Qt
Internal/Contributor docs for the Qt SDK. <b>Note:</b> These are NOT official API docs; those are found <a href='https://doc.qt.io/'>here</a>.
Loading...
Searching...
No Matches
QSslCertificate Class Reference

The QSslCertificate class provides a convenient API for an X509 certificate. More...

#include <qsslcertificate.h>

+ Collaboration diagram for QSslCertificate:

Public Types

enum  SubjectInfo {
  Organization , CommonName , LocalityName , OrganizationalUnitName ,
  CountryName , StateOrProvinceName , DistinguishedNameQualifier , SerialNumber ,
  EmailAddress
}
 Describes keys that you can pass to QSslCertificate::issuerInfo() or QSslCertificate::subjectInfo() to get information about the certificate issuer or subject. More...
 
enum class  PatternSyntax { RegularExpression , Wildcard , FixedString }
 

Public Member Functions

 QSslCertificate (QIODevice *device, QSsl::EncodingFormat format=QSsl::Pem)
 Constructs a QSslCertificate by reading format encoded data from device and using the first certificate found.
 
 QSslCertificate (const QByteArray &data=QByteArray(), QSsl::EncodingFormat format=QSsl::Pem)
 Constructs a QSslCertificate by parsing the format encoded data and using the first available certificate found.
 
 QSslCertificate (const QSslCertificate &other)
 Constructs an identical copy of other.
 
 ~QSslCertificate ()
 Destroys the QSslCertificate.
 
QSslCertificateoperator= (QSslCertificate &&other) noexcept
 
QSslCertificateoperator= (const QSslCertificate &other)
 Copies the contents of other into this certificate, making the two certificates identical.
 
void swap (QSslCertificate &other) noexcept
 
bool operator== (const QSslCertificate &other) const
 Returns true if this certificate is the same as other; otherwise returns false.
 
bool operator!= (const QSslCertificate &other) const
 Returns true if this certificate is not the same as other; otherwise returns false.
 
bool isNull () const
 Returns true if this is a null certificate (i.e., a certificate with no contents); otherwise returns false.
 
bool isBlacklisted () const
 Returns true if this certificate is blacklisted; otherwise returns false.
 
bool isSelfSigned () const
 
void clear ()
 Clears the contents of this certificate, making it a null certificate.
 
QByteArray version () const
 Returns the certificate's version string.
 
QByteArray serialNumber () const
 Returns the certificate's serial number string in hexadecimal format.
 
QByteArray digest (QCryptographicHash::Algorithm algorithm=QCryptographicHash::Md5) const
 Returns a cryptographic digest of this certificate.
 
QStringList issuerInfo (SubjectInfo info) const
 Returns the issuer information for the subject from the certificate, or an empty list if there is no information for subject in the certificate.
 
QStringList issuerInfo (const QByteArray &attribute) const
 Returns the issuer information for attribute from the certificate, or an empty list if there is no information for attribute in the certificate.
 
QStringList subjectInfo (SubjectInfo info) const
 Returns the information for the subject, or an empty list if there is no information for subject in the certificate.
 
QStringList subjectInfo (const QByteArray &attribute) const
 Returns the subject information for attribute, or an empty list if there is no information for attribute in the certificate.
 
QString issuerDisplayName () const
 
QString subjectDisplayName () const
 
QList< QByteArraysubjectInfoAttributes () const
 
QList< QByteArrayissuerInfoAttributes () const
 
QMultiMap< QSsl::AlternativeNameEntryType, QStringsubjectAlternativeNames () const
 Returns the list of alternative subject names for this certificate.
 
QDateTime effectiveDate () const
 Returns the date-time that the certificate becomes valid, or an empty QDateTime if this is a null certificate.
 
QDateTime expiryDate () const
 Returns the date-time that the certificate expires, or an empty QDateTime if this is a null certificate.
 
QSslKey publicKey () const
 Returns the certificate subject's public key.
 
QList< QSslCertificateExtensionextensions () const
 Returns a list containing the X509 extensions of this certificate.
 
QByteArray toPem () const
 Returns this certificate converted to a PEM (Base64) encoded representation.
 
QByteArray toDer () const
 Returns this certificate converted to a DER (binary) encoded representation.
 
QString toText () const
 Returns this certificate converted to a human-readable text representation.
 
Qt::HANDLE handle () const
 Returns a pointer to the native certificate handle, if there is one, else \nullptr.
 

Static Public Member Functions

static QList< QSslCertificatefromPath (const QString &path, QSsl::EncodingFormat format=QSsl::Pem, PatternSyntax syntax=PatternSyntax::FixedString)
 
static QList< QSslCertificatefromDevice (QIODevice *device, QSsl::EncodingFormat format=QSsl::Pem)
 Searches for and parses all certificates in device that are encoded in the specified format and returns them in a list of certificates.
 
static QList< QSslCertificatefromData (const QByteArray &data, QSsl::EncodingFormat format=QSsl::Pem)
 Searches for and parses all certificates in data that are encoded in the specified format and returns them in a list of certificates.
 
static QList< QSslErrorverify (const QList< QSslCertificate > &certificateChain, const QString &hostName=QString())
 Verifies a certificate chain.
 
static bool importPkcs12 (QIODevice *device, QSslKey *key, QSslCertificate *cert, QList< QSslCertificate > *caCertificates=nullptr, const QByteArray &passPhrase=QByteArray())
 

Friends

class QTlsBackend
 
Q_NETWORK_EXPORT size_t qHash (const QSslCertificate &key, size_t seed) noexcept
 

Detailed Description

The QSslCertificate class provides a convenient API for an X509 certificate.

Since
4.3

\reentrant

\inmodule QtNetwork

QSslCertificate stores an X509 certificate, and is commonly used to verify the identity and store information about the local host, a remotely connected peer, or a trusted third party Certificate Authority.

There are many ways to construct a QSslCertificate. The most common way is to call QSslSocket::peerCertificate(), which returns a QSslCertificate object, or QSslSocket::peerCertificateChain(), which returns a list of them. You can also load certificates from a DER (binary) or PEM (Base64) encoded bundle, typically stored as one or more local files, or in a Qt Resource.

You can call isNull() to check if your certificate is null. By default, QSslCertificate constructs a null certificate. A null certificate is invalid, but an invalid certificate is not necessarily null. If you want to reset all contents in a certificate, call clear().

After loading a certificate, you can find information about the certificate, its subject, and its issuer, by calling one of the many accessor functions, including version(), serialNumber(), issuerInfo() and subjectInfo(). You can call effectiveDate() and expiryDate() to check when the certificate starts being effective and when it expires. The publicKey() function returns the certificate subject's public key as a QSslKey. You can call issuerInfo() or subjectInfo() to get detailed information about the certificate issuer and its subject.

Internally, QSslCertificate is stored as an X509 structure. You can access this handle by calling handle(), but the results are likely to not be portable.

See also
QSslSocket, QSslKey, QSslCipher, QSslError

Definition at line 34 of file qsslcertificate.h.

Member Enumeration Documentation

◆ PatternSyntax

enum class QSslCertificate::PatternSyntax
strong
Since
5.15

The syntax used to interpret the meaning of the pattern.

\value RegularExpression A rich Perl-like pattern matching syntax.

\value Wildcard This provides a simple pattern matching syntax similar to that used by shells (command interpreters) for "file globbing". See \l {QRegularExpression::fromWildcard()}.

\value FixedString The pattern is a fixed string. This is equivalent to using the RegularExpression pattern on a string in which all metacharacters are escaped using escape(). This is the default.

Enumerator
RegularExpression 
Wildcard 
FixedString 

Definition at line 49 of file qsslcertificate.h.

◆ SubjectInfo

Describes keys that you can pass to QSslCertificate::issuerInfo() or QSslCertificate::subjectInfo() to get information about the certificate issuer or subject.

\value Organization "O" The name of the organization.

\value CommonName "CN" The common name; most often this is used to store the host name.

\value LocalityName "L" The locality.

\value OrganizationalUnitName "OU" The organizational unit name.

\value CountryName "C" The country.

\value StateOrProvinceName "ST" The state or province.

\value DistinguishedNameQualifier The distinguished name qualifier

\value SerialNumber The certificate's serial number

\value EmailAddress The email address associated with the certificate

Enumerator
Organization 
CommonName 
LocalityName 
OrganizationalUnitName 
CountryName 
StateOrProvinceName 
DistinguishedNameQualifier 
SerialNumber 
EmailAddress 

Definition at line 37 of file qsslcertificate.h.

Constructor & Destructor Documentation

◆ QSslCertificate() [1/3]

QSslCertificate::QSslCertificate ( QIODevice * device,
QSsl::EncodingFormat format = QSsl::Pem )
explicit

Constructs a QSslCertificate by reading format encoded data from device and using the first certificate found.

You can later call isNull() to see if device contained a certificate, and if this certificate was loaded successfully.

Definition at line 143 of file qsslcertificate.cpp.

References QTlsBackend::activeOrAnyBackend(), certs, device, QSsl::Pem, and qCWarning.

+ Here is the call graph for this function:

◆ QSslCertificate() [2/3]

QSslCertificate::QSslCertificate ( const QByteArray & data = QByteArray(),
QSsl::EncodingFormat format = QSsl::Pem )
explicit

Constructs a QSslCertificate by parsing the format encoded data and using the first available certificate found.

You can later call isNull() to see if data contained a certificate, and if this certificate was loaded successfully.

Definition at line 173 of file qsslcertificate.cpp.

References QTlsBackend::activeOrAnyBackend(), certs, QSsl::Pem, and qCWarning.

+ Here is the call graph for this function:

◆ QSslCertificate() [3/3]

QSslCertificate::QSslCertificate ( const QSslCertificate & other)

Constructs an identical copy of other.

Definition at line 197 of file qsslcertificate.cpp.

◆ ~QSslCertificate()

QSslCertificate::~QSslCertificate ( )

Destroys the QSslCertificate.

Definition at line 204 of file qsslcertificate.cpp.

Member Function Documentation

◆ clear()

void QSslCertificate::clear ( )

Clears the contents of this certificate, making it a null certificate.

See also
isNull()

Definition at line 307 of file qsslcertificate.cpp.

References isNull().

Referenced by QSslSocketPrivate::createPlainSocket(), and QSslSocketPrivate::init().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ digest()

QByteArray QSslCertificate::digest ( QCryptographicHash::Algorithm algorithm = QCryptographicHash::Md5) const

Returns a cryptographic digest of this certificate.

By default, an MD5 digest will be generated, but you can also specify a custom algorithm.

Definition at line 344 of file qsslcertificate.cpp.

References QCryptographicHash::hash(), and toDer().

Referenced by operator<<().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ effectiveDate()

QDateTime QSslCertificate::effectiveDate ( ) const

Returns the date-time that the certificate becomes valid, or an empty QDateTime if this is a null certificate.

See also
expiryDate()

Definition at line 489 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by operator<<().

+ Here is the caller graph for this function:

◆ expiryDate()

QDateTime QSslCertificate::expiryDate ( ) const

Returns the date-time that the certificate expires, or an empty QDateTime if this is a null certificate.

See also
effectiveDate()

Definition at line 505 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by operator<<().

+ Here is the caller graph for this function:

◆ extensions()

QList< QSslCertificateExtension > QSslCertificate::extensions ( ) const

Returns a list containing the X509 extensions of this certificate.

Since
5.0

Definition at line 555 of file qsslcertificate.cpp.

References QSslCertificatePrivate::extensions().

+ Here is the call graph for this function:

◆ fromData()

QList< QSslCertificate > QSslCertificate::fromData ( const QByteArray & data,
QSsl::EncodingFormat format = QSsl::Pem )
static

Searches for and parses all certificates in data that are encoded in the specified format and returns them in a list of certificates.

See also
fromDevice()

Definition at line 731 of file qsslcertificate.cpp.

References QTlsBackend::activeOrAnyBackend(), QSsl::Pem, and qCWarning.

Referenced by fromDevice(), fromPath(), and QTlsPrivate::systemCaCertificates().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ fromDevice()

QList< QSslCertificate > QSslCertificate::fromDevice ( QIODevice * device,
QSsl::EncodingFormat format = QSsl::Pem )
static

Searches for and parses all certificates in device that are encoded in the specified format and returns them in a list of certificates.

See also
fromData()

Definition at line 715 of file qsslcertificate.cpp.

References device, fromData(), and qCWarning.

+ Here is the call graph for this function:

◆ fromPath()

QList< QSslCertificate > QSslCertificate::fromPath ( const QString & path,
QSsl::EncodingFormat format = QSsl::Pem,
PatternSyntax syntax = PatternSyntax::FixedString )
static
Since
5.15

Searches all files in the path for certificates encoded in the specified format and returns them in a list. path must be a file or a pattern matching one or more files, as specified by syntax.

Example:

const auto certs = QSslCertificate::fromPath("C:/ssl/certificate.*.pem",
for (const QSslCertificate &cert : certs) {
}
The QSslCertificate class provides a convenient API for an X509 certificate.
@ Pem
Definition qssl.h:29
const auto certs
[1]
See also
fromData()

Definition at line 617 of file qsslcertificate.cpp.

References QRegularExpression::anchoredPattern(), certs, file, QDir::Files, fromData(), QDir::fromNativeSeparators(), QString::indexOf(), QString::lastIndexOf(), QStringView::left(), QFile::open(), QSsl::Pem, pos, qWarning, QIODevice::readAll(), QIODeviceBase::ReadOnly, RegularExpression, QString::remove(), QIODeviceBase::Text, QRegularExpression::UnanchoredWildcardConversion, Wildcard, and QRegularExpression::wildcardToRegularExpression().

Referenced by QSslConfiguration::addCaCertificates(), and QTlsPrivate::systemCaCertificates().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ handle()

Qt::HANDLE QSslCertificate::handle ( ) const

Returns a pointer to the native certificate handle, if there is one, else \nullptr.

You can use this handle, together with the native API, to access extended information about the certificate.

Warning
Use of this function has a high probability of being non-portable, and its return value may vary from platform to platform or change from minor release to minor release.

Definition at line 525 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ importPkcs12()

bool QSslCertificate::importPkcs12 ( QIODevice * device,
QSslKey * key,
QSslCertificate * certificate,
QList< QSslCertificate > * caCertificates = nullptr,
const QByteArray & passPhrase = QByteArray() )
static
Since
5.4

Imports a PKCS#12 (pfx) file from the specified device. A PKCS#12 file is a bundle that can contain a number of certificates and keys. This method reads a single key, its certificate and any associated caCertificates from the bundle. If a passPhrase is specified then this will be used to decrypt the bundle. Returns true if the PKCS#12 file was successfully loaded.

Note
The device must be open and ready to be read from.

Definition at line 790 of file qsslcertificate.cpp.

References QTlsBackend::activeOrAnyBackend(), device, and qCWarning.

+ Here is the call graph for this function:

◆ isBlacklisted()

bool QSslCertificate::isBlacklisted ( ) const

Returns true if this certificate is blacklisted; otherwise returns false.

See also
isNull()

Definition at line 278 of file qsslcertificate.cpp.

References QSslCertificatePrivate::isBlacklisted().

+ Here is the call graph for this function:

◆ isNull()

bool QSslCertificate::isNull ( ) const

Returns true if this is a null certificate (i.e., a certificate with no contents); otherwise returns false.

By default, QSslCertificate constructs a null certificate.

See also
clear()

Definition at line 264 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by clear(), QSslConfiguration::isNull(), operator==(), and QTlsPrivate::X509CertificateSchannel::QSslCertificate_from_CERT_CONTEXT().

+ Here is the caller graph for this function:

◆ isSelfSigned()

bool QSslCertificate::isSelfSigned ( ) const
Since
5.4

Returns true if this certificate is self signed; otherwise returns false.

A certificate is considered self-signed its issuer and subject are identical.

Definition at line 293 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ issuerDisplayName()

QString QSslCertificate::issuerDisplayName ( ) const
Since
5.12

Returns a name that describes the issuer. It returns the QSslCertificate::CommonName if available, otherwise falls back to the first QSslCertificate::Organization or the first QSslCertificate::OrganizationalUnitName.

See also
issuerInfo()

Definition at line 920 of file qsslcertificate.cpp.

References CommonName, issuerInfo(), Organization, and OrganizationalUnitName.

Referenced by operator<<().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ issuerInfo() [1/2]

QStringList QSslCertificate::issuerInfo ( const QByteArray & attribute) const

Returns the issuer information for attribute from the certificate, or an empty list if there is no information for attribute in the certificate.

There can be more than one entry for an attribute.

See also
subjectInfo()

Definition at line 376 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ issuerInfo() [2/2]

QStringList QSslCertificate::issuerInfo ( SubjectInfo subject) const

Returns the issuer information for the subject from the certificate, or an empty list if there is no information for subject in the certificate.

There can be more than one entry of each type.

See also
subjectInfo()

Definition at line 359 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend, and info.

Referenced by QSslCertificatePrivate::isBlacklisted(), and issuerDisplayName().

+ Here is the caller graph for this function:

◆ issuerInfoAttributes()

QList< QByteArray > QSslCertificate::issuerInfoAttributes ( ) const
Since
5.0 Returns a list of the attributes that have values in the issuer information of this certificate. The information associated with a given attribute can be accessed using the issuerInfo() method. Note that this list may include the OIDs for any elements that are not known by the SSL backend.
See also
subjectInfo()

Definition at line 450 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ operator!=()

bool QSslCertificate::operator!= ( const QSslCertificate & other) const
inline

Returns true if this certificate is not the same as other; otherwise returns false.

Definition at line 67 of file qsslcertificate.h.

References operator==(), and other().

+ Here is the call graph for this function:

◆ operator=() [1/2]

QSslCertificate & QSslCertificate::operator= ( const QSslCertificate & other)

Copies the contents of other into this certificate, making the two certificates identical.

Definition at line 212 of file qsslcertificate.cpp.

References other().

+ Here is the call graph for this function:

◆ operator=() [2/2]

QSslCertificate & QSslCertificate::operator= ( QSslCertificate && other)
inlinenoexcept

Definition at line 60 of file qsslcertificate.h.

References other(), and swap().

+ Here is the call graph for this function:

◆ operator==()

bool QSslCertificate::operator== ( const QSslCertificate & other) const

Returns true if this certificate is the same as other; otherwise returns false.

Definition at line 233 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend, isNull(), and other().

+ Here is the call graph for this function:

◆ publicKey()

QSslKey QSslCertificate::publicKey ( ) const

Returns the certificate subject's public key.

Definition at line 538 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend, and QTlsBackend::resetBackend().

+ Here is the call graph for this function:

◆ serialNumber()

QByteArray QSslCertificate::serialNumber ( ) const

Returns the certificate's serial number string in hexadecimal format.

Definition at line 331 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by QSslCertificatePrivate::isBlacklisted(), and operator<<().

+ Here is the caller graph for this function:

◆ subjectAlternativeNames()

QMultiMap< QSsl::AlternativeNameEntryType, QString > QSslCertificate::subjectAlternativeNames ( ) const

Returns the list of alternative subject names for this certificate.

The alternative names typically contain host names, optionally with wildcards, that are valid for this certificate.

These names are tested against the connected peer's host name, if either the subject information for \l CommonName doesn't define a valid host name, or the subject info name doesn't match the peer's host name.

See also
subjectInfo()

Definition at line 473 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by operator<<().

+ Here is the caller graph for this function:

◆ subjectDisplayName()

QString QSslCertificate::subjectDisplayName ( ) const
Since
5.12

Returns a name that describes the subject. It returns the QSslCertificate::CommonName if available, otherwise falls back to the first QSslCertificate::Organization or the first QSslCertificate::OrganizationalUnitName.

See also
subjectInfo()

Definition at line 945 of file qsslcertificate.cpp.

References CommonName, Organization, OrganizationalUnitName, and subjectInfo().

Referenced by operator<<().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ subjectInfo() [1/2]

QStringList QSslCertificate::subjectInfo ( const QByteArray & attribute) const

Returns the subject information for attribute, or an empty list if there is no information for attribute in the certificate.

There can be more than one entry for an attribute.

See also
issuerInfo()

Definition at line 410 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ subjectInfo() [2/2]

QStringList QSslCertificate::subjectInfo ( SubjectInfo subject) const

Returns the information for the subject, or an empty list if there is no information for subject in the certificate.

There can be more than one entry of each type.

See also
issuerInfo()

Definition at line 393 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend, and info.

Referenced by QSslCertificatePrivate::isBlacklisted(), and subjectDisplayName().

+ Here is the caller graph for this function:

◆ subjectInfoAttributes()

QList< QByteArray > QSslCertificate::subjectInfoAttributes ( ) const
Since
5.0 Returns a list of the attributes that have values in the subject information of this certificate. The information associated with a given attribute can be accessed using the subjectInfo() method. Note that this list may include the OIDs for any elements that are not known by the SSL backend.
See also
subjectInfo()

Definition at line 430 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ swap()

void QSslCertificate::swap ( QSslCertificate & other)
inlinenoexcept
Since
5.0

Swaps this certificate instance with other. This function is very fast and never fails.

Definition at line 63 of file qsslcertificate.h.

References d, and other().

+ Here is the call graph for this function:

◆ toDer()

QByteArray QSslCertificate::toDer ( ) const

Returns this certificate converted to a DER (binary) encoded representation.

Definition at line 580 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by digest(), and QWindowsCaRootFetcher::start().

+ Here is the caller graph for this function:

◆ toPem()

QByteArray QSslCertificate::toPem ( ) const

Returns this certificate converted to a PEM (Base64) encoded representation.

Definition at line 566 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ toText()

QString QSslCertificate::toText ( ) const

Returns this certificate converted to a human-readable text representation.

Since
5.0

Definition at line 596 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

◆ verify()

QList< QSslError > QSslCertificate::verify ( const QList< QSslCertificate > & certificateChain,
const QString & hostName = QString() )
static

Verifies a certificate chain.

The chain to be verified is passed in the certificateChain parameter. The first certificate in the list should be the leaf certificate of the chain to be verified. If hostName is specified then the certificate is also checked to see if it is valid for the specified host name.

Note that the root (CA) certificate should not be included in the list to be verified, this will be looked up automatically using the CA list specified in the default QSslConfiguration, and, in addition, if possible, CA certificates loaded on demand on Unix and Windows.

Since
5.0

Definition at line 763 of file qsslcertificate.cpp.

References QTlsBackend::activeOrAnyBackend(), and qCWarning.

+ Here is the call graph for this function:

◆ version()

QByteArray QSslCertificate::version ( ) const

Returns the certificate's version string.

Definition at line 318 of file qsslcertificate.cpp.

References QSslCertificatePrivate::backend.

Referenced by operator<<().

+ Here is the caller graph for this function:

Friends And Related Symbol Documentation

◆ qHash

Q_NETWORK_EXPORT size_t qHash ( const QSslCertificate & key,
size_t seed )
friend

◆ QTlsBackend

friend class QTlsBackend
friend

Definition at line 120 of file qsslcertificate.h.


The documentation for this class was generated from the following files: