NAME

SXNET_new, SXNET_free, SXNETID_new, SXNETID_free, d2i_SXNET, i2d_SXNET, d2i_SXNETID, i2d_SXNETID — Thawte strong extranet X.509 extension

SYNOPSIS

#include <openssl/x509v3.h> SXNET *
SXNET_new(void); void
SXNET_free(SXNET *sxnet); SXNETID *
SXNETID_new(void); void
SXNETID_free(SXNETID *sxnetid); SXNET *
d2i_SXNET(SXNET **val_out, const unsigned char **der_in, long length); int
i2d_SXNET(SXNET *val_in, unsigned char **der_out); SXNETID *
d2i_SXNETID(SXNETID **val_out, const unsigned char **der_in, long length); int
i2d_SXNETID(SXNETID *val_in, unsigned char **der_out);

DESCRIPTION

SXNET_new() allocates and initializes an empty SXNET object representing a non-standard proprietary Thawte strong extranet X.509 extension. SXNET_free() frees sxnet. SXNETID_new() allocates and initializes an empty SXNETID object. It is used inside SXNET. SXNETID_free() frees sxnetid. The remaining functions decode and encode these objects using DER format. For details about the semantics, examples, caveats, and bugs, see ASN1_item_d2i(3).

RETURN VALUES

SXNET_new() and d2i_SXNET() return an SXNET object or NULL if an error occurs. SXNETID_new() and d2i_SXNETID() return an SXNETID object or NULL if an error occurs. i2d_SXNET() and i2d_SXNETID() return the number of bytes successfully encoded or a negative value if an error occurs.

SEE ALSO

X509_EXTENSION_new(3), X509_new(3) M. Shuttleworth, The Strong Extranet: real-world personal certification, Thawte Consulting, South Africa, 1998.

HISTORY

These functions first appeared in OpenSSL 0.9.3 and have been available since OpenBSD 2.6.

BUGS

This manual page does not explain what the extension actually does because no authoritative information was found online so far. The only hint was found in an ancient white paper "Securing IBM Applications with Public Key Infrastructure" on the IBM website, dated June 13, 2001: "Thawte also has a technology called Strong Extranet that allows institutions to encode customer information in the extensions to their customer's certificates. Because multiple institutions can add information, the user needs only one certificate, making renewal and revocation simpler, although the issue of modifying an extension to an existing certificate is not addressed." It is unclear whether that explanation is accurate, but in any case, it is not very specific.