nx_https_cert_pipeline.nx
buildroot/runtime/nx_https_cert_pipeline.nx
about
nx_https_cert_pipeline.nx -- top-level HTTPS cert verification
pipeline.
Phase 0b §I.4 piece 8 of the chain-walker arc (the user-facing
API). Bundles the shipped substrate primitives into ONE call
that takes raw TLS 1.3 Certificate message bytes + hostname +
trust anchor + now-epoch and returns one composite verdict.
Composes 4 substrate primitives:
nx_tls13_auth.tls13_parse_certificate_chain_all (9f35188f)
-- extract cert offset array from Certificate message
nx_x509.x509_parse (extended for issuer/subject DN)
-- parse each cert's DER into an X509Cert struct
nx_x509_leaf_check.x509_leaf_check (50d861a8)
-- leaf-cert validity period + SAN hostname match
nx_x509_chain_verify.nx_x509_chain_verify (afe895e6)
-- chain walker (DN linkage + per-cert sig verify)
Flow:
1. parse_certificate_chain_all -> cert offset array
2. for each offset, x509_parse into a parsed-cert slab
3. leaf_check(cert[0]) -- validity period + SAN hostname match
(returns LEAF_* on first failure)
4. Append the trust anchor cert at the end of the parsed array
and call chain_verify on the (leaf..root) ordering
5. Return composite verdict
Public API:
nx_https_cert_pipeline_verify(
cert_msg_buf, cert_msg_len,
hostname, hostname_len,
now_epoch_secs,
trust_anchor_buf, trust_anchor_cert
) -> verdict
nx_https_cert_pipeline_verdict_is_valid(v) -> 0|1
Sealed verdict enum:
NX_HTTPS_PIPELINE_OK full validation passed
NX_HTTPS_PIPELINE_CERT_MSG_BAD Certificate-message parse fail
dependencies 6 imports · 9 importers
imports: nx_syscalls.nxnx_x509.nxnx_x509_leaf_check.nxnx_x509_chain_verify.nxnx_x509_trust_store.nxnx_tls13_auth.nx
imported by: nx_chain_pipeline_real_test.nxnx_https_cert_pipeline_test.nxnx_https_pipeline_e2e_test.nxnx_porkbun_ping_probe.nxnx_tls12_req.nxnx_tls13_ch_compat_test.nxnx_tls13_client_validate_certificate.nxnx_tls13_client_validate_certificate_test.nxnx_tls13_recv_hs_probe_test.nx
structs
| none |
consts
| 82 | const NX_HTTPS_PIPELINE_OK: i64 = 1 |
| 83 | const NX_HTTPS_PIPELINE_CERT_MSG_BAD: i64 = 2 |
| 84 | const NX_HTTPS_PIPELINE_CERT_PARSE_FAIL: i64 = 3 |
| 85 | const NX_HTTPS_PIPELINE_LEAF_NOT_YET_VALID: i64 = 4 |
| 86 | const NX_HTTPS_PIPELINE_LEAF_EXPIRED: i64 = 5 |
| 87 | const NX_HTTPS_PIPELINE_LEAF_NO_SAN: i64 = 6 |
| 88 | const NX_HTTPS_PIPELINE_HOSTNAME_MISMATCH: i64 = 7 |
| 89 | const NX_HTTPS_PIPELINE_LEAF_OTHER: i64 = 8 |
| 90 | const NX_HTTPS_PIPELINE_CHAIN_DN_MISMATCH: i64 = 9 |
| 91 | const NX_HTTPS_PIPELINE_CHAIN_SIG_FAIL: i64 = 10 |
| 92 | const NX_HTTPS_PIPELINE_CHAIN_OTHER: i64 = 11 |
| 93 | const NX_HTTPS_PIPELINE_NO_TRUST_ANCHOR: i64 = 12 |
| 94 | const NX_HTTPS_PIPELINE_VERDICT_N: i64 = 13 |
| 96 | const NX_HTTPS_PIPELINE_MAX_CERTS: i64 = 8 |
functions
| 98 | func nx_https_cert_pipeline_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 111 | func _pipeline_verify_n( |
| 186 | func nx_https_cert_pipeline_verify( |
| 221 | func nx_https_cert_pipeline_verify_with_store( |
| 295 | func main() -> i64 |