NAME

NAME_CONSTRAINTS_new, NAME_CONSTRAINTS_free, GENERAL_SUBTREE_new, GENERAL_SUBTREE_free — X.509 CA name constraints extension

SYNOPSIS

library “libcrypto”
#include <openssl/x509v3.h> NAME_CONSTRAINTS *
NAME_CONSTRAINTS_new(void); void
NAME_CONSTRAINTS_free(NAME_CONSTRAINTS *names); GENERAL_SUBTREE *
GENERAL_SUBTREE_new(void); void
GENERAL_SUBTREE_free(GENERAL_SUBTREE *name);

DESCRIPTION

X.509 CA certificates can use the name constraints extension to restrict the subject names of subsequent certificates in a certification path. NAME_CONSTRAINTS_new() allocates and initializes an empty NAME_CONSTRAINTS object, representing an ASN.1 NameConstraints structure defined in RFC 5280 section 4.2.1.10. It consists of two STACK_OF(GENERAL_SUBTREE) objects, one specifying permitted names, the other excluded names. NAME_CONSTRAINTS_free() frees names. GENERAL_SUBTREE_new() allocates and initializes an empty GENERAL_SUBTREE object, representing an ASN.1 GeneralSubtree structure defined in RFC 5280 section 4.2.1.10. It is a trivial wrapper around the GENERAL_NAME object documented in GENERAL_NAME_new(3). The standard requires the other fields of GENERAL_SUBTREE to be ignored. GENERAL_SUBTREE_free() frees name.

RETURN VALUES

NAME_CONSTRAINTS_new() and GENERAL_SUBTREE_new() return the new NAME_CONSTRAINTS or GENERAL_SUBTREE object, respectively, or NULL if an error occurs.

SEE ALSO

BASIC_CONSTRAINTS_new(3), GENERAL_NAMES_new(3), X509_EXTENSION_new(3), X509_new(3)

STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 4.2.1.10: Name Constraints

HISTORY

NAME_CONSTRAINTS_new(), NAME_CONSTRAINTS_free(), GENERAL_SUBTREE_new(), and GENERAL_SUBTREE_free() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5.