voltone
X509 - High-level APIs around certificates, CSRs and key pairs
Erlang/OTP’s :public_key application provides a set of high-level APIs for working with common PKI-related data structures. Under the hood, it supports many more data types, extracted at build time from various standard ASN.1 files. Combining those APIs and the underlying data types to perform common tasks can be a challenge.
The x509 package offers convenient Elixir APIs for:
- Generating RSA and EC private keys
- Deriving the public key from a given private key
- Wrapping and unwrapping keys (e.g. PKCS#8 containers)
- Creating ‘Relative Distinguished Names’ (e.g. Subject and Issuer names)
- Creating PKCS#10 CSRs
- Creating self-signed and issuer-signed RSA and ECDSA certificates with extensions, based on pre-defined or custom templates
- Exporting and importing entities in PEM and DER format
As a design decision, functions return standard :public_key data types rather than Elixir structs, so the results can be used directly in calls to Erlang/OTP and related libraries.
There is still some work to be done, in documentation and test coverage as well as functional enhancements, but I believe it is in good enough shape for others to start experimenting. Please note that the API may change until it hits 1.0.
Feedback is welcome, both here and as GitHub issues/PRs!
Most Liked
voltone
voltone
It’s been a while, it appears I have not been posting version announcements here, but I thought I’d let you know that v0.9.0 is now available.
Main feature is compatibility with OTP 28. Some of the internals of Erlang/OTP’s public_key applications were changed, requiring fixes in the package and in OTP itself. Erlang/OTP 28.0 is unfortunately not compatible with this package, but the OTP team recently released 28.0.1 that brought back any functionality that was lost.
Bottom line: if you’re on OTP 28, make sure you use 28.0.1 and use X509 v0.9.0. The package still works with older OTP versions, but this required compile-time conditionals to adapt to the version of public_key in use, so if you compile on OTP <28 your code will not run on OTP >=28 (and vice versa, but that is often the case anyway).
This version also brings support for EdDSA keys (ed25519 and ed448), including in certificates and CSRs.
Release notes are here and full docs are here.
Please note that the current plans for a 1.0 release call for the X509.Test.Suite and X509.Test.Server modules to be extracted into a separate package. Just a heads-up…
voltone
I just published v0.3.0, which paves the way for some API changes ahead of a 1.0 release. This version does not change any existing APIs, but does introduce new functions that adhere to the new API style. In the next release the return value of existing functions will be changed!
Please have a look at the release notes and start using the new API where possible, so as not to be affected by those upcoming changes.
Sorry for the inconvenience, I just want to make sure I have a clean, consistent and future-proof API in place by the time this hits 1.0.
voltone
Release v0.4.0 is now available. Please check the release notes for details on breaking changes! Hopefully the API will now be stable until v1.0.
This release includes some fixes for issues that might cause certificate chain verification errors for certificates issued from an intermediate CA, and for ECDSA certificates issued from any CA. Hat tip to @fhunleth and @mobileoverlord for those and other contributions.
Now working on CRL support for 0.5.0.
voltone
These modules are not meant for unit tests of the package itself, they are tools the package provides for building (automated or manual) test environments, similar to the (defunct?) badssl.com website.
Popular in Libraries
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
Practical resources that improve the lives of professional developers. By developers, for developers.
Categories:
Sub Categories:
Forums
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"