X509 import

[sjaeckel]

Start implemeting X.509 APIs.

In #693 this was requested and I was already at it and now we have the first part: Parsing of an X.509 certificate and the cryptographic validation of such a certificate.

NB: This does not yet contain the logic that is required to determine whether a CA is eligible to sign a certificate etc.

Checklist

• documentation is added or updated
• tests are added or updated

[karel-m]

@sjaeckel Why was the CI pipeline with tests and builds not triggered after my last commit?

[karel-m]

I've just reviewed this PR and pushed a few commits. Two issues I’m still not happy with:

• We are not rejecting certificates that contain unrecognized critical extensions, as required by RFC 5280 section 4.2. I've just added a comment to code about this.
• It is a bit surprising that x509_free takes ltc_x509_certificate ** as its argument. Other _free functions take a single pointer (rsa_free, ecc_free, pka_key_free ...) so x509_free is currently the odd one out.

I also managed to break the CI tests somehow; however, it is too late tonight for me to fix that now.

[karel-m]

see my commits

[sjaeckel]

• We are not rejecting certificates that contain unrecognized critical extensions, as required by RFC 5280 section 4.2. I've just added a comment to code about this.

Good point!

• It is a bit surprising that x509_free takes ltc_x509_certificate ** as its argument. Other _free functions take a single pointer (rsa_free, ecc_free, pka_key_free ...) so x509_free is currently the odd one out.

Because I like the pattern more. I prefer to be on the safe side, see also the commit I just added which introduces the same pattern for s_free().

[sjaeckel]

While adding some of them as dummy I came to the conclusion: this is just parsing and not validation. Should we maybe track this as "yes, it's a valid topic, but not now"?

I've collected the following infos on the extensions you mentioned which are tracked outside RFC 5280:

1. No Revocation Available is CRITICALITY { FALSE }
2. OCSP No Check The RFC says: The CA does so by including the extension id-pkix-ocsp-nocheck. This SHOULD be a non-critical extension. The value of the extension SHALL be NULL.
3. Proxy Certificate Information is indeed critical
4. ac-auditEntity I couldn't find anything