, int b)
    if (text != NULL) Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(text, -1)); \
    Tcl_ListObjAppendElement(interp, obj, Tcl_NewIntObj(value)); \
}
#define LAPPEND_LONG(interp, obj, text, value) {\
{
    return (a < b) ? a : b;
    if (text != NULL) Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(text, -1)); \
    Tcl_ListObjAppendElement(interp, obj, Tcl_NewLongObj(value)); \
}
#define LAPPEND_BOOL(interp, obj, text, value) {\
    if (text != NULL) Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(text, -1)); \
    Tcl_ListObjAppendElement(interp, obj, Tcl_NewBooleanObj(value)); \

static int max(int a, int b)
}
#define LAPPEND_LIST(interp, obj, text, listObj) {\
{
    return (a > b) ? a : b;
    if (text != NULL) Tcl_ListObjAppendElement(interp, obj, Tcl_NewStringObj(text, -1)); \
    Tcl_ListObjAppendElement(interp, obj, listObj); \
}

/*
 * Binary string to hex string
 */
int String_to_Hex(char* input, int len, char *output, int max) {
int String_to_Hex(char* input, int len, char *output, int size) {
    int count = 0;

    for (int i = 0; i < len && count < max - 1; i++, count += 2) {
    for (int i = 0; i < len && count < size - 1; i++, count += 2) {
	sprintf(output + count, "%02X", input[i] & 0xff);
    }
    output[count] = 0;
    return count;
}

/*
 * BIO to Buffer
 */
int BIO_to_Buffer(int result, BIO *bio, void *buffer) {
int BIO_to_Buffer(int result, BIO *bio, void *buffer, int size) {
    int len = 0;
    int pending = BIO_pending(bio);

    if (result) {
	len = BIO_read(bio, buffer, min(BIO_pending(bio), BUFSIZ));
	len = BIO_read(bio, buffer, (pending < size) ? pending : size);
	(void)BIO_flush(bio);
	if (len < 0) {
	    len = 0;
	}
    }
    return len;
}
80
81
82
83
84
85
86
87
88
89
90

91
92
93
94
95
96

97
98
99
100
101
102
103
104
105
106
107
108
109



110
111
112
113
114
115
116
117
118

119
120
121
122
123
124

125
126
127

128
129
130
131
132
133

134
135
136

137
138

139
140
141
142
143

144
145
146
147
148



149
150
151

152
153

154
155

156
157

158
159
160

161
162

163
164
165
166



167
168

169
170
171
172
173
174

175
176
177
178
179
180
181

182
183
184
185
186

187
188
189
190

191
192

193
194

195
196
197
198
199
200
201

202

203
204
205
206
207
208
209
210

211
212
213
214
215

216
217
218
219
220
221
222

223
224

225
226
227

228
229
230
231
232


233
234
235
236
237

238
239

240
241
242

243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261

262
263
264
265

266
267
268
269
270
271
272


273
274
275
276
277


278
279
280


281
282

283
284

285
286

287
288

289
290
291
292
293


294
295

296
297

298
299

300
301

302
303
304
305
306
307

308
309

310
311
312

313
314
315

316
317
318

319
320
321

322
323
324

325
326
327

328
329
330

331
332
333

334
335
336

337
338
339
340
341
342

343
344

345
346
347
348
349
350
351
352
353
354
355
82
83
84
85
86
87
88

89
90

91
92
93
94
95
96

97
98
99
100
101
102
103
104
105
106
107



108
109
110
111
112
113
114
115
116
117
118

119






120



121

122
123
124


125
126
127

128


129
130
131
132


133
134




135
136
137

138

139


140
141

142


143
144
145

146


147
148



149
150
151


152
153
154
155
156


157
158
159
160
161
162


163
164
165
166
167

168
169
170
171

172


173


174


175
176
177


178
179
180
181
182


183



184
185




186
187
188


189


190
191
192
193
194


195
196
197



198
199



200

201


202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223


224

225


226

227
228
229
230


231
232
233



234
235
236
237


238
239
240
241
242
243

244


245
246

247

248
249


250
251
252
253
254
255

256


257
258

259

260
261
262
263

264
265

266

267

268
269
270

271
272
273

274
275
276

277
278
279

280
281
282

283
284
285

286
287
288

289
290
291

292
293



294

295
296

297
298
299
300

301
302
303
304
305
306
307







-


-
+





-
+










-
-
-
+
+
+








-
+
-
-
-
-
-
-
+
-
-
-
+
-



-
-
+


-
+
-
-
+



-
-
+

-
-
-
-
+
+
+
-

-
+
-
-
+

-
+
-
-
+


-
+
-
-
+

-
-
-
+
+
+
-
-
+




-
-
+





-
-
+




-
+



-
+
-
-
+
-
-
+
-
-



-
-
+

+


-
-

-
-
-
+

-
-
-
-
+


-
-

-
-
+


+

-
-
+


-
-
-
+
+
-
-
-

-
+
-
-
+



+

















-
-
+
-

-
-
+
-




-
-
+
+

-
-
-

+
+

-
-
+
+


+

-
+
-
-
+

-
+
-


-
-
+
+


+

-
+
-
-
+

-
+
-




-
+

-
+
-

-
+


-
+


-
+


-
+


-
+


-
+


-
+


-
+


-
+

-
-
-

-
+

-
+



-







 *	Result:
 *		A Tcl List Object representing the provided
 *		X509 certificate.
 *
 *------------------------------------------------------*
 */


Tcl_Obj*
Tls_NewX509Obj(Tcl_Interp *interp, X509 *cert) {
    Tcl_Obj *certPtr = Tcl_NewListObj(0, NULL);
    Tcl_Obj *certPtr = Tcl_NewListObj(0, NULL), *listPtr;
    BIO *bio = BIO_new(BIO_s_mem());
    int mdnid, pknid, bits, len;
    uint32_t xflags, usage;
    char buffer[BUFSIZ];
    unsigned char md[EVP_MAX_MD_SIZE];
    STACK_OF(GENERAL_NAME) *san;
    STACK_OF(GENERAL_NAME) *names;
    STACK_OF(DIST_POINT) *crl;
    STACK_OF(OPENSSL_STRING) *ocsp;
    unsigned long flags = XN_FLAG_RFC2253 | ASN1_STRFLGS_UTF8_CONVERT;
    flags &= ~ASN1_STRFLGS_ESC_MSB;

    if (bio == NULL || certPtr == NULL) {
	return NULL;
    }

    /* Signature algorithm and value - RFC 5280 section 4.1.1.2 and 4.1.1.3 */
    /* The signatureAlgorithm field contains the identifier for the cryptographic algorithm
	used by the CA to sign this certificate. The signatureValue field contains a digital
	signature computed upon the ASN.1 DER encoded tbsCertificate. */
    /* signatureAlgorithm is the id of the cryptographic algorithm used by the
	CA to sign this cert. signatureValue is the digital signature computed
	upon the ASN.1 DER encoded tbsCertificate. */
    {
	const X509_ALGOR *sig_alg;
	const ASN1_BIT_STRING *sig;
	int sig_nid;

	X509_get0_signature(&sig, &sig_alg, cert);
	/* sig_nid = X509_get_signature_nid(cert) */
	sig_nid = OBJ_obj2nid(sig_alg->algorithm);

	LAPPEND_STR(interp, certPtr, "signatureAlgorithm", OBJ_nid2ln(sig_nid), -1);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("signatureAlgorithm", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(OBJ_nid2ln(sig_nid),-1));

	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("signatureValue", -1));
	if (sig_nid != NID_undef) {
	    len = String_to_Hex(sig->data, sig->length, buffer, BUFSIZ);
	len = (sig_nid != NID_undef) ? String_to_Hex(sig->data, sig->length, buffer, BUFSIZ) : 0;
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	} else {
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
	LAPPEND_STR(interp, certPtr, "signatureValue", buffer, len);
	}
    }

    /* Version of the encoded certificate - RFC 5280 section 4.1.2.1 */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("version", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewLongObj(X509_get_version(cert)+1));
    LAPPEND_LONG(interp, certPtr, "version", X509_get_version(cert)+1);

    /* Unique number assigned by CA to certificate - RFC 5280 section 4.1.2.2 */
    len = BIO_to_Buffer(i2a_ASN1_INTEGER(bio, X509_get0_serialNumber(cert)), bio, buffer);
    len = BIO_to_Buffer(i2a_ASN1_INTEGER(bio, X509_get0_serialNumber(cert)), bio, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("serialNumber", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    LAPPEND_STR(interp, certPtr, "serialNumber", buffer, len);

    /* Signature algorithm used by the CA to sign the certificate. Must match
	signatureAlgorithm. RFC 5280 section 4.1.2.3 */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("signature", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(OBJ_nid2ln(X509_get_signature_nid(cert)),-1));
    LAPPEND_STR(interp, certPtr, "signature", OBJ_nid2ln(X509_get_signature_nid(cert)), -1);

    /* The issuer identifies the entity that has signed and issued the certificate.
	RFC 5280 section 4.1.2.4 */
    len = BIO_to_Buffer(X509_NAME_print_ex(bio, X509_get_issuer_name(cert), 0, flags), bio, buffer);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("issuer", -1));
    /* Issuer identifies the entity that signed and issued the cert. RFC 5280 section 4.1.2.4 */
    len = BIO_to_Buffer(X509_NAME_print_ex(bio, X509_get_issuer_name(cert), 0, flags), bio, buffer, BUFSIZ);
    LAPPEND_STR(interp, certPtr, "issuer", buffer, len);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));

    /* Certificate validity period is the time interval during which the CA
    /* Certificate validity period is the interval the CA warrants that it will
	warrants that it will maintain information about the status of the certificate.
	RFC 5280 section 4.1.2.5 */
	maintain info on the status of the certificate. RFC 5280 section 4.1.2.5 */
    /* Get Validity - Not Before */
    len = BIO_to_Buffer(ASN1_TIME_print(bio, X509_get0_notBefore(cert)), bio, buffer);
    len = BIO_to_Buffer(ASN1_TIME_print(bio, X509_get0_notBefore(cert)), bio, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("notBefore", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    LAPPEND_STR(interp, certPtr, "notBefore", buffer, len);

    /* Get Validity - Not After */
    len = BIO_to_Buffer(ASN1_TIME_print(bio, X509_get0_notAfter(cert)), bio, buffer);
    len = BIO_to_Buffer(ASN1_TIME_print(bio, X509_get0_notAfter(cert)), bio, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("notAfter", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    LAPPEND_STR(interp, certPtr, "notAfter", buffer, len);

    /* The subject identifies the entity associated with the public key stored
	in the subject public key field. RFC 5280 section 4.1.2.6 */
    len = BIO_to_Buffer(X509_NAME_print_ex(bio, X509_get_subject_name(cert), 0, flags), bio, buffer);
    /* Subject identifies the entity associated with the public key stored in
	the subject public key field. RFC 5280 section 4.1.2.6 */
    len = BIO_to_Buffer(X509_NAME_print_ex(bio, X509_get_subject_name(cert), 0, flags), bio, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("subject", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    LAPPEND_STR(interp, certPtr, "subject", buffer, len);

    /* SHA1 Fingerprint of cert - DER representation */
    if (X509_digest(cert, EVP_sha1(), md, &len)) {
    len = String_to_Hex(md, len, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("sha1_hash", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	LAPPEND_STR(interp, certPtr, "sha1_hash", buffer, len);
    }

    /* SHA256 Fingerprint of cert - DER representation */
    if (X509_digest(cert, EVP_sha256(), md, &len)) {
    len = String_to_Hex(md, len, buffer, BUFSIZ);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("sha256_hash", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	LAPPEND_STR(interp, certPtr, "sha256_hash", buffer, len);
    }

    /* Subject Public Key Info specifies the public key and identifies the
	algorithm with which the key is used. RFC 5280 section 4.1.2.7 */
    if (X509_get_signature_info(cert, &mdnid, &pknid, &bits, &xflags) == 1) {
    if (X509_get_signature_info(cert, &mdnid, &pknid, &bits, &xflags)) {
	ASN1_BIT_STRING *key;
	unsigned int n;

	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("signingDigest", -1));
	LAPPEND_STR(interp, certPtr, "signingDigest", OBJ_nid2ln(mdnid), -1);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(OBJ_nid2ln(mdnid),-1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("publicKeyAlgorithm", -1));
	LAPPEND_STR(interp, certPtr, "publicKeyAlgorithm", OBJ_nid2ln(pknid), -1);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(OBJ_nid2ln(pknid),-1));
	/* Effective security bits */
	LAPPEND_INT(interp, certPtr, "bits", bits); /* Effective security bits */
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("bits", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewIntObj(bits));

	key = X509_get0_pubkey_bitstr(cert);
	len = String_to_Hex(key->data, key->length, buffer, BUFSIZ);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("publicKey", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	LAPPEND_STR(interp, certPtr, "publicKey", buffer, len);

	len = 0;
	if (X509_pubkey_digest(cert, EVP_get_digestbynid(pknid), md, &n)) {
	    len = String_to_Hex(md, (int)n, buffer, BUFSIZ);
	} else {
	    len = 0;
	}
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("publicKeyHash", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	
	LAPPEND_STR(interp, certPtr, "publicKeyHash", buffer, len);

	/* Check if cert was issued by CA cert issuer or self signed */
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("self_signed", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewBooleanObj(X509_check_issued(cert, cert) == X509_V_OK));

	len = 0;
	if (X509_digest(cert, EVP_get_digestbynid(mdnid), md, &n)) {
	    len = String_to_Hex(md, (int)n, buffer, BUFSIZ);
	} else {
	    len = 0;
	}
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("signatureHash", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
	LAPPEND_STR(interp, certPtr, "signatureHash", buffer, len);
    }

    /* Get extensions flags */
    xflags = X509_get_extension_flags(cert);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("extension_flags", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewIntObj(xflags));
    LAPPEND_INT(interp, certPtr, "extFlags", xflags);

	/* Check if cert was issued by CA cert issuer or self signed */
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("selfIssued", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewBooleanObj(xflags & EXFLAG_SI));

    LAPPEND_BOOL(interp, certPtr, "selfIssued", xflags & EXFLAG_SI);
    LAPPEND_BOOL(interp, certPtr, "selfSigned", xflags & EXFLAG_SS);
	/* Check if cert was issued by CA cert issuer or self signed */
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("selfSigned", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewBooleanObj(xflags & EXFLAG_SS));


    /* The Unique Ids are used to handle the possibility of reuse of subject
    /* Unique Ids -  The unique identifiers are present in the certificate to handle the
	possibility of reuse of subject and/or issuer names over time. RFC 5280 section 4.1.2.8 */
	and/or issuer names over time. RFC 5280 section 4.1.2.8 */
    {
	const ASN1_BIT_STRING *iuid, *suid;
        X509_get0_uids(cert, &iuid, &suid);

	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("issuerUniqueId", -1));
	if (iuid != NULL) {
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewByteArrayObj((char *)iuid->data, iuid->length));
	} else {
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
	}

	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("subjectUniqueId", -1));
	if (suid != NULL) {
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewByteArrayObj((char *)suid->data, suid->length));
	} else {
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
	}
    }

    /* X509 v3 Extensions - RFC 5280 section 4.1.2.9 */
    len = X509_get_ext_count(cert);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("num_extensions", -1));
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewIntObj(len));
    listPtr = Tcl_NewListObj(0, NULL);
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("extensions", -1));
    if (len > 0) {
	Tcl_Obj *extsPtr = Tcl_NewListObj(0, NULL);
	const STACK_OF(X509_EXTENSION) *exts;
	const STACK_OF(X509_EXTENSION) *exts = X509_get0_extensions(cert);
	exts = X509_get0_extensions(cert);

	for (int i=0; i < len; i++) {
	    X509_EXTENSION *ex = sk_X509_EXTENSION_value(exts, i);
	    ASN1_OBJECT *obj = X509_EXTENSION_get_object(ex);
	    unsigned nid2 = OBJ_obj2nid(obj);
	    Tcl_ListObjAppendElement(interp, extsPtr, Tcl_NewStringObj(OBJ_nid2ln(nid2), -1));

	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj(OBJ_nid2ln(OBJ_obj2nid(obj)), -1));
	}
	Tcl_ListObjAppendElement(interp, certPtr, extsPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_INT(interp, certPtr, "extCount", len);
    LAPPEND_LIST(interp, certPtr, "extensions", listPtr);

    /* Authority Key Identifier (AKI) of a certificate should be the Subject Key
	Identifier (SKI) of its signer (the CA). RFC 5280 section 4.2.1.1, NID_authority_key_identifier */
    /* Authority Key Identifier (AKI) is the Subject Key Identifier (SKI) of
	its signer (the CA). RFC 5280 section 4.2.1.1, NID_authority_key_identifier */
    {
	ASN1_OCTET_STRING *astring = X509_get0_authority_key_id(cert);
	len = 0;
	if (astring != NULL) {
	    len = String_to_Hex((char *)ASN1_STRING_get0_data(astring), ASN1_STRING_length(astring), buffer, BUFSIZ);
	    len = String_to_Hex((char *)ASN1_STRING_get0_data(astring),
	} else {
	    len = 0;
		ASN1_STRING_length(astring), buffer, BUFSIZ);
	}
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("authorityKeyIdentifier", -1));
	LAPPEND_STR(interp, certPtr, "authorityKeyIdentifier", buffer, len);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    }

    /* Subject Key Identifier (SKI) provides a means of identifying certificates
	that contain a particular public key. RFC 5280 section 4.2.1.2, NID_subject_key_identifier */
    /* Subject Key Identifier (SKI) is used to dentify certificates that contain
	a particular public key. RFC 5280 section 4.2.1.2, NID_subject_key_identifier */
    {
	ASN1_OCTET_STRING *astring = X509_get0_subject_key_id(cert);
	len = 0;
	if (astring != NULL) {
	    len = String_to_Hex((char *)ASN1_STRING_get0_data(astring), ASN1_STRING_length(astring), buffer, BUFSIZ);
	    len = String_to_Hex((char *)ASN1_STRING_get0_data(astring),
	} else {
	    len = 0;
		ASN1_STRING_length(astring), buffer, BUFSIZ);
	}
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("subjectKeyIdentifier", -1));
	LAPPEND_STR(interp, certPtr, "subjectKeyIdentifier", buffer, len);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(buffer, len));
    }

    /* Key usage extension defines the purpose (e.g., encipherment, signature, certificate
	signing) of the key contained in the certificate. RFC 5280 section 4.2.1.3, NID_key_usage */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("keyUsage", -1));
    listPtr = Tcl_NewListObj(0, NULL);
    usage = X509_get_key_usage(cert);
    if (xflags & EXFLAG_KUSAGE && usage < 0xffffff) {
    if ((xflags & EXFLAG_KUSAGE) && usage < 0xffffff) {
	Tcl_Obj *tmpPtr = Tcl_NewListObj(0, NULL);
	if (usage & KU_DIGITAL_SIGNATURE) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Digital Signature", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Digital Signature", -1));
	}
	if (usage & KU_NON_REPUDIATION) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Non-Repudiation", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Non-Repudiation", -1));
	}
	if (usage & KU_KEY_ENCIPHERMENT) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Key Encipherment", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Key Encipherment", -1));
	}
	if (usage & KU_DATA_ENCIPHERMENT) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Data Encipherment", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Data Encipherment", -1));
	}
	if (usage & KU_KEY_AGREEMENT) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Key Agreement", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Key Agreement", -1));
	}
	if (usage & KU_KEY_CERT_SIGN) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Certificate Signing", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Certificate Signing", -1));
	}
	if (usage & KU_CRL_SIGN) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("CRL Signing", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("CRL Signing", -1));
	}
	if (usage & KU_ENCIPHER_ONLY) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Encipher Only", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Encipher Only", -1));
	}
	if (usage & KU_DECIPHER_ONLY) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Decipher Only", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Decipher Only", -1));
	}
	Tcl_ListObjAppendElement(interp, certPtr, tmpPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }

    LAPPEND_LIST(interp, certPtr, "keyUsage", listPtr);

    /* Purpose */
    /* Certificate Purpose */
    {
	char *purpose = NULL;

	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("purpose", -1));
	if (X509_check_purpose(cert, X509_PURPOSE_SSL_CLIENT, 0) > 0) {
	    purpose = "SSL Client";
	} else if (X509_check_purpose(cert, X509_PURPOSE_SSL_SERVER, 0) > 0) {
	    purpose = "SSL Server";
	} else if (X509_check_purpose(cert, X509_PURPOSE_NS_SSL_SERVER, 0) > 0) {
	    purpose = "MSS SSL Server";
	} else if (X509_check_purpose(cert, X509_PURPOSE_SMIME_SIGN, 0) > 0) {
363
364
365
366
367
368
369
370

371
372
373
374


375
376
377
378
379
380
381
382
383
384

385
386

387
388

389
390
391
392
393
394
395
396
397
398
399

400
401
402
403
404
405
406
407




408
409
410

411
412

413
414
415

416
417
418

419
420
421
422

423
424
425


426
427
428
429
430
431
432




433
434
435

436
437

438
439
440

441
442
443

444
445
446
447

448
449
450
451
452
453

454
455
456

457
458
459
460

461
462

463
464
465
466


467
468
469
470

471
472

473
474
475


476
477
478


479
480

481
482
483

484
485
486

487
488
489

490
491
492

493
494
495

496
497
498

499
500
501

502
503
504

505
506
507
508
509

510
511
512
513
514




515
516
517
518
519
520
521
522
523
524
525
526
527
528
529

530
531
532
533
534
535
536
537
538

539

540
541
542
543
544
545
546
547

548
549
550
551
552
553
554
555

556
557
558
559
560
561


562
563

564
565
566
567
568
569
570
571
572

573
574
575
576
577
578
579


580
581
582
583


584
585
586

587
588

589
590
591
592
593
594

595
596
597
598

599
600

601
602
603

604
605
606
607

608
609
610
611
612
613
614
315
316
317
318
319
320
321

322
323
324


325
326
327
328
329
330
331
332
333
334
335

336


337


338

339
340
341
342
343
344
345
346
347

348
349







350
351
352
353
354


355


356



357



358



359
360
361


362
363







364
365
366
367
368


369


370



371



372



373
374
375
376
377
378
379

380

381

382


383

384


385

386


387
388
389
390
391

392
393

394



395
396
397


398
399
400

401
402
403

404
405
406

407
408
409

410
411
412

413
414
415

416
417
418

419
420
421

422
423
424

425
426



427
428
429




430
431
432
433

434
435
436
437
438
439
440
441
442
443
444
445
446

447
448
449
450
451
452
453
454
455
456
457

458
459
460
461
462



463
464
465
466
467
468
469
470


471
472





473
474
475

476
477
478

479




480
481
482
483
484
485
486


487
488




489
490



491


492
493
494

495
496

497




498


499

500

501




502


503
504
505
506
507







-
+


-
-
+
+









-
+
-
-
+
-
-
+
-









-
+

-
-
-
-
-
-
-
+
+
+
+

-
-
+
-
-
+
-
-
-
+
-
-
-
+
-
-
-

+

-
-
+
+
-
-
-
-
-
-
-
+
+
+
+

-
-
+
-
-
+
-
-
-
+
-
-
-
+
-
-
-

+





-
+
-

-
+
-
-

-
+
-
-
+
-

-
-
+
+



-
+

-
+
-
-
-
+
+

-
-
+
+

-
+


-
+


-
+


-
+


-
+


-
+


-
+


-
+


-
+

-
-
-

+

-
-
-
-
+
+
+
+
-













-
+









+
-
+




-
-
-

+






-
-
+

-
-
-
-
-
+
+

-
+


-

-
-
-
-

+





-
-
+
+
-
-
-
-
+
+
-
-
-
+
-
-
+


-


-
+
-
-
-
-
+
-
-
+
-

-
+
-
-
-
-
+
-
-





	} else if (X509_check_purpose(cert, X509_PURPOSE_OCSP_HELPER, 0) > 0) {
	    purpose = "OCSP Helper";
	} else if (X509_check_purpose(cert, X509_PURPOSE_TIMESTAMP_SIGN, 0) > 0) {
	    purpose = "Timestamp Signing";
	} else {
	    purpose = "";
	}
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(purpose, -1));
	LAPPEND_STR(interp, certPtr, "purpose", purpose, -1);
    }

    {
	Tcl_Obj *purpPtr = Tcl_NewListObj(0, NULL);
    /* Get purposes */
    listPtr = Tcl_NewListObj(0, NULL);
	for (int j = 0; j < X509_PURPOSE_get_count(); j++) {
	    X509_PURPOSE *ptmp = X509_PURPOSE_get0(j);
	    Tcl_Obj *tmpPtr = Tcl_NewListObj(0, NULL);

	    for (int i = 0; i < 2; i++) {
		int idret = X509_check_purpose(cert, X509_PURPOSE_get_id(ptmp), i);
		Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj(i ? "CA" : "nonCA", -1));
		Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj(idret == 1 ? "Yes" : "No", -1));
	    }
	    Tcl_ListObjAppendElement(interp, purpPtr, Tcl_NewStringObj(X509_PURPOSE_get0_name(ptmp), -1));
	LAPPEND_LIST(interp, listPtr, X509_PURPOSE_get0_name(ptmp), tmpPtr);
	    Tcl_ListObjAppendElement(interp, purpPtr, tmpPtr);
	}
    }
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("certificatePurpose", -1));
	Tcl_ListObjAppendElement(interp, certPtr, purpPtr);
    LAPPEND_LIST(interp, certPtr, "certificatePurpose", listPtr);
    }

    /* Certificate Policies - indicates the issuing CA considers its issuerDomainPolicy
	equivalent to the subject CA's subjectDomainPolicy. RFC 5280 section 4.2.1.4, NID_certificate_policies */
    if (xflags & EXFLAG_INVALID_POLICY) {
	/* Reject cert */
    }

    /* Policy Mappings - RFC 5280 section 4.2.1.5, NID_policy_mappings */

    /* Subject Alternative Name (SAN) contains additional URLs, DNS name, or IP
    /* Subject Alternative Name (SAN) contains additional URLs, DNS names, or IP
	addresses bound to certificate. RFC 5280 section 4.2.1.6, NID_subject_alt_name */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("subjectAltName", -1));
    san = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
    if (san) {
	Tcl_Obj *namesPtr = Tcl_NewListObj(0, NULL);

	for (int i=0; i < sk_GENERAL_NAME_num(san); i++) {
	    const GENERAL_NAME *name = sk_GENERAL_NAME_value(san, i);
    listPtr = Tcl_NewListObj(0, NULL);
    if (names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL)) {
	for (int i=0; i < sk_GENERAL_NAME_num(names); i++) {
	    const GENERAL_NAME *name = sk_GENERAL_NAME_value(names, i);

	    if (name && bio) {
		if (GENERAL_NAME_print(bio, name)) {
	    len = BIO_to_Buffer(name && GENERAL_NAME_print(bio, name), bio, buffer, BUFSIZ);
		    int n = BIO_read(bio, buffer, min(BIO_pending(bio), BUFSIZ));
		    buffer[max(n, 0)] = 0;
	    LAPPEND_STR(interp, listPtr, NULL, buffer, len);
		    (void)BIO_flush(bio);
		    Tcl_ListObjAppendElement(interp, namesPtr, Tcl_NewStringObj(buffer, n));
		}
	}
	    }
	}
	sk_GENERAL_NAME_pop_free(san, GENERAL_NAME_free);
	sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
	Tcl_ListObjAppendElement(interp, certPtr, namesPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_LIST(interp, certPtr, "subjectAltName", listPtr);

    /* Issuer Alternative Name (issuerAltName) is used to associate Internet
	style identities with the certificate issuer. RFC 5280 section 4.2.1.7, NID_issuer_alt_name */
    /* Issuer Alternative Name is used to associate Internet style identities
	with the certificate issuer. RFC 5280 section 4.2.1.7, NID_issuer_alt_name */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("issuerAltName", -1));
    san = X509_get_ext_d2i(cert, NID_issuer_alt_name, NULL, NULL);
    if (san) {
	Tcl_Obj *namesPtr = Tcl_NewListObj(0, NULL);

	for (int i=0; i < sk_GENERAL_NAME_num(san); i++) {
	    const GENERAL_NAME *name = sk_GENERAL_NAME_value(san, i);
    listPtr = Tcl_NewListObj(0, NULL);
    if (names = X509_get_ext_d2i(cert, NID_issuer_alt_name, NULL, NULL)) {
	for (int i=0; i < sk_GENERAL_NAME_num(names); i++) {
	    const GENERAL_NAME *name = sk_GENERAL_NAME_value(names, i);

	    if (name && bio) {
		if (GENERAL_NAME_print(bio, name)) {
	    len = BIO_to_Buffer(name && GENERAL_NAME_print(bio, name), bio, buffer, BUFSIZ);
		    int n = BIO_read(bio, buffer, min(BIO_pending(bio), BUFSIZ));
		    buffer[max(n, 0)] = 0;
	    LAPPEND_STR(interp, listPtr, NULL, buffer, len);
		    (void)BIO_flush(bio);
		    Tcl_ListObjAppendElement(interp, namesPtr, Tcl_NewStringObj(buffer, n));
		}
	}
	    }
	}
	sk_GENERAL_NAME_pop_free(san, GENERAL_NAME_free);
	sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
	Tcl_ListObjAppendElement(interp, certPtr, namesPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_LIST(interp, certPtr, "issuerAltName", listPtr);

    /* Subject Directory Attributes provides identification attributes (e.g., nationality)
	of the subject. RFC 5280 section 4.2.1.8 (subjectDirectoryAttributes) */

    /* Basic Constraints identifies whether the subject of the cert is a CA and
	the max depth of valid cert paths that include this cert.
	the max depth of valid cert paths for this cert. RFC 5280 section 4.2.1.9, NID_basic_constraints */
	RFC 5280 section 4.2.1.9 (basicConstraints, NID_basic_constraints) */
    if (xflags & EXFLAG_BCONS) {
	long len2 = X509_get_pathlen(cert);
	LAPPEND_LONG(interp, certPtr, "pathLen", X509_get_pathlen(cert));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("pathLen", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewLongObj(len2));
    }
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("basicConstraintsCA", -1));
    LAPPEND_BOOL(interp, certPtr, "basicConstraintsCA", xflags & EXFLAG_CA);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewBooleanObj(xflags & EXFLAG_CA));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("basicConstraintsCritical", -1));
    LAPPEND_BOOL(interp, certPtr, "basicConstraintsCritical", xflags & EXFLAG_CRITICAL);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewBooleanObj(xflags & EXFLAG_CRITICAL));

    /* Name Constraints is only used in CA certs to indicate a name space within
	which all subject names in subsequent certificates in a certification path
    /* Name Constraints is only used in CA certs to indicate the name space for
	all subject names in subsequent certificates in a certification path
	MUST be located. RFC 5280 section 4.2.1.10, NID_name_constraints */

    /* Policy Constraints is only used in CA certs to limit the length of a
	cert chain that may be issued from that CA. RFC 5280 section 4.2.1.11, NID_policy_constraints */
	cert chain for that CA. RFC 5280 section 4.2.1.11, NID_policy_constraints */

    /* Extended Key Usage indicates one or more purposes for which the certified
    /* Extended Key Usage indicates the purposes the certified public key may be
	public key may be used, in addition to or in place of the basic purposes.
	RFC 5280 section 4.2.1.12, NID_ext_key_usage */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("extendedKeyUsage", -1));
	used, beyond the basic purposes. RFC 5280 section 4.2.1.12, NID_ext_key_usage */
    listPtr = Tcl_NewListObj(0, NULL);
    if (xflags & EXFLAG_XKUSAGE) {
    usage = X509_get_extended_key_usage(cert);
	Tcl_Obj *tmpPtr = Tcl_NewListObj(0, NULL);
	usage = X509_get_extended_key_usage(cert);

	if (usage & XKU_SSL_SERVER) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("TLS Web Server Authentication", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("TLS Web Server Authentication", -1));
	}
	if (usage & XKU_SSL_CLIENT) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("TLS Web Client Authentication", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("TLS Web Client Authentication", -1));
	}
	if (usage & XKU_SMIME) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("E-mail Protection", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("E-mail Protection", -1));
	}
	if (usage & XKU_CODE_SIGN) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Code Signing", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Code Signing", -1));
	}
	if (usage & XKU_SGC) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("SGC", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("SGC", -1));
	}
	if (usage & XKU_OCSP_SIGN) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("OCSP Signing", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("OCSP Signing", -1));
	}
	if (usage & XKU_TIMESTAMP) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Time Stamping", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Time Stamping", -1));
	}
	if (usage & XKU_DVCS ) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("DVCS", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("DVCS", -1));
	}
	if (usage & XKU_ANYEKU) {
	    Tcl_ListObjAppendElement(interp, tmpPtr, Tcl_NewStringObj("Any Extended Key Usage", -1));
	    Tcl_ListObjAppendElement(interp, listPtr, Tcl_NewStringObj("Any Extended Key Usage", -1));
	}
	Tcl_ListObjAppendElement(interp, certPtr, tmpPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_LIST(interp, certPtr, "extendedKeyUsage", listPtr);

    /* CRL Distribution Points extension identifies how CRL information is
	obtained. RFC 5280 section 4.2.1.13*/
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("crlDistributionPoints", -1));
    crl = X509_get_ext_d2i(cert, NID_crl_distribution_points, NULL, NULL);
    /* CRL Distribution Points identifies where CRL information can be obtained.
	RFC 5280 section 4.2.1.13*/
    listPtr = Tcl_NewListObj(0, NULL);
    if (crl = X509_get_ext_d2i(cert, NID_crl_distribution_points, NULL, NULL)) {
    if (crl) {
	Tcl_Obj *namesPtr = Tcl_NewListObj(0, NULL);

	for (int i=0; i < sk_DIST_POINT_num(crl); i++) {
	    DIST_POINT *dp = sk_DIST_POINT_value(crl, i);
	    DIST_POINT_NAME *distpoint = dp->distpoint;

	    if (distpoint->type == 0) {
		/* fullname GENERALIZEDNAME */
		for (int j = 0; j < sk_GENERAL_NAME_num(distpoint->name.fullname); j++) {
		    GENERAL_NAME *gen = sk_GENERAL_NAME_value(distpoint->name.fullname, j);
		    int type;
		    ASN1_STRING *uri = GENERAL_NAME_get0_value(gen, &type);
		    if (type == GEN_URI) {
			Tcl_ListObjAppendElement(interp, namesPtr,
			Tcl_ListObjAppendElement(interp, listPtr,
			    Tcl_NewStringObj((char*)ASN1_STRING_get0_data(uri), ASN1_STRING_length(uri)));
		    }
		}
	    } else if (distpoint->type == 1) {
		/* relativename X509NAME */
		STACK_OF(X509_NAME_ENTRY) *sk_relname = distpoint->name.relativename;
		for (int j = 0; j < sk_X509_NAME_ENTRY_num(sk_relname); j++) {
		    X509_NAME_ENTRY *e = sk_X509_NAME_ENTRY_value(sk_relname, j);
		    ASN1_STRING *d = X509_NAME_ENTRY_get_data(e);
		    Tcl_ListObjAppendElement(interp, listPtr,
		    Tcl_ListObjAppendElement(interp, namesPtr, Tcl_NewStringObj((char*)ASN1_STRING_data(d), ASN1_STRING_length(d)));
			Tcl_NewStringObj((char*)ASN1_STRING_data(d), ASN1_STRING_length(d)));
		}
	    }
	}
	CRL_DIST_POINTS_free(crl);
	Tcl_ListObjAppendElement(interp, certPtr, namesPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_LIST(interp, certPtr, "crlDistributionPoints", listPtr);

    /* Freshest CRL extension */
    if (xflags & EXFLAG_FRESHEST) {
    }

    /* Authority Information Access indicates how to access info and services
	for the certificate issuer. THis includes on-line validation services
	and CA policy data. RFC 5280 section 4.2.2.1, NID_info_access */
	for the certificate issuer. RFC 5280 section 4.2.2.1, NID_info_access */
    /* Get On-line Certificate Status Protocol (OSCP) URL */
    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("ocsp", -1));
    ocsp = X509_get1_ocsp(cert);
    if (ocsp) {
	Tcl_Obj *urlsPtr = Tcl_NewListObj(0, NULL);

    listPtr = Tcl_NewListObj(0, NULL);
    if (ocsp = X509_get1_ocsp(cert)) {
	for (int i = 0; i < sk_OPENSSL_STRING_num(ocsp); i++) {
	    Tcl_ListObjAppendElement(interp, urlsPtr,
	    Tcl_ListObjAppendElement(interp, listPtr,
		Tcl_NewStringObj(sk_OPENSSL_STRING_value(ocsp, i), -1));
	}

	X509_email_free(ocsp);
	/* sk_OPENSSL_STRING_free(ocsp); */
	Tcl_ListObjAppendElement(interp, certPtr, urlsPtr);
    } else {
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("", -1));
    }
    LAPPEND_LIST(interp, certPtr, "ocsp", listPtr);

    /* CA Issuers URL caIssuers */

    /* Subject Information Access - RFC 5280 section 4.2.2.2, NID_sinfo_access */

    /* Certificate Alias as UTF-8 string. If uses a PKCS#12 structure, alias
	will reflect the friendlyName attribute (RFC 2985). */
    /* Certificate Alias. If uses a PKCS#12 structure, alias will reflect the
	friendlyName attribute (RFC 2985). */
    {
	unsigned char *bstring;
	len = 0;
	bstring = X509_alias_get0(cert, &len);
    len = 0;
    LAPPEND_STR(interp, certPtr, "alias", X509_alias_get0(cert, &len), len);
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("alias", -1));
	Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj((char *)bstring, len));
    }


    /* All data */
    /* Certificate and dump all data */
    {
	char certStr[CERT_STR_SIZE];
	len = 0;

	/* Get certificate */
	if (PEM_write_bio_X509(bio, cert)) {
	len = BIO_to_Buffer(PEM_write_bio_X509(bio, cert), bio, certStr, CERT_STR_SIZE);
	    len = BIO_read(bio, certStr, min(BIO_pending(bio), CERT_STR_SIZE));
	    (void)BIO_flush(bio);
	    if (len < 0) {len = 0;}
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("certificate", -1));
	LAPPEND_STR(interp, certPtr, "certificate", certStr, len);
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(certStr, len));
	}


	/* Get all cert info */
	if (X509_print_ex(bio, cert, flags, 0)) {
	len = BIO_to_Buffer(X509_print_ex(bio, cert, flags, 0), bio, certStr, CERT_STR_SIZE);
	    len = BIO_read(bio, certStr, min(BIO_pending(bio), CERT_STR_SIZE));
	    (void)BIO_flush(bio);
	    if (len < 0) {len = 0;}
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj("all", -1));
	LAPPEND_STR(interp, certPtr, "all", certStr, len);
	    Tcl_ListObjAppendElement(interp, certPtr, Tcl_NewStringObj(certStr, len));
	}
    }

    BIO_free(bio);
    return certPtr;
}