Loading certificates

A server that uses a real certificate reads it from a cert.pem/key.pem pair. This page decodes the pair step by step, then loads it with one call. The pair is a self-signed demo for localhost.

Code

main.c

#define WIRED_MAIN
#include "wired.h"

static int fail(const char* msg) {
  wired_log_str(msg);
  return 1;
}

int wired_main(int argc, char** argv) {
  static u8 text[8192], der[4096];
  if (argc < 3) return fail("usage: tls-certificates cert.pem key.pem\n");

  /* Walk every PEM block of cert.pem, decoding each to DER. */
  wired_span pem =
      wired_fio_read_span(argv[1], wired_mspan_of(text, sizeof text));
  if (pem.n == 0) return fail("cannot read cert.pem\n");
  usz        at = 0;
  wired_span label;
  wired_obuf out = {der, sizeof der, 0};
  for (usz start = 0; wired_pem_next(pem, &at, &label, &out); start = out.len) {
    wired_dprintf(
        2, "block %.*s len=%llu\n", WIRED_SPAN_ARG(label),
        (u64)(out.len - start));
  }

  /* key.pem holds one block: the P-256 private key (SEC1 or PKCS#8). */
  u8 priv[32];
  pem     = wired_fio_read_span(argv[2], wired_mspan_of(text, sizeof text));
  at      = 0;
  out.len = 0;
  if (!wired_pem_next(pem, &at, &label, &out) ||
      !wired_eckey_p256_priv(wired_span_of(der, out.len), priv))
    return fail("bad key\n");
  wired_log_str("key ok\n");

  /* certreload does all of the above in one call and fills a server
   * identity; the store must outlive the identity. */
  static wired_certreload_store store;
  wired_srvboot_id              id = {0};
  if (!wired_certreload_load(argv[1], argv[2], &store, &id))
    return fail("load failed\n");
  wired_dprintf(2, "load ok: %llu certificate(s)\n", (u64)id.chain_count);
  return 0;
}

Output

$ ./tls-certificates cert.pem key.pem
block CERTIFICATE len=386
key ok
load ok: 1 certificate(s)

How it works

• wired_fio_read(path, buf) reads a whole file into a caller-owned buffer.
• wired_pem_next(text, &at, &label, &der) decodes the next PEM block to DER and advances at. Call it in a loop to walk a fullchain file.
• wired_eckey_p256_priv(der, priv) extracts the P-256 private key from SEC1 or PKCS#8 DER.
• wired_certreload_load(cert, key, &store, &id) does all of the above and points id.chain/id.chain_count/id.cert_seed at store. Keep store alive as long as id is in use.