CL_CrlAddCert

NAME

  CL_CrlAddCert,
  CSSM_CL_CrlAddCert - Revoke an input certificate (CDSA)

SYNOPSIS

  # include <cssm.h>

   API:
       CSSM_RETURN CSSMAPI CSSM_CL_CrlAddCert
       (CSSM_CL_HANDLE CLHandle,
       CSSM_CC_HANDLE CCHandle,
       const CSSM_DATA *Cert,
       uint32 NumberOfFields,
       const CSSM_FIELD *CrlEntryFields,
       const CSSM_DATA *OldCrl,
       CSSM_DATA_PTR NewCrl)

   SPI:
       CSSM_RETURN CSSMCLI CL_CrlAddCert
       (CSSM_CL_HANDLE CLHandle,
       CSSM_CC_HANDLE CCHandle,
       const CSSM_DATA *Cert,
       uint32 NumberOfFields,
       const CSSM_FIELD *CrlEntryFields,
       const CSSM_DATA *OldCrl,
       CSSM_DATA_PTR NewCrl)

LIBRARY

  Common Security Services Manager library (CDSA$INCSSM300_SHR.EXE)

PARAMETERS

  CLHandle (input)
          The handle that describes the add-in certificate library module
          used to perform this function.

  CCHandle (input)
          The handle that describes the context of this cryptographic
          operation.

  Cert (input)
          A pointer to the CSSM_DATA structure containing the certificate
          to be revoked.

  NumberOfFields (input)
          The number of OID/value pairs specified in the CrlEntryFields
          input parameter.

  CrlEntryFields (input)
          An array of OID/value pairs specifying the initial values for
          descriptive data fields of the new CRL entry.

  OldCrl (input)
          A pointer to the CSSM_DATA structure containing the CRL to
          which the newly revoked certificate will be added.

  NewCrl (output)
          A pointer to the CSSM_DATA structure containing the updated
          CRL.  The NewCrl->Data is allocated by the service provider
          and must be deallocated by the application.

DESCRIPTION

  This function revokes the input certificate by adding a record
  representing the certificate to the CRL. The values for the new entry
  in the CRL are specified by the list of OID/value input pairs. The
  reason for revocation is a typical value specified in the list. The
  new CRL entry is signed using the private key and signing algorithm
  specified in the CCHandle.

  The CCHandle must be a context created using the function
  CSSM_CSP_CreateSignatureContext() (CSSM API), or
  CSP_CreateSignatureContext() (CL SPI). The context must specify the
  Cryptographic Services Provider (CSP) module, the signing algorithm,
  and the signing key that must be used to perform this operation. The
  context must also provide the passphrase or a callback function to
  obtain the passphrase required to access and use the private key.

  The operation is valid only if the CRL has not been closed by the
  process of signing the CRL, by calling CSSM_CL_CrlSign() (CSSM API),
  or CL_CrlSign() (CL SPI). Once the CRL has been signed, entries cannot
  be added or removed.

RETURN VALUE

  A CSSM_RETURN value indicating success or specifying a particular
  error condition. The value CSSM_OK indicates success. All other values
  represent an error condition.

ERRORS

  Errors are described in the CDSA technical standard.  See CDSA.

       CSSMERR_CL_INVALID_CONTEXT_HANDLE
       CSSMERR_CL_INVALID_CERT_POINTER
       CSSMERR_CL_UNKNOWN_FORMAT
       CSSMERR_CL_INVALID_FIELD_POINTER
       CSSMERR_CL_UNKNOWN_TAG
       CSSMERR_CL_INVALID_NUMBER_OF_FIELDS
       CSSMERR_CL_INVALID_CRL_POINTER
       CSSMERR_CL_CRL_ALREADY_SIGNED

SEE ALSO

  Books

  Intel CDSA Application Developer's Guide (see CDSA)

  Other Help Topics

  Functions for the CSSM API:

      CSSM_CL_CrlRemoveCert

  Functions for the CLI SPI:

      CL_CrlRemoveCert