nx_x509_build.nx
buildroot/runtime/hub/nx_x509_build.nx
about
nx_x509_build.nx -- V-HOST-4b: sovereign X.509 v3 self-signed cert builder.
Composes hub/nx_asn1_write (V-HOST-4a) + ed25519_sign_full to produce
a fully-conformant RFC 5280 X.509 v3 certificate signed with Ed25519
(RFC 8410 + RFC 8032).
COMPOSES (per "avoid duplicate primitives"):
hub/nx_asn1_write (DER encoder; sibling to existing asn1.nx READ surface)
nx_ed25519_signature (ed25519_sign_full per RFC 8032 ยง5.1.6)
COMPOSED BY:
bin/nx_cert_gen.nx (V-HOST-4c; CLI driver; queued)
future: ACME cert request flow integration
V-HOST-4b SCOPE per RFC 5280:
Certificate {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier, // ed25519
signatureValue BIT STRING // ed25519 64-byte sig
}
TBSCertificate {
version [0] EXPLICIT INTEGER (v3 = 2),
serialNumber INTEGER (operator-supplied OR random),
signature AlgorithmIdentifier, // ed25519
issuer Name, // self-signed: subject == issuer
validity Validity {notBefore, notAfter}, // GeneralizedTime
subject Name, // CN=<domain>
subjectPublicKeyInfo SubjectPublicKeyInfo,// ed25519 pubkey
extensions [3] EXPLICIT Extensions { // V3 extensions
subjectAltName // SAN list
basicConstraints // CA:FALSE
keyUsage // digitalSignature
}
}
V-HOST-4b NON-SCOPE (V+1):
- ECDSA / RSA sig algs (only Ed25519 V1)
- CA certs (only end-entity / leaf V1)
- Cert chain (only self-signed V1)
- CRL distribution points / OCSP / AIA extensions
dependencies 9 imports · 10 importers
imports: nx_syscalls.nxnx_asn1_write.nxnx_ed25519_signature.nxnx_ecdsa_p256.nxnx_ecdsa_p256_sign.nxnx_x509_sig_alg.nxnx_u256.nxnx_p256_point.nxnx_sha256.nx
imported by: _h2_multistream_curl_daemon.nx_h2_serve_curl_daemon.nx_h2_serve_loopback_gate.nx_nx_pub_from_priv_isolated_test.nxnx_acme_csr.nxnx_cert_gen.nxnx_cms_tls_gate.nxnx_h2_test_leaf.nxnx_mtls_ecdsa.nxnx_tls13_clientauth_ecdsa.nx
structs
| 139 | struct NxX509BuildInputs |
consts
| 56 | const NX_X509_OK: i64 = 0 |
| 57 | const NX_X509_BAD_INPUT: i64 = 3620 |
| 58 | const NX_X509_BUF_OVERFLOW: i64 = 3621 |
| 59 | const NX_X509_TOO_MANY_SANS: i64 = 3622 |
| 60 | const NX_X509_BAD_TIME: i64 = 3623 |
| 61 | const NX_X509_SIGN_FAILED: i64 = 3624 |
| 62 | const NX_X509_SERIAL_TOO_LARGE: i64 = 3625 |
| 65 | const NX_X509_MAX_DER_OUT: i64 = 8192 // V1 self-signed cert easily fits |
| 66 | const NX_X509_MAX_TBS_BUF: i64 = 4096 // TBSCertificate scratch |
| 67 | const NX_X509_MAX_NAME_BUF: i64 = 256 // CN body |
| 68 | const NX_X509_MAX_SANS: i64 = 16 |
| 69 | const NX_X509_MAX_SAN_LEN: i64 = 253 // hostname per RFC 1035 + room |
| 70 | const NX_X509_MAX_VALIDITY_BUF: i64 = 64 |
| 71 | const NX_X509_MAX_SPKI_BUF: i64 = 128 |
| 72 | const NX_X509_MAX_EXT_BUF: i64 = 512 |
| 73 | const NX_X509_MAX_ISSUER_BUF: i64 = 256 |
| 74 | const NX_X509_ED25519_SIG_LEN: i64 = 64 |
| 75 | const NX_X509_ED25519_PUB_LEN: i64 = 32 |
| 76 | const NX_X509_ED25519_PRIV_LEN: i64 = 32 |
| 113 | const NX_X509_OID_ED25519: *u8 = "\x2B\x65\x70" as *u8 |
| 114 | const NX_X509_OID_ED25519_N: i64 = 3 |
| 115 | const NX_X509_OID_SAN: *u8 = "\x55\x1D\x11" as *u8 |
| 116 | const NX_X509_OID_SAN_N: i64 = 3 |
| 117 | const NX_X509_OID_BASIC_CONSTRAINTS: *u8 = "\x55\x1D\x13" as *u8 |
| 118 | const NX_X509_OID_BASIC_CONSTRAINTS_N: i64 = 3 |
| 119 | const NX_X509_OID_KEY_USAGE: *u8 = "\x55\x1D\x0F" as *u8 |
| 120 | const NX_X509_OID_KEY_USAGE_N: i64 = 3 |
| 121 | const NX_X509_OID_CN: *u8 = "\x55\x04\x03" as *u8 |
| 122 | const NX_X509_OID_CN_N: i64 = 3 |
| 126 | const NX_X509_OID_ECDSA_SHA256: *u8 = "\x2A\x86\x48\xCE\x3D\x04\x03\x02" as *u8 |
| 127 | const NX_X509_OID_ECDSA_SHA256_N: i64 = 8 |
| 129 | const NX_X509_OID_EC_PUBLIC_KEY: *u8 = "\x2A\x86\x48\xCE\x3D\x02\x01" as *u8 |
| 130 | const NX_X509_OID_EC_PUBLIC_KEY_N: i64 = 7 |
| 132 | const NX_X509_OID_SECP256R1: *u8 = "\x2A\x86\x48\xCE\x3D\x03\x01\x07" as *u8 |
| 133 | const NX_X509_OID_SECP256R1_N: i64 = 8 |
| 135 | const NX_X509_ECDSA_P256_PUB_LEN: i64 = 65 // 0x04 || X(32B) || Y(32B) uncompressed |
functions
| 97 | func nx_x509_sig_alg_name(a: i64) -> *u8 |
| 166 | func nx_x509_inputs_init(inp: *NxX509BuildInputs, |
| 201 | func nx_x509_inputs_init_ecdsa_p256(inp: *NxX509BuildInputs, |
| 240 | func nx_x509_build_alg_ed25519(out: *u8, cap: i64, off: i64) -> i64 called by 2: nx_x509_build_sig_algnx_x509_build_spki_ed25519 calls 3: sys_mmapnx_aw_put_oidnx_aw_wrap_sequence |
| 254 | func nx_x509_build_alg_ecdsa_p256_sha256(out: *u8, cap: i64, off: i64) -> i64 called by 2: nx_acme_build_csr_ecdsa_p256nx_x509_build_sig_alg calls 3: sys_mmapnx_aw_put_oidnx_aw_wrap_sequence |
| 267 | func nx_x509_build_sig_alg(out: *u8, cap: i64, off: i64, sig_alg: i64) -> i64 |
| 288 | func nx_x509_build_spki_ecdsa_p256(out: *u8, cap: i64, off: i64, |
| 322 | func nx_x509_build_spki(out: *u8, cap: i64, off: i64, inp: *NxX509BuildInputs) -> i64 |
| 339 | func nx_x509_ecdsa_sig_to_der(r: *i64, s: *i64, |
| 382 | func nx_x509_build_name_cn(out: *u8, cap: i64, off: i64, |
| 405 | func nx_x509_build_validity(out: *u8, cap: i64, off: i64, |
| 423 | func nx_x509_build_spki_ed25519(out: *u8, cap: i64, off: i64, called by 1: nx_x509_build_spki calls 4: sys_mmapnx_x509_build_alg_ed25519nx_aw_put_bit_stringnx_aw_wrap_sequence |
| 439 | func nx_x509_build_ext_san(out: *u8, cap: i64, off: i64, |
| 476 | func nx_x509_build_extensions(out: *u8, cap: i64, off: i64, called by 1: nx_x509_build_tbs calls 4: sys_mmapnx_x509_build_ext_sannx_aw_wrap_sequencenx_aw_wrap_explicit |
| 500 | func nx_x509_build_tbs(out: *u8, cap: i64, off: i64, |
| 546 | func nx_x509_build_self_signed(inp: *NxX509BuildInputs, |