CopperSpice API  1.7.2
QSslCertificate Class Reference

The QSslCertificate class provides a convenient API for an X509 certificate. More...

Public Types

enum  SubjectInfo
 

Public Methods

 QSslCertificate (const QByteArray &data=QByteArray (), QSsl::EncodingFormat format=QSsl::Pem)
 
 QSslCertificate (const QSslCertificate &other)
 
 QSslCertificate (QIODevice *device, QSsl::EncodingFormat format=QSsl::Pem)
 
 ~QSslCertificate ()
 
void clear ()
 
QByteArray digest (QCryptographicHash::Algorithm algorithm=QCryptographicHash::Md5) const
 
QDateTime effectiveDate () const
 
QDateTime expiryDate () const
 
QList< QSslCertificateExtensionextensions () const
 
Qt::HANDLE handle () const
 
bool isBlacklisted () const
 
bool isNull () const
 
bool isSelfSigned () const
 
QStringList issuerInfo (const QByteArray &attribute) const
 
QStringList issuerInfo (SubjectInfo info) const
 
QList< QByteArrayissuerInfoAttributes () const
 
bool operator!= (const QSslCertificate &other) const
 
QSslCertificate & operator= (const QSslCertificate &other)
 
QSslCertificate & operator= (QSslCertificate &&other)
 
bool operator== (const QSslCertificate &other) const
 
QSslKey publicKey () const
 
QByteArray serialNumber () const
 
QMultiMap< QSsl::AlternativeNameEntryType, QStringsubjectAlternativeNames () const
 
QStringList subjectInfo (const QByteArray &attribute) const
 
QStringList subjectInfo (SubjectInfo subject) const
 
QList< QByteArraysubjectInfoAttributes () const
 
void swap (QSslCertificate &other)
 
QByteArray toDer () const
 
QByteArray toPem () const
 
QString toText () const
 
QByteArray version () const
 

Static Public Methods

static QList< QSslCertificate > fromData (const QByteArray &data, QSsl::EncodingFormat format=QSsl::Pem)
 
static QList< QSslCertificate > fromDevice (QIODevice *device, QSsl::EncodingFormat format=QSsl::Pem)
 
static QList< QSslCertificate > fromPath (const QString &path, QSsl::EncodingFormat format=QSsl::Pem, QPatternOption syntax=QPatternOption::WildcardOption)
 
static bool importPkcs12 (QIODevice *device, QSslKey *key, QSslCertificate *certificate, QList< QSslCertificate > *caCertificates=nullptr, const QByteArray &passPhrase=QByteArray ())
 
static QList< QSslErrorverify (const QList< QSslCertificate > &certificateChain, const QString &hostName=QString ())
 

Detailed Description

The QSslCertificate class provides a convenient API for an X509 certificate.

QSslCertificate stores an X509 certificate, and is commonly used to verify the identity and store information about the local host, a remotely connected peer, or a trusted third party Certificate Authority.

There are many ways to construct a QSslCertificate. The most common way is to call QSslSocket::peerCertificate(), which returns a QSslCertificate object, or QSslSocket::peerCertificateChain(), which returns a list of them. You can also load certificates from a DER (binary) or PEM (Base64) encoded bundle, typically stored as one or more local files, or using the Resource System.

You can call isNull() to check if your certificate is null. By default, QSslCertificate constructs a null certificate. To check if the certificate is valid, call isValid(). A null certificate is invalid, but an invalid certificate is not necessarily null. If you want to reset all contents in a certificate, call clear().

After loading a certificate, you can find information about the certificate, its subject, and its issuer, by calling one of the many accessor functions, including version(), serialNumber(), issuerInfo() and subjectInfo(). You can call effectiveDate() and expiryDate() to check when the certificate starts being effective and when it expires. The publicKey() function returns the certificate subject's public key as a QSslKey. You can call issuerInfo() or subjectInfo() to get detailed information about the certificate issuer and its subject.

Internally, QSslCertificate is stored as an X509 structure. You can access this handle by calling handle(), but the results are likely to not be portable.

See also
QSslSocket, QSslKey, QSslCipher, QSslError

Member Enumeration Documentation

Describes keys that you can pass to QSslCertificate::issuerInfo() or QSslCertificate::subjectInfo() to get information about the certificate issuer or subject.

ConstantValueDescription
QSslCertificate::Organization0 "O" Name of the organization.
QSslCertificate::CommonName1 "CN" Common name, most often this is used to store the host name.
QSslCertificate::LocalityName2 "L" Locality.
QSslCertificate::OrganizationalUnitName3 "OU" Organizational unit name.
QSslCertificate::CountryName4 "C" Country.
QSslCertificate::StateOrProvinceName5 "ST" State or province.

Constructor & Destructor Documentation

QSslCertificate::QSslCertificate ( QIODevice device,
QSsl::EncodingFormat  format = QSsl::Pem 
)
explicit

Constructs a QSslCertificate by reading format encoded data from device and using the first certificate found. You can later call isNull() to see if device contained a certificate, and if this certificate was loaded successfully.

QSslCertificate::QSslCertificate ( const QByteArray data = QByteArray(),
QSsl::EncodingFormat  format = QSsl::Pem 
)
explicit

Constructs a QSslCertificate by parsing the format encoded data and using the first available certificate found. You can later call isNull() to see if data contained a certificate, and if this certificate was loaded successfully.

QSslCertificate::QSslCertificate ( const QSslCertificate &  other)

Constructs an identical copy of other.

QSslCertificate::~QSslCertificate ( )

Destroys the QSslCertificate.

Method Documentation

void QSslCertificate::clear ( )

Clears the contents of this certificate, making it a null certificate.

See also
isNull()
QByteArray QSslCertificate::digest ( QCryptographicHash::Algorithm  algorithm = QCryptographicHash::Md5) const

Returns a cryptographic digest of this certificate. By default an MD5 digest will be generated, however you can also specify a custom algorithm.

QDateTime QSslCertificate::effectiveDate ( ) const

Returns the date-time that the certificate becomes valid, or an empty QDateTime if this is a null certificate.

See also
expiryDate()
QDateTime QSslCertificate::expiryDate ( ) const

Returns the date-time that the certificate expires, or an empty QDateTime if this is a null certificate.

See also
effectiveDate()
QList< QSslCertificateExtension > QSslCertificate::extensions ( ) const

Returns a list containing the X509 extensions of this certificate.

QList< QSslCertificate > QSslCertificate::fromData ( const QByteArray data,
QSsl::EncodingFormat  format = QSsl::Pem 
)
static

Searches for and parses all certificates in data that are encoded in the specified format and returns them in a list of certificates.

See also
fromDevice()
QList< QSslCertificate > QSslCertificate::fromDevice ( QIODevice device,
QSsl::EncodingFormat  format = QSsl::Pem 
)
static

Searches for and parses all certificates in device that are encoded in the specified format and returns them in a list of certificates.

See also
fromData()
QList< QSslCertificate > QSslCertificate::fromPath ( const QString path,
QSsl::EncodingFormat  format = QSsl::Pem,
QPatternOption  syntax = QPatternOption::WildcardOption 
)
static

Searches all files in the path for certificates encoded in the specified format and returns them in a list. Path must be a file or a pattern matching one or more files, as specified by syntax.

for (const QSslCertificate &cert : QSslCertificate::fromPath("c:/ssl/certificate.*.pem", QSsl::Pem)) {
qDebug() << cert.issuerInfo(QSslCertificate::Organization);
}
See also
fromData()
Qt::HANDLE QSslCertificate::handle ( ) const

Returns a pointer to the native certificate handle, if there is one, or a null pointer otherwise. You can use this handle, together with the native API, to access extended information about the certificate.

Warning
Use of this method has a high probability of being non-portable, and its return value may vary from platform to platform or change from minor release to minor release.
bool QSslCertificate::importPkcs12 ( QIODevice device,
QSslKey key,
QSslCertificate *  certificate,
QList< QSslCertificate > *  caCertificates = nullptr,
const QByteArray passPhrase = QByteArray() 
)
static

Imports a PKCS#12 (pfx) file from the specified device. A PKCS#12 file is a bundle that can contain a number of certificates and keys. This method reads a single key, its certificate and any associated caCertificates from the bundle. If a passPhrase is specified then this will be used to decrypt the bundle. Returns true if the PKCS#12 file was successfully loaded.

Note: The device must be open and ready to be read from.

bool QSslCertificate::isBlacklisted ( ) const

Returns true if this certificate is blacklisted, otherwise returns false.

See also
isNull()
bool QSslCertificate::isNull ( ) const

Returns true if this is a null certificate (i.e., a certificate with no contents), otherwise returns false. By default QSslCertificate constructs a null certificate.

See also
isValid(), clear()
bool QSslCertificate::isSelfSigned ( ) const

Returns true if this certificate is self signed, otherwise returns false. A certificate is considered self-signed if the issuer and subject are identical.

QStringList QSslCertificate::issuerInfo ( const QByteArray attribute) const

Returns the issuer information for attribute from the certificate or an empty string if there is no information in the certificate.

See also
subjectInfo()
QStringList QSslCertificate::issuerInfo ( SubjectInfo  info) const

Returns the issuer information for the info from the certificate or an empty string if there is no information in the certificate.

See also
subjectInfo()
QList< QByteArray > QSslCertificate::issuerInfoAttributes ( ) const

Returns a list of the attributes that have values in the issuer information of this certificate. The information associated with a given attribute can be accessed using the issuerInfo() method. Note that this list may include the OIDs for any elements that are not known by the SSL backend.

See also
subjectInfo()
bool QSslCertificate::operator!= ( const QSslCertificate &  other) const
inline

Returns true if this certificate is not the same as other, otherwise returns false.

QSslCertificate & QSslCertificate::operator= ( const QSslCertificate &  other)

Copy assigns from other and returns a reference to this object

QSslCertificate & QSslCertificate::operator= ( QSslCertificate &&  other)
inline

Move assigns from other and returns a reference to this object.

bool QSslCertificate::operator== ( const QSslCertificate &  other) const

Returns true if this certificate is the same as other, otherwise returns false.

QSslKey QSslCertificate::publicKey ( ) const

Returns the certificate subject's public key.

QByteArray QSslCertificate::serialNumber ( ) const

Returns the certificate's serial number string in decimal format. In case the serial number can not be converted to decimal format (i.e. if it is bigger than 4294967295, which means it does not fit into 4 bytes), its hexadecimal version is returned.

QMultiMap< QSsl::AlternativeNameEntryType, QString > QSslCertificate::subjectAlternativeNames ( ) const

Returns the list of alternative subject names for this certificate. The alternative names typically contain host names, optionally with wildcards, that are valid for this certificate.

These names are tested against the connected peer's host name, if either the subject information for CommonName does not define a valid host name, or the subject info name does not match the peer's host name.

See also
subjectInfo()
QStringList QSslCertificate::subjectInfo ( const QByteArray attribute) const

Returns the subject information for attribute or an empty string if there is no information in the certificate.

See also
issuerInfo()
QStringList QSslCertificate::subjectInfo ( SubjectInfo  subject) const

Returns the information for the subject, or an empty string if there is no information for in the certificate.

See also
issuerInfo()
QList< QByteArray > QSslCertificate::subjectInfoAttributes ( ) const

Returns a list of the attributes that have values in the subject information of this certificate. The information associated with a given attribute can be accessed using the subjectInfo() method. Note that this list may include the OIDs for any elements that are not known by the SSL backend.

/sa subjectInfo()

void QSslCertificate::swap ( QSslCertificate &  other)
inline

Swaps other with this object. This operation is very fast and never fails.

QByteArray QSslCertificate::toDer ( ) const

Returns this certificate converted to a DER (binary) encoded representation.

QByteArray QSslCertificate::toPem ( ) const

Returns this certificate converted to a PEM (Base64) encoded representation.

QString QSslCertificate::toText ( ) const

Returns this certificate converted to a human-readable text representation.

QList< QSslError > QSslCertificate::verify ( const QList< QSslCertificate > &  certificateChain,
const QString hostName = QString() 
)
static

Verifies a certificate chain. The chain to be verified is passed in the certificateChain parameter. The first certificate in the list should be the leaf certificate of the chain to be verified. If hostName is specified then the certificate is also checked to see if it is valid for the specified host name.

Note that the root (CA) certificate should not be included in the list to be verified, this will be looked up automatically either using the CA list specified by QSslSocket::defaultCaCertificates() or if possible, it will be loaded on demand on Unix.

QByteArray QSslCertificate::version ( ) const

Returns the certificate's version string.