nbdkit_peer_tls_dn3

Usage

 #include <nbdkit-plugin.h>
 char *nbdkit_peer_tls_dn (void);
 char *nbdkit_peer_tls_issuer_dn (void);

Overview

If all of these conditions are met:

then these APIs can be used to get the Distinguished Name (DN) of the certificate or the certificate's issuer. The issuer is the Certificate Authority (CA) that issued the client certificate.

The DN is returned as a string of the form "CN=xx,O=yy,[...]C=zz" (see RFC 4514 for the exact format).

If the DN is not available, "" is returned (this is not an error).

nbdkit-ip-filter(1) can be used to filter client connections by the DN.

 country = US
 state = New York
 locality = New York
 organization = BigCo
 cn = client.example.com
 tls_www_client
 encryption_key
 signing_key

 cn = BigCo
 ca
 cert_signing_key

 CN=client.example.com,O=BigCo,L=New York,ST=New York,C=US

 CN=BigCo

Return value

On success both of these functions return a TLS Distinguished Name as a string, or "". The caller must free this string.

If there is an error they call nbdkit_error(3) and return "NULL".

Language bindings

In nbdkit-ocaml-plugin(3):

 NBDKit.peer_tls_dn : unit -> string
 NBDKit.peer_tls_issuer_dn : unit -> string

In nbdkit-python-plugin(3):

 import nbdkit
 dn = nbdkit.peer_tls_dn()
 dn = nbdkit.peer_tls_issuer_dn()