35 files changed, 24851 insertions, 0 deletions

diff --git a/src/daemon/https/x509/Makefile.am b/src/daemon/https/x509/Makefile.am
new file mode 100644
index 00000000..c3a30f03
--- /dev/null
+++ b/src/daemon/https/x509/Makefile.am
@@ -0,0 +1,36 @@
+
+AM_CPPFLAGS = -I./includes \
+-I$(top_srcdir)/src/daemon/https/includes \
+-I$(top_srcdir)/src/daemon/https/minitasn1 \
+-I$(top_srcdir)/src/daemon/https/lgl \
+-I$(top_srcdir)/src/daemon/https/x509 \
+-I$(top_srcdir)/src/daemon/https/tls
+
+noinst_LTLIBRARIES = libx509.la
+
+libx509_la_LDFLAGS = -lgcrypt 
+# -l $(top_srcdir)/src/daemon/https/lgl/liblgl.la
+
+libx509_la_SOURCES = \
+common.c \
+crq.c \
+crl.c \
+crl_write.c \
+dn.c \
+dsa.c \
+extensions.c \
+mpi.c \
+pkcs12_bag.c \
+pkcs12.c \
+pkcs12_encr.c \
+pkcs7.c \
+x509_privkey.c \
+privkey_pkcs8.c \
+rfc2818_hostname.c \
+sign.c \
+x509_verify.c \
+x509.c \
+x509_write.c
+# output.c
+
+
diff --git a/src/daemon/https/x509/common.c b/src/daemon/https/x509/common.c
new file mode 100644
index 00000000..98a655c7
--- /dev/null
+++ b/src/daemon/https/x509/common.c
@@ -0,0 +1,1491 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <gnutls_str.h>
+#include <gnutls_x509.h>
+#include <gnutls_num.h>
+#include <x509_b64.h>
+#include <common.h>
+#include <mpi.h>
+#include <time.h>
+
+typedef struct _oid2string
+{
+  const char *oid;
+  const char *ldap_desc;
+  int choice;                   /* of type DirectoryString */
+  int printable;
+} oid2string;
+
+/* This list contains all the OIDs that may be
+ * contained in a rdnSequence and are printable.
+ */
+static const oid2string _oid2str[] = {
+  /* PKIX
+   */
+  {"1.3.6.1.5.5.7.9.1",
+   "dateOfBirth",
+   0,
+   1},
+  {"1.3.6.1.5.5.7.9.2",
+   "placeOfBirth",
+   0,
+   1},
+  {"1.3.6.1.5.5.7.9.3",
+   "gender",
+   0,
+   1},
+  {"1.3.6.1.5.5.7.9.4",
+   "countryOfCitizenship",
+   0,
+   1},
+  {"1.3.6.1.5.5.7.9.5",
+   "countryOfResidence",
+   0,
+   1},
+
+  {"2.5.4.6",
+   "C",
+   0,
+   1},
+  {"2.5.4.9",
+   "STREET",
+   1,
+   1},
+  {"2.5.4.12",
+   "T",
+   1,
+   1},
+  {"2.5.4.10",
+   "O",
+   1,
+   1},
+  {"2.5.4.11",
+   "OU",
+   1,
+   1},
+  {"2.5.4.3",
+   "CN",
+   1,
+   1},
+  {"2.5.4.7",
+   "L",
+   1,
+   1},
+  {"2.5.4.8",
+   "ST",
+   1,
+   1},
+
+  {"2.5.4.5",
+   "serialNumber",
+   0,
+   1},
+  {"2.5.4.20",
+   "telephoneNumber",
+   0,
+   1},
+  {"2.5.4.4",
+   "surName",
+   1,
+   1},
+  {"2.5.4.43",
+   "initials",
+   1,
+   1},
+  {"2.5.4.44",
+   "generationQualifier",
+   1,
+   1},
+  {"2.5.4.42",
+   "givenName",
+   1,
+   1},
+  {"2.5.4.65",
+   "pseudonym",
+   1,
+   1},
+  {"2.5.4.46",
+   "dnQualifier",
+   0,
+   1},
+
+  {"0.9.2342.19200300.100.1.25",
+   "DC",
+   0,
+   1},
+  {"0.9.2342.19200300.100.1.1",
+   "UID",
+   1,
+   1},
+
+  /* PKCS #9
+   */
+  {"1.2.840.113549.1.9.1",
+   "EMAIL",
+   0,
+   1},
+  {"1.2.840.113549.1.9.7",
+   NULL,
+   1,
+   1},
+
+  /* friendly name */
+  {"1.2.840.113549.1.9.20",
+   NULL,
+   0,
+   1},
+  {NULL,
+   NULL,
+   0,
+   0}
+};
+
+/* Returns 1 if the data defined by the OID are printable.
+ */
+int
+_gnutls_x509_oid_data_printable (const char *oid)
+{
+  int i = 0;
+
+  do
+    {
+      if (strcmp (_oid2str[i].oid, oid) == 0)
+        return _oid2str[i].printable;
+      i++;
+    }
+  while (_oid2str[i].oid != NULL);
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_dn_oid_known - This function will return true if the given OID is known
+ * @oid: holds an Object Identifier in a null terminated string
+ *
+ * This function will inform about known DN OIDs. This is useful since functions
+ * like gnutls_x509_crt_set_dn_by_oid() use the information on known
+ * OIDs to properly encode their input. Object Identifiers that are not
+ * known are not encoded by these functions, and their input is stored directly
+ * into the ASN.1 structure. In that case of unknown OIDs, you have
+ * the responsibility of DER encoding your data.
+ *
+ * Returns 1 on known OIDs and 0 otherwise.
+ *
+ **/
+int
+gnutls_x509_dn_oid_known (const char *oid)
+{
+  int i = 0;
+
+  do
+    {
+      if (strcmp (_oid2str[i].oid, oid) == 0)
+        return 1;
+      i++;
+    }
+  while (_oid2str[i].oid != NULL);
+
+  return 0;
+}
+
+/* Returns 1 if the data defined by the OID are of a choice
+ * type.
+ */
+int
+_gnutls_x509_oid_data_choice (const char *oid)
+{
+  int i = 0;
+
+  do
+    {
+      if (strcmp (_oid2str[i].oid, oid) == 0)
+        return _oid2str[i].choice;
+      i++;
+    }
+  while (_oid2str[i].oid != NULL);
+
+  return 0;
+}
+
+const char *
+_gnutls_x509_oid2ldap_string (const char *oid)
+{
+  int i = 0;
+
+  do
+    {
+      if (strcmp (_oid2str[i].oid, oid) == 0)
+        return _oid2str[i].ldap_desc;
+      i++;
+    }
+  while (_oid2str[i].oid != NULL);
+
+  return NULL;
+}
+
+/* This function will convert an attribute value, specified by the OID,
+ * to a string. The result will be a null terminated string.
+ *
+ * res may be null. This will just return the res_size, needed to
+ * hold the string.
+ */
+int
+_gnutls_x509_oid_data2string (const char *oid,
+                              void *value,
+                              int value_size, char *res, size_t * res_size)
+{
+  char str[MAX_STRING_LEN], tmpname[128];
+  const char *ANAME = NULL;
+  int CHOICE = -1, len = -1, result;
+  ASN1_TYPE tmpasn = ASN1_TYPE_EMPTY;
+  char asn1_err[MAX_ERROR_DESCRIPTION_SIZE] = "";
+
+  if (value == NULL || value_size <= 0 || res_size == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (_gnutls_x509_oid_data_printable (oid) == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ANAME = asn1_find_structure_from_oid (_gnutls_get_pkix (), oid);
+  CHOICE = _gnutls_x509_oid_data_choice (oid);
+
+  if (ANAME == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  _gnutls_str_cpy (str, sizeof (str), "PKIX1.");
+  _gnutls_str_cat (str, sizeof (str), ANAME);
+
+  if ((result = asn1_create_element (_gnutls_get_pkix (), str,
+                                     &tmpasn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if ((result = asn1_der_decoding (&tmpasn, value, value_size, asn1_err))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("asn1_der_decoding: %s:%s\n", str, asn1_err);
+      asn1_delete_structure (&tmpasn);
+      return _gnutls_asn2err (result);
+    }
+
+  /* If this is a choice then we read the choice. Otherwise it
+   * is the value;
+   */
+  len = sizeof (str) - 1;
+  if ((result = asn1_read_value (tmpasn, "", str, &len)) != ASN1_SUCCESS)
+    {                           /* CHOICE */
+      gnutls_assert ();
+      asn1_delete_structure (&tmpasn);
+      return _gnutls_asn2err (result);
+    }
+
+  if (CHOICE == 0)
+    {
+      str[len] = 0;
+
+      if (res)
+        _gnutls_str_cpy (res, *res_size, str);
+      *res_size = len;
+
+      asn1_delete_structure (&tmpasn);
+    }
+  else
+    {                           /* CHOICE */
+      int non_printable = 0, teletex = 0;
+      str[len] = 0;
+
+      /* Note that we do not support strings other than
+       * UTF-8 (thus ASCII as well).
+       */
+      if (strcmp (str, "printableString") != 0
+          && strcmp (str, "ia5String") != 0
+          && strcmp (str, "utf8String") != 0)
+        {
+          non_printable = 1;
+        }
+      if (strcmp (str, "teletexString") == 0)
+        teletex = 1;
+
+      _gnutls_str_cpy (tmpname, sizeof (tmpname), str);
+
+      len = sizeof (str) - 1;
+      if ((result = asn1_read_value (tmpasn, tmpname, str, &len))
+          != ASN1_SUCCESS)
+        {
+          asn1_delete_structure (&tmpasn);
+          return _gnutls_asn2err (result);
+        }
+
+      asn1_delete_structure (&tmpasn);
+
+      if (teletex != 0)
+        {
+          int ascii = 0, i;
+          /* HACK: if the teletex string contains only ascii
+           * characters then treat it as printable.
+           */
+          for (i = 0; i < len; i++)
+            if (!isascii (str[i]))
+              ascii = 1;
+
+          if (ascii == 0)
+            non_printable = 0;
+        }
+
+      if (res)
+        {
+          if (non_printable == 0)
+            {
+              str[len] = 0;
+              _gnutls_str_cpy (res, *res_size, str);
+              *res_size = len;
+            }
+          else
+            {
+              result = _gnutls_x509_data2hex (str, len, res, res_size);
+              if (result < 0)
+                {
+                  gnutls_assert ();
+                  return result;
+                }
+            }
+        }
+
+    }
+
+  return 0;
+}
+
+/* Converts a data string to an LDAP rfc2253 hex string
+ * something like '#01020304'
+ */
+int
+_gnutls_x509_data2hex (const opaque * data,
+                       size_t data_size, opaque * out, size_t * sizeof_out)
+{
+  char *res;
+  char escaped[MAX_STRING_LEN];
+
+  if (2 * data_size + 1 > MAX_STRING_LEN)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  res = _gnutls_bin2hex (data, data_size, escaped, sizeof (escaped));
+
+  if (res)
+    {
+      unsigned int size = strlen (res) + 1;
+      if (size + 1 > *sizeof_out)
+        {
+          *sizeof_out = size;
+          return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        }
+      *sizeof_out = size;       /* -1 for the null +1 for the '#' */
+
+      if (out)
+        {
+          strcpy (out, "#");
+          strcat (out, res);
+        }
+
+      return 0;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+}
+
+/* TIME functions 
+ * Convertions between generalized or UTC time to time_t
+ *
+ */
+
+/* This is an emulations of the struct tm.
+ * Since we do not use libc's functions, we don't need to
+ * depend on the libc structure.
+ */
+typedef struct fake_tm
+{
+  int tm_mon;
+  int tm_year;                  /* FULL year - ie 1971 */
+  int tm_mday;
+  int tm_hour;
+  int tm_min;
+  int tm_sec;
+} fake_tm;
+
+/* The mktime_utc function is due to Russ Allbery (rra@stanford.edu),
+ * who placed it under public domain:
+ */
+
+/* The number of days in each month. 
+ */
+static const int MONTHDAYS[] = { 31,
+  28,
+  31,
+  30,
+  31,
+  30,
+  31,
+  31,
+  30,
+  31,
+  30,
+  31
+};
+
+/* Whether a given year is a leap year. */
+#define ISLEAP(year) \
+        (((year) % 4) == 0 && (((year) % 100) != 0 || ((year) % 400) == 0))
+
+/*
+ **  Given a struct tm representing a calendar time in UTC, convert it to
+ **  seconds since epoch.  Returns (time_t) -1 if the time is not
+ **  convertable.  Note that this function does not canonicalize the provided
+ **  struct tm, nor does it allow out of range values or years before 1970.
+ */
+static time_t
+mktime_utc (const struct fake_tm *tm)
+{
+  time_t result = 0;
+  int i;
+
+  /* We do allow some ill-formed dates, but we don't do anything special
+   * with them and our callers really shouldn't pass them to us.  Do
+   * explicitly disallow the ones that would cause invalid array accesses
+   * or other algorithm problems. 
+   */
+  if (tm->tm_mon < 0 || tm->tm_mon > 11 || tm->tm_year < 1970)
+    return (time_t) - 1;
+
+  /* Convert to a time_t. 
+   */
+  for (i = 1970; i < tm->tm_year; i++)
+    result += 365 + ISLEAP (i);
+  for (i = 0; i < tm->tm_mon; i++)
+    result += MONTHDAYS[i];
+  if (tm->tm_mon > 1 && ISLEAP (tm->tm_year))
+    result++;
+  result = 24 * (result + tm->tm_mday - 1) + tm->tm_hour;
+  result = 60 * result + tm->tm_min;
+  result = 60 * result + tm->tm_sec;
+  return result;
+}
+
+/* this one will parse dates of the form:
+ * month|day|hour|minute|sec* (2 chars each)
+ * and year is given. Returns a time_t date.
+ */
+time_t
+_gnutls_x509_time2gtime (const char *ttime, int year)
+{
+  char xx[3];
+  struct fake_tm etime;
+  time_t ret;
+
+  if (strlen (ttime) < 8)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  etime.tm_year = year;
+
+  /* In order to work with 32 bit
+   * time_t.
+   */
+  if (sizeof (time_t) <= 4 && etime.tm_year >= 2038)
+    return (time_t) 2145914603; /* 2037-12-31 23:23:23 */
+
+  xx[2] = 0;
+
+  /* get the month
+   */
+  memcpy (xx, ttime, 2);        /* month */
+  etime.tm_mon = atoi (xx) - 1;
+  ttime += 2;
+
+  /* get the day
+   */
+  memcpy (xx, ttime, 2);        /* day */
+  etime.tm_mday = atoi (xx);
+  ttime += 2;
+
+  /* get the hour
+   */
+  memcpy (xx, ttime, 2);        /* hour */
+  etime.tm_hour = atoi (xx);
+  ttime += 2;
+
+  /* get the minutes
+   */
+  memcpy (xx, ttime, 2);        /* minutes */
+  etime.tm_min = atoi (xx);
+  ttime += 2;
+
+  if (strlen (ttime) >= 2)
+    {
+      memcpy (xx, ttime, 2);
+      etime.tm_sec = atoi (xx);
+      ttime += 2;
+    }
+  else
+    etime.tm_sec = 0;
+
+  ret = mktime_utc (&etime);
+
+  return ret;
+}
+
+/* returns a time_t value that contains the given time.
+ * The given time is expressed as:
+ * YEAR(2)|MONTH(2)|DAY(2)|HOUR(2)|MIN(2)|SEC(2)*
+ *
+ * (seconds are optional)
+ */
+time_t
+_gnutls_x509_utcTime2gtime (const char *ttime)
+{
+  char xx[3];
+  int year;
+
+  if (strlen (ttime) < 10)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+  xx[2] = 0;
+  /* get the year
+   */
+  memcpy (xx, ttime, 2);        /* year */
+  year = atoi (xx);
+  ttime += 2;
+
+  if (year > 49)
+    year += 1900;
+  else
+    year += 2000;
+
+  return _gnutls_x509_time2gtime (ttime, year);
+}
+
+/* returns a time value that contains the given time.
+ * The given time is expressed as:
+ * YEAR(2)|MONTH(2)|DAY(2)|HOUR(2)|MIN(2)|SEC(2)
+ */
+int
+_gnutls_x509_gtime2utcTime (time_t gtime, char *str_time, int str_time_size)
+{
+  size_t ret;
+
+#ifdef HAVE_GMTIME_R
+  struct tm _tm;
+
+  gmtime_r (&gtime, &_tm);
+
+  ret = strftime (str_time, str_time_size, "%y%m%d%H%M%SZ", &_tm);
+#else
+  struct tm *_tm;
+
+  _tm = gmtime (&gtime);
+
+  ret = strftime (str_time, str_time_size, "%y%m%d%H%M%SZ", _tm);
+#endif
+
+  if (!ret)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  return 0;
+
+}
+
+/* returns a time_t value that contains the given time.
+ * The given time is expressed as:
+ * YEAR(4)|MONTH(2)|DAY(2)|HOUR(2)|MIN(2)|SEC(2)*
+ */
+time_t
+_gnutls_x509_generalTime2gtime (const char *ttime)
+{
+  char xx[5];
+  int year;
+
+  if (strlen (ttime) < 12)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  if (strchr (ttime, 'Z') == 0)
+    {
+      gnutls_assert ();
+      /* sorry we don't support it yet
+       */
+      return (time_t) - 1;
+    }
+  xx[4] = 0;
+
+  /* get the year
+   */
+  memcpy (xx, ttime, 4);        /* year */
+  year = atoi (xx);
+  ttime += 4;
+
+  return _gnutls_x509_time2gtime (ttime, year);
+
+}
+
+/* Extracts the time in time_t from the ASN1_TYPE given. When should
+ * be something like "tbsCertList.thisUpdate".
+ */
+#define MAX_TIME 64
+time_t
+_gnutls_x509_get_time (ASN1_TYPE c2, const char *when)
+{
+  char ttime[MAX_TIME];
+  char name[128];
+  time_t c_time = (time_t) - 1;
+  int len, result;
+
+  _gnutls_str_cpy (name, sizeof (name), when);
+
+  len = sizeof (ttime) - 1;
+  if ((result = asn1_read_value (c2, name, ttime, &len)) < 0)
+    {
+      gnutls_assert ();
+      return (time_t) (-1);
+    }
+
+  /* CHOICE */
+  if (strcmp (ttime, "generalTime") == 0)
+    {
+
+      _gnutls_str_cat (name, sizeof (name), ".generalTime");
+      len = sizeof (ttime) - 1;
+      result = asn1_read_value (c2, name, ttime, &len);
+      if (result == ASN1_SUCCESS)
+        c_time = _gnutls_x509_generalTime2gtime (ttime);
+    }
+  else
+    {                           /* UTCTIME */
+
+      _gnutls_str_cat (name, sizeof (name), ".utcTime");
+      len = sizeof (ttime) - 1;
+      result = asn1_read_value (c2, name, ttime, &len);
+      if (result == ASN1_SUCCESS)
+        c_time = _gnutls_x509_utcTime2gtime (ttime);
+    }
+
+  /* We cannot handle dates after 2031 in 32 bit machines.
+   * a time_t of 64bits has to be used.
+   */
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return (time_t) (-1);
+    }
+  return c_time;
+}
+
+/* Sets the time in time_t in the ASN1_TYPE given. Where should
+ * be something like "tbsCertList.thisUpdate".
+ */
+int
+_gnutls_x509_set_time (ASN1_TYPE c2, const char *where, time_t tim)
+{
+  char str_time[MAX_TIME];
+  char name[128];
+  int result, len;
+
+  _gnutls_str_cpy (name, sizeof (name), where);
+
+  if ((result = asn1_write_value (c2, name, "utcTime", 1)) < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_gtime2utcTime (tim, str_time, sizeof (str_time));
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  _gnutls_str_cat (name, sizeof (name), ".utcTime");
+
+  len = strlen (str_time);
+  result = asn1_write_value (c2, name, str_time, len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+gnutls_x509_subject_alt_name_t
+_gnutls_x509_san_find_type (char *str_type)
+{
+  if (strcmp (str_type, "dNSName") == 0)
+    return GNUTLS_SAN_DNSNAME;
+  if (strcmp (str_type, "rfc822Name") == 0)
+    return GNUTLS_SAN_RFC822NAME;
+  if (strcmp (str_type, "uniformResourceIdentifier") == 0)
+    return GNUTLS_SAN_URI;
+  if (strcmp (str_type, "iPAddress") == 0)
+    return GNUTLS_SAN_IPADDRESS;
+  if (strcmp (str_type, "otherName") == 0)
+    return GNUTLS_SAN_OTHERNAME;
+  if (strcmp (str_type, "directoryName") == 0)
+    return GNUTLS_SAN_DN;
+  return (gnutls_x509_subject_alt_name_t) - 1;
+}
+
+/* A generic export function. Will export the given ASN.1 encoded data
+ * to PEM or DER raw data.
+ */
+int
+_gnutls_x509_export_int (ASN1_TYPE asn1_data,
+                         gnutls_x509_crt_fmt_t format,
+                         char *pem_header,
+                         unsigned char *output_data,
+                         size_t * output_data_size)
+{
+  int result, len;
+
+  if (format == GNUTLS_X509_FMT_DER)
+    {
+
+      if (output_data == NULL)
+        *output_data_size = 0;
+
+      len = *output_data_size;
+
+      if ((result = asn1_der_coding (asn1_data, "", output_data, &len,
+                                     NULL)) != ASN1_SUCCESS)
+        {
+          *output_data_size = len;
+          if (result == ASN1_MEM_ERROR)
+            {
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      *output_data_size = len;
+
+    }
+  else
+    {                           /* PEM */
+      opaque *out;
+      gnutls_datum_t tmp;
+
+      result = _gnutls_x509_der_encode (asn1_data, "", &tmp, 0);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      result = _gnutls_fbase64_encode (pem_header, tmp.data, tmp.size, &out);
+
+      _gnutls_free_datum (&tmp);
+
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      if (result == 0)
+        {                       /* oooops */
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      if ((unsigned) result > *output_data_size)
+        {
+          gnutls_assert ();
+          gnutls_free (out);
+          *output_data_size = result;
+          return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        }
+
+      *output_data_size = result;
+
+      if (output_data)
+        {
+          memcpy (output_data, out, result);
+
+          /* do not include the null character into output size.
+           */
+          *output_data_size = result - 1;
+        }
+      gnutls_free (out);
+
+    }
+
+  return 0;
+}
+
+/* Decodes an octet string. Leave string_type null for a normal
+ * octet string. Otherwise put something like BMPString, PrintableString
+ * etc.
+ */
+int
+_gnutls_x509_decode_octet_string (const char *string_type,
+                                  const opaque * der,
+                                  size_t der_size,
+                                  opaque * output, size_t * output_size)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, tmp_output_size;
+  char strname[64];
+
+  if (string_type == NULL)
+    _gnutls_str_cpy (strname, sizeof (strname), "PKIX1.pkcs-7-Data");
+  else
+    {
+      _gnutls_str_cpy (strname, sizeof (strname), "PKIX1.");
+      _gnutls_str_cat (strname, sizeof (strname), string_type);
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (), strname,
+                            &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_der_decoding (&c2, der, der_size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  tmp_output_size = *output_size;
+  result = asn1_read_value (c2, "", output, &tmp_output_size);
+  *output_size = tmp_output_size;
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  return 0;
+
+cleanup:if (c2)
+    asn1_delete_structure (&c2);
+
+  return result;
+}
+
+/* Reads a value from an ASN1 tree, and puts the output
+ * in an allocated variable in the given datum.
+ * flags == 0 do nothing  with the DER output
+ * flags == 1 parse the DER output as OCTET STRING
+ * flags == 2 the value is a BIT STRING
+ */
+int
+_gnutls_x509_read_value (ASN1_TYPE c,
+                         const char *root, gnutls_datum_t * ret, int flags)
+{
+  int len = 0, result;
+  size_t slen;
+  opaque *tmp = NULL;
+
+  result = asn1_read_value (c, root, NULL, &len);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      return result;
+    }
+
+  if (flags == 2)
+    len /= 8;
+
+  tmp = gnutls_malloc (len);
+  if (tmp == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  result = asn1_read_value (c, root, tmp, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (flags == 2)
+    len /= 8;
+
+  /* Extract the OCTET STRING.
+   */
+
+  if (flags == 1)
+    {
+      slen = len;
+      result = _gnutls_x509_decode_octet_string (NULL, tmp, slen, tmp, &slen);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+      len = slen;
+    }
+
+  ret->data = tmp;
+  ret->size = len;
+
+  return 0;
+
+cleanup:gnutls_free (tmp);
+  return result;
+
+}
+
+/* DER Encodes the src ASN1_TYPE and stores it to
+ * the given datum. If str is non null then the data are encoded as
+ * an OCTET STRING.
+ */
+int
+_gnutls_x509_der_encode (ASN1_TYPE src,
+                         const char *src_name, gnutls_datum_t * res, int str)
+{
+  int size, result;
+  int asize;
+  opaque *data = NULL;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  size = 0;
+  result = asn1_der_coding (src, src_name, NULL, &size, NULL);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* allocate data for the der
+   */
+
+  if (str)
+    size += 16;                 /* for later to include the octet tags */
+  asize = size;
+
+  data = gnutls_malloc (size);
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  result = asn1_der_coding (src, src_name, data, &size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (str)
+    {
+      if ((result =
+           asn1_create_element (_gnutls_get_pkix (), "PKIX1.pkcs-7-Data",
+                                &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      result = asn1_write_value (c2, "", data, size);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      result = asn1_der_coding (c2, "", data, &asize, NULL);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      size = asize;
+
+      asn1_delete_structure (&c2);
+    }
+
+  res->data = data;
+  res->size = size;
+  return 0;
+
+cleanup:gnutls_free (data);
+  asn1_delete_structure (&c2);
+  return result;
+
+}
+
+/* DER Encodes the src ASN1_TYPE and stores it to
+ * dest in dest_name. Useful to encode something and store it
+ * as OCTET. If str is non null then the data are encoded as
+ * an OCTET STRING.
+ */
+int
+_gnutls_x509_der_encode_and_copy (ASN1_TYPE src,
+                                  const char *src_name,
+                                  ASN1_TYPE dest,
+                                  const char *dest_name, int str)
+{
+  int result;
+  gnutls_datum_t encoded;
+
+  result = _gnutls_x509_der_encode (src, src_name, &encoded, str);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Write the data.
+   */
+  result = asn1_write_value (dest, dest_name, encoded.data, encoded.size);
+
+  _gnutls_free_datum (&encoded);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/* Writes the value of the datum in the given ASN1_TYPE. If str is non
+ * zero it encodes it as OCTET STRING.
+ */
+int
+_gnutls_x509_write_value (ASN1_TYPE c,
+                          const char *root,
+                          const gnutls_datum_t * data, int str)
+{
+  int result;
+  int asize;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  gnutls_datum_t val;
+
+  asize = data->size + 16;
+
+  val.data = gnutls_malloc (asize);
+  if (val.data == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  if (str)
+    {
+      /* Convert it to OCTET STRING
+       */
+      if ((result =
+           asn1_create_element (_gnutls_get_pkix (), "PKIX1.pkcs-7-Data",
+                                &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      result = asn1_write_value (c2, "", data->data, data->size);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      result = _gnutls_x509_der_encode (c2, "", &val, 0);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+    }
+  else
+    {
+      val.data = data->data;
+      val.size = data->size;
+    }
+
+  /* Write the data.
+   */
+  result = asn1_write_value (c, root, val.data, val.size);
+
+  if (val.data != data->data)
+    _gnutls_free_datum (&val);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+
+cleanup:if (val.data != data->data)
+    _gnutls_free_datum (&val);
+  return result;
+}
+
+/* Encodes and copies the private key parameters into a
+ * subjectPublicKeyInfo structure.
+ *
+ */
+int
+_gnutls_x509_encode_and_copy_PKI_params (ASN1_TYPE dst,
+                                         const char *dst_name,
+                                         gnutls_pk_algorithm_t
+                                         pk_algorithm,
+                                         mpi_t * params, int params_size)
+{
+  const char *pk;
+  gnutls_datum_t der = { NULL,
+    0
+  };
+  int result;
+  char name[128];
+
+  pk = _gnutls_x509_pk_to_oid (pk_algorithm);
+  if (pk == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
+    }
+
+  /* write the OID
+   */
+  _gnutls_str_cpy (name, sizeof (name), dst_name);
+  _gnutls_str_cat (name, sizeof (name), ".algorithm.algorithm");
+  result = asn1_write_value (dst, name, pk, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (pk_algorithm == GNUTLS_PK_RSA)
+    {
+      /* disable parameters, which are not used in RSA.
+       */
+      _gnutls_str_cpy (name, sizeof (name), dst_name);
+      _gnutls_str_cat (name, sizeof (name), ".algorithm.parameters");
+      result = asn1_write_value (dst, name, NULL, 0);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      result = _gnutls_x509_write_rsa_params (params, params_size, &der);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      /* Write the DER parameters. (in bits)
+       */
+      _gnutls_str_cpy (name, sizeof (name), dst_name);
+      _gnutls_str_cat (name, sizeof (name), ".subjectPublicKey");
+      result = asn1_write_value (dst, name, der.data, der.size * 8);
+
+      _gnutls_free_datum (&der);
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+    }
+  else
+    return GNUTLS_E_UNIMPLEMENTED_FEATURE;
+
+  return 0;
+}
+
+/* Reads and returns the PK algorithm of the given certificate-like
+ * ASN.1 structure. src_name should be something like "tbsCertificate.subjectPublicKeyInfo".
+ */
+int
+_gnutls_x509_get_pk_algorithm (ASN1_TYPE src,
+                               const char *src_name, unsigned int *bits)
+{
+  int result;
+  opaque *str = NULL;
+  int algo;
+  char oid[64];
+  int len;
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE];
+  char name[128];
+
+  _gnutls_str_cpy (name, sizeof (name), src_name);
+  _gnutls_str_cat (name, sizeof (name), ".algorithm.algorithm");
+
+  len = sizeof (oid);
+  result = asn1_read_value (src, name, oid, &len);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  algo = _gnutls_x509_oid2pk_algorithm (oid);
+
+  if (bits == NULL)
+    {
+      gnutls_free (str);
+      return algo;
+    }
+
+  /* Now read the parameters' bits 
+   */
+  _gnutls_str_cpy (name, sizeof (name), src_name);
+  _gnutls_str_cat (name, sizeof (name), ".subjectPublicKey");
+
+  len = 0;
+  result = asn1_read_value (src, name, NULL, &len);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (len % 8 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CERTIFICATE_ERROR;
+    }
+
+  len /= 8;
+
+  str = gnutls_malloc (len);
+  if (str == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_str_cpy (name, sizeof (name), src_name);
+  _gnutls_str_cat (name, sizeof (name), ".subjectPublicKey");
+
+  result = asn1_read_value (src, name, str, &len);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_free (str);
+      return _gnutls_asn2err (result);
+    }
+
+  len /= 8;
+
+  switch (algo)
+    {
+    case GNUTLS_PK_RSA:
+      {
+        if ((result = _gnutls_x509_read_rsa_params (str, len, params)) < 0)
+          {
+            gnutls_assert ();
+            return result;
+          }
+
+        bits[0] = _gnutls_mpi_get_nbits (params[0]);
+
+        _gnutls_mpi_release (&params[0]);
+        _gnutls_mpi_release (&params[1]);
+      }
+      break;
+    default:
+      _gnutls_x509_log
+        ("_gnutls_x509_get_pk_algorithm: unhandled algorithm %d\n", algo);
+    }
+
+  gnutls_free (str);
+  return algo;
+}
+
+/* Reads the DER signed data from the certificate and allocates space and
+ * returns them into signed_data.
+ */
+int
+_gnutls_x509_get_signed_data (ASN1_TYPE src,
+                              const char *src_name,
+                              gnutls_datum_t * signed_data)
+{
+  gnutls_datum_t der;
+  int start, end, result;
+
+  result = _gnutls_x509_der_encode (src, "", &der, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Get the signed data
+   */
+  result = asn1_der_decoding_startEnd (src, der.data, der.size, src_name,
+                                       &start, &end);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_set_datum (signed_data, &der.data[start], end - start + 1);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = 0;
+
+cleanup:_gnutls_free_datum (&der);
+
+  return result;
+}
+
+/* Reads the DER signature from the certificate and allocates space and
+ * returns them into signed_data.
+ */
+int
+_gnutls_x509_get_signature (ASN1_TYPE src,
+                            const char *src_name, gnutls_datum_t * signature)
+{
+  int bits, result, len;
+
+  signature->data = NULL;
+  signature->size = 0;
+
+  /* Read the signature 
+   */
+  bits = 0;
+  result = asn1_read_value (src, src_name, NULL, &bits);
+
+  if (result != ASN1_MEM_ERROR)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if (bits % 8 != 0)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_CERTIFICATE_ERROR;
+      goto cleanup;
+    }
+
+  len = bits / 8;
+
+  signature->data = gnutls_malloc (len);
+  if (signature->data == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      return result;
+    }
+
+  /* read the bit string of the signature
+   */
+  bits = len;
+  result = asn1_read_value (src, src_name, signature->data, &bits);
+
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  signature->size = len;
+
+  return 0;
+
+cleanup:return result;
+}
diff --git a/src/daemon/https/x509/common.h b/src/daemon/https/x509/common.h
new file mode 100644
index 00000000..0b696810
--- /dev/null
+++ b/src/daemon/https/x509/common.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef COMMON_H
+# define COMMON_H
+
+#include <gnutls.h>
+#include <gnutls_algorithms.h>
+
+#define MAX_STRING_LEN 512
+
+#define GNUTLS_XML_SHOW_ALL 1
+
+#define PEM_CRL "X509 CRL"
+#define PEM_X509_CERT "X509 CERTIFICATE"
+#define PEM_X509_CERT2 "CERTIFICATE"
+#define PEM_PKCS7 "PKCS7"
+#define PEM_PKCS12 "PKCS12"
+
+/* public key algorithm's OIDs
+ */
+#define PK_PKIX1_RSA_OID "1.2.840.113549.1.1.1"
+#define PK_DSA_OID "1.2.840.10040.4.1"
+#define PK_GOST_R3410_94_OID "1.2.643.2.2.20"
+#define PK_GOST_R3410_2001_OID "1.2.643.2.2.19"
+
+/* signature OIDs
+ */
+#define SIG_DSA_SHA1_OID "1.2.840.10040.4.3"
+#define SIG_RSA_MD5_OID "1.2.840.113549.1.1.4"
+#define SIG_RSA_MD2_OID "1.2.840.113549.1.1.2"
+#define SIG_RSA_SHA1_OID "1.2.840.113549.1.1.5"
+#define SIG_RSA_SHA256_OID "1.2.840.113549.1.1.11"
+#define SIG_RSA_SHA384_OID "1.2.840.113549.1.1.12"
+#define SIG_RSA_SHA512_OID "1.2.840.113549.1.1.13"
+#define SIG_RSA_RMD160_OID "1.3.36.3.3.1.2"
+#define SIG_GOST_R3410_94_OID "1.2.643.2.2.4"
+#define SIG_GOST_R3410_2001_OID "1.2.643.2.2.3"
+
+time_t _gnutls_x509_utcTime2gtime (const char *ttime);
+time_t _gnutls_x509_generalTime2gtime (const char *ttime);
+int _gnutls_x509_set_time (ASN1_TYPE c2, const char *where, time_t tim);
+
+int _gnutls_x509_decode_octet_string (const char *string_type,
+                                      const opaque * der, size_t der_size,
+                                      opaque * output, size_t * output_size);
+int _gnutls_x509_oid_data2string (const char *OID, void *value,
+                                  int value_size, char *res,
+                                  size_t * res_size);
+int _gnutls_x509_data2hex (const opaque * data, size_t data_size,
+                           opaque * out, size_t * sizeof_out);
+
+const char *_gnutls_x509_oid2ldap_string (const char *OID);
+
+int _gnutls_x509_oid_data_choice (const char *OID);
+int _gnutls_x509_oid_data_printable (const char *OID);
+
+time_t _gnutls_x509_get_time (ASN1_TYPE c2, const char *when);
+
+gnutls_x509_subject_alt_name_t _gnutls_x509_san_find_type (char *str_type);
+
+int _gnutls_x509_der_encode_and_copy (ASN1_TYPE src, const char *src_name,
+                                      ASN1_TYPE dest, const char *dest_name,
+                                      int str);
+int _gnutls_x509_der_encode (ASN1_TYPE src, const char *src_name,
+                             gnutls_datum_t * res, int str);
+
+int _gnutls_x509_export_int (ASN1_TYPE asn1_data,
+                             gnutls_x509_crt_fmt_t format, char *pem_header,
+                             unsigned char *output_data,
+                             size_t * output_data_size);
+
+int _gnutls_x509_read_value (ASN1_TYPE c, const char *root,
+                             gnutls_datum_t * ret, int str);
+int _gnutls_x509_write_value (ASN1_TYPE c, const char *root,
+                              const gnutls_datum_t * data, int str);
+
+int _gnutls_x509_encode_and_write_attribute (const char *given_oid,
+                                             ASN1_TYPE asn1_struct,
+                                             const char *where,
+                                             const void *data,
+                                             int sizeof_data, int multi);
+int _gnutls_x509_decode_and_read_attribute (ASN1_TYPE asn1_struct,
+                                            const char *where, char *oid,
+                                            int oid_size,
+                                            gnutls_datum_t * value, int multi,
+                                            int octet);
+
+int _gnutls_x509_get_pk_algorithm (ASN1_TYPE src, const char *src_name,
+                                   unsigned int *bits);
+
+int _gnutls_x509_encode_and_copy_PKI_params (ASN1_TYPE dst,
+                                             const char *dst_name,
+                                             gnutls_pk_algorithm_t
+                                             pk_algorithm, mpi_t * params,
+                                             int params_size);
+int _gnutls_asn1_copy_node (ASN1_TYPE * dst, const char *dst_name,
+                            ASN1_TYPE src, const char *src_name);
+
+int _gnutls_x509_get_signed_data (ASN1_TYPE src, const char *src_name,
+                                  gnutls_datum_t * signed_data);
+int _gnutls_x509_get_signature (ASN1_TYPE src, const char *src_name,
+                                gnutls_datum_t * signature);
+
+#endif
diff --git a/src/daemon/https/x509/crl.c b/src/daemon/https/x509/crl.c
new file mode 100644
index 00000000..d3b5c954
--- /dev/null
+++ b/src/daemon/https/x509/crl.c
@@ -0,0 +1,705 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <x509_b64.h>
+#include <x509.h>
+#include <dn.h>
+
+/**
+  * gnutls_x509_crl_init - This function initializes a gnutls_x509_crl_t structure
+  * @crl: The structure to be initialized
+  *
+  * This function will initialize a CRL structure. CRL stands for
+  * Certificate Revocation List. A revocation list usually contains
+  * lists of certificate serial numbers that have been revoked
+  * by an Authority. The revocation lists are always signed with
+  * the authority's private key.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_init (gnutls_x509_crl_t * crl)
+{
+  *crl = gnutls_calloc (1, sizeof (gnutls_x509_crl_int));
+
+  if (*crl)
+    {
+      int result = asn1_create_element (_gnutls_get_pkix (),
+                                        "PKIX1.CertificateList",
+                                        &(*crl)->crl);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          gnutls_free (*crl);
+          return _gnutls_asn2err (result);
+        }
+      return 0;                 /* success */
+    }
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+  * gnutls_x509_crl_deinit - This function deinitializes memory used by a gnutls_x509_crl_t structure
+  * @crl: The structure to be initialized
+  *
+  * This function will deinitialize a CRL structure. 
+  *
+  **/
+void
+gnutls_x509_crl_deinit (gnutls_x509_crl_t crl)
+{
+  if (!crl)
+    return;
+
+  if (crl->crl)
+    asn1_delete_structure (&crl->crl);
+
+  gnutls_free (crl);
+}
+
+/**
+  * gnutls_x509_crl_import - This function will import a DER or PEM encoded CRL
+  * @crl: The structure to store the parsed CRL.
+  * @data: The DER or PEM encoded CRL.
+  * @format: One of DER or PEM
+  *
+  * This function will convert the given DER or PEM encoded CRL
+  * to the native gnutls_x509_crl_t format. The output will be stored in 'crl'.
+  *
+  * If the CRL is PEM encoded it should have a header of "X509 CRL".
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_import (gnutls_x509_crl_t crl,
+                        const gnutls_datum_t * data,
+                        gnutls_x509_crt_fmt_t format)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* If the CRL is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      result = _gnutls_fbase64_decode (PEM_CRL, data->data, data->size, &out);
+
+      if (result <= 0)
+        {
+          if (result == 0)
+            result = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_assert ();
+          return result;
+        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+
+  result = asn1_der_decoding (&crl->crl, _data.data, _data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if (need_free)
+    _gnutls_free_datum (&_data);
+
+  return 0;
+
+cleanup:
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+
+/**
+  * gnutls_x509_crl_get_issuer_dn - This function returns the CRL's issuer distinguished name
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @buf: a pointer to a structure to hold the peer's name (may be null)
+  * @sizeof_buf: initially holds the size of @buf
+  *
+  * This function will copy the name of the CRL issuer in the provided buffer. The name 
+  * will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output
+  * string will be ASCII or UTF-8 encoded, depending on the certificate data.
+  *
+  * If buf is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+  * in that case the sizeof_buf will be updated with the required size, and
+  * 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_get_issuer_dn (const gnutls_x509_crl_t crl, char *buf,
+                               size_t * sizeof_buf)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn (crl->crl,
+                                "tbsCertList.issuer.rdnSequence",
+                                buf, sizeof_buf);
+}
+
+/**
+  * gnutls_x509_crl_get_issuer_dn_by_oid - This function returns the CRL's issuer distinguished name
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @oid: holds an Object Identified in null terminated string
+  * @indx: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+  * @raw_flag: If non zero returns the raw DER data of the DN part.
+  * @buf: a pointer to a structure to hold the peer's name (may be null)
+  * @sizeof_buf: initially holds the size of @buf
+  *
+  * This function will extract the part of the name of the CRL issuer specified
+  * by the given OID. The output will be encoded as described in RFC2253. The output
+  * string will be ASCII or UTF-8 encoded, depending on the certificate data.
+  *
+  * Some helper macros with popular OIDs can be found in gnutls/x509.h
+  * If raw flag is zero, this function will only return known OIDs as text. Other OIDs 
+  * will be DER encoded, as described in RFC2253 -- in hex format with a '\#' prefix.
+  * You can check about known OIDs using gnutls_x509_dn_oid_known().
+  *
+  * If buf is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+  * in that case the sizeof_buf will be updated with the required size,
+  * and 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_get_issuer_dn_by_oid (gnutls_x509_crl_t crl,
+                                      const char *oid, int indx,
+                                      unsigned int raw_flag, void *buf,
+                                      size_t * sizeof_buf)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn_oid (crl->crl,
+                                    "tbsCertList.issuer.rdnSequence",
+                                    oid, indx, raw_flag, buf, sizeof_buf);
+}
+
+/**
+  * gnutls_x509_crl_get_dn_oid - This function returns the Certificate request issuer's distinguished name OIDs
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @indx: Specifies which DN OID to send. Use zero to get the first one.
+  * @oid: a pointer to a structure to hold the name (may be null)
+  * @sizeof_oid: initially holds the size of 'oid'
+  *
+  * This function will extract the requested OID of the name of the CRL issuer, specified
+  * by the given index. 
+  *
+  * If oid is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+  * in that case the sizeof_oid will be updated with the required size.
+  * On success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_crl_get_dn_oid (gnutls_x509_crl_t crl,
+                            int indx, void *oid, size_t * sizeof_oid)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_get_dn_oid (crl->crl,
+                                  "tbsCertList.issuer.rdnSequence", indx,
+                                  oid, sizeof_oid);
+}
+
+
+/**
+  * gnutls_x509_crl_get_signature_algorithm - This function returns the CRL's signature algorithm
+  * @crl: should contain a gnutls_x509_crl_t structure
+  *
+  * This function will return a value of the gnutls_sign_algorithm_t enumeration that 
+  * is the signature algorithm. 
+  *
+  * Returns a negative value on error.
+  *
+  **/
+int
+gnutls_x509_crl_get_signature_algorithm (gnutls_x509_crl_t crl)
+{
+  int result;
+  gnutls_datum_t sa;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Read the signature algorithm. Note that parameters are not
+   * read. They will be read from the issuer's certificate if needed.
+   */
+
+  result =
+    _gnutls_x509_read_value (crl->crl, "signatureAlgorithm.algorithm",
+                             &sa, 0);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_oid2sign_algorithm ((const char *) sa.data);
+
+  _gnutls_free_datum (&sa);
+
+  return result;
+}
+
+/**
+ * gnutls_x509_crl_get_signature - Returns the CRL's signature
+ * @crl: should contain a gnutls_x509_crl_t structure
+ * @sig: a pointer where the signature part will be copied (may be null).
+ * @sizeof_sig: initially holds the size of @sig
+ *
+ * This function will extract the signature field of a CRL.
+ *
+ * Returns 0 on success, and a negative value on error.
+ **/
+int
+gnutls_x509_crl_get_signature (gnutls_x509_crl_t crl,
+                               char *sig, size_t * sizeof_sig)
+{
+  int result;
+  int bits, len;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  bits = 0;
+  result = asn1_read_value (crl->crl, "signature", NULL, &bits);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (bits % 8 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CERTIFICATE_ERROR;
+    }
+
+  len = bits / 8;
+
+  if (*sizeof_sig < len)
+    {
+      *sizeof_sig = bits / 8;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  result = asn1_read_value (crl->crl, "signature", sig, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crl_get_version - This function returns the CRL's version number
+  * @crl: should contain a gnutls_x509_crl_t structure
+  *
+  * This function will return the version of the specified CRL.
+  *
+  * Returns a negative value on error.
+  *
+  **/
+int
+gnutls_x509_crl_get_version (gnutls_x509_crl_t crl)
+{
+  opaque version[5];
+  int len, result;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  len = sizeof (version);
+  if ((result =
+       asn1_read_value (crl->crl, "tbsCertList.version", version,
+                        &len)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return (int) version[0] + 1;
+}
+
+/**
+  * gnutls_x509_crl_get_this_update - This function returns the CRL's thisUpdate time
+  * @crl: should contain a gnutls_x509_crl_t structure
+  *
+  * This function will return the time this CRL was issued.
+  *
+  * Returns (time_t)-1 on error.
+  *
+  **/
+time_t
+gnutls_x509_crl_get_this_update (gnutls_x509_crl_t crl)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  return _gnutls_x509_get_time (crl->crl, "tbsCertList.thisUpdate");
+}
+
+/**
+  * gnutls_x509_crl_get_next_update - This function returns the CRL's nextUpdate time
+  * @crl: should contain a gnutls_x509_crl_t structure
+  *
+  * This function will return the time the next CRL will be issued.
+  * This field is optional in a CRL so it might be normal to get
+  * an error instead.
+  *
+  * Returns (time_t)-1 on error.
+  *
+  **/
+time_t
+gnutls_x509_crl_get_next_update (gnutls_x509_crl_t crl)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  return _gnutls_x509_get_time (crl->crl, "tbsCertList.nextUpdate");
+}
+
+/**
+  * gnutls_x509_crl_get_crt_count - This function returns the number of revoked certificates in a CRL
+  * @crl: should contain a gnutls_x509_crl_t structure
+  *
+  * This function will return the number of revoked certificates in the
+  * given CRL.
+  *
+  * Returns a negative value on failure.
+  *
+  **/
+int
+gnutls_x509_crl_get_crt_count (gnutls_x509_crl_t crl)
+{
+
+  int count, result;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result =
+    asn1_number_of_elements (crl->crl,
+                             "tbsCertList.revokedCertificates", &count);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return 0;                 /* no certificates */
+    }
+
+  return count;
+}
+
+/**
+  * gnutls_x509_crl_get_crt_serial - This function returns the serial number of a revoked certificate
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @indx: the index of the certificate to extract (starting from 0)
+  * @serial: where the serial number will be copied
+  * @serial_size: initially holds the size of serial
+  * @t: if non null, will hold the time this certificate was revoked
+  *
+  * This function will return the serial number of the specified, by
+  * the index, revoked certificate.
+  *
+  * Returns a negative value on failure.
+  *
+  **/
+int
+gnutls_x509_crl_get_crt_serial (gnutls_x509_crl_t crl, int indx,
+                                unsigned char *serial,
+                                size_t * serial_size, time_t * t)
+{
+
+  int result, _serial_size;
+  char serial_name[MAX_NAME_SIZE];
+  char date_name[MAX_NAME_SIZE];
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  snprintf (serial_name, sizeof (serial_name),
+            "tbsCertList.revokedCertificates.?%u.userCertificate", indx + 1);
+  snprintf (date_name, sizeof (date_name),
+            "tbsCertList.revokedCertificates.?%u.revocationDate", indx + 1);
+
+  _serial_size = *serial_size;
+  result = asn1_read_value (crl->crl, serial_name, serial, &_serial_size);
+
+  *serial_size = _serial_size;
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+      return _gnutls_asn2err (result);
+    }
+
+  if (t)
+    {
+      *t = _gnutls_x509_get_time (crl->crl, date_name);
+    }
+
+  return 0;
+}
+
+/*-
+  * _gnutls_x509_crl_get_raw_issuer_dn - This function returns the issuer's DN DER encoded
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @dn: will hold the starting point of the DN
+  *
+  * This function will return a pointer to the DER encoded DN structure and
+  * the length.
+  *
+  * Returns a negative value on error, and zero on success.
+  *
+  -*/
+int
+_gnutls_x509_crl_get_raw_issuer_dn (gnutls_x509_crl_t crl,
+                                    gnutls_datum_t * dn)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, len1;
+  int start1, end1;
+  gnutls_datum_t crl_signed_data;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* get the issuer of 'crl'
+   */
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (), "PKIX1.TBSCertList",
+                            &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    _gnutls_x509_get_signed_data (crl->crl, "tbsCertList", &crl_signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result =
+    asn1_der_decoding (&c2, crl_signed_data.data, crl_signed_data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result =
+    asn1_der_decoding_startEnd (c2, crl_signed_data.data,
+                                crl_signed_data.size, "issuer",
+                                &start1, &end1);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  len1 = end1 - start1 + 1;
+
+  _gnutls_set_datum (dn, &crl_signed_data.data[start1], len1);
+
+  result = 0;
+
+cleanup:
+  asn1_delete_structure (&c2);
+  _gnutls_free_datum (&crl_signed_data);
+  return result;
+}
+
+/**
+  * gnutls_x509_crl_export - This function will export the CRL
+  * @crl: Holds the revocation list
+  * @format: the format of output params. One of PEM or DER.
+  * @output_data: will contain a private key PEM or DER encoded
+  * @output_data_size: holds the size of output_data (and will be replaced by the actual size of parameters)
+  *
+  * This function will export the revocation list to DER or PEM format.
+  *
+  * If the buffer provided is not long enough to hold the output, then
+  * GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
+  *
+  * If the structure is PEM encoded, it will have a header
+  * of "BEGIN X509 CRL".
+  *
+  * Returns 0 on success, and a negative value on failure.
+  *
+  **/
+int
+gnutls_x509_crl_export (gnutls_x509_crl_t crl,
+                        gnutls_x509_crt_fmt_t format, void *output_data,
+                        size_t * output_data_size)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_export_int (crl->crl, format, PEM_CRL,
+                                  output_data, output_data_size);
+}
+
+/*-
+  * _gnutls_x509_crl_cpy - This function copies a gnutls_x509_crl_t structure
+  * @dest: The structure where to copy
+  * @src: The structure to be copied
+  *
+  * This function will copy an X.509 certificate structure. 
+  *
+  * Returns 0 on success.
+  *
+  -*/
+int
+_gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
+{
+  int ret;
+  size_t der_size;
+  opaque *der;
+  gnutls_datum_t tmp;
+
+  ret = gnutls_x509_crl_export (src, GNUTLS_X509_FMT_DER, NULL, &der_size);
+  if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  der = gnutls_alloca (der_size);
+  if (der == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  ret = gnutls_x509_crl_export (src, GNUTLS_X509_FMT_DER, der, &der_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (der);
+      return ret;
+    }
+
+  tmp.data = der;
+  tmp.size = der_size;
+  ret = gnutls_x509_crl_import (dest, &tmp, GNUTLS_X509_FMT_DER);
+
+  gnutls_afree (der);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+
+}
+
+#endif
diff --git a/src/daemon/https/x509/crl_write.c b/src/daemon/https/x509/crl_write.c
new file mode 100644
index 00000000..370a492c
--- /dev/null
+++ b/src/daemon/https/x509/crl_write.c
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains functions to handle CRL generation.
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <crq.h>
+#include <dn.h>
+#include <mpi.h>
+#include <sign.h>
+#include <extensions.h>
+#include <libtasn1.h>
+
+static void disable_optional_stuff (gnutls_x509_crl_t crl);
+
+/**
+  * gnutls_x509_crl_set_version - This function will set the CRL version
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @version: holds the version number. For CRLv1 crls must be 1.
+  *
+  * This function will set the version of the CRL. This
+  * must be one for CRL version 1, and so on. The CRLs generated
+  * by gnutls should have a version number of 2.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_set_version (gnutls_x509_crl_t crl, unsigned int version)
+{
+  int result;
+  char null = version;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  null -= 1;
+  if (null < 0)
+    null = 0;
+
+  result = asn1_write_value (crl->crl, "tbsCertList.version", &null, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crl_sign2 - This function will sign a CRL with a key
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @issuer: is the certificate of the certificate issuer
+  * @issuer_key: holds the issuer's private key
+  * @dig: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+  * @flags: must be 0
+  *
+  * This function will sign the CRL with the issuer's private key, and
+  * will copy the issuer's information into the CRL.
+  *
+  * This must be the last step in a certificate CRL since all
+  * the previously set parameters are now signed.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_sign2 (gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
+                       gnutls_x509_privkey_t issuer_key,
+                       gnutls_digest_algorithm_t dig, unsigned int flags)
+{
+  int result;
+
+  if (crl == NULL || issuer == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* disable all the unneeded OPTIONAL fields.
+   */
+  disable_optional_stuff (crl);
+
+  result = _gnutls_x509_pkix_sign (crl->crl, "tbsCertList",
+                                   dig, issuer, issuer_key);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crl_sign - This function will sign a CRL with a key
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @issuer: is the certificate of the certificate issuer
+  * @issuer_key: holds the issuer's private key
+  *
+  * This function is the same a gnutls_x509_crl_sign2() with no flags, and
+  * SHA1 as the hash algorithm.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crl_sign (gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer,
+                      gnutls_x509_privkey_t issuer_key)
+{
+  return gnutls_x509_crl_sign2 (crl, issuer, issuer_key, GNUTLS_DIG_SHA1, 0);
+}
+
+/**
+  * gnutls_x509_crl_set_this_update - This function will set the CRL's issuing time
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @act_time: The actual time
+  *
+  * This function will set the time this CRL was issued.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crl_set_this_update (gnutls_x509_crl_t crl, time_t act_time)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_set_time (crl->crl, "tbsCertList.thisUpdate", act_time);
+}
+
+/**
+  * gnutls_x509_crl_set_next_update - This function will set the CRL next update time
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @exp_time: The actual time
+  *
+  * This function will set the time this CRL will be updated.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crl_set_next_update (gnutls_x509_crl_t crl, time_t exp_time)
+{
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+  return _gnutls_x509_set_time (crl->crl, "tbsCertList.nextUpdate", exp_time);
+}
+
+/**
+  * gnutls_x509_crl_set_crt_serial - This function will set a revoked certificate's serial number
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @serial: The revoked certificate's serial number
+  * @serial_size: Holds the size of the serial field.
+  * @revocation_time: The time this certificate was revoked
+  *
+  * This function will set a revoked certificate's serial number to the CRL. 
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crl_set_crt_serial (gnutls_x509_crl_t crl,
+                                const void *serial, size_t serial_size,
+                                time_t revocation_time)
+{
+  int ret;
+
+  if (crl == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret =
+    asn1_write_value (crl->crl, "tbsCertList.revokedCertificates", "NEW", 1);
+  if (ret != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  ret =
+    asn1_write_value (crl->crl,
+                      "tbsCertList.revokedCertificates.?LAST.userCertificate",
+                      serial, serial_size);
+  if (ret != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  ret =
+    _gnutls_x509_set_time (crl->crl,
+                           "tbsCertList.revokedCertificates.?LAST.revocationDate",
+                           revocation_time);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret =
+    asn1_write_value (crl->crl,
+                      "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions",
+                      NULL, 0);
+  if (ret != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crl_set_crt - This function will set a revoked certificate's serial number
+  * @crl: should contain a gnutls_x509_crl_t structure
+  * @crt: should contain a gnutls_x509_crt_t structure with the revoked certificate
+  * @revocation_time: The time this certificate was revoked
+  *
+  * This function will set a revoked certificate's serial number to the CRL. 
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crl_set_crt (gnutls_x509_crl_t crl, gnutls_x509_crt_t crt,
+                         time_t revocation_time)
+{
+  int ret;
+  opaque serial[128];
+  size_t serial_size;
+
+  if (crl == NULL || crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  serial_size = sizeof (serial);
+  ret = gnutls_x509_crt_get_serial (crt, serial, &serial_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret =
+    gnutls_x509_crl_set_crt_serial (crl, serial, serial_size,
+                                    revocation_time);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  return 0;
+}
+
+
+/* If OPTIONAL fields have not been initialized then
+ * disable them.
+ */
+static void
+disable_optional_stuff (gnutls_x509_crl_t crl)
+{
+
+  asn1_write_value (crl->crl, "tbsCertList.crlExtensions", NULL, 0);
+
+  return;
+}
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/crq.c b/src/daemon/https/x509/crq.c
new file mode 100644
index 00000000..8e663d51
--- /dev/null
+++ b/src/daemon/https/x509/crq.c
@@ -0,0 +1,887 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains functions to handle PKCS #10 certificate requests.
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <crq.h>
+#include <dn.h>
+#include <mpi.h>
+#include <sign.h>
+#include <extensions.h>
+#include <libtasn1.h>
+
+/**
+  * gnutls_x509_crq_init - This function initializes a gnutls_x509_crq_t structure
+  * @crq: The structure to be initialized
+  *
+  * This function will initialize a PKCS10 certificate request structure. 
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_init (gnutls_x509_crq_t * crq)
+{
+  *crq = gnutls_calloc (1, sizeof (gnutls_x509_crq_int));
+
+  if (*crq)
+    {
+      int result = asn1_create_element (_gnutls_get_pkix (),
+                                        "PKIX1.pkcs-10-CertificationRequest",
+                                        &((*crq)->crq));
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          gnutls_free (*crq);
+          return _gnutls_asn2err (result);
+        }
+      return 0;                 /* success */
+    }
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+  * gnutls_x509_crq_deinit - This function deinitializes memory used by a gnutls_x509_crq_t structure
+  * @crq: The structure to be initialized
+  *
+  * This function will deinitialize a CRL structure. 
+  *
+  **/
+void
+gnutls_x509_crq_deinit (gnutls_x509_crq_t crq)
+{
+  if (!crq)
+    return;
+
+  if (crq->crq)
+    asn1_delete_structure (&crq->crq);
+
+  gnutls_free (crq);
+}
+
+#define PEM_CRQ "NEW CERTIFICATE REQUEST"
+#define PEM_CRQ2 "CERTIFICATE REQUEST"
+
+/**
+  * gnutls_x509_crq_import - This function will import a DER or PEM encoded Certificate request
+  * @crq: The structure to store the parsed certificate request.
+  * @data: The DER or PEM encoded certificate.
+  * @format: One of DER or PEM
+  *
+  * This function will convert the given DER or PEM encoded Certificate
+  * to the native gnutls_x509_crq_t format. The output will be stored in @cert.
+  *
+  * If the Certificate is PEM encoded it should have a header of "NEW CERTIFICATE REQUEST".
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_import (gnutls_x509_crq_t crq,
+                        const gnutls_datum_t * data,
+                        gnutls_x509_crt_fmt_t format)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  /* If the Certificate is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      /* Try the first header */
+      result = _gnutls_fbase64_decode (PEM_CRQ, data->data, data->size, &out);
+
+      if (result <= 0)          /* Go for the second header */
+        result =
+          _gnutls_fbase64_decode (PEM_CRQ2, data->data, data->size, &out);
+
+      if (result <= 0)
+        {
+          if (result == 0)
+            result = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_assert ();
+          return result;
+        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+  result = asn1_der_decoding (&crq->crq, _data.data, _data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = 0;
+
+cleanup:
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+
+
+/**
+  * gnutls_x509_crq_get_dn - This function returns the Certificate request subject's distinguished name
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @buf: a pointer to a structure to hold the name (may be null)
+  * @sizeof_buf: initially holds the size of @buf
+  *
+  * This function will copy the name of the Certificate request
+  * subject in the provided buffer. The name will be in the form
+  * "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+  * will be ASCII or UTF-8 encoded, depending on the certificate data.
+  *
+  * If @buf is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+  * long enough, and in that case the *sizeof_buf will be updated with
+  * the required size.  On success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_crq_get_dn (gnutls_x509_crq_t crq, char *buf, size_t * sizeof_buf)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn (crq->crq,
+                                "certificationRequestInfo.subject.rdnSequence",
+                                buf, sizeof_buf);
+}
+
+/**
+  * gnutls_x509_crq_get_dn_by_oid - This function returns the Certificate request subject's distinguished name
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @oid: holds an Object Identified in null terminated string
+  * @indx: In case multiple same OIDs exist in the RDN, this specifies
+  *   which to send. Use zero to get the first one.
+  * @raw_flag: If non zero returns the raw DER data of the DN part.
+  * @buf: a pointer to a structure to hold the name (may be null)
+  * @sizeof_buf: initially holds the size of @buf
+  *
+  * This function will extract the part of the name of the Certificate
+  * request subject, specified by the given OID. The output will be
+  * encoded as described in RFC2253. The output string will be ASCII
+  * or UTF-8 encoded, depending on the certificate data.
+  *
+  * Some helper macros with popular OIDs can be found in gnutls/x509.h
+  * If raw flag is zero, this function will only return known OIDs as
+  * text. Other OIDs will be DER encoded, as described in RFC2253 --
+  * in hex format with a '\#' prefix.  You can check about known OIDs
+  * using gnutls_x509_dn_oid_known().
+  *
+  * If @buf is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+  * long enough, and in that case the *sizeof_buf will be updated with
+  * the required size.  On success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_crq_get_dn_by_oid (gnutls_x509_crq_t crq, const char *oid,
+                               int indx, unsigned int raw_flag,
+                               void *buf, size_t * sizeof_buf)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn_oid (crq->crq,
+                                    "certificationRequestInfo.subject.rdnSequence",
+                                    oid, indx, raw_flag, buf, sizeof_buf);
+}
+
+/**
+  * gnutls_x509_crq_get_dn_oid - This function returns the Certificate request subject's distinguished name OIDs
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @indx: Specifies which DN OID to send. Use zero to get the first one.
+  * @oid: a pointer to a structure to hold the name (may be null)
+  * @sizeof_oid: initially holds the size of @oid
+  *
+  * This function will extract the requested OID of the name of the
+  * Certificate request subject, specified by the given index.
+  *
+  * If oid is null then only the size will be filled.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+  * long enough, and in that case the *sizeof_oid will be updated with
+  * the required size.  On success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_crq_get_dn_oid (gnutls_x509_crq_t crq,
+                            int indx, void *oid, size_t * sizeof_oid)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_get_dn_oid (crq->crq,
+                                  "certificationRequestInfo.subject.rdnSequence",
+                                  indx, oid, sizeof_oid);
+}
+
+/* Parses an Attribute list in the asn1_struct, and searches for the
+ * given OID. The index indicates the attribute value to be returned.
+ *
+ * If raw==0 only printable data are returned, or GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE.
+ *
+ * asn1_attr_name must be a string in the form "certificationRequestInfo.attributes"
+ *
+ */
+static int
+parse_attribute (ASN1_TYPE asn1_struct,
+                 const char *attr_name, const char *given_oid, int indx,
+                 int raw, char *buf, size_t * sizeof_buf)
+{
+  int k1, result;
+  char tmpbuffer1[MAX_NAME_SIZE];
+  char tmpbuffer3[MAX_NAME_SIZE];
+  char value[200];
+  char oid[128];
+  int len, printable;
+
+  if (*sizeof_buf == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  buf[0] = 0;
+
+  k1 = 0;
+  do
+    {
+
+      k1++;
+      /* create a string like "attribute.?1"
+       */
+      if (attr_name[0] != 0)
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", attr_name, k1);
+      else
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
+
+      len = sizeof (value) - 1;
+      result = asn1_read_value (asn1_struct, tmpbuffer1, value, &len);
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          gnutls_assert ();
+          break;
+        }
+
+      if (result != ASN1_VALUE_NOT_FOUND)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      /* Move to the attibute type and values
+       */
+      /* Read the OID 
+       */
+      _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer1);
+      _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".type");
+
+      len = sizeof (oid) - 1;
+      result = asn1_read_value (asn1_struct, tmpbuffer3, oid, &len);
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        break;
+      else if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      if (strcmp (oid, given_oid) == 0)
+        {                       /* Found the OID */
+
+          /* Read the Value 
+           */
+          snprintf (tmpbuffer3, sizeof (tmpbuffer3), "%s.values.?%u",
+                    tmpbuffer1, indx + 1);
+
+          len = sizeof (value) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer3, value, &len);
+
+          if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          if (raw == 0)
+            {
+              printable = _gnutls_x509_oid_data_printable (oid);
+              if (printable == 1)
+                {
+                  if ((result =
+                       _gnutls_x509_oid_data2string
+                       (oid, value, len, buf, sizeof_buf)) < 0)
+                    {
+                      gnutls_assert ();
+                      goto cleanup;
+                    }
+                  return 0;
+                }
+              else
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE;
+                }
+            }
+          else
+            {                   /* raw!=0 */
+              if (*sizeof_buf > (size_t) len && buf != NULL)
+                {
+                  *sizeof_buf = len;
+                  memcpy (buf, value, len);
+
+                  return 0;
+                }
+              else
+                {
+                  *sizeof_buf = len;
+                  gnutls_assert ();
+                  return GNUTLS_E_SHORT_MEMORY_BUFFER;
+                }
+            }
+        }
+
+    }
+  while (1);
+
+  gnutls_assert ();
+
+  result = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+
+cleanup:
+  return result;
+}
+
+/**
+  * gnutls_x509_crq_get_challenge_password - This function will get the challenge password 
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @pass: will hold a null terminated password
+  * @sizeof_pass: Initially holds the size of @pass.
+  *
+  * This function will return the challenge password in the
+  * request.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_get_challenge_password (gnutls_x509_crq_t crq,
+                                        char *pass, size_t * sizeof_pass)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return parse_attribute (crq->crq, "certificationRequestInfo.attributes",
+                          "1.2.840.113549.1.9.7", 0, 0, pass, sizeof_pass);
+}
+
+/**
+  * gnutls_x509_crq_set_attribute_by_oid - This function will set an attribute in the request
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @oid: holds an Object Identified in null terminated string
+  * @buf: a pointer to a structure that holds the attribute data
+  * @sizeof_buf: holds the size of @buf
+  *
+  * This function will set the attribute in the certificate request specified
+  * by the given Object ID. The attribute must be be DER encoded.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_set_attribute_by_oid (gnutls_x509_crq_t crq,
+                                      const char *oid, void *buf,
+                                      size_t sizeof_buf)
+{
+  int result;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Add the attribute.
+   */
+  result =
+    asn1_write_value (crq->crq, "certificationRequestInfo.attributes",
+                      "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    _gnutls_x509_encode_and_write_attribute (oid,
+                                             crq->crq,
+                                             "certificationRequestInfo.attributes.?LAST",
+                                             buf, sizeof_buf, 1);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crq_get_attribute_by_oid - This function will get an attribute of the request 
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @oid: holds an Object Identified in null terminated string
+  * @indx: In case multiple same OIDs exist in the attribute list, this specifies
+  *   which to send. Use zero to get the first one.
+  * @buf: a pointer to a structure to hold the attribute data (may be null)
+  * @sizeof_buf: initially holds the size of @buf
+  *
+  * This function will return the attribute in the certificate request specified
+  * by the given Object ID. The attribute will be DER encoded.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_get_attribute_by_oid (gnutls_x509_crq_t crq,
+                                      const char *oid, int indx, void *buf,
+                                      size_t * sizeof_buf)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return parse_attribute (crq->crq, "certificationRequestInfo.attributes",
+                          oid, indx, 1, buf, sizeof_buf);
+}
+
+/**
+  * gnutls_x509_crq_set_dn_by_oid - This function will set the Certificate request subject's distinguished name
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @oid: holds an Object Identifier in a null terminated string
+  * @raw_flag: must be 0, or 1 if the data are DER encoded
+  * @data: a pointer to the input data
+  * @sizeof_data: holds the size of @data
+  *
+  * This function will set the part of the name of the Certificate request subject, specified
+  * by the given OID. The input string should be ASCII or UTF-8 encoded.
+  *
+  * Some helper macros with popular OIDs can be found in gnutls/x509.h
+  * With this function you can only set the known OIDs. You can test
+  * for known OIDs using gnutls_x509_dn_oid_known(). For OIDs that are
+  * not known (by gnutls) you should properly DER encode your data, and
+  * call this function with raw_flag set.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_set_dn_by_oid (gnutls_x509_crq_t crq, const char *oid,
+                               unsigned int raw_flag, const void *data,
+                               unsigned int sizeof_data)
+{
+  if (sizeof_data == 0 || data == NULL || crq == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_set_dn_oid (crq->crq,
+                                  "certificationRequestInfo.subject", oid,
+                                  raw_flag, data, sizeof_data);
+}
+
+/**
+  * gnutls_x509_crq_set_version - This function will set the Certificate request version
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @version: holds the version number. For v1 Requests must be 1.
+  *
+  * This function will set the version of the certificate request. For
+  * version 1 requests this must be one.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_set_version (gnutls_x509_crq_t crq, unsigned int version)
+{
+  int result;
+  unsigned char null = version;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (null > 0)
+    null--;
+
+  result =
+    asn1_write_value (crq->crq, "certificationRequestInfo.version", &null, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crq_get_version - This function returns the Certificate request's version number
+  * @crq: should contain a gnutls_x509_crq_t structure
+  *
+  * This function will return the version of the specified Certificate request.
+  *
+  * Returns a negative value on error.
+  *
+  **/
+int
+gnutls_x509_crq_get_version (gnutls_x509_crq_t crq)
+{
+  opaque version[5];
+  int len, result;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  len = sizeof (version);
+  if ((result =
+       asn1_read_value (crq->crq, "certificationRequestInfo.version",
+                        version, &len)) != ASN1_SUCCESS)
+    {
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        return 1;               /* the DEFAULT version */
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return (int) version[0] + 1;
+}
+
+/**
+  * gnutls_x509_crq_set_key - This function will associate the Certificate request with a key
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @key: holds a private key
+  *
+  * This function will set the public parameters from the given private key to the
+  * request. Only RSA keys are currently supported.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_set_key (gnutls_x509_crq_t crq, gnutls_x509_privkey_t key)
+{
+  int result;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_encode_and_copy_PKI_params (crq->crq,
+                                                    "certificationRequestInfo.subjectPKInfo",
+                                                    key->pk_algorithm,
+                                                    key->params,
+                                                    key->params_size);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crq_set_challenge_password - This function will set a challenge password 
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @pass: holds a null terminated password
+  *
+  * This function will set a challenge password to be used when revoking the request.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_set_challenge_password (gnutls_x509_crq_t crq,
+                                        const char *pass)
+{
+  int result;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Add the attribute.
+   */
+  result =
+    asn1_write_value (crq->crq, "certificationRequestInfo.attributes",
+                      "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    _gnutls_x509_encode_and_write_attribute ("1.2.840.113549.1.9.7",
+                                             crq->crq,
+                                             "certificationRequestInfo.attributes.?LAST",
+                                             pass, strlen (pass), 1);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crq_sign2 - This function will sign a Certificate request with a key
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @key: holds a private key
+  * @dig: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+  * @flags: must be 0
+  *
+  * This function will sign the certificate request with a private key.
+  * This must be the same key as the one used in gnutls_x509_crt_set_key() since a
+  * certificate request is self signed.
+  *
+  * This must be the last step in a certificate request generation since all
+  * the previously set parameters are now signed.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_sign2 (gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
+                       gnutls_digest_algorithm_t dig, unsigned int flags)
+{
+  int result;
+  gnutls_datum_t signature;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Step 1. Self sign the request.
+   */
+  result =
+    _gnutls_x509_sign_tbs (crq->crq, "certificationRequestInfo",
+                           dig, key, &signature);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. write the signature (bits)
+   */
+  result =
+    asn1_write_value (crq->crq, "signature", signature.data,
+                      signature.size * 8);
+
+  _gnutls_free_datum (&signature);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* Step 3. Write the signatureAlgorithm field.
+   */
+  result = _gnutls_x509_write_sig_params (crq->crq, "signatureAlgorithm",
+                                          key->pk_algorithm, dig, key->params,
+                                          key->params_size);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crq_sign - This function will sign a Certificate request with a key
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @key: holds a private key
+  *
+  * This function is the same a gnutls_x509_crq_sign2() with no flags, and
+  * SHA1 as the hash algorithm.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_sign (gnutls_x509_crq_t crq, gnutls_x509_privkey_t key)
+{
+  return gnutls_x509_crq_sign2 (crq, key, GNUTLS_DIG_SHA1, 0);
+}
+
+/**
+  * gnutls_x509_crq_export - Export the generated certificate request
+  * @crq: Holds the request
+  * @format: the format of output params. One of PEM or DER.
+  * @output_data: will contain a certificate request PEM or DER encoded
+  * @output_data_size: holds the size of output_data (and will be
+  *   replaced by the actual size of parameters)
+  *
+  * This function will export the certificate request to a PKCS10
+  *
+  * If the buffer provided is not long enough to hold the output, then
+  * GNUTLS_E_SHORT_MEMORY_BUFFER will be returned and
+  * *output_data_size will be updated.
+  *
+  * If the structure is PEM encoded, it will have a header of "BEGIN
+  * NEW CERTIFICATE REQUEST".
+  *
+  * Return value: In case of failure a negative value will be
+  *   returned, and 0 on success.
+  *
+  **/
+int
+gnutls_x509_crq_export (gnutls_x509_crq_t crq,
+                        gnutls_x509_crt_fmt_t format, void *output_data,
+                        size_t * output_data_size)
+{
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_export_int (crq->crq, format, PEM_CRQ,
+                                  output_data, output_data_size);
+}
+
+/**
+  * gnutls_x509_crq_get_pk_algorithm - This function returns the certificate request's PublicKey algorithm
+  * @crq: should contain a gnutls_x509_crq_t structure
+  * @bits: if bits is non null it will hold the size of the parameters' in bits
+  *
+  * This function will return the public key algorithm of a PKCS \#10 
+  * certificate request.
+  *
+  * If bits is non null, it should have enough size to hold the parameters
+  * size in bits. For RSA the bits returned is the modulus. 
+  * For DSA the bits returned are of the public
+  * exponent.
+  *
+  * Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+  * or a negative value on error.
+  *
+  **/
+int
+gnutls_x509_crq_get_pk_algorithm (gnutls_x509_crq_t crq, unsigned int *bits)
+{
+  int result;
+
+  if (crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result =
+    _gnutls_x509_get_pk_algorithm (crq->crq,
+                                   "certificationRequestInfo.subjectPKInfo",
+                                   bits);
+  if (result < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return result;
+}
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/crq.h b/src/daemon/https/x509/crq.h
new file mode 100644
index 00000000..80e600b5
--- /dev/null
+++ b/src/daemon/https/x509/crq.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <x509.h>
+
+typedef struct gnutls_x509_crq_int
+{
+  ASN1_TYPE crq;
+} gnutls_x509_crq_int;
diff --git a/src/daemon/https/x509/dn.c b/src/daemon/https/x509/dn.c
new file mode 100644
index 00000000..c356aac1
--- /dev/null
+++ b/src/daemon/https/x509/dn.c
@@ -0,0 +1,1140 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007  Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <gnutls_str.h>
+#include <common.h>
+#include <gnutls_num.h>
+#include <dn.h>
+
+/* This file includes all the required to parse an X.509 Distriguished
+ * Name (you need a parser just to read a name in the X.509 protoocols!!!)
+ */
+
+/* Converts the given OID to an ldap acceptable string or
+ * a dotted OID. 
+ */
+static const char *
+oid2ldap_string (const char *oid)
+{
+  const char *ret;
+
+  ret = _gnutls_x509_oid2ldap_string (oid);
+  if (ret)
+    return ret;
+
+  /* else return the OID in dotted format */
+  return oid;
+}
+
+/* Escapes a string following the rules from RFC2253.
+ */
+static char *
+str_escape (char *str, char *buffer, unsigned int buffer_size)
+{
+  int str_length, j, i;
+
+  if (str == NULL || buffer == NULL)
+    return NULL;
+
+  str_length = MIN (strlen (str), buffer_size - 1);
+
+  for (i = j = 0; i < str_length; i++)
+    {
+      if (str[i] == ',' || str[i] == '+' || str[i] == '"'
+          || str[i] == '\\' || str[i] == '<' || str[i] == '>'
+          || str[i] == ';')
+        buffer[j++] = '\\';
+
+      buffer[j++] = str[i];
+    }
+
+  /* null terminate the string */
+  buffer[j] = 0;
+
+  return buffer;
+}
+
+/* Parses an X509 DN in the asn1_struct, and puts the output into
+ * the string buf. The output is an LDAP encoded DN.
+ *
+ * asn1_rdn_name must be a string in the form "tbsCertificate.issuer.rdnSequence".
+ * That is to point in the rndSequence.
+ */
+int
+_gnutls_x509_parse_dn (ASN1_TYPE asn1_struct,
+                       const char *asn1_rdn_name, char *buf,
+                       size_t * sizeof_buf)
+{
+  gnutls_string out_str;
+  int k2, k1, result;
+  char tmpbuffer1[MAX_NAME_SIZE];
+  char tmpbuffer2[MAX_NAME_SIZE];
+  char tmpbuffer3[MAX_NAME_SIZE];
+  opaque value[MAX_STRING_LEN], *value2 = NULL;
+  char *escaped = NULL;
+  const char *ldap_desc;
+  char oid[128];
+  int len, printable;
+  char *string = NULL;
+  size_t sizeof_string, sizeof_escaped;
+
+  if (sizeof_buf == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (*sizeof_buf > 0 && buf)
+    buf[0] = 0;
+  else
+    *sizeof_buf = 0;
+
+  _gnutls_string_init (&out_str, gnutls_malloc, gnutls_realloc, gnutls_free);
+
+  k1 = 0;
+  do
+    {
+
+      k1++;
+      /* create a string like "tbsCertList.issuer.rdnSequence.?1"
+       */
+      if (asn1_rdn_name[0] != 0)
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", asn1_rdn_name,
+                  k1);
+      else
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
+
+      len = sizeof (value) - 1;
+      result = asn1_read_value (asn1_struct, tmpbuffer1, value, &len);
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          break;
+        }
+
+      if (result != ASN1_VALUE_NOT_FOUND)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      k2 = 0;
+
+      do
+        {                       /* Move to the attibute type and values
+                                 */
+          k2++;
+
+          if (tmpbuffer1[0] != 0)
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "%s.?%u", tmpbuffer1,
+                      k2);
+          else
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "?%u", k2);
+
+          /* Try to read the RelativeDistinguishedName attributes.
+           */
+
+          len = sizeof (value) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer2, value, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            break;
+          if (result != ASN1_VALUE_NOT_FOUND)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          /* Read the OID 
+           */
+          _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer2);
+          _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".type");
+
+          len = sizeof (oid) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer3, oid, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            break;
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          /* Read the Value 
+           */
+          _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer2);
+          _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".value");
+
+          len = 0;
+          result = asn1_read_value (asn1_struct, tmpbuffer3, NULL, &len);
+
+          value2 = gnutls_malloc (len);
+          if (value2 == NULL)
+            {
+              gnutls_assert ();
+              result = GNUTLS_E_MEMORY_ERROR;
+              goto cleanup;
+            }
+
+          result = asn1_read_value (asn1_struct, tmpbuffer3, value2, &len);
+
+          if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+#define STR_APPEND(y) if ((result=_gnutls_string_append_str( &out_str, y)) < 0) { \
+        gnutls_assert(); \
+        goto cleanup; \
+}
+          /*   The encodings of adjoining RelativeDistinguishedNames are separated
+           *   by a comma character (',' ASCII 44).
+           */
+
+          /*   Where there is a multi-valued RDN, the outputs from adjoining
+           *   AttributeTypeAndValues are separated by a plus ('+' ASCII 43)
+           *   character.
+           */
+          if (k1 != 1)
+            {                   /* the first time do not append a comma */
+              if (k2 != 1)
+                {               /* adjoining multi-value RDN */
+                  STR_APPEND ("+");
+                }
+              else
+                {
+                  STR_APPEND (",");
+                }
+            }
+
+          ldap_desc = oid2ldap_string (oid);
+          printable = _gnutls_x509_oid_data_printable (oid);
+
+          sizeof_escaped = 2 * len + 1;
+
+          escaped = gnutls_malloc (sizeof_escaped);
+          if (escaped == NULL)
+            {
+              gnutls_assert ();
+              result = GNUTLS_E_MEMORY_ERROR;
+              goto cleanup;
+            }
+
+          sizeof_string = 2 * len + 2;  /* in case it is not printable */
+
+          string = gnutls_malloc (sizeof_string);
+          if (string == NULL)
+            {
+              gnutls_assert ();
+              result = GNUTLS_E_MEMORY_ERROR;
+              goto cleanup;
+            }
+
+          STR_APPEND (ldap_desc);
+          STR_APPEND ("=");
+          result = 0;
+
+          if (printable)
+            result =
+              _gnutls_x509_oid_data2string (oid,
+                                            value2, len,
+                                            string, &sizeof_string);
+
+          if (!printable || result < 0)
+            result =
+              _gnutls_x509_data2hex (value2, len, string, &sizeof_string);
+
+          if (result < 0)
+            {
+              gnutls_assert ();
+              _gnutls_x509_log
+                ("Found OID: '%s' with value '%s'\n",
+                 oid, _gnutls_bin2hex (value2, len, escaped, sizeof_escaped));
+              goto cleanup;
+            }
+          STR_APPEND (str_escape (string, escaped, sizeof_escaped));
+          gnutls_free (string);
+          string = NULL;
+
+          gnutls_free (escaped);
+          escaped = NULL;
+          gnutls_free (value2);
+          value2 = NULL;
+
+        }
+      while (1);
+
+    }
+  while (1);
+
+  if (out_str.length >= (unsigned int) *sizeof_buf)
+    {
+      gnutls_assert ();
+      *sizeof_buf = out_str.length + 1;
+      result = GNUTLS_E_SHORT_MEMORY_BUFFER;
+      goto cleanup;
+    }
+
+  if (buf)
+    {
+      memcpy (buf, out_str.data, out_str.length);
+      buf[out_str.length] = 0;
+    }
+  *sizeof_buf = out_str.length;
+
+  result = 0;
+
+cleanup:
+  gnutls_free (value2);
+  gnutls_free (string);
+  gnutls_free (escaped);
+  _gnutls_string_clear (&out_str);
+  return result;
+}
+
+/* Parses an X509 DN in the asn1_struct, and searches for the
+ * given OID in the DN.
+ *
+ * If raw_flag == 0, the output will be encoded in the LDAP way. (#hex for non printable)
+ * Otherwise the raw DER data are returned.
+ *
+ * asn1_rdn_name must be a string in the form "tbsCertificate.issuer.rdnSequence".
+ * That is to point in the rndSequence.
+ *
+ * indx specifies which OID to return. Ie 0 means return the first specified
+ * OID found, 1 the second etc.
+ */
+int
+_gnutls_x509_parse_dn_oid (ASN1_TYPE asn1_struct,
+                           const char *asn1_rdn_name,
+                           const char *given_oid, int indx,
+                           unsigned int raw_flag,
+                           void *buf, size_t * sizeof_buf)
+{
+  int k2, k1, result;
+  char tmpbuffer1[MAX_NAME_SIZE];
+  char tmpbuffer2[MAX_NAME_SIZE];
+  char tmpbuffer3[MAX_NAME_SIZE];
+  opaque value[256];
+  char oid[128];
+  int len, printable;
+  int i = 0;
+  char *cbuf = buf;
+
+  if (cbuf == NULL)
+    *sizeof_buf = 0;
+  else
+    cbuf[0] = 0;
+
+  k1 = 0;
+  do
+    {
+
+      k1++;
+      /* create a string like "tbsCertList.issuer.rdnSequence.?1"
+       */
+      if (asn1_rdn_name[0] != 0)
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", asn1_rdn_name,
+                  k1);
+      else
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
+
+      len = sizeof (value) - 1;
+      result = asn1_read_value (asn1_struct, tmpbuffer1, value, &len);
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          gnutls_assert ();
+          break;
+        }
+
+      if (result != ASN1_VALUE_NOT_FOUND)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      k2 = 0;
+
+      do
+        {                       /* Move to the attibute type and values
+                                 */
+          k2++;
+
+          if (tmpbuffer1[0] != 0)
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "%s.?%u", tmpbuffer1,
+                      k2);
+          else
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "?%u", k2);
+
+          /* Try to read the RelativeDistinguishedName attributes.
+           */
+
+          len = sizeof (value) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer2, value, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            {
+              break;
+            }
+          if (result != ASN1_VALUE_NOT_FOUND)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          /* Read the OID 
+           */
+          _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer2);
+          _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".type");
+
+          len = sizeof (oid) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer3, oid, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            break;
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          if (strcmp (oid, given_oid) == 0 && indx == i++)
+            {                   /* Found the OID */
+
+              /* Read the Value 
+               */
+              _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer2);
+              _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".value");
+
+              len = *sizeof_buf;
+              result = asn1_read_value (asn1_struct, tmpbuffer3, buf, &len);
+
+              if (result != ASN1_SUCCESS)
+                {
+                  gnutls_assert ();
+                  if (result == ASN1_MEM_ERROR)
+                    *sizeof_buf = len;
+                  result = _gnutls_asn2err (result);
+                  goto cleanup;
+                }
+
+              if (raw_flag != 0)
+                {
+                  if ((unsigned) len > *sizeof_buf)
+                    {
+                      *sizeof_buf = len;
+                      result = GNUTLS_E_SHORT_MEMORY_BUFFER;
+                      goto cleanup;
+                    }
+                  *sizeof_buf = len;
+
+                  return 0;
+
+                }
+              else
+                {               /* parse data. raw_flag == 0 */
+                  printable = _gnutls_x509_oid_data_printable (oid);
+
+                  if (printable == 1)
+                    result =
+                      _gnutls_x509_oid_data2string (oid, buf, len,
+                                                    cbuf, sizeof_buf);
+                  else
+                    result =
+                      _gnutls_x509_data2hex (buf, len, cbuf, sizeof_buf);
+
+                  if (result < 0)
+                    {
+                      gnutls_assert ();
+                      goto cleanup;
+                    }
+
+                  return 0;
+
+                }               /* raw_flag == 0 */
+            }
+        }
+      while (1);
+
+    }
+  while (1);
+
+  gnutls_assert ();
+
+  result = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+
+cleanup:
+  return result;
+}
+
+
+/* Parses an X509 DN in the asn1_struct, and returns the requested
+ * DN OID.
+ *
+ * asn1_rdn_name must be a string in the form "tbsCertificate.issuer.rdnSequence".
+ * That is to point in the rndSequence.
+ *
+ * indx specifies which OID to return. Ie 0 means return the first specified
+ * OID found, 1 the second etc.
+ */
+int
+_gnutls_x509_get_dn_oid (ASN1_TYPE asn1_struct,
+                         const char *asn1_rdn_name,
+                         int indx, void *_oid, size_t * sizeof_oid)
+{
+  int k2, k1, result;
+  char tmpbuffer1[MAX_NAME_SIZE];
+  char tmpbuffer2[MAX_NAME_SIZE];
+  char tmpbuffer3[MAX_NAME_SIZE];
+  char value[256];
+  char oid[128];
+  int len;
+  int i = 0;
+
+  k1 = 0;
+  do
+    {
+
+      k1++;
+      /* create a string like "tbsCertList.issuer.rdnSequence.?1"
+       */
+      if (asn1_rdn_name[0] != 0)
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", asn1_rdn_name,
+                  k1);
+      else
+        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
+
+      len = sizeof (value) - 1;
+      result = asn1_read_value (asn1_struct, tmpbuffer1, value, &len);
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          gnutls_assert ();
+          break;
+        }
+
+      if (result != ASN1_VALUE_NOT_FOUND)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      k2 = 0;
+
+      do
+        {                       /* Move to the attibute type and values
+                                 */
+          k2++;
+
+          if (tmpbuffer1[0] != 0)
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "%s.?%u", tmpbuffer1,
+                      k2);
+          else
+            snprintf (tmpbuffer2, sizeof (tmpbuffer2), "?%u", k2);
+
+          /* Try to read the RelativeDistinguishedName attributes.
+           */
+
+          len = sizeof (value) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer2, value, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            {
+              break;
+            }
+          if (result != ASN1_VALUE_NOT_FOUND)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          /* Read the OID 
+           */
+          _gnutls_str_cpy (tmpbuffer3, sizeof (tmpbuffer3), tmpbuffer2);
+          _gnutls_str_cat (tmpbuffer3, sizeof (tmpbuffer3), ".type");
+
+          len = sizeof (oid) - 1;
+          result = asn1_read_value (asn1_struct, tmpbuffer3, oid, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            break;
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              result = _gnutls_asn2err (result);
+              goto cleanup;
+            }
+
+          if (indx == i++)
+            {                   /* Found the OID */
+
+              len = strlen (oid) + 1;
+
+              if (*sizeof_oid < (unsigned) len)
+                {
+                  *sizeof_oid = len;
+                  gnutls_assert ();
+                  return GNUTLS_E_SHORT_MEMORY_BUFFER;
+                }
+
+              memcpy (_oid, oid, len);
+              *sizeof_oid = len - 1;
+
+              return 0;
+            }
+        }
+      while (1);
+
+    }
+  while (1);
+
+  gnutls_assert ();
+
+  result = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+
+cleanup:
+  return result;
+}
+
+/* This will encode and write the AttributeTypeAndValue field.
+ * 'multi' must be zero if writing an AttributeTypeAndValue, and 1 if Attribute.
+ * In all cases only one value is written.
+ */
+int
+_gnutls_x509_encode_and_write_attribute (const char *given_oid,
+                                         ASN1_TYPE asn1_struct,
+                                         const char *where,
+                                         const void *_data,
+                                         int sizeof_data, int multi)
+{
+  const char *val_name;
+  const opaque *data = _data;
+  char tmp[128];
+  ASN1_TYPE c2;
+  int result;
+
+
+  /* Find how to encode the data.
+   */
+  val_name = asn1_find_structure_from_oid (_gnutls_get_pkix (), given_oid);
+  if (val_name == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_X509_UNSUPPORTED_OID;
+    }
+
+  _gnutls_str_cpy (tmp, sizeof (tmp), "PKIX1.");
+  _gnutls_str_cat (tmp, sizeof (tmp), val_name);
+
+  result = asn1_create_element (_gnutls_get_pkix (), tmp, &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  tmp[0] = 0;
+
+  if ((result = _gnutls_x509_oid_data_choice (given_oid)) > 0)
+    {
+      char *string_type;
+      int i;
+
+      string_type = "printableString";
+
+      /* Check if the data is plain ascii, and use
+       * the UTF8 string type if not.
+       */
+      for (i = 0; i < sizeof_data; i++)
+        {
+          if (!isascii (data[i]))
+            {
+              string_type = "utf8String";
+              break;
+            }
+        }
+
+      /* if the type is a CHOICE then write the
+       * type we'll use.
+       */
+      result = asn1_write_value (c2, "", string_type, 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          asn1_delete_structure (&c2);
+          return _gnutls_asn2err (result);
+        }
+
+      _gnutls_str_cpy (tmp, sizeof (tmp), string_type);
+    }
+
+  result = asn1_write_value (c2, tmp, data, sizeof_data);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+
+  /* write the data (value)
+   */
+
+  _gnutls_str_cpy (tmp, sizeof (tmp), where);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".value");
+
+  if (multi != 0)
+    {                           /* if not writing an AttributeTypeAndValue, but an Attribute */
+      _gnutls_str_cat (tmp, sizeof (tmp), "s"); /* values */
+
+      result = asn1_write_value (asn1_struct, tmp, "NEW", 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      _gnutls_str_cat (tmp, sizeof (tmp), ".?LAST");
+
+    }
+
+  result = _gnutls_x509_der_encode_and_copy (c2, "", asn1_struct, tmp, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* write the type
+   */
+  _gnutls_str_cpy (tmp, sizeof (tmp), where);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".type");
+
+  result = asn1_write_value (asn1_struct, tmp, given_oid, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/* This will write the AttributeTypeAndValue field. The data must be already DER encoded.
+ * 'multi' must be zero if writing an AttributeTypeAndValue, and 1 if Attribute.
+ * In all cases only one value is written.
+ */
+int
+_gnutls_x509_write_attribute (const char *given_oid,
+                              ASN1_TYPE asn1_struct, const char *where,
+                              const void *_data, int sizeof_data, int multi)
+{
+  char tmp[128];
+  int result;
+
+  /* write the data (value)
+   */
+
+  _gnutls_str_cpy (tmp, sizeof (tmp), where);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".value");
+
+  if (multi != 0)
+    {                           /* if not writing an AttributeTypeAndValue, but an Attribute */
+      _gnutls_str_cat (tmp, sizeof (tmp), "s"); /* values */
+
+      result = asn1_write_value (asn1_struct, tmp, "NEW", 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      _gnutls_str_cat (tmp, sizeof (tmp), ".?LAST");
+
+    }
+
+  result = asn1_write_value (asn1_struct, tmp, _data, sizeof_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* write the type
+   */
+  _gnutls_str_cpy (tmp, sizeof (tmp), where);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".type");
+
+  result = asn1_write_value (asn1_struct, tmp, given_oid, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+
+/* Decodes an X.509 Attribute (if multi==1) or an AttributeTypeAndValue
+ * otherwise.
+ *
+ * octet_string should be non zero if we are to decode octet strings after
+ * decoding.
+ *
+ * The output is allocated and stored in value.
+ */
+int
+_gnutls_x509_decode_and_read_attribute (ASN1_TYPE asn1_struct,
+                                        const char *where, char *oid,
+                                        int oid_size, gnutls_datum_t * value,
+                                        int multi, int octet_string)
+{
+  char tmpbuffer[128];
+  int len, result;
+
+  /* Read the OID 
+   */
+  _gnutls_str_cpy (tmpbuffer, sizeof (tmpbuffer), where);
+  _gnutls_str_cat (tmpbuffer, sizeof (tmpbuffer), ".type");
+
+  len = oid_size - 1;
+  result = asn1_read_value (asn1_struct, tmpbuffer, oid, &len);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      return result;
+    }
+
+  /* Read the Value 
+   */
+
+  _gnutls_str_cpy (tmpbuffer, sizeof (tmpbuffer), where);
+  _gnutls_str_cat (tmpbuffer, sizeof (tmpbuffer), ".value");
+
+  if (multi)
+    _gnutls_str_cat (tmpbuffer, sizeof (tmpbuffer), "s.?1");    /* .values.?1 */
+
+  result =
+    _gnutls_x509_read_value (asn1_struct, tmpbuffer, value, octet_string);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+
+}
+
+/* Sets an X509 DN in the asn1_struct, and puts the given OID in the DN.
+ * The input is assumed to be raw data.
+ *
+ * asn1_rdn_name must be a string in the form "tbsCertificate.issuer".
+ * That is to point before the rndSequence.
+ *
+ */
+int
+_gnutls_x509_set_dn_oid (ASN1_TYPE asn1_struct,
+                         const char *asn1_name, const char *given_oid,
+                         int raw_flag, const char *name, int sizeof_name)
+{
+  int result;
+  char tmp[MAX_NAME_SIZE], asn1_rdn_name[MAX_NAME_SIZE];
+
+  if (sizeof_name == 0 || name == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* create the rdnSequence
+   */
+  result = asn1_write_value (asn1_struct, asn1_name, "rdnSequence", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  _gnutls_str_cpy (asn1_rdn_name, sizeof (asn1_rdn_name), asn1_name);
+  _gnutls_str_cat (asn1_rdn_name, sizeof (asn1_rdn_name), ".rdnSequence");
+
+  /* create a new element 
+   */
+  result = asn1_write_value (asn1_struct, asn1_rdn_name, "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  _gnutls_str_cpy (tmp, sizeof (tmp), asn1_rdn_name);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".?LAST");
+
+  /* create the set with only one element
+   */
+  result = asn1_write_value (asn1_struct, tmp, "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+
+  /* Encode and write the data
+   */
+  _gnutls_str_cpy (tmp, sizeof (tmp), asn1_rdn_name);
+  _gnutls_str_cat (tmp, sizeof (tmp), ".?LAST.?LAST");
+
+  if (!raw_flag)
+    {
+      result =
+        _gnutls_x509_encode_and_write_attribute (given_oid,
+                                                 asn1_struct,
+                                                 tmp, name, sizeof_name, 0);
+    }
+  else
+    {
+      result =
+        _gnutls_x509_write_attribute (given_oid, asn1_struct,
+                                      tmp, name, sizeof_name, 0);
+    }
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+
+/**
+  * gnutls_x509_rdn_get - This function parses an RDN sequence and returns a string
+  * @idn: should contain a DER encoded RDN sequence
+  * @buf: a pointer to a structure to hold the peer's name
+  * @sizeof_buf: holds the size of @buf
+  *
+  * This function will return the name of the given RDN sequence.  The
+  * name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in
+  * RFC2253.
+  *
+  * If the provided buffer is not long enough, returns
+  * GNUTLS_E_SHORT_MEMORY_BUFFER and *sizeof_buf will be updated.  On
+  * success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_rdn_get (const gnutls_datum_t * idn,
+                     char *buf, size_t * sizeof_buf)
+{
+  int result;
+  ASN1_TYPE dn = ASN1_TYPE_EMPTY;
+
+  if (sizeof_buf == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (buf)
+    buf[0] = 0;
+
+
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (),
+                            "PKIX1.Name", &dn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&dn, idn->data, idn->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&dn);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_parse_dn (dn, "rdnSequence", buf, sizeof_buf);
+
+  asn1_delete_structure (&dn);
+  return result;
+
+}
+
+/**
+  * gnutls_x509_rdn_get_by_oid - This function parses an RDN sequence and returns a string
+  * @idn: should contain a DER encoded RDN sequence
+  * @oid: an Object Identifier
+  * @indx: In case multiple same OIDs exist in the RDN indicates which
+  *   to send. Use 0 for the first one.
+  * @raw_flag: If non zero then the raw DER data are returned.
+  * @buf: a pointer to a structure to hold the peer's name
+  * @sizeof_buf: holds the size of @buf
+  *
+  * This function will return the name of the given Object identifier,
+  * of the RDN sequence.  The name will be encoded using the rules
+  * from RFC2253.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
+  * the provided buffer is not long enough, and 0 on success.
+  *
+  **/
+int
+gnutls_x509_rdn_get_by_oid (const gnutls_datum_t * idn, const char *oid,
+                            int indx, unsigned int raw_flag,
+                            void *buf, size_t * sizeof_buf)
+{
+  int result;
+  ASN1_TYPE dn = ASN1_TYPE_EMPTY;
+
+  if (sizeof_buf == 0)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (),
+                            "PKIX1.Name", &dn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&dn, idn->data, idn->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&dn);
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    _gnutls_x509_parse_dn_oid (dn, "rdnSequence", oid, indx,
+                               raw_flag, buf, sizeof_buf);
+
+  asn1_delete_structure (&dn);
+  return result;
+
+}
+
+/**
+  * gnutls_x509_rdn_get_oid - This function parses an RDN sequence and returns an OID.
+  * @idn: should contain a DER encoded RDN sequence
+  * @indx: Indicates which OID to return. Use 0 for the first one.
+  * @oid: a pointer to a structure to hold the peer's name OID
+  * @sizeof_oid: holds the size of @oid
+  *
+  * This function will return the specified Object identifier, of the
+  * RDN sequence.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
+  * the provided buffer is not long enough, and 0 on success.
+  *
+  **/
+int
+gnutls_x509_rdn_get_oid (const gnutls_datum_t * idn,
+                         int indx, void *buf, size_t * sizeof_buf)
+{
+  int result;
+  ASN1_TYPE dn = ASN1_TYPE_EMPTY;
+
+  if (sizeof_buf == 0)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (),
+                            "PKIX1.Name", &dn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&dn, idn->data, idn->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&dn);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_get_dn_oid (dn, "rdnSequence", indx, buf, sizeof_buf);
+
+  asn1_delete_structure (&dn);
+  return result;
+
+}
+
+/*
+ * Compares the DER encoded part of a DN.
+ *
+ * FIXME: use a real DN comparison algorithm.
+ *
+ * Returns 1 if the DN's match and zero if they don't match. Otherwise
+ * a negative value is returned to indicate error.
+ */
+int
+_gnutls_x509_compare_raw_dn (const gnutls_datum_t * dn1,
+                             const gnutls_datum_t * dn2)
+{
+
+  if (dn1->size != dn2->size)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+  if (memcmp (dn1->data, dn2->data, dn2->size) != 0)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+  return 1;                     /* they match */
+}
diff --git a/src/daemon/https/x509/dn.h b/src/daemon/https/x509/dn.h
new file mode 100644
index 00000000..93a9262c
--- /dev/null
+++ b/src/daemon/https/x509/dn.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef DN_H
+# define DN_H
+
+/* Some OIDs usually found in Distinguished names
+ */
+#define OID_X520_COUNTRY_NAME           "2.5.4.6"
+#define OID_X520_ORGANIZATION_NAME      "2.5.4.10"
+#define OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
+#define OID_X520_COMMON_NAME            "2.5.4.3"
+#define OID_X520_LOCALITY_NAME          "2.5.4.7"
+#define OID_X520_STATE_OR_PROVINCE_NAME         "2.5.4.8"
+#define OID_LDAP_DC                     "0.9.2342.19200300.100.1.25"
+#define OID_LDAP_UID                    "0.9.2342.19200300.100.1.1"
+#define OID_PKCS9_EMAIL                         "1.2.840.113549.1.9.1"
+
+int _gnutls_x509_parse_dn (ASN1_TYPE asn1_struct,
+                           const char *asn1_rdn_name, char *buf,
+                           size_t * sizeof_buf);
+
+int _gnutls_x509_parse_dn_oid (ASN1_TYPE asn1_struct,
+                               const char *asn1_rdn_name, const char *oid,
+                               int indx, unsigned int raw_flag, void *buf,
+                               size_t * sizeof_buf);
+
+int _gnutls_x509_set_dn_oid (ASN1_TYPE asn1_struct,
+                             const char *asn1_rdn_name, const char *oid,
+                             int raw_flag, const char *name, int sizeof_name);
+
+int _gnutls_x509_get_dn_oid (ASN1_TYPE asn1_struct,
+                             const char *asn1_rdn_name,
+                             int indx, void *_oid, size_t * sizeof_oid);
+
+
+#endif
diff --git a/src/daemon/https/x509/dsa.c b/src/daemon/https/x509/dsa.c
new file mode 100644
index 00000000..af403911
--- /dev/null
+++ b/src/daemon/https/x509/dsa.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains code for DSA keys.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_datum.h>
+#include <debug.h>
+
+/* resarr will contain: p(0), q(1), g(2), y(3), x(4).
+ */
+int
+_gnutls_dsa_generate_params (mpi_t * resarr, int *resarr_len, int bits)
+{
+
+  int ret;
+  gcry_sexp_t parms, key, list;
+
+  /* FIXME: Remove me once we depend on 1.3.1 */
+  if (bits > 1024 && gcry_check_version ("1.3.1") == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (bits < 512)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = gcry_sexp_build (&parms, NULL, "(genkey(dsa(nbits %d)))", bits);
+  if (ret != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* generate the DSA key 
+   */
+  ret = gcry_pk_genkey (&key, parms);
+  gcry_sexp_release (parms);
+
+  if (ret != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  list = gcry_sexp_find_token (key, "p", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[0] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "q", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[1] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "g", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[2] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "y", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[3] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+
+  list = gcry_sexp_find_token (key, "x", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[4] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+
+  gcry_sexp_release (key);
+
+  _gnutls_dump_mpi ("p: ", resarr[0]);
+  _gnutls_dump_mpi ("q: ", resarr[1]);
+  _gnutls_dump_mpi ("g: ", resarr[2]);
+  _gnutls_dump_mpi ("y: ", resarr[3]);
+  _gnutls_dump_mpi ("x: ", resarr[4]);
+
+  *resarr_len = 5;
+
+  return 0;
+
+}
diff --git a/src/daemon/https/x509/dsa.h b/src/daemon/https/x509/dsa.h
new file mode 100644
index 00000000..5489ffa3
--- /dev/null
+++ b/src/daemon/https/x509/dsa.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_dsa_generate_params (mpi_t * resarr, int *resarr_len, int bits);
diff --git a/src/daemon/https/x509/extensions.c b/src/daemon/https/x509/extensions.c
new file mode 100644
index 00000000..98379add
--- /dev/null
+++ b/src/daemon/https/x509/extensions.c
@@ -0,0 +1,1095 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate to the X.509 extension parsing.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_global.h>
+#include <mpi.h>
+#include <libtasn1.h>
+#include <common.h>
+#include <x509.h>
+#include <extensions.h>
+#include <gnutls_datum.h>
+
+/* This function will attempt to return the requested extension found in
+ * the given X509v3 certificate. The return value is allocated and stored into
+ * ret.
+ *
+ * Critical will be either 0 or 1.
+ *
+ * If the extension does not exist, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will
+ * be returned.
+ */
+int
+_gnutls_x509_crt_get_extension (gnutls_x509_crt_t cert,
+                                const char *extension_id, int indx,
+                                gnutls_datum_t * ret, unsigned int *_critical)
+{
+  int k, result, len;
+  char name[MAX_NAME_SIZE], name2[MAX_NAME_SIZE];
+  char str[1024];
+  char str_critical[10];
+  int critical = 0;
+  char extnID[128];
+  gnutls_datum_t value;
+  int indx_counter = 0;
+
+  ret->data = NULL;
+  ret->size = 0;
+
+  k = 0;
+  do
+    {
+      k++;
+
+      snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u", k);
+
+      len = sizeof (str) - 1;
+      result = asn1_read_value (cert->cert, name, str, &len);
+
+      /* move to next
+       */
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          break;
+        }
+
+      do
+        {
+
+          _gnutls_str_cpy (name2, sizeof (name2), name);
+          _gnutls_str_cat (name2, sizeof (name2), ".extnID");
+
+          len = sizeof (extnID) - 1;
+          result = asn1_read_value (cert->cert, name2, extnID, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            {
+              gnutls_assert ();
+              break;
+            }
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              return _gnutls_asn2err (result);
+            }
+
+          /* Handle Extension 
+           */
+          if (strcmp (extnID, extension_id) == 0 && indx == indx_counter++)
+            {
+              /* extension was found 
+               */
+
+              /* read the critical status.
+               */
+              _gnutls_str_cpy (name2, sizeof (name2), name);
+              _gnutls_str_cat (name2, sizeof (name2), ".critical");
+
+              len = sizeof (str_critical);
+              result =
+                asn1_read_value (cert->cert, name2, str_critical, &len);
+
+              if (result == ASN1_ELEMENT_NOT_FOUND)
+                {
+                  gnutls_assert ();
+                  break;
+                }
+              else if (result != ASN1_SUCCESS)
+                {
+                  gnutls_assert ();
+                  return _gnutls_asn2err (result);
+                }
+
+              if (str_critical[0] == 'T')
+                critical = 1;
+              else
+                critical = 0;
+
+              /* read the value.
+               */
+              _gnutls_str_cpy (name2, sizeof (name2), name);
+              _gnutls_str_cat (name2, sizeof (name2), ".extnValue");
+
+              result = _gnutls_x509_read_value (cert->cert, name2, &value, 0);
+              if (result < 0)
+                {
+                  gnutls_assert ();
+                  return result;
+                }
+
+              ret->data = value.data;
+              ret->size = value.size;
+
+              if (_critical)
+                *_critical = critical;
+
+              return 0;
+            }
+
+
+        }
+      while (0);
+    }
+  while (1);
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+  else
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+}
+
+/* This function will attempt to return the requested extension OID found in
+ * the given X509v3 certificate. 
+ *
+ * If you have passed the last extension, GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will
+ * be returned.
+ */
+int
+_gnutls_x509_crt_get_extension_oid (gnutls_x509_crt_t cert,
+                                    int indx, void *oid, size_t * sizeof_oid)
+{
+  int k, result, len;
+  char name[MAX_NAME_SIZE], name2[MAX_NAME_SIZE];
+  char str[1024];
+  char extnID[128];
+  int indx_counter = 0;
+
+  k = 0;
+  do
+    {
+      k++;
+
+      snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u", k);
+
+      len = sizeof (str) - 1;
+      result = asn1_read_value (cert->cert, name, str, &len);
+
+      /* move to next
+       */
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          break;
+        }
+
+      do
+        {
+
+          _gnutls_str_cpy (name2, sizeof (name2), name);
+          _gnutls_str_cat (name2, sizeof (name2), ".extnID");
+
+          len = sizeof (extnID) - 1;
+          result = asn1_read_value (cert->cert, name2, extnID, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            {
+              gnutls_assert ();
+              break;
+            }
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              return _gnutls_asn2err (result);
+            }
+
+          /* Handle Extension 
+           */
+          if (indx == indx_counter++)
+            {
+              len = strlen (extnID) + 1;
+
+              if (*sizeof_oid < (unsigned) len)
+                {
+                  *sizeof_oid = len;
+                  gnutls_assert ();
+                  return GNUTLS_E_SHORT_MEMORY_BUFFER;
+                }
+
+              memcpy (oid, extnID, len);
+              *sizeof_oid = len - 1;
+
+              return 0;
+            }
+
+
+        }
+      while (0);
+    }
+  while (1);
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+  else
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+}
+
+/* This function will attempt to set the requested extension in
+ * the given X509v3 certificate. 
+ *
+ * Critical will be either 0 or 1.
+ */
+static int
+set_extension (ASN1_TYPE asn, const char *extension_id,
+               const gnutls_datum_t * ext_data, unsigned int critical)
+{
+  int result;
+  const char *str;
+
+  /* Add a new extension in the list.
+   */
+  result = asn1_write_value (asn, "tbsCertificate.extensions", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    asn1_write_value (asn, "tbsCertificate.extensions.?LAST.extnID",
+                      extension_id, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (critical == 0)
+    str = "FALSE";
+  else
+    str = "TRUE";
+
+
+  result =
+    asn1_write_value (asn, "tbsCertificate.extensions.?LAST.critical",
+                      str, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    _gnutls_x509_write_value (asn,
+                              "tbsCertificate.extensions.?LAST.extnValue",
+                              ext_data, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/* Overwrite the given extension (using the index)
+ * index here starts from one.
+ */
+static int
+overwrite_extension (ASN1_TYPE asn, unsigned int indx,
+                     const gnutls_datum_t * ext_data, unsigned int critical)
+{
+  char name[MAX_NAME_SIZE], name2[MAX_NAME_SIZE];
+  const char *str;
+  int result;
+
+  snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u", indx);
+
+  if (critical == 0)
+    str = "FALSE";
+  else
+    str = "TRUE";
+
+  _gnutls_str_cpy (name2, sizeof (name2), name);
+  _gnutls_str_cat (name2, sizeof (name2), ".critical");
+
+  result = asn1_write_value (asn, name2, str, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  _gnutls_str_cpy (name2, sizeof (name2), name);
+  _gnutls_str_cat (name2, sizeof (name2), ".extnValue");
+
+  result = _gnutls_x509_write_value (asn, name2, ext_data, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/* This function will attempt to overwrite the requested extension with
+ * the given one. 
+ *
+ * Critical will be either 0 or 1.
+ */
+int
+_gnutls_x509_crt_set_extension (gnutls_x509_crt_t cert,
+                                const char *ext_id,
+                                const gnutls_datum_t * ext_data,
+                                unsigned int critical)
+{
+  int result;
+  int k, len;
+  char name[MAX_NAME_SIZE], name2[MAX_NAME_SIZE];
+  char extnID[128];
+
+  /* Find the index of the given extension.
+   */
+  k = 0;
+  do
+    {
+      k++;
+
+      snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u", k);
+
+      len = sizeof (extnID) - 1;
+      result = asn1_read_value (cert->cert, name, extnID, &len);
+
+      /* move to next
+       */
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        {
+          break;
+        }
+
+      do
+        {
+
+          _gnutls_str_cpy (name2, sizeof (name2), name);
+          _gnutls_str_cat (name2, sizeof (name2), ".extnID");
+
+          len = sizeof (extnID) - 1;
+          result = asn1_read_value (cert->cert, name2, extnID, &len);
+
+          if (result == ASN1_ELEMENT_NOT_FOUND)
+            {
+              gnutls_assert ();
+              break;
+            }
+          else if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              return _gnutls_asn2err (result);
+            }
+
+          /* Handle Extension 
+           */
+          if (strcmp (extnID, ext_id) == 0)
+            {
+              /* extension was found 
+               */
+              return overwrite_extension (cert->cert, k, ext_data, critical);
+            }
+
+
+        }
+      while (0);
+    }
+  while (1);
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return set_extension (cert->cert, ext_id, ext_data, critical);
+    }
+  else
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+
+  return 0;
+}
+
+
+/* Here we only extract the KeyUsage field, from the DER encoded
+ * extension.
+ */
+int
+_gnutls_x509_ext_extract_keyUsage (uint16_t * keyUsage,
+                                   opaque * extnValue, int extnValueLen)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int len, result;
+  uint8_t str[2];
+
+  str[0] = str[1] = 0;
+  *keyUsage = 0;
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.KeyUsage", &ext)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&ext, extnValue, extnValueLen, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  len = sizeof (str);
+  result = asn1_read_value (ext, "", str, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return 0;
+    }
+
+  *keyUsage = str[0] | (str[1] << 8);
+
+  asn1_delete_structure (&ext);
+
+  return 0;
+}
+
+/* extract the basicConstraints from the DER encoded extension
+ */
+int
+_gnutls_x509_ext_extract_basicConstraints (int *CA,
+                                           int *pathLenConstraint,
+                                           opaque * extnValue,
+                                           int extnValueLen)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  char str[128];
+  int len, result;
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.BasicConstraints", &ext)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&ext, extnValue, extnValueLen, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  if (pathLenConstraint)
+    {
+      result = _gnutls_x509_read_uint (ext, "pathLenConstraint",
+                                       pathLenConstraint);
+      if (result == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)
+        *pathLenConstraint = -1;
+      else if (result != GNUTLS_E_SUCCESS)
+        {
+          gnutls_assert ();
+          asn1_delete_structure (&ext);
+          return _gnutls_asn2err (result);
+        }
+    }
+
+  /* the default value of cA is false.
+   */
+  len = sizeof (str) - 1;
+  result = asn1_read_value (ext, "cA", str, &len);
+  if (result == ASN1_SUCCESS && strcmp (str, "TRUE") == 0)
+    *CA = 1;
+  else
+    *CA = 0;
+
+  asn1_delete_structure (&ext);
+
+  return 0;
+}
+
+/* generate the basicConstraints in a DER encoded extension
+ * Use 0 or 1 (TRUE) for CA.
+ * Use negative values for pathLenConstraint to indicate that the field
+ * should not be present, >= 0 to indicate set values.
+ */
+int
+_gnutls_x509_ext_gen_basicConstraints (int CA,
+                                       int pathLenConstraint,
+                                       gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  const char *str;
+  int result;
+
+  if (CA == 0)
+    str = "FALSE";
+  else
+    str = "TRUE";
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.BasicConstraints", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (ext, "cA", str, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  if (pathLenConstraint < 0)
+    {
+      result = asn1_write_value (ext, "pathLenConstraint", NULL, 0);
+      if (result < 0)
+        result = _gnutls_asn2err (result);
+    }
+  else
+    result = _gnutls_x509_write_uint32 (ext, "pathLenConstraint",
+                                        pathLenConstraint);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return result;
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/* generate the keyUsage in a DER encoded extension
+ * Use an ORed SEQUENCE of GNUTLS_KEY_* for usage.
+ */
+int
+_gnutls_x509_ext_gen_keyUsage (uint16_t usage, gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+  uint8_t str[2];
+
+  result = asn1_create_element (_gnutls_get_pkix (), "PKIX1.KeyUsage", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  str[0] = usage & 0xff;
+  str[1] = usage >> 8;
+
+  result = asn1_write_value (ext, "", str, 9);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+static int
+write_new_general_name (ASN1_TYPE ext, const char *ext_name,
+                        gnutls_x509_subject_alt_name_t type,
+                        const char *data_string)
+{
+  const char *str;
+  int result;
+  char name[128];
+
+  result = asn1_write_value (ext, ext_name, "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  switch (type)
+    {
+    case GNUTLS_SAN_DNSNAME:
+      str = "dNSName";
+      break;
+    case GNUTLS_SAN_RFC822NAME:
+      str = "rfc822Name";
+      break;
+    case GNUTLS_SAN_URI:
+      str = "uniformResourceIdentifier";
+      break;
+    case GNUTLS_SAN_IPADDRESS:
+      str = "iPAddress";
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (ext_name[0] == 0)
+    {                           /* no dot */
+      _gnutls_str_cpy (name, sizeof (name), "?LAST");
+    }
+  else
+    {
+      _gnutls_str_cpy (name, sizeof (name), ext_name);
+      _gnutls_str_cat (name, sizeof (name), ".?LAST");
+    }
+
+  result = asn1_write_value (ext, name, str, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  _gnutls_str_cat (name, sizeof (name), ".");
+  _gnutls_str_cat (name, sizeof (name), str);
+
+  result = asn1_write_value (ext, name, data_string, strlen (data_string));
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/* Convert the given name to GeneralNames in a DER encoded extension.
+ * This is the same as subject alternative name.
+ */
+int
+_gnutls_x509_ext_gen_subject_alt_name (gnutls_x509_subject_alt_name_t
+                                       type, const char *data_string,
+                                       gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.GeneralNames", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = write_new_general_name (ext, "", type, data_string);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return result;
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/* generate the SubjectKeyID in a DER encoded extension
+ */
+int
+_gnutls_x509_ext_gen_key_id (const void *id, size_t id_size,
+                             gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (),
+                         "PKIX1.SubjectKeyIdentifier", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (ext, "", id, id_size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/* generate the AuthorityKeyID in a DER encoded extension
+ */
+int
+_gnutls_x509_ext_gen_auth_key_id (const void *id, size_t id_size,
+                                  gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (),
+                         "PKIX1.AuthorityKeyIdentifier", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (ext, "keyIdentifier", id, id_size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  asn1_write_value (ext, "authorityCertIssuer", NULL, 0);
+  asn1_write_value (ext, "authorityCertSerialNumber", NULL, 0);
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+
+/* Creates and encodes the CRL Distribution points. data_string should be a name
+ * and type holds the type of the name. 
+ * reason_flags should be an or'ed sequence of GNUTLS_CRL_REASON_*.
+ *
+ */
+int
+_gnutls_x509_ext_gen_crl_dist_points (gnutls_x509_subject_alt_name_t
+                                      type, const void *data_string,
+                                      unsigned int reason_flags,
+                                      gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  gnutls_datum_t gnames = { NULL, 0 };
+  int result;
+  uint8_t reasons[2];
+
+  reasons[0] = reason_flags & 0xff;
+  reasons[1] = reason_flags >> 8;
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (),
+                         "PKIX1.CRLDistributionPoints", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_write_value (ext, "", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (reason_flags)
+    {
+      result = asn1_write_value (ext, "?LAST.reasons", reasons, 9);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+    }
+  else
+    {
+      result = asn1_write_value (ext, "?LAST.reasons", NULL, 0);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+    }
+
+  result = asn1_write_value (ext, "?LAST.cRLIssuer", NULL, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* When used as type CHOICE.
+   */
+  result = asn1_write_value (ext, "?LAST.distributionPoint", "fullName", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+#if 0
+  /* only needed in old code (where defined as SEQUENCE OF) */
+  asn1_write_value (ext,
+                    "?LAST.distributionPoint.nameRelativeToCRLIssuer",
+                    NULL, 0);
+#endif
+
+  result =
+    write_new_general_name (ext, "?LAST.distributionPoint.fullName",
+                            type, data_string);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = 0;
+
+cleanup:
+  _gnutls_free_datum (&gnames);
+  asn1_delete_structure (&ext);
+
+  return result;
+}
+
+/* extract the proxyCertInfo from the DER encoded extension
+ */
+int
+_gnutls_x509_ext_extract_proxyCertInfo (int *pathLenConstraint,
+                                        char **policyLanguage,
+                                        char **policy,
+                                        size_t * sizeof_policy,
+                                        opaque * extnValue, int extnValueLen)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+  gnutls_datum_t value;
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.ProxyCertInfo", &ext)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&ext, extnValue, extnValueLen, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  if (pathLenConstraint)
+    {
+      result = _gnutls_x509_read_uint (ext, "pCPathLenConstraint",
+                                       pathLenConstraint);
+      if (result == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)
+        *pathLenConstraint = -1;
+      else if (result != GNUTLS_E_SUCCESS)
+        {
+          asn1_delete_structure (&ext);
+          return _gnutls_asn2err (result);
+        }
+    }
+
+  result = _gnutls_x509_read_value (ext, "proxyPolicy.policyLanguage",
+                                    &value, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return result;
+    }
+
+  if (policyLanguage)
+    *policyLanguage = gnutls_strdup (value.data);
+
+  result = _gnutls_x509_read_value (ext, "proxyPolicy.policy", &value, 0);
+  if (result == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)
+    {
+      if (policy)
+        *policy = NULL;
+      if (sizeof_policy)
+        *sizeof_policy = 0;
+    }
+  else if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return result;
+    }
+  else
+    {
+      if (policy)
+        *policy = value.data;
+      if (sizeof_policy)
+        *sizeof_policy = value.size;
+    }
+
+  asn1_delete_structure (&ext);
+
+  return 0;
+}
+
+/* generate the proxyCertInfo in a DER encoded extension
+ */
+int
+_gnutls_x509_ext_gen_proxyCertInfo (int pathLenConstraint,
+                                    const char *policyLanguage,
+                                    const char *policy,
+                                    size_t sizeof_policy,
+                                    gnutls_datum_t * der_ext)
+{
+  ASN1_TYPE ext = ASN1_TYPE_EMPTY;
+  int result;
+
+  result = asn1_create_element (_gnutls_get_pkix (),
+                                "PKIX1.ProxyCertInfo", &ext);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (pathLenConstraint < 0)
+    {
+      result = asn1_write_value (ext, "pCPathLenConstraint", NULL, 0);
+      if (result < 0)
+        result = _gnutls_asn2err (result);
+    }
+  else
+    result = _gnutls_x509_write_uint32 (ext, "pCPathLenConstraint",
+                                        pathLenConstraint);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return result;
+    }
+
+  result = asn1_write_value (ext, "proxyPolicy.policyLanguage",
+                             policyLanguage, 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (ext, "proxyPolicy.policy",
+                             policy, sizeof_policy);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&ext);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_der_encode (ext, "", der_ext, 0);
+
+  asn1_delete_structure (&ext);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/x509/extensions.h b/src/daemon/https/x509/extensions.h
new file mode 100644
index 00000000..fb758c90
--- /dev/null
+++ b/src/daemon/https/x509/extensions.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_x509_crt_get_extension (gnutls_x509_crt_t cert,
+                                    const char *extension_id, int indx,
+                                    gnutls_datum_t * ret,
+                                    unsigned int *critical);
+
+int _gnutls_x509_crt_get_extension_oid (gnutls_x509_crt_t cert,
+                                        int indx, void *ret,
+                                        size_t * ret_size);
+int _gnutls_x509_ext_extract_keyUsage (uint16_t * keyUsage,
+                                       opaque * extnValue, int extnValueLen);
+int _gnutls_x509_ext_extract_basicConstraints (int *CA,
+                                               int *pathLenConstraint,
+                                               opaque * extnValue,
+                                               int extnValueLen);
+int _gnutls_x509_crt_set_extension (gnutls_x509_crt_t cert,
+                                    const char *extension_id,
+                                    const gnutls_datum_t * ext_data,
+                                    unsigned int critical);
+int _gnutls_x509_ext_gen_basicConstraints (int CA, int pathLenConstraint,
+                                           gnutls_datum_t * der_ext);
+int _gnutls_x509_ext_gen_keyUsage (uint16_t usage, gnutls_datum_t * der_ext);
+int _gnutls_x509_ext_gen_subject_alt_name (gnutls_x509_subject_alt_name_t
+                                           type, const char *data_string,
+                                           gnutls_datum_t * der_ext);
+int _gnutls_x509_ext_gen_crl_dist_points (gnutls_x509_subject_alt_name_t
+                                          type, const void *data_string,
+                                          unsigned int reason_flags,
+                                          gnutls_datum_t * der_ext);
+int _gnutls_x509_ext_gen_key_id (const void *id, size_t id_size,
+                                 gnutls_datum_t * der_data);
+int _gnutls_x509_ext_gen_auth_key_id (const void *id, size_t id_size,
+                                      gnutls_datum_t * der_data);
+
+int _gnutls_x509_ext_extract_proxyCertInfo (int *pathLenConstraint,
+                                            char **policyLanguage,
+                                            char **policy,
+                                            size_t *sizeof_policy,
+                                            opaque * extnValue,
+                                            int extnValueLen);
+int _gnutls_x509_ext_gen_proxyCertInfo (int pathLenConstraint,
+                                        const char *policyLanguage,
+                                        const char *policy,
+                                        size_t sizeof_policy,
+                                        gnutls_datum_t * der_ext);
diff --git a/src/daemon/https/x509/mpi.c b/src/daemon/https/x509/mpi.c
new file mode 100644
index 00000000..8cc43855
--- /dev/null
+++ b/src/daemon/https/x509/mpi.c
@@ -0,0 +1,576 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_global.h>
+#include <libtasn1.h>
+#include <gnutls_datum.h>
+#include "common.h"
+#include "x509.h"
+#include <gnutls_num.h>
+#include "mpi.h"
+
+/*
+ * some x509 certificate parsing functions that relate to MPI parameter
+ * extraction. This reads the BIT STRING subjectPublicKey.
+ * Returns 2 parameters (m,e).
+ */
+int
+_gnutls_x509_read_rsa_params (opaque * der, int dersize, mpi_t * params)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.RSAPublicKey",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&spk, der, dersize, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return _gnutls_asn2err (result);
+    }
+
+  if ((result = _gnutls_x509_read_int (spk, "modulus", &params[0])) < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  if ((result =
+       _gnutls_x509_read_int (spk, "publicExponent", &params[1])) < 0)
+    {
+      gnutls_assert ();
+      _gnutls_mpi_release (&params[0]);
+      asn1_delete_structure (&spk);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  asn1_delete_structure (&spk);
+
+  return 0;
+
+}
+
+/* reads p,q and g 
+ * from the certificate (subjectPublicKey BIT STRING).
+ * params[0-2]
+ */
+int
+_gnutls_x509_read_dsa_params (opaque * der, int dersize, mpi_t * params)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (), "PKIX1.Dss-Parms",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&spk, der, dersize, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return _gnutls_asn2err (result);
+    }
+
+  /* FIXME: If the parameters are not included in the certificate
+   * then the issuer's parameters should be used. This is not
+   * done yet.
+   */
+
+  /* Read p */
+
+  if ((result = _gnutls_x509_read_int (spk, "p", &params[0])) < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  /* Read q */
+
+  if ((result = _gnutls_x509_read_int (spk, "q", &params[1])) < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      _gnutls_mpi_release (&params[0]);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  /* Read g */
+
+  if ((result = _gnutls_x509_read_int (spk, "g", &params[2])) < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      _gnutls_mpi_release (&params[0]);
+      _gnutls_mpi_release (&params[1]);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  asn1_delete_structure (&spk);
+
+  return 0;
+
+}
+
+/* Reads an Integer from the DER encoded data
+ */
+
+int
+_gnutls_x509_read_der_int (opaque * der, int dersize, mpi_t * out)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  /* == INTEGER */
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DSAPublicKey",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&spk, der, dersize, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Read Y */
+
+  if ((result = _gnutls_x509_read_int (spk, "", out)) < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&spk);
+      return _gnutls_asn2err (result);
+    }
+
+  asn1_delete_structure (&spk);
+
+  return 0;
+
+}
+
+/* reads DSA's Y
+ * from the certificate 
+ * only sets params[3]
+ */
+int
+_gnutls_x509_read_dsa_pubkey (opaque * der, int dersize, mpi_t * params)
+{
+  return _gnutls_x509_read_der_int (der, dersize, &params[3]);
+}
+
+/* Extracts DSA and RSA parameters from a certificate.
+ */
+int
+_gnutls_x509_crt_get_mpis (gnutls_x509_crt_t cert,
+                           mpi_t * params, int *params_size)
+{
+  int result;
+  int pk_algorithm;
+  gnutls_datum tmp = { NULL, 0 };
+
+  /* Read the algorithm's OID
+   */
+  pk_algorithm = gnutls_x509_crt_get_pk_algorithm (cert, NULL);
+
+  /* Read the algorithm's parameters
+   */
+  result
+    = _gnutls_x509_read_value (cert->cert,
+                               "tbsCertificate.subjectPublicKeyInfo.subjectPublicKey",
+                               &tmp, 2);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  switch (pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+      /* params[0] is the modulus,
+       * params[1] is the exponent
+       */
+      if (*params_size < RSA_PUBLIC_PARAMS)
+        {
+          gnutls_assert ();
+          /* internal error. Increase the mpi_ts in params */
+          result = GNUTLS_E_INTERNAL_ERROR;
+          goto error;
+        }
+
+      if ((result =
+           _gnutls_x509_read_rsa_params (tmp.data, tmp.size, params)) < 0)
+        {
+          gnutls_assert ();
+          goto error;
+        }
+      *params_size = RSA_PUBLIC_PARAMS;
+
+      break;
+    default:
+      /* other types like DH
+       * currently not supported
+       */
+      gnutls_assert ();
+      result = GNUTLS_E_X509_CERTIFICATE_ERROR;
+      goto error;
+    }
+
+  result = 0;
+
+error:_gnutls_free_datum (&tmp);
+  return result;
+}
+
+/*
+ * some x509 certificate functions that relate to MPI parameter
+ * setting. This writes the BIT STRING subjectPublicKey.
+ * Needs 2 parameters (m,e).
+ *
+ * Allocates the space used to store the DER data.
+ */
+int
+_gnutls_x509_write_rsa_params (mpi_t * params,
+                               int params_size, gnutls_datum_t * der)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  der->data = NULL;
+  der->size = 0;
+
+  if (params_size < 2)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INVALID_REQUEST;
+      goto cleanup;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.RSAPublicKey",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_write_int (spk, "modulus", params[0], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_write_int (spk, "publicExponent", params[1], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_der_encode (spk, "", der, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&spk);
+  return 0;
+
+cleanup:asn1_delete_structure (&spk);
+
+  return result;
+}
+
+/*
+ * This function writes and encodes the parameters for DSS or RSA keys.
+ * This is the "signatureAlgorithm" fields.
+ */
+int
+_gnutls_x509_write_sig_params (ASN1_TYPE dst,
+                               const char *dst_name,
+                               gnutls_pk_algorithm_t pk_algorithm,
+                               gnutls_digest_algorithm_t dig,
+                               mpi_t * params, int params_size)
+{
+  gnutls_datum_t der;
+  int result;
+  char name[128];
+  const char *pk;
+
+  _gnutls_str_cpy (name, sizeof (name), dst_name);
+  _gnutls_str_cat (name, sizeof (name), ".algorithm");
+
+  pk = _gnutls_x509_sign_to_oid (pk_algorithm, HASH2MAC (dig));
+  if (pk == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* write the OID.
+   */
+  result = asn1_write_value (dst, name, pk, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  _gnutls_str_cpy (name, sizeof (name), dst_name);
+  _gnutls_str_cat (name, sizeof (name), ".parameters");
+
+  if (pk_algorithm == GNUTLS_PK_RSA)
+    {                           /* RSA */
+      result = asn1_write_value (dst, name, NULL, 0);
+
+      if (result != ASN1_SUCCESS && result != ASN1_ELEMENT_NOT_FOUND)
+        {
+          /* Here we ignore the element not found error, since this
+           * may have been disabled before.
+           */
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+    }
+
+  return 0;
+}
+
+/*
+ * This function writes the parameters for DSS keys.
+ * Needs 3 parameters (p,q,g).
+ *
+ * Allocates the space used to store the DER data.
+ */
+int
+_gnutls_x509_write_dsa_params (mpi_t * params,
+                               int params_size, gnutls_datum_t * der)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  der->data = NULL;
+  der->size = 0;
+
+  if (params_size < 3)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INVALID_REQUEST;
+      goto cleanup;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DSAParameters",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_write_int (spk, "p", params[0], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_write_int (spk, "q", params[1], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_write_int (spk, "g", params[2], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_der_encode (spk, "", der, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = 0;
+
+cleanup:asn1_delete_structure (&spk);
+  return result;
+}
+
+/*
+ * This function writes the public parameters for DSS keys.
+ * Needs 1 parameter (y).
+ *
+ * Allocates the space used to store the DER data.
+ */
+int
+_gnutls_x509_write_dsa_public_key (mpi_t * params,
+                                   int params_size, gnutls_datum_t * der)
+{
+  int result;
+  ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+  der->data = NULL;
+  der->size = 0;
+
+  if (params_size < 3)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INVALID_REQUEST;
+      goto cleanup;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DSAPublicKey",
+                            &spk)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_write_int (spk, "", params[3], 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_der_encode (spk, "", der, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&spk);
+  return 0;
+
+cleanup:asn1_delete_structure (&spk);
+  return result;
+}
+
+/* this function reads a (small) unsigned integer
+ * from asn1 structs. Combines the read and the convertion
+ * steps.
+ */
+int
+_gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
+{
+  int len, result;
+  opaque *tmpstr;
+
+  len = 0;
+  result = asn1_read_value (node, value, NULL, &len);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  tmpstr = gnutls_alloca (len);
+  if (tmpstr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_read_value (node, value, tmpstr, &len);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_afree (tmpstr);
+      return _gnutls_asn2err (result);
+    }
+
+  if (len == 1)
+    *ret = tmpstr[0];
+  else if (len == 2)
+    *ret = _gnutls_read_uint16 (tmpstr);
+  else if (len == 3)
+    *ret = _gnutls_read_uint24 (tmpstr);
+  else if (len == 4)
+    *ret = _gnutls_read_uint32 (tmpstr);
+  else
+    {
+      gnutls_assert ();
+      gnutls_afree (tmpstr);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  gnutls_afree (tmpstr);
+
+  return 0;
+}
+
+/* Writes the specified integer into the specified node.
+ */
+int
+_gnutls_x509_write_uint32 (ASN1_TYPE node, const char *value, uint32_t num)
+{
+  opaque tmpstr[4];
+  int result;
+
+  _gnutls_write_uint32 (num, tmpstr);
+
+  result = asn1_write_value (node, value, tmpstr, 4);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/x509/mpi.h b/src/daemon/https/x509/mpi.h
new file mode 100644
index 00000000..785d7e02
--- /dev/null
+++ b/src/daemon/https/x509/mpi.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include "x509.h"
+
+int _gnutls_x509_crt_get_mpis (gnutls_x509_crt_t cert,
+                               mpi_t * params, int *params_size);
+int _gnutls_x509_read_rsa_params (opaque * der, int dersize, mpi_t * params);
+int _gnutls_x509_read_dsa_pubkey (opaque * der, int dersize, mpi_t * params);
+int _gnutls_x509_read_dsa_params (opaque * der, int dersize, mpi_t * params);
+
+int _gnutls_x509_write_rsa_params (mpi_t * params, int params_size,
+                                   gnutls_datum_t * der);
+int _gnutls_x509_write_dsa_params (mpi_t * params, int params_size,
+                                   gnutls_datum_t * der);
+int _gnutls_x509_write_dsa_public_key (mpi_t * params, int params_size,
+                                       gnutls_datum_t * der);
+
+int _gnutls_x509_read_uint (ASN1_TYPE node, const char *value,
+                            unsigned int *ret);
+
+int  
+_gnutls_x509_read_der_int  (opaque * der, int dersize, mpi_t* out);
+
+int _gnutls_x509_read_int (ASN1_TYPE node, const char *value,
+                           mpi_t * ret_mpi);
+int _gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi,
+                            int lz);
+int _gnutls_x509_write_uint32 (ASN1_TYPE node, const char *value,
+                               uint32_t num);
+
+int _gnutls_x509_write_sig_params (ASN1_TYPE dst, const char *dst_name,
+                                   gnutls_pk_algorithm_t pk_algorithm,
+                                   gnutls_digest_algorithm_t, mpi_t * params,
+                                   int params_size);
diff --git a/src/daemon/https/x509/output.c b/src/daemon/https/x509/output.c
new file mode 100644
index 00000000..dcc87ab1
--- /dev/null
+++ b/src/daemon/https/x509/output.c
@@ -0,0 +1,1360 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+/* Functions for printing X.509 Certificate structures
+ */
+
+#include <gnutls_int.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509.h>
+#include <gnutls_errors.h>
+
+/* I18n of error codes. */
+#include "gettext.h"
+#define _(String) dgettext (PACKAGE, String)
+#define N_(String) gettext_noop (String)
+
+#define addf _gnutls_string_append_printf
+#define adds _gnutls_string_append_str
+
+static void
+hexdump (gnutls_string * str, const char *data, size_t len, const char *spc)
+{
+  size_t j;
+
+  if (spc)
+    adds (str, spc);
+  for (j = 0; j < len; j++)
+    {
+      if (((j + 1) % 16) == 0)
+        {
+          addf (str, "%.2x\n", (unsigned char) data[j]);
+          if (spc && j != (len - 1))
+            adds (str, spc);
+        }
+      else if (j == (len - 1))
+        addf (str, "%.2x", (unsigned char) data[j]);
+      else
+        addf (str, "%.2x:", (unsigned char) data[j]);
+    }
+  if ((j % 16) != 0)
+    adds (str, "\n");
+}
+
+static void
+hexprint (gnutls_string * str, const char *data, size_t len)
+{
+  size_t j;
+
+  if (len == 0)
+    adds (str, "00");
+  else
+    {
+      for (j = 0; j < len; j++)
+        addf (str, "%.2x", (unsigned char) data[j]);
+    }
+}
+
+
+static void
+asciiprint (gnutls_string * str, const char *data, size_t len)
+{
+  size_t j;
+
+  for (j = 0; j < len; j++)
+    if (isprint (data[j]))
+      addf (str, "%c", (unsigned char) data[j]);
+    else
+      addf (str, ".");
+}
+
+static void
+print_proxy (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  int pathlen;
+  char *policyLanguage;
+  char *policy;
+  size_t npolicy;
+  int err;
+
+  err = gnutls_x509_crt_get_proxy (cert, NULL,
+                                   &pathlen, &policyLanguage,
+                                   &policy, &npolicy);
+  if (err < 0)
+    {
+      addf (str, "error: get_proxy: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  if (pathlen >= 0)
+    addf (str, _("\t\t\tPath Length Constraint: %d\n"), pathlen);
+  addf (str, _("\t\t\tPolicy Language: %s"), policyLanguage);
+  if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.1") == 0)
+    adds (str, " (id-ppl-inheritALL)\n");
+  else if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.2") == 0)
+    adds (str, " (id-ppl-independent)\n");
+  else
+    adds (str, "\n");
+  if (npolicy)
+    {
+      adds (str, _("\t\t\tPolicy:\n\t\t\t\tASCII: "));
+      asciiprint (str, policy, npolicy);
+      adds (str, _("\n\t\t\t\tHexdump: "));
+      hexprint (str, policy, npolicy);
+      adds (str, "\n");
+    }
+}
+
+static void
+print_ski (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  char *buffer = NULL;
+  size_t size = 0;
+  int err;
+
+  err = gnutls_x509_crt_get_subject_key_id (cert, buffer, &size, NULL);
+  if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+      addf (str, "error: get_subject_key_id: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  buffer = gnutls_malloc (size);
+  if (!buffer)
+    {
+      addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  err = gnutls_x509_crt_get_subject_key_id (cert, buffer, &size, NULL);
+  if (err < 0)
+    {
+      gnutls_free (buffer);
+      addf (str, "error: get_subject_key_id2: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  adds (str, "\t\t\t");
+  hexprint (str, buffer, size);
+  adds (str, "\n");
+
+  gnutls_free (buffer);
+}
+
+static void
+print_aki (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  char *buffer = NULL;
+  size_t size = 0;
+  int err;
+
+  err = gnutls_x509_crt_get_authority_key_id (cert, buffer, &size, NULL);
+  if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+      addf (str, "error: get_authority_key_id: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  buffer = gnutls_malloc (size);
+  if (!buffer)
+    {
+      addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  err = gnutls_x509_crt_get_authority_key_id (cert, buffer, &size, NULL);
+  if (err < 0)
+    {
+      gnutls_free (buffer);
+      addf (str, "error: get_authority_key_id2: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  adds (str, "\t\t\t");
+  hexprint (str, buffer, size);
+  adds (str, "\n");
+
+  gnutls_free (buffer);
+}
+
+static void
+print_key_usage (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  unsigned int key_usage;
+  int err;
+
+  err = gnutls_x509_crt_get_key_usage (cert, &key_usage, NULL);
+  if (err < 0)
+    {
+      addf (str, "error: get_key_usage: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  if (key_usage & GNUTLS_KEY_DIGITAL_SIGNATURE)
+    addf (str, _("\t\t\tDigital signature.\n"));
+  if (key_usage & GNUTLS_KEY_NON_REPUDIATION)
+    addf (str, _("\t\t\tNon repudiation.\n"));
+  if (key_usage & GNUTLS_KEY_KEY_ENCIPHERMENT)
+    addf (str, _("\t\t\tKey encipherment.\n"));
+  if (key_usage & GNUTLS_KEY_DATA_ENCIPHERMENT)
+    addf (str, _("\t\t\tData encipherment.\n"));
+  if (key_usage & GNUTLS_KEY_KEY_AGREEMENT)
+    addf (str, _("\t\t\tKey agreement.\n"));
+  if (key_usage & GNUTLS_KEY_KEY_CERT_SIGN)
+    addf (str, _("\t\t\tCertificate signing.\n"));
+  if (key_usage & GNUTLS_KEY_CRL_SIGN)
+    addf (str, _("\t\t\tCRL signing.\n"));
+  if (key_usage & GNUTLS_KEY_ENCIPHER_ONLY)
+    addf (str, _("\t\t\tKey encipher only.\n"));
+  if (key_usage & GNUTLS_KEY_DECIPHER_ONLY)
+    addf (str, _("\t\t\tKey decipher only.\n"));
+}
+
+static void
+print_crldist (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  char *buffer = NULL;
+  size_t size;
+  int err;
+  int indx;
+
+  for (indx = 0;; indx++)
+    {
+      size = 0;
+      err = gnutls_x509_crt_get_crl_dist_points (cert, indx, buffer, &size,
+                                                 NULL, NULL);
+      if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+        return;
+      if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          addf (str, "error: get_crl_dist_points: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      buffer = gnutls_malloc (size);
+      if (!buffer)
+        {
+          addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      err = gnutls_x509_crt_get_crl_dist_points (cert, indx, buffer, &size,
+                                                 NULL, NULL);
+      if (err < 0)
+        {
+          gnutls_free (buffer);
+          addf (str, "error: get_crl_dist_points2: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      switch (err)
+        {
+        case GNUTLS_SAN_DNSNAME:
+          addf (str, "\t\t\tDNSname: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_RFC822NAME:
+          addf (str, "\t\t\tRFC822name: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_URI:
+          addf (str, "\t\t\tURI: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_IPADDRESS:
+          addf (str, "\t\t\tIPAddress: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_DN:
+          addf (str, "\t\t\tdirectoryName: %.*s\n", size, buffer);
+          break;
+
+        default:
+          addf (str, "error: unknown SAN\n");
+          break;
+        }
+      gnutls_free (buffer);
+    }
+}
+
+static void
+print_key_purpose (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  int indx;
+  char *buffer = NULL;
+  size_t size;
+  int err;
+
+  for (indx = 0;; indx++)
+    {
+      size = 0;
+      err = gnutls_x509_crt_get_key_purpose_oid (cert, indx, buffer,
+                                                 &size, NULL);
+      if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+        return;
+      if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          addf (str, "error: get_key_purpose_oid: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      buffer = gnutls_malloc (size);
+      if (!buffer)
+        {
+          addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      err = gnutls_x509_crt_get_key_purpose_oid (cert, indx, buffer,
+                                                 &size, NULL);
+      if (err < 0)
+        {
+          gnutls_free (buffer);
+          addf (str, "error: get_key_purpose_oid2: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      if (strcmp (buffer, GNUTLS_KP_TLS_WWW_SERVER) == 0)
+        addf (str, _("\t\t\tTLS WWW Server.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_TLS_WWW_CLIENT) == 0)
+        addf (str, _("\t\t\tTLS WWW Client.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_CODE_SIGNING) == 0)
+        addf (str, _("\t\t\tCode signing.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_EMAIL_PROTECTION) == 0)
+        addf (str, _("\t\t\tEmail protection.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_TIME_STAMPING) == 0)
+        addf (str, _("\t\t\tTime stamping.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_OCSP_SIGNING) == 0)
+        addf (str, _("\t\t\tOCSP signing.\n"));
+      else if (strcmp (buffer, GNUTLS_KP_ANY) == 0)
+        addf (str, _("\t\t\tAny purpose.\n"));
+      else
+        addf (str, "\t\t\t%s\n", buffer);
+
+      gnutls_free (buffer);
+    }
+}
+
+static void
+print_basic (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  int pathlen;
+  int err;
+
+  err = gnutls_x509_crt_get_basic_constraints (cert, NULL, NULL, &pathlen);
+  if (err < 0)
+    {
+      addf (str, "error: get_basic_constraints: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  if (err == 0)
+    addf (str, _("\t\t\tCertificate Authority (CA): FALSE\n"));
+  else
+    addf (str, _("\t\t\tCertificate Authority (CA): TRUE\n"));
+
+  if (pathlen >= 0)
+    addf (str, _("\t\t\tPath Length Constraint: %d\n"), pathlen);
+}
+
+static void
+print_san (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  unsigned int san_idx;
+
+  for (san_idx = 0;; san_idx++)
+    {
+      char *buffer = NULL;
+      size_t size = 0;
+      int err;
+
+      err =
+        gnutls_x509_crt_get_subject_alt_name (cert, san_idx, buffer, &size,
+                                              NULL);
+      if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+        break;
+      if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          addf (str, "error: get_subject_alt_name: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      buffer = gnutls_malloc (size);
+      if (!buffer)
+        {
+          addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      err = gnutls_x509_crt_get_subject_alt_name (cert, san_idx,
+                                                  buffer, &size, NULL);
+      if (err < 0)
+        {
+          gnutls_free (buffer);
+          addf (str, "error: get_subject_alt_name2: %s\n",
+                gnutls_strerror (err));
+          return;
+        }
+
+      switch (err)
+        {
+        case GNUTLS_SAN_DNSNAME:
+          addf (str, "\t\t\tDNSname: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_RFC822NAME:
+          addf (str, "\t\t\tRFC822name: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_URI:
+          addf (str, "\t\t\tURI: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_IPADDRESS:
+          addf (str, "\t\t\tIPAddress: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_DN:
+          addf (str, "\t\t\tdirectoryName: %.*s\n", size, buffer);
+          break;
+
+        case GNUTLS_SAN_OTHERNAME:
+          {
+            char *oid = NULL;
+            size_t oidsize;
+
+            oidsize = 0;
+            err = gnutls_x509_crt_get_subject_alt_othername_oid
+              (cert, san_idx, oid, &oidsize);
+            if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+              {
+                gnutls_free (buffer);
+                addf (str, "error: get_subject_alt_othername_oid: %s\n",
+                      gnutls_strerror (err));
+                return;
+              }
+
+            oid = gnutls_malloc (oidsize);
+            if (!oid)
+              {
+                gnutls_free (buffer);
+                addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+                return;
+              }
+
+            err = gnutls_x509_crt_get_subject_alt_othername_oid
+              (cert, san_idx, oid, &oidsize);
+            if (err < 0)
+              {
+                gnutls_free (buffer);
+                gnutls_free (oid);
+                addf (str, "error: get_subject_alt_othername_oid2: %s\n",
+                      gnutls_strerror (err));
+                return;
+              }
+
+            if (err == GNUTLS_SAN_OTHERNAME_XMPP)
+              addf (str, _("\t\t\tXMPP Address: %.*s\n"), size, buffer);
+            else
+              {
+                addf (str, _("\t\t\totherName OID: %.*s\n"), oidsize, oid);
+                addf (str, _("\t\t\totherName DER: "));
+                hexprint (str, buffer, size);
+                addf (str, _("\n\t\t\totherName ASCII: "));
+                asciiprint (str, buffer, size);
+                addf (str, "\n");
+              }
+            gnutls_free (oid);
+          }
+          break;
+
+        default:
+          addf (str, "error: unknown SAN\n");
+          break;
+        }
+
+      gnutls_free (buffer);
+    }
+}
+
+static void
+print_cert (gnutls_string * str, gnutls_x509_crt_t cert, int notsigned)
+{
+  /* Version. */
+  {
+    int version = gnutls_x509_crt_get_version (cert);
+    if (version < 0)
+      addf (str, "error: get_version: %s\n", gnutls_strerror (version));
+    else
+      addf (str, _("\tVersion: %d\n"), version);
+  }
+
+  /* Serial. */
+  {
+    char serial[128];
+    size_t serial_size = sizeof (serial);
+    int err;
+
+    err = gnutls_x509_crt_get_serial (cert, serial, &serial_size);
+    if (err < 0)
+      addf (str, "error: get_serial: %s\n", gnutls_strerror (err));
+    else
+      {
+        addf (str, _("\tSerial Number (hex): "));
+        hexprint (str, serial, serial_size);
+        addf (str, "\n");
+      }
+  }
+
+  /* Issuer. */
+  if (!notsigned)
+    {
+      char dn[1024];
+      size_t dn_size = sizeof (dn);
+      int err;
+
+      err = gnutls_x509_crt_get_issuer_dn (cert, dn, &dn_size);
+      if (err < 0)
+        addf (str, "error: get_issuer_dn: %s\n", gnutls_strerror (err));
+      else
+        addf (str, _("\tIssuer: %s\n"), dn);
+    }
+
+  /* Validity. */
+  {
+    time_t tim;
+
+    addf (str, _("\tValidity:\n"));
+
+    tim = gnutls_x509_crt_get_activation_time (cert);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "error: gmtime_r (%d)\n", t);
+      else if (strftime (s, max, "%a %b %e %H:%M:%S UTC %Y", &t) == 0)
+        addf (str, "error: strftime (%d)\n", t);
+      else
+        addf (str, _("\t\tNot Before: %s\n"), s);
+    }
+
+    tim = gnutls_x509_crt_get_expiration_time (cert);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "error: gmtime_r (%d)\n", t);
+      else if (strftime (s, max, "%a %b %e %H:%M:%S UTC %Y", &t) == 0)
+        addf (str, "error: strftime (%d)\n", t);
+      else
+        addf (str, _("\t\tNot After: %s\n"), s);
+    }
+  }
+
+  /* Subject. */
+  {
+    char dn[1024];
+    size_t dn_size = sizeof (dn);
+    int err;
+
+    err = gnutls_x509_crt_get_dn (cert, dn, &dn_size);
+    if (err < 0)
+      addf (str, "error: get_dn: %s\n", gnutls_strerror (err));
+    else
+      addf (str, _("\tSubject: %s\n"), dn);
+  }
+
+  /* SubjectPublicKeyInfo. */
+  {
+    int err;
+    unsigned int bits;
+
+    err = gnutls_x509_crt_get_pk_algorithm (cert, &bits);
+    if (err < 0)
+      addf (str, "error: get_pk_algorithm: %s\n", gnutls_strerror (err));
+    else
+      {
+        const char *name = gnutls_pk_algorithm_get_name (err);
+        if (name == NULL)
+          name = "Unknown";
+
+        addf (str, _("\tSubject Public Key Algorithm: %s\n"), name);
+        switch (err)
+          {
+          case GNUTLS_PK_RSA:
+            {
+              gnutls_datum_t m, e;
+
+              err = gnutls_x509_crt_get_pk_rsa_raw (cert, &m, &e);
+              if (err < 0)
+                addf (str, "error: get_pk_rsa_raw: %s\n",
+                      gnutls_strerror (err));
+              else
+                {
+                  addf (str, _("\t\tModulus (bits %d):\n"), bits);
+                  hexdump (str, m.data, m.size, "\t\t\t");
+                  addf (str, _("\t\tExponent:\n"));
+                  hexdump (str, e.data, e.size, "\t\t\t");
+                }
+
+              gnutls_free (m.data);
+              gnutls_free (e.data);
+            }
+            break;
+
+          case GNUTLS_PK_DSA:
+            {
+              gnutls_datum_t p, q, g, y;
+
+              err = gnutls_x509_crt_get_pk_dsa_raw (cert, &p, &q, &g, &y);
+              if (err < 0)
+                addf (str, "error: get_pk_dsa_raw: %s\n",
+                      gnutls_strerror (err));
+              else
+                {
+                  addf (str, _("\t\tPublic key (bits %d):\n"), bits);
+                  hexdump (str, y.data, y.size, "\t\t\t");
+                  addf (str, _("\t\tP:\n"));
+                  hexdump (str, p.data, p.size, "\t\t\t");
+                  addf (str, _("\t\tQ:\n"));
+                  hexdump (str, q.data, q.size, "\t\t\t");
+                  addf (str, _("\t\tG:\n"));
+                  hexdump (str, g.data, g.size, "\t\t\t");
+                }
+            }
+            break;
+
+          default:
+            break;
+          }
+      }
+  }
+
+  /* Extensions. */
+  if (gnutls_x509_crt_get_version (cert) >= 3)
+    {
+      size_t i;
+      int err = 0;
+
+      for (i = 0;; i++)
+        {
+          char oid[128] = "";
+          size_t sizeof_oid = sizeof (oid);
+          int critical;
+          size_t san_idx = 0;
+          size_t proxy_idx = 0;
+          size_t basic_idx = 0;
+          size_t keyusage_idx = 0;
+          size_t keypurpose_idx = 0;
+          size_t ski_idx = 0;
+          size_t aki_idx = 0;
+          size_t crldist_idx = 0;
+
+          err = gnutls_x509_crt_get_extension_info (cert, i,
+                                                    oid, &sizeof_oid,
+                                                    &critical);
+          if (err < 0)
+            {
+              if (err == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+                break;
+              addf (str, "error: get_extension_info: %s\n",
+                    gnutls_strerror (err));
+              continue;
+            }
+
+          if (i == 0)
+            addf (str, _("\tExtensions:\n"));
+
+          if (strcmp (oid, "2.5.29.19") == 0)
+            {
+              if (basic_idx)
+                {
+                  addf (str, "error: more than one basic constraint\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tBasic Constraints (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_basic (str, cert);
+
+              basic_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.14") == 0)
+            {
+              if (ski_idx)
+                {
+                  addf (str, "error: more than one SKI extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tSubject Key Identifier (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_ski (str, cert);
+
+              ski_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.35") == 0)
+            {
+              if (aki_idx)
+                {
+                  addf (str, "error: more than one AKI extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tAuthority Key Identifier (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_aki (str, cert);
+
+              aki_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.15") == 0)
+            {
+              if (keyusage_idx)
+                {
+                  addf (str, "error: more than one key usage extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tKey Usage (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_key_usage (str, cert);
+
+              keyusage_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.37") == 0)
+            {
+              if (keypurpose_idx)
+                {
+                  addf (str, "error: more than one key purpose extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tKey Purpose (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_key_purpose (str, cert);
+
+              keypurpose_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.17") == 0)
+            {
+              if (san_idx)
+                {
+                  addf (str, "error: more than one SKI extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tSubject Alternative Name (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_san (str, cert);
+
+              san_idx++;
+            }
+          else if (strcmp (oid, "2.5.29.31") == 0)
+            {
+              if (crldist_idx)
+                {
+                  addf (str, "error: more than one CRL distribution point\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tCRL Distribution points (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_crldist (str, cert);
+
+              crldist_idx++;
+            }
+          else if (strcmp (oid, "1.3.6.1.5.5.7.1.14") == 0)
+            {
+              if (proxy_idx)
+                {
+                  addf (str, "error: more than one proxy extension\n");
+                  continue;
+                }
+
+              addf (str, _("\t\tProxy Certificate Information (%s):\n"),
+                    critical ? _("critical") : _("not critical"));
+
+              print_proxy (str, cert);
+
+              proxy_idx++;
+            }
+          else
+            {
+              char *buffer;
+              size_t extlen = 0;
+
+              addf (str, _("\t\tUnknown extension %s (%s):\n"), oid,
+                    critical ? _("critical") : _("not critical"));
+
+              err = gnutls_x509_crt_get_extension_data (cert, i,
+                                                        NULL, &extlen);
+              if (err < 0)
+                {
+                  addf (str, "error: get_extension_data: %s\n",
+                        gnutls_strerror (err));
+                  continue;
+                }
+
+              buffer = gnutls_malloc (extlen);
+              if (!buffer)
+                {
+                  addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+                  continue;
+                }
+
+              err = gnutls_x509_crt_get_extension_data (cert, i,
+                                                        buffer, &extlen);
+              if (err < 0)
+                {
+                  gnutls_free (buffer);
+                  addf (str, "error: get_extension_data2: %s\n",
+                        gnutls_strerror (err));
+                  continue;
+                }
+
+              addf (str, _("\t\t\tASCII: "));
+              asciiprint (str, buffer, extlen);
+              addf (str, "\n");
+
+              addf (str, _("\t\t\tHexdump: "));
+              hexprint (str, buffer, extlen);
+              adds (str, "\n");
+
+              gnutls_free (buffer);
+            }
+        }
+    }
+
+  /* Signature. */
+  if (!notsigned)
+    {
+      int err;
+      size_t size = 0;
+      char *buffer = NULL;
+
+      err = gnutls_x509_crt_get_signature_algorithm (cert);
+      if (err < 0)
+        addf (str, "error: get_signature_algorithm: %s\n",
+              gnutls_strerror (err));
+      else
+        {
+          const char *name = gnutls_sign_algorithm_get_name (err);
+          if (name == NULL)
+            name = "Unknown";
+          addf (str, _("\tSignature Algorithm: %s\n"), name);
+        }
+      if (err == GNUTLS_SIGN_RSA_MD5 || err == GNUTLS_SIGN_RSA_MD2)
+        {
+          addf (str,
+                _
+                ("warning: signed using a broken signature algorithm that can be forged.\n"));
+        }
+
+      err = gnutls_x509_crt_get_signature (cert, buffer, &size);
+      if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          addf (str, "error: get_signature: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      buffer = gnutls_malloc (size);
+      if (!buffer)
+        {
+          addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      err = gnutls_x509_crt_get_signature (cert, buffer, &size);
+      if (err < 0)
+        {
+          gnutls_free (buffer);
+          addf (str, "error: get_signature2: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      addf (str, _("\tSignature:\n"));
+      hexdump (str, buffer, size, "\t\t");
+
+      gnutls_free (buffer);
+    }
+}
+
+static void
+print_fingerprint (gnutls_string * str, gnutls_x509_crt_t cert,
+                   gnutls_digest_algorithm_t algo)
+{
+  int err;
+  char buffer[MAX_HASH_SIZE];
+  size_t size = sizeof (buffer);
+
+  err = gnutls_x509_crt_get_fingerprint (cert, algo, buffer, &size);
+  if (err < 0)
+    {
+      addf (str, "error: get_fingerprint: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  if (algo == GNUTLS_DIG_MD5)
+    addf (str, _("\tMD5 fingerprint:\n\t\t"));
+  else
+    addf (str, _("\tSHA-1 fingerprint:\n\t\t"));
+  hexprint (str, buffer, size);
+  adds (str, "\n");
+}
+
+static void
+print_keyid (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+  int err;
+  size_t size = 0;
+  char *buffer = NULL;
+
+  err = gnutls_x509_crt_get_key_id (cert, 0, buffer, &size);
+  if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+      addf (str, "error: get_key_id: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  buffer = gnutls_malloc (size);
+  if (!buffer)
+    {
+      addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  err = gnutls_x509_crt_get_key_id (cert, 0, buffer, &size);
+  if (err < 0)
+    {
+      gnutls_free (buffer);
+      addf (str, "error: get_key_id2: %s\n", gnutls_strerror (err));
+      return;
+    }
+
+  addf (str, _("\tPublic Key Id:\n\t\t"));
+  hexprint (str, buffer, size);
+  adds (str, "\n");
+
+  gnutls_free (buffer);
+}
+
+static void
+print_other (gnutls_string * str, gnutls_x509_crt_t cert, int notsigned)
+{
+  if (!notsigned)
+    {
+      print_fingerprint (str, cert, GNUTLS_DIG_MD5);
+      print_fingerprint (str, cert, GNUTLS_DIG_SHA1);
+    }
+  print_keyid (str, cert);
+}
+
+static void
+print_oneline (gnutls_string * str, gnutls_x509_crt_t cert)
+{
+
+  /* Subject. */
+  {
+    char dn[1024];
+    size_t dn_size = sizeof (dn);
+    int err;
+
+    err = gnutls_x509_crt_get_dn (cert, dn, &dn_size);
+    if (err < 0)
+      addf (str, "unknown subject (%s), ", gnutls_strerror (err));
+    else
+      addf (str, "subject `%s', ", dn);
+  }
+
+  /* Issuer. */
+  {
+    char dn[1024];
+    size_t dn_size = sizeof (dn);
+    int err;
+
+    err = gnutls_x509_crt_get_issuer_dn (cert, dn, &dn_size);
+    if (err < 0)
+      addf (str, "unknown issuer (%s), ", gnutls_strerror (err));
+    else
+      addf (str, "issuer `%s', ", dn);
+  }
+
+  {
+    int bits;
+    const char *name = gnutls_pk_algorithm_get_name
+      (gnutls_x509_crt_get_pk_algorithm (cert, &bits));
+    if (name == NULL)
+      name = "Unknown";
+    addf (str, "%s key %d bits, ", name, bits);
+  }
+
+  /* Validity. */
+  {
+    time_t tim;
+
+    tim = gnutls_x509_crt_get_activation_time (cert);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "unknown activation (%d), ", t);
+      else if (strftime (s, max, "%Y-%m-%d %H:%M:%S UTC", &t) == 0)
+        addf (str, "failed activation (%d), ", t);
+      else
+        addf (str, "activated `%s', ", s);
+    }
+
+    tim = gnutls_x509_crt_get_expiration_time (cert);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "unknown expiry (%d), ", t);
+      else if (strftime (s, max, "%Y-%m-%d %H:%M:%S UTC", &t) == 0)
+        addf (str, "failed expiry (%d), ", t);
+      else
+        addf (str, "expires `%s', ", s);
+    }
+  }
+
+  {
+    int pathlen;
+    char *policyLanguage;
+    int err;
+
+    err = gnutls_x509_crt_get_proxy (cert, NULL,
+                                     &pathlen, &policyLanguage, NULL, NULL);
+    if (err == 0)
+      {
+        addf (str, "proxy certificate (policy=");
+        if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.1") == 0)
+          addf (str, "id-ppl-inheritALL");
+        else if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.2") == 0)
+          addf (str, "id-ppl-independent");
+        else
+          addf (str, "%s", policyLanguage);
+        if (pathlen >= 0)
+          addf (str, ", pathlen=%d), ", pathlen);
+        else
+          addf (str, "), ");
+        gnutls_free (policyLanguage);
+      }
+  }
+
+  {
+    char buffer[20];
+    size_t size = sizeof (buffer);
+    int err;
+
+    err = gnutls_x509_crt_get_fingerprint (cert, GNUTLS_DIG_SHA1,
+                                           buffer, &size);
+    if (err < 0)
+      {
+        addf (str, "unknown fingerprint (%s)", gnutls_strerror (err));
+      }
+    else
+      {
+        addf (str, "SHA-1 fingerprint `");
+        hexprint (str, buffer, size);
+        adds (str, "'");
+      }
+  }
+
+}
+
+/**
+ * gnutls_x509_crt_print - Pretty print X.509 certificates
+ * @cert: The structure to be printed
+ * @format: Indicate the format to use
+ * @out: Newly allocated datum with zero terminated string.
+ *
+ * This function will pretty print a X.509 certificate, suitable for
+ * display to a human.
+ *
+ * If the format is %GNUTLS_X509_CRT_FULL then all fields of the
+ * certificate will be output, on multiple lines.  The
+ * %GNUTLS_X509_CRT_ONELINE format will generate one line with some
+ * selected fields, which is useful for logging purposes.
+ *
+ * The output @out needs to be deallocate using gnutls_free().
+ *
+ * Returns 0 on success.
+ **/
+int
+gnutls_x509_crt_print (gnutls_x509_crt_t cert,
+                       gnutls_certificate_print_formats_t format,
+                       gnutls_datum_t * out)
+{
+  gnutls_string str;
+
+  if (format == GNUTLS_X509_CRT_FULL
+      || format == GNUTLS_X509_CRT_UNSIGNED_FULL)
+    {
+      _gnutls_string_init (&str, gnutls_malloc, gnutls_realloc, gnutls_free);
+
+      _gnutls_string_append_str (&str, _("X.509 Certificate Information:\n"));
+
+      print_cert (&str, cert, format == GNUTLS_X509_CRT_UNSIGNED_FULL);
+
+      _gnutls_string_append_str (&str, _("Other Information:\n"));
+
+      print_other (&str, cert, format == GNUTLS_X509_CRT_UNSIGNED_FULL);
+
+      _gnutls_string_append_data (&str, "\0", 1);
+      out->data = str.data;
+      out->size = strlen (str.data);
+    }
+  else if (format == GNUTLS_X509_CRT_ONELINE)
+    {
+      _gnutls_string_init (&str, gnutls_malloc, gnutls_realloc, gnutls_free);
+
+      print_oneline (&str, cert);
+
+      _gnutls_string_append_data (&str, "\0", 1);
+      out->data = str.data;
+      out->size = strlen (str.data);
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return 0;
+}
+
+static void
+print_crl (gnutls_string * str, gnutls_x509_crl_t crl, int notsigned)
+{
+  /* Version. */
+  {
+    int version = gnutls_x509_crl_get_version (crl);
+    if (version == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)
+      addf (str, _("\tVersion: 1 (default)\n"));
+    else if (version < 0)
+      addf (str, "error: get_version: %s\n", gnutls_strerror (version));
+    else
+      addf (str, _("\tVersion: %d\n"), version);
+  }
+
+  /* Issuer. */
+  if (!notsigned)
+    {
+      char dn[1024];
+      size_t dn_size = sizeof (dn);
+      int err;
+
+      err = gnutls_x509_crl_get_issuer_dn (crl, dn, &dn_size);
+      if (err < 0)
+        addf (str, "error: get_issuer_dn: %s\n", gnutls_strerror (err));
+      else
+        addf (str, _("\tIssuer: %s\n"), dn);
+    }
+
+  /* Validity. */
+  {
+    time_t tim;
+
+    addf (str, _("\tUpdate dates:\n"));
+
+    tim = gnutls_x509_crl_get_this_update (crl);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "error: gmtime_r (%d)\n", t);
+      else if (strftime (s, max, "%a %b %e %H:%M:%S UTC %Y", &t) == 0)
+        addf (str, "error: strftime (%d)\n", t);
+      else
+        addf (str, _("\t\tIssued: %s\n"), s);
+    }
+
+    tim = gnutls_x509_crl_get_next_update (crl);
+    {
+      char s[42];
+      size_t max = sizeof (s);
+      struct tm t;
+
+      if (tim == -1)
+        addf (str, "\t\tNo next update time.\n");
+      else if (gmtime_r (&tim, &t) == NULL)
+        addf (str, "error: gmtime_r (%d)\n", t);
+      else if (strftime (s, max, "%a %b %e %H:%M:%S UTC %Y", &t) == 0)
+        addf (str, "error: strftime (%d)\n", t);
+      else
+        addf (str, _("\t\tNext at: %s\n"), s);
+    }
+  }
+
+  /* Revoked certificates. */
+  {
+    int num = gnutls_x509_crl_get_crt_count (crl);
+    int j;
+
+    if (num)
+      addf (str, _("\tRevoked certificates (%d):\n"), num);
+    else
+      addf (str, _("\tNo revoked certificates.\n"));
+
+    for (j = 0; j < num; j++)
+      {
+        char serial[128];
+        size_t serial_size = sizeof (serial);
+        int err;
+        time_t tim;
+
+        err = gnutls_x509_crl_get_crt_serial (crl, j, serial,
+                                              &serial_size, &tim);
+        if (err < 0)
+          addf (str, "error: get_crt_serial: %s\n", gnutls_strerror (err));
+        else
+          {
+            char s[42];
+            size_t max = sizeof (s);
+            struct tm t;
+
+            addf (str, _("\t\tSerial Number (hex): "));
+            hexprint (str, serial, serial_size);
+            adds (str, "\n");
+
+            if (gmtime_r (&tim, &t) == NULL)
+              addf (str, "error: gmtime_r (%d)\n", t);
+            else if (strftime (s, max, "%a %b %e %H:%M:%S UTC %Y", &t) == 0)
+              addf (str, "error: strftime (%d)\n", t);
+            else
+              addf (str, _("\t\tRevoked at: %s\n"), s);
+          }
+      }
+  }
+
+  /* Signature. */
+  if (!notsigned)
+    {
+      int err;
+      size_t size = 0;
+      char *buffer = NULL;
+
+      err = gnutls_x509_crl_get_signature_algorithm (crl);
+      if (err < 0)
+        addf (str, "error: get_signature_algorithm: %s\n",
+              gnutls_strerror (err));
+      else
+        {
+          const char *name = gnutls_sign_algorithm_get_name (err);
+          if (name == NULL)
+            name = "Unknown";
+          addf (str, _("\tSignature Algorithm: %s\n"), name);
+        }
+      if (err == GNUTLS_SIGN_RSA_MD5 || err == GNUTLS_SIGN_RSA_MD2)
+        {
+          addf (str,
+                _
+                ("warning: signed using a broken signature algorithm that can be forged.\n"));
+        }
+
+      err = gnutls_x509_crl_get_signature (crl, buffer, &size);
+      if (err != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          addf (str, "error: get_signature: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      buffer = gnutls_malloc (size);
+      if (!buffer)
+        {
+          addf (str, "error: malloc: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      err = gnutls_x509_crl_get_signature (crl, buffer, &size);
+      if (err < 0)
+        {
+          gnutls_free (buffer);
+          addf (str, "error: get_signature2: %s\n", gnutls_strerror (err));
+          return;
+        }
+
+      addf (str, _("\tSignature:\n"));
+      hexdump (str, buffer, size, "\t\t");
+
+      gnutls_free (buffer);
+    }
+}
+
+/**
+ * gnutls_x509_crl_print - Pretty print X.509 certificate revocation list
+ * @crl: The structure to be printed
+ * @format: Indicate the format to use
+ * @out: Newly allocated datum with zero terminated string.
+ *
+ * This function will pretty print a X.509 certificate revocation
+ * list, suitable for display to a human.
+ *
+ * The output @out needs to be deallocate using gnutls_free().
+ *
+ * Returns 0 on success.
+ **/
+int
+gnutls_x509_crl_print (gnutls_x509_crl_t crl,
+                       gnutls_certificate_print_formats_t format,
+                       gnutls_datum_t * out)
+{
+  gnutls_string str;
+
+  _gnutls_string_init (&str, gnutls_malloc, gnutls_realloc, gnutls_free);
+
+  _gnutls_string_append_str
+    (&str, _("X.509 Certificate Revocation List Information:\n"));
+
+  print_crl (&str, crl, format == GNUTLS_X509_CRT_UNSIGNED_FULL);
+
+  _gnutls_string_append_data (&str, "\0", 1);
+  out->data = str.data;
+  out->size = strlen (str.data);
+
+  return 0;
+}
diff --git a/src/daemon/https/x509/pkcs12.c b/src/daemon/https/x509/pkcs12.c
new file mode 100644
index 00000000..40f7a243
--- /dev/null
+++ b/src/daemon/https/x509/pkcs12.c
@@ -0,0 +1,1325 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate on PKCS12 packet parsing.
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+#include <common.h>
+#include <x509_b64.h>
+#include <pkcs12.h>
+#include <dn.h>
+#include <mpi.h>
+#include <gc.h>
+
+
+/* Decodes the PKCS #12 auth_safe, and returns the allocated raw data,
+ * which holds them. Returns an ASN1_TYPE of authenticatedSafe.
+ */
+static int
+_decode_pkcs12_auth_safe (ASN1_TYPE pkcs12, ASN1_TYPE * authen_safe,
+                          gnutls_datum_t * raw)
+{
+  char oid[128];
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  gnutls_datum_t auth_safe = { NULL, 0 };
+  int tmp_size, len, result;
+
+  len = sizeof (oid) - 1;
+  result = asn1_read_value (pkcs12, "authSafe.contentType", oid, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (strcmp (oid, DATA_OID) != 0)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("Unknown PKCS12 Content OID '%s'\n", oid);
+      return GNUTLS_E_UNKNOWN_PKCS_CONTENT_TYPE;
+    }
+
+  /* Step 1. Read the content data
+   */
+
+  tmp_size = 0;
+  result =
+    _gnutls_x509_read_value (pkcs12, "authSafe.content", &auth_safe, 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* Step 2. Extract the authenticatedSafe.
+   */
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-12-AuthenticatedSafe",
+        &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_der_decoding (&c2, auth_safe.data, auth_safe.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (raw == NULL)
+    {
+      _gnutls_free_datum (&auth_safe);
+    }
+  else
+    {
+      raw->data = auth_safe.data;
+      raw->size = auth_safe.size;
+    }
+
+  if (authen_safe)
+    *authen_safe = c2;
+  else
+    asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  _gnutls_free_datum (&auth_safe);
+  return result;
+}
+
+/**
+  * gnutls_pkcs12_init - This function initializes a gnutls_pkcs12_t structure
+  * @pkcs12: The structure to be initialized
+  *
+  * This function will initialize a PKCS12 structure. PKCS12 structures
+  * usually contain lists of X.509 Certificates and X.509 Certificate
+  * revocation lists.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_init (gnutls_pkcs12_t * pkcs12)
+{
+  *pkcs12 = gnutls_calloc (1, sizeof (gnutls_pkcs12_int));
+
+  if (*pkcs12)
+    {
+      int result = asn1_create_element (_gnutls_get_pkix (),
+                                        "PKIX1.pkcs-12-PFX",
+                                        &(*pkcs12)->pkcs12);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          gnutls_free (*pkcs12);
+          return _gnutls_asn2err (result);
+        }
+      return 0;                 /* success */
+    }
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+  * gnutls_pkcs12_deinit - This function deinitializes memory used by a gnutls_pkcs12_t structure
+  * @pkcs12: The structure to be initialized
+  *
+  * This function will deinitialize a PKCS12 structure. 
+  *
+  **/
+void
+gnutls_pkcs12_deinit (gnutls_pkcs12_t pkcs12)
+{
+  if (!pkcs12)
+    return;
+
+  if (pkcs12->pkcs12)
+    asn1_delete_structure (&pkcs12->pkcs12);
+
+  gnutls_free (pkcs12);
+}
+
+/**
+  * gnutls_pkcs12_import - This function will import a DER or PEM encoded PKCS12 structure
+  * @pkcs12: The structure to store the parsed PKCS12.
+  * @data: The DER or PEM encoded PKCS12.
+  * @format: One of DER or PEM
+  * @flags: an ORed sequence of gnutls_privkey_pkcs8_flags
+  *
+  * This function will convert the given DER or PEM encoded PKCS12
+  * to the native gnutls_pkcs12_t format. The output will be stored in 'pkcs12'.
+  *
+  * If the PKCS12 is PEM encoded it should have a header of "PKCS12".
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_import (gnutls_pkcs12_t pkcs12,
+                      const gnutls_datum_t * data,
+                      gnutls_x509_crt_fmt_t format, unsigned int flags)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* If the PKCS12 is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      result = _gnutls_fbase64_decode (PEM_PKCS12, data->data, data->size,
+                                       &out);
+
+      if (result <= 0)
+        {
+          if (result == 0)
+            result = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_assert ();
+          return result;
+        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+  result = asn1_der_decoding (&pkcs12->pkcs12, _data.data, _data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if (need_free)
+    _gnutls_free_datum (&_data);
+
+  return 0;
+
+cleanup:
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+
+/**
+  * gnutls_pkcs12_export - This function will export the pkcs12 structure
+  * @pkcs12: Holds the pkcs12 structure
+  * @format: the format of output params. One of PEM or DER.
+  * @output_data: will contain a structure PEM or DER encoded
+  * @output_data_size: holds the size of output_data (and will be
+  *   replaced by the actual size of parameters)
+  *
+  * This function will export the pkcs12 structure to DER or PEM format.
+  *
+  * If the buffer provided is not long enough to hold the output, then
+  * *output_data_size will be updated and GNUTLS_E_SHORT_MEMORY_BUFFER
+  * will be returned.
+  *
+  * If the structure is PEM encoded, it will have a header
+  * of "BEGIN PKCS12".
+  *
+  * Return value: In case of failure a negative value will be
+  *   returned, and 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_export (gnutls_pkcs12_t pkcs12,
+                      gnutls_x509_crt_fmt_t format, void *output_data,
+                      size_t * output_data_size)
+{
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_export_int (pkcs12->pkcs12, format, PEM_PKCS12,
+                                  output_data, output_data_size);
+}
+
+static int
+oid2bag (const char *oid)
+{
+  if (strcmp (oid, BAG_PKCS8_KEY) == 0)
+    return GNUTLS_BAG_PKCS8_KEY;
+  if (strcmp (oid, BAG_PKCS8_ENCRYPTED_KEY) == 0)
+    return GNUTLS_BAG_PKCS8_ENCRYPTED_KEY;
+  if (strcmp (oid, BAG_CERTIFICATE) == 0)
+    return GNUTLS_BAG_CERTIFICATE;
+  if (strcmp (oid, BAG_CRL) == 0)
+    return GNUTLS_BAG_CRL;
+
+  return GNUTLS_BAG_UNKNOWN;
+}
+
+static const char *
+bag_to_oid (int bag)
+{
+  switch (bag)
+    {
+    case GNUTLS_BAG_PKCS8_KEY:
+      return BAG_PKCS8_KEY;
+    case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
+      return BAG_PKCS8_ENCRYPTED_KEY;
+    case GNUTLS_BAG_CERTIFICATE:
+      return BAG_CERTIFICATE;
+    case GNUTLS_BAG_CRL:
+      return BAG_CRL;
+    }
+  return NULL;
+}
+
+static inline char *
+ucs2_to_ascii (char *data, int size)
+{
+  int i, j;
+
+  for (i = 0; i < size / 2; i++)
+    {
+      j = 2 * i + 1;
+      if (isascii (data[j]))
+        data[i] = data[i * 2 + 1];
+      else
+        data[i] = '?';
+    }
+  data[i] = 0;
+
+  return data;
+}
+
+/* Decodes the SafeContents, and puts the output in
+ * the given bag. 
+ */
+int
+_pkcs12_decode_safe_contents (const gnutls_datum_t * content,
+                              gnutls_pkcs12_bag_t bag)
+{
+  char oid[128], root[MAX_NAME_SIZE];
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int len, result;
+  int bag_type;
+  gnutls_datum_t attr_val;
+  int count = 0, i, attributes, j;
+  size_t size;
+
+  /* Step 1. Extract the SEQUENCE.
+   */
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-12-SafeContents",
+        &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_der_decoding (&c2, content->data, content->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Count the number of bags
+   */
+  result = asn1_number_of_elements (c2, "", &count);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  bag->bag_elements = MIN (MAX_BAG_ELEMENTS, count);
+
+  for (i = 0; i < bag->bag_elements; i++)
+    {
+
+      snprintf (root, sizeof (root), "?%u.bagId", i + 1);
+
+      len = sizeof (oid);
+      result = asn1_read_value (c2, root, oid, &len);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      /* Read the Bag type
+       */
+      bag_type = oid2bag (oid);
+
+      if (bag_type < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+      /* Read the Bag Value
+       */
+
+      snprintf (root, sizeof (root), "?%u.bagValue", i + 1);
+
+      result = _gnutls_x509_read_value (c2, root, &bag->element[i].data, 0);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+      if (bag_type == GNUTLS_BAG_CERTIFICATE || bag_type == GNUTLS_BAG_CRL)
+        {
+          gnutls_datum_t tmp = bag->element[i].data;
+
+          result =
+            _pkcs12_decode_crt_bag (bag_type, &tmp, &bag->element[i].data);
+          if (result < 0)
+            {
+              gnutls_assert ();
+              goto cleanup;
+            }
+
+          _gnutls_free_datum (&tmp);
+        }
+
+      /* read the bag attributes
+       */
+      snprintf (root, sizeof (root), "?%u.bagAttributes", i + 1);
+
+      result = asn1_number_of_elements (c2, root, &attributes);
+      if (result != ASN1_SUCCESS && result != ASN1_ELEMENT_NOT_FOUND)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      if (attributes < 0)
+        attributes = 1;
+
+      if (result != ASN1_ELEMENT_NOT_FOUND)
+        for (j = 0; j < attributes; j++)
+          {
+
+            snprintf (root, sizeof (root), "?%u.bagAttributes.?%u", i + 1,
+                      j + 1);
+
+            result =
+              _gnutls_x509_decode_and_read_attribute (c2, root, oid,
+                                                      sizeof (oid), &attr_val,
+                                                      1, 0);
+
+            if (result < 0)
+              {
+                gnutls_assert ();
+                continue;       /* continue in case we find some known attributes */
+              }
+
+            if (strcmp (oid, KEY_ID_OID) == 0)
+              {
+                size = attr_val.size;
+
+                result =
+                  _gnutls_x509_decode_octet_string (NULL, attr_val.data, size,
+                                                    attr_val.data, &size);
+                attr_val.size = size;
+                if (result < 0)
+                  {
+                    _gnutls_free_datum (&attr_val);
+                    gnutls_assert ();
+                    _gnutls_x509_log
+                      ("Error decoding PKCS12 Bag Attribute OID '%s'\n", oid);
+                    continue;
+                  }
+                bag->element[i].local_key_id = attr_val;
+              }
+            else if (strcmp (oid, FRIENDLY_NAME_OID) == 0)
+              {
+                size = attr_val.size;
+                result =
+                  _gnutls_x509_decode_octet_string ("BMPString",
+                                                    attr_val.data, size,
+                                                    attr_val.data, &size);
+                attr_val.size = size;
+                if (result < 0)
+                  {
+                    _gnutls_free_datum (&attr_val);
+                    gnutls_assert ();
+                    _gnutls_x509_log
+                      ("Error decoding PKCS12 Bag Attribute OID '%s'\n", oid);
+                    continue;
+                  }
+                bag->element[i].friendly_name =
+                  ucs2_to_ascii (attr_val.data, attr_val.size);
+              }
+            else
+              {
+                _gnutls_free_datum (&attr_val);
+                _gnutls_x509_log
+                  ("Unknown PKCS12 Bag Attribute OID '%s'\n", oid);
+              }
+          }
+
+
+      bag->element[i].type = bag_type;
+
+    }
+
+  asn1_delete_structure (&c2);
+
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+
+}
+
+
+static int
+_parse_safe_contents (ASN1_TYPE sc, const char *sc_name,
+                      gnutls_pkcs12_bag_t bag)
+{
+  gnutls_datum_t content = { NULL, 0 };
+  int result;
+
+  /* Step 1. Extract the content.
+   */
+
+  result = _gnutls_x509_read_value (sc, sc_name, &content, 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _pkcs12_decode_safe_contents (&content, bag);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  _gnutls_free_datum (&content);
+
+  return 0;
+
+cleanup:
+  _gnutls_free_datum (&content);
+  return result;
+}
+
+
+/**
+  * gnutls_pkcs12_get_bag - This function returns a Bag from a PKCS12 structure
+  * @pkcs12: should contain a gnutls_pkcs12_t structure
+  * @indx: contains the index of the bag to extract
+  * @bag: An initialized bag, where the contents of the bag will be copied
+  *
+  * This function will return a Bag from the PKCS12 structure.
+  * Returns 0 on success.
+  *
+  * After the last Bag has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+  * will be returned.
+  *
+  **/
+int
+gnutls_pkcs12_get_bag (gnutls_pkcs12_t pkcs12,
+                       int indx, gnutls_pkcs12_bag_t bag)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, len;
+  char root2[MAX_NAME_SIZE];
+  char oid[128];
+
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Step 1. decode the data.
+   */
+  result = _decode_pkcs12_auth_safe (pkcs12->pkcs12, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Parse the AuthenticatedSafe
+   */
+
+  snprintf (root2, sizeof (root2), "?%u.contentType", indx + 1);
+
+  len = sizeof (oid) - 1;
+  result = asn1_read_value (c2, root2, oid, &len);
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      result = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+      goto cleanup;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Not encrypted Bag
+   */
+
+  snprintf (root2, sizeof (root2), "?%u.content", indx + 1);
+
+  if (strcmp (oid, DATA_OID) == 0)
+    {
+      result = _parse_safe_contents (c2, root2, bag);
+      goto cleanup;
+    }
+
+  /* ENC_DATA_OID needs decryption */
+
+  bag->element[0].type = GNUTLS_BAG_ENCRYPTED;
+  bag->bag_elements = 1;
+
+  result = _gnutls_x509_read_value (c2, root2, &bag->element[0].data, 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/* Creates an empty PFX structure for the PKCS12 structure.
+ */
+static int
+create_empty_pfx (ASN1_TYPE pkcs12)
+{
+  uint8_t three = 3;
+  int result;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  /* Use version 3
+   */
+  result = asn1_write_value (pkcs12, "version", &three, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Write the content type of the data
+   */
+  result = asn1_write_value (pkcs12, "authSafe.contentType", DATA_OID, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Check if the authenticatedSafe content is empty, and encode a
+   * null one in that case.
+   */
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-12-AuthenticatedSafe",
+        &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs12, "authSafe.content", 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  asn1_delete_structure (&c2);
+  return result;
+
+}
+
+/**
+  * gnutls_pkcs12_set_bag - This function inserts a Bag into a PKCS12 structure
+  * @pkcs12: should contain a gnutls_pkcs12_t structure
+  * @bag: An initialized bag
+  *
+  * This function will insert a Bag into the PKCS12 structure.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_set_bag (gnutls_pkcs12_t pkcs12, gnutls_pkcs12_bag_t bag)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  ASN1_TYPE safe_cont = ASN1_TYPE_EMPTY;
+  int result;
+  int enc = 0, dum = 1;
+  char null;
+
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Step 1. Check if the pkcs12 structure is empty. In that
+   * case generate an empty PFX.
+   */
+  result = asn1_read_value (pkcs12->pkcs12, "authSafe.content", &null, &dum);
+  if (result == ASN1_VALUE_NOT_FOUND)
+    {
+      result = create_empty_pfx (pkcs12->pkcs12);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+
+  /* Step 2. decode the authenticatedSafe.
+   */
+  result = _decode_pkcs12_auth_safe (pkcs12->pkcs12, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 3. Encode the bag elements into a SafeContents 
+   * structure.
+   */
+  result = _pkcs12_encode_safe_contents (bag, &safe_cont, &enc);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 4. Insert the encoded SafeContents into the AuthenticatedSafe
+   * structure.
+   */
+  result = asn1_write_value (c2, "", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (enc)
+    result = asn1_write_value (c2, "?LAST.contentType", ENC_DATA_OID, 1);
+  else
+    result = asn1_write_value (c2, "?LAST.contentType", DATA_OID, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (enc)
+    {
+      /* Encrypted packets are written directly.
+       */
+      result =
+        asn1_write_value (c2, "?LAST.content",
+                          bag->element[0].data.data,
+                          bag->element[0].data.size);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+    }
+  else
+    {
+      result =
+        _gnutls_x509_der_encode_and_copy (safe_cont, "", c2,
+                                          "?LAST.content", 1);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+
+  asn1_delete_structure (&safe_cont);
+
+
+  /* Step 5. Reencode and copy the AuthenticatedSafe into the pkcs12
+   * structure.
+   */
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs12->pkcs12,
+                                      "authSafe.content", 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  asn1_delete_structure (&c2);
+  asn1_delete_structure (&safe_cont);
+  return result;
+}
+
+/**
+  * gnutls_pkcs12_generate_mac - This function generates the MAC of the PKCS12 structure
+  * @pkcs12: should contain a gnutls_pkcs12_t structure
+  * @pass: The password for the MAC
+  *
+  * This function will generate a MAC for the PKCS12 structure.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_generate_mac (gnutls_pkcs12_t pkcs12, const char *pass)
+{
+  opaque salt[8], key[20];
+  int result;
+  const int iter = 1;
+  mac_hd_t td1 = NULL;
+  gnutls_datum_t tmp = { NULL, 0 };
+  opaque sha_mac[20];
+
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Generate the salt.
+   */
+  if (gc_nonce (salt, sizeof (salt)) != GC_OK)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RANDOM_FAILED;
+    }
+
+  /* Write the salt into the structure.
+   */
+  result =
+    asn1_write_value (pkcs12->pkcs12, "macData.macSalt", salt, sizeof (salt));
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* write the iterations
+   */
+
+  if (iter > 1)
+    {
+      result =
+        _gnutls_x509_write_uint32 (pkcs12->pkcs12, "macData.iterations",
+                                   iter);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+
+  /* Generate the key.
+   */
+  result = _pkcs12_string_to_key (3 /*MAC*/, salt, sizeof (salt),
+                                  iter, pass, sizeof (key), key);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* Get the data to be MACed
+   */
+  result = _decode_pkcs12_auth_safe (pkcs12->pkcs12, NULL, &tmp);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* MAC the data
+   */
+  td1 = _gnutls_hmac_init (GNUTLS_MAC_SHA1, key, sizeof (key));
+  if (td1 == GNUTLS_MAC_FAILED)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  _gnutls_hmac (td1, tmp.data, tmp.size);
+  _gnutls_free_datum (&tmp);
+
+  _gnutls_hmac_deinit (td1, sha_mac);
+
+
+  result =
+    asn1_write_value (pkcs12->pkcs12, "macData.mac.digest", sha_mac,
+                      sizeof (sha_mac));
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result =
+    asn1_write_value (pkcs12->pkcs12,
+                      "macData.mac.digestAlgorithm.parameters", NULL, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result =
+    asn1_write_value (pkcs12->pkcs12,
+                      "macData.mac.digestAlgorithm.algorithm", HASH_OID_SHA1,
+                      1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  return 0;
+
+cleanup:
+  _gnutls_free_datum (&tmp);
+  return result;
+}
+
+/**
+  * gnutls_pkcs12_verify_mac - This function verifies the MAC of the PKCS12 structure
+  * @pkcs12: should contain a gnutls_pkcs12_t structure
+  * @pass: The password for the MAC
+  *
+  * This function will verify the MAC for the PKCS12 structure.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_verify_mac (gnutls_pkcs12_t pkcs12, const char *pass)
+{
+  opaque key[20];
+  int result;
+  unsigned int iter;
+  int len;
+  mac_hd_t td1 = NULL;
+  gnutls_datum_t tmp = { NULL, 0 }, salt =
+  {
+  NULL, 0};
+  opaque sha_mac[20];
+  opaque sha_mac_orig[20];
+
+  if (pkcs12 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* read the iterations
+   */
+
+  result =
+    _gnutls_x509_read_uint (pkcs12->pkcs12, "macData.iterations", &iter);
+  if (result < 0)
+    {
+      iter = 1;                 /* the default */
+    }
+
+
+  /* Read the salt from the structure.
+   */
+  result =
+    _gnutls_x509_read_value (pkcs12->pkcs12, "macData.macSalt", &salt, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Generate the key.
+   */
+  result = _pkcs12_string_to_key (3 /*MAC*/, salt.data, salt.size,
+                                  iter, pass, sizeof (key), key);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  _gnutls_free_datum (&salt);
+
+  /* Get the data to be MACed
+   */
+  result = _decode_pkcs12_auth_safe (pkcs12->pkcs12, NULL, &tmp);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* MAC the data
+   */
+  td1 = _gnutls_hmac_init (GNUTLS_MAC_SHA1, key, sizeof (key));
+  if (td1 == GNUTLS_MAC_FAILED)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  _gnutls_hmac (td1, tmp.data, tmp.size);
+  _gnutls_free_datum (&tmp);
+
+  _gnutls_hmac_deinit (td1, sha_mac);
+
+  len = sizeof (sha_mac_orig);
+  result =
+    asn1_read_value (pkcs12->pkcs12, "macData.mac.digest", sha_mac_orig,
+                     &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (memcmp (sha_mac_orig, sha_mac, sizeof (sha_mac)) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MAC_VERIFY_FAILED;
+    }
+
+  return 0;
+
+cleanup:
+  _gnutls_free_datum (&tmp);
+  _gnutls_free_datum (&salt);
+  return result;
+}
+
+
+static int
+write_attributes (gnutls_pkcs12_bag_t bag, int elem,
+                  ASN1_TYPE c2, const char *where)
+{
+  int result;
+  char root[128];
+
+  /* If the bag attributes are empty, then write
+   * nothing to the attribute field.
+   */
+  if (bag->element[elem].friendly_name == NULL &&
+      bag->element[elem].local_key_id.data == NULL)
+    {
+      /* no attributes
+       */
+      result = asn1_write_value (c2, where, NULL, 0);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      return 0;
+    }
+
+  if (bag->element[elem].local_key_id.data != NULL)
+    {
+
+      /* Add a new Attribute
+       */
+      result = asn1_write_value (c2, where, "NEW", 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      _gnutls_str_cpy (root, sizeof (root), where);
+      _gnutls_str_cat (root, sizeof (root), ".?LAST");
+
+      result =
+        _gnutls_x509_encode_and_write_attribute (KEY_ID_OID, c2, root,
+                                                 bag->element[elem].
+                                                 local_key_id.data,
+                                                 bag->element[elem].
+                                                 local_key_id.size, 1);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+
+  if (bag->element[elem].friendly_name != NULL)
+    {
+      opaque *name;
+      int size, i;
+      const char *p;
+
+      /* Add a new Attribute
+       */
+      result = asn1_write_value (c2, where, "NEW", 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      /* convert name to BMPString
+       */
+      size = strlen (bag->element[elem].friendly_name) * 2;
+      name = gnutls_malloc (size);
+
+      if (name == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      p = bag->element[elem].friendly_name;
+      for (i = 0; i < size; i += 2)
+        {
+          name[i] = 0;
+          name[i + 1] = *p;
+          p++;
+        }
+
+      _gnutls_str_cpy (root, sizeof (root), where);
+      _gnutls_str_cat (root, sizeof (root), ".?LAST");
+
+      result =
+        _gnutls_x509_encode_and_write_attribute (FRIENDLY_NAME_OID, c2,
+                                                 root, name, size, 1);
+
+      gnutls_free (name);
+
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+
+  return 0;
+}
+
+
+/* Encodes the bag into a SafeContents structure, and puts the output in
+ * the given datum. Enc is set to non zero if the data are encrypted;
+ */
+int
+_pkcs12_encode_safe_contents (gnutls_pkcs12_bag_t bag, ASN1_TYPE * contents,
+                              int *enc)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+  int i;
+  const char *oid;
+
+  if (bag->element[0].type == GNUTLS_BAG_ENCRYPTED && enc)
+    {
+      *enc = 1;
+      return 0;                 /* ENCRYPTED BAG, do nothing. */
+    }
+  else if (enc)
+    *enc = 0;
+
+  /* Step 1. Create the SEQUENCE.
+   */
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-12-SafeContents",
+        &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  for (i = 0; i < bag->bag_elements; i++)
+    {
+
+      oid = bag_to_oid (bag->element[i].type);
+      if (oid == NULL)
+        {
+          gnutls_assert ();
+          continue;
+        }
+
+      result = asn1_write_value (c2, "", "NEW", 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      /* Copy the bag type.
+       */
+      result = asn1_write_value (c2, "?LAST.bagId", oid, 1);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      /* Set empty attributes
+       */
+      result = write_attributes (bag, i, c2, "?LAST.bagAttributes");
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+
+      /* Copy the Bag Value
+       */
+
+      if (bag->element[i].type == GNUTLS_BAG_CERTIFICATE ||
+          bag->element[i].type == GNUTLS_BAG_CRL)
+        {
+          gnutls_datum_t tmp;
+
+          /* in that case encode it to a CertBag or
+           * a CrlBag.
+           */
+
+          result =
+            _pkcs12_encode_crt_bag (bag->element[i].type,
+                                    &bag->element[i].data, &tmp);
+
+          if (result < 0)
+            {
+              gnutls_assert ();
+              goto cleanup;
+            }
+
+          result = _gnutls_x509_write_value (c2, "?LAST.bagValue", &tmp, 0);
+
+          _gnutls_free_datum (&tmp);
+
+        }
+      else
+        {
+
+          result = _gnutls_x509_write_value (c2, "?LAST.bagValue",
+                                             &bag->element[i].data, 0);
+        }
+
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+    }
+
+  /* Encode the data and copy them into the datum
+   */
+  *contents = c2;
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+
+}
+
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/pkcs12.h b/src/daemon/https/x509/pkcs12.h
new file mode 100644
index 00000000..566058fb
--- /dev/null
+++ b/src/daemon/https/x509/pkcs12.h
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+// TODO clean
+
+#ifndef GNUTLS_PKCS12_H
+# define GNUTLS_PKCS12_H
+
+#ifdef __cplusplus
+extern "C"
+  {
+#endif
+
+#include <x509.h>
+
+#define MAX_BAG_ELEMENTS 32
+
+/* PKCS12 structures handling 
+ */
+struct gnutls_pkcs12_int;
+
+struct gnutls_pkcs12_bag_int;
+typedef struct gnutls_pkcs12_int
+  {
+    ASN1_TYPE pkcs12;
+  } gnutls_pkcs12_int;
+
+typedef enum gnutls_pkcs12_bag_type_t
+  {
+    GNUTLS_BAG_EMPTY = 0,
+
+    GNUTLS_BAG_PKCS8_ENCRYPTED_KEY = 1,
+    GNUTLS_BAG_PKCS8_KEY,
+    GNUTLS_BAG_CERTIFICATE,
+    GNUTLS_BAG_CRL,
+    GNUTLS_BAG_ENCRYPTED = 10,
+    GNUTLS_BAG_UNKNOWN = 20
+  } gnutls_pkcs12_bag_type_t;
+
+struct bag_element
+  {
+    gnutls_datum_t data;
+    gnutls_pkcs12_bag_type_t type;
+    gnutls_datum_t local_key_id;
+    char *friendly_name;
+  };
+
+typedef struct gnutls_pkcs12_bag_int
+  {
+    struct bag_element element[MAX_BAG_ELEMENTS];
+    int bag_elements;
+  } gnutls_pkcs12_bag_int;
+
+/* Bag attributes */
+#define FRIENDLY_NAME_OID "1.2.840.113549.1.9.20"
+#define KEY_ID_OID "1.2.840.113549.1.9.21"
+
+typedef struct gnutls_pkcs12_int *gnutls_pkcs12_t;
+typedef struct gnutls_pkcs12_bag_int *gnutls_pkcs12_bag_t;
+
+int gnutls_pkcs12_init(gnutls_pkcs12_t * pkcs12);
+void gnutls_pkcs12_deinit(gnutls_pkcs12_t pkcs12);
+int gnutls_pkcs12_import(gnutls_pkcs12_t pkcs12,
+                         const gnutls_datum_t * data,
+                         gnutls_x509_crt_fmt_t format,
+                         unsigned int flags);
+int gnutls_pkcs12_export(gnutls_pkcs12_t pkcs12,
+                         gnutls_x509_crt_fmt_t format,
+                         void *output_data,
+                         size_t * output_data_size);
+
+int gnutls_pkcs12_get_bag(gnutls_pkcs12_t pkcs12,
+                          int indx,
+                          gnutls_pkcs12_bag_t bag);
+int gnutls_pkcs12_set_bag(gnutls_pkcs12_t pkcs12,
+                          gnutls_pkcs12_bag_t bag);
+
+int gnutls_pkcs12_generate_mac(gnutls_pkcs12_t pkcs12,
+                               const char *pass);
+int gnutls_pkcs12_verify_mac(gnutls_pkcs12_t pkcs12,
+                             const char *pass);
+
+int gnutls_pkcs12_bag_decrypt(gnutls_pkcs12_bag_t bag,
+                              const char *pass);
+int gnutls_pkcs12_bag_encrypt(gnutls_pkcs12_bag_t bag,
+                              const char *pass,
+                              unsigned int flags);
+
+gnutls_pkcs12_bag_type_t gnutls_pkcs12_bag_get_type(gnutls_pkcs12_bag_t
+                                                    bag,
+                                                    int indx);
+int gnutls_pkcs12_bag_get_data(gnutls_pkcs12_bag_t bag,
+                               int indx,
+                               gnutls_datum_t * data);
+int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag_t bag,
+                               gnutls_pkcs12_bag_type_t type,
+                               const gnutls_datum_t * data);
+int gnutls_pkcs12_bag_set_crl(gnutls_pkcs12_bag_t bag,
+                              gnutls_x509_crl_t crl);
+int gnutls_pkcs12_bag_set_crt(gnutls_pkcs12_bag_t bag,
+                              gnutls_x509_crt_t crt);
+
+int gnutls_pkcs12_bag_init(gnutls_pkcs12_bag_t * bag);
+void gnutls_pkcs12_bag_deinit(gnutls_pkcs12_bag_t bag);
+int gnutls_pkcs12_bag_get_count(gnutls_pkcs12_bag_t bag);
+
+int gnutls_pkcs12_bag_get_key_id(gnutls_pkcs12_bag_t bag,
+                                 int indx,
+                                 gnutls_datum_t * id);
+int gnutls_pkcs12_bag_set_key_id(gnutls_pkcs12_bag_t bag,
+                                 int indx,
+                                 const gnutls_datum_t * id);
+
+int gnutls_pkcs12_bag_get_friendly_name(gnutls_pkcs12_bag_t bag,
+                                        int indx,
+                                        char **name);
+int gnutls_pkcs12_bag_set_friendly_name(gnutls_pkcs12_bag_t bag,
+                                        int indx,
+                                        const char *name);
+
+#ifdef __cplusplus
+}
+#endif
+
+#define BAG_PKCS8_KEY "1.2.840.113549.1.12.10.1.1"
+#define BAG_PKCS8_ENCRYPTED_KEY "1.2.840.113549.1.12.10.1.2"
+#define BAG_CERTIFICATE "1.2.840.113549.1.12.10.1.3"
+#define BAG_CRL "1.2.840.113549.1.12.10.1.4"
+
+/* PKCS #7
+ */
+#define DATA_OID "1.2.840.113549.1.7.1"
+#define ENC_DATA_OID "1.2.840.113549.1.7.6"
+
+int gnutls_pkcs12_init(gnutls_pkcs12_t * pkcs12);
+void gnutls_pkcs12_deinit(gnutls_pkcs12_t pkcs12);
+int gnutls_pkcs12_import(gnutls_pkcs12_t pkcs12,
+                         const gnutls_datum_t * data,
+                         gnutls_x509_crt_fmt_t format,
+                         unsigned int flags);
+
+int gnutls_pkcs12_get_bag(gnutls_pkcs12_t pkcs12,
+                          int indx,
+                          gnutls_pkcs12_bag_t bag);
+
+int gnutls_pkcs12_bag_init(gnutls_pkcs12_bag_t * bag);
+void gnutls_pkcs12_bag_deinit(gnutls_pkcs12_bag_t bag);
+
+int _pkcs12_string_to_key(unsigned int id,
+                          const opaque * salt,
+                          unsigned int salt_size,
+                          unsigned int iter,
+                          const char *pw,
+                          unsigned int req_keylen,
+                          opaque * keybuf);
+
+int _gnutls_pkcs7_decrypt_data(const gnutls_datum_t * data,
+                               const char *password,
+                               gnutls_datum_t * dec);
+
+typedef enum schema_id
+  {
+    PBES2, /* the stuff in PKCS #5 */
+    PKCS12_3DES_SHA1, /* the fucking stuff in PKCS #12 */
+    PKCS12_ARCFOUR_SHA1,
+    PKCS12_RC2_40_SHA1
+  } schema_id;
+
+int _gnutls_pkcs7_encrypt_data(schema_id schema,
+                               const gnutls_datum_t * data,
+                               const char *password,
+                               gnutls_datum_t * enc);
+int _pkcs12_decode_safe_contents(const gnutls_datum_t * content,
+                                 gnutls_pkcs12_bag_t bag);
+
+int _pkcs12_encode_safe_contents(gnutls_pkcs12_bag_t bag,
+                                 ASN1_TYPE * content,
+                                 int *enc);
+
+int _pkcs12_decode_crt_bag(gnutls_pkcs12_bag_type_t type,
+                           const gnutls_datum_t * in,
+                           gnutls_datum_t * out);
+int _pkcs12_encode_crt_bag(gnutls_pkcs12_bag_type_t type,
+                           const gnutls_datum_t * raw,
+                           gnutls_datum_t * out);
+
+#endif        /* GNUTLS_PKCS12_H */
diff --git a/src/daemon/https/x509/pkcs12_bag.c b/src/daemon/https/x509/pkcs12_bag.c
new file mode 100644
index 00000000..c34ec757
--- /dev/null
+++ b/src/daemon/https/x509/pkcs12_bag.c
@@ -0,0 +1,770 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate on PKCS12 Bag packet parsing.
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <pkcs12.h>
+#include <privkey.h>
+
+/**
+  * gnutls_pkcs12_bag_init - This function initializes a gnutls_pkcs12_bag_t  structure
+  * @bag: The structure to be initialized
+  *
+  * This function will initialize a PKCS12 bag structure. PKCS12 Bags
+  * usually contain private keys, lists of X.509 Certificates and X.509 Certificate
+  * revocation lists.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_bag_init (gnutls_pkcs12_bag_t * bag)
+{
+  *bag = gnutls_calloc (1, sizeof (gnutls_pkcs12_bag_int));
+
+  if (*bag)
+    {
+      return 0;                 /* success */
+    }
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+static inline void
+_pkcs12_bag_free_data (gnutls_pkcs12_bag_t bag)
+{
+  int i;
+
+  for (i = 0; i < bag->bag_elements; i++)
+    {
+      _gnutls_free_datum (&bag->element[i].data);
+      _gnutls_free_datum (&bag->element[i].local_key_id);
+      gnutls_free (bag->element[i].friendly_name);
+      bag->element[i].friendly_name = NULL;
+      bag->element[i].type = 0;
+    }
+
+}
+
+
+/**
+  * gnutls_pkcs12_bag_deinit - This function deinitializes memory used by a gnutls_pkcs12_t structure
+  * @bag: The structure to be initialized
+  *
+  * This function will deinitialize a PKCS12 Bag structure. 
+  *
+  **/
+void
+gnutls_pkcs12_bag_deinit (gnutls_pkcs12_bag_t bag)
+{
+  if (!bag)
+    return;
+
+  _pkcs12_bag_free_data (bag);
+
+  gnutls_free (bag);
+}
+
+/**
+  * gnutls_pkcs12_bag_get_type - This function returns the bag's type
+  * @bag: The bag
+  * @indx: The element of the bag to get the type
+  *
+  * This function will return the bag's type. One of the gnutls_pkcs12_bag_type_t
+  * enumerations.
+  *
+  **/
+gnutls_pkcs12_bag_type_t
+gnutls_pkcs12_bag_get_type (gnutls_pkcs12_bag_t bag, int indx)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx >= bag->bag_elements)
+    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+  return bag->element[indx].type;
+}
+
+/**
+  * gnutls_pkcs12_bag_get_count - This function returns the bag's elements count
+  * @bag: The bag
+  *
+  * This function will return the number of the elements withing the bag. 
+  *
+  **/
+int
+gnutls_pkcs12_bag_get_count (gnutls_pkcs12_bag_t bag)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return bag->bag_elements;
+}
+
+/**
+  * gnutls_pkcs12_bag_get_data - This function returns the bag's data
+  * @bag: The bag
+  * @indx: The element of the bag to get the data from
+  * @data: where the bag's data will be. Should be treated as constant.
+  *
+  * This function will return the bag's data. The data is a constant
+  * that is stored into the bag. Should not be accessed after the bag
+  * is deleted.
+  *
+  * Returns 0 on success and a negative error code on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_get_data (gnutls_pkcs12_bag_t bag, int indx,
+                            gnutls_datum_t * data)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx >= bag->bag_elements)
+    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+
+  data->data = bag->element[indx].data.data;
+  data->size = bag->element[indx].data.size;
+
+  return 0;
+}
+
+#define X509_CERT_OID "1.2.840.113549.1.9.22.1"
+#define X509_CRL_OID  "1.2.840.113549.1.9.23.1"
+
+int
+_pkcs12_decode_crt_bag (gnutls_pkcs12_bag_type_t type,
+                        const gnutls_datum_t * in, gnutls_datum_t * out)
+{
+  int ret;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (type == GNUTLS_BAG_CERTIFICATE)
+    {
+      if ((ret = asn1_create_element (_gnutls_get_pkix (),
+                                      "PKIX1.pkcs-12-CertBag",
+                                      &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = asn1_der_decoding (&c2, in->data, in->size, NULL);
+      if (ret != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = _gnutls_x509_read_value (c2, "certValue", out, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+    }
+  else
+    {                           /* CRL */
+      if ((ret = asn1_create_element (_gnutls_get_pkix (),
+                                      "PKIX1.pkcs-12-CRLBag",
+                                      &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = asn1_der_decoding (&c2, in->data, in->size, NULL);
+      if (ret != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = _gnutls_x509_read_value (c2, "crlValue", out, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+
+cleanup:
+
+  asn1_delete_structure (&c2);
+  return ret;
+}
+
+
+int
+_pkcs12_encode_crt_bag (gnutls_pkcs12_bag_type_t type,
+                        const gnutls_datum_t * raw, gnutls_datum_t * out)
+{
+  int ret;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (type == GNUTLS_BAG_CERTIFICATE)
+    {
+      if ((ret = asn1_create_element (_gnutls_get_pkix (),
+                                      "PKIX1.pkcs-12-CertBag",
+                                      &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = asn1_write_value (c2, "certId", X509_CERT_OID, 1);
+      if (ret != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = _gnutls_x509_write_value (c2, "certValue", raw, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+    }
+  else
+    {                           /* CRL */
+      if ((ret = asn1_create_element (_gnutls_get_pkix (),
+                                      "PKIX1.pkcs-12-CRLBag",
+                                      &c2)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = asn1_write_value (c2, "crlId", X509_CRL_OID, 1);
+      if (ret != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          ret = _gnutls_asn2err (ret);
+          goto cleanup;
+        }
+
+      ret = _gnutls_x509_write_value (c2, "crlValue", raw, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+
+  ret = _gnutls_x509_der_encode (c2, "", out, 0);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+
+cleanup:
+
+  asn1_delete_structure (&c2);
+  return ret;
+}
+
+
+/**
+  * gnutls_pkcs12_bag_set_data - This function inserts data into the bag
+  * @bag: The bag
+  * @type: The data's type
+  * @data: the data to be copied.
+  *
+  * This function will insert the given data of the given type into the
+  * bag. 
+  *
+  * Returns the index of the added bag on success, or a negative
+  * value on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_set_data (gnutls_pkcs12_bag_t bag,
+                            gnutls_pkcs12_bag_type_t type,
+                            const gnutls_datum_t * data)
+{
+  int ret;
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (bag->bag_elements == MAX_BAG_ELEMENTS - 1)
+    {
+      gnutls_assert ();
+      /* bag is full */
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (bag->bag_elements == 1)
+    {
+      /* A bag with a key or an encrypted bag, must have
+       * only one element.
+       */
+
+      if (bag->element[0].type == GNUTLS_BAG_PKCS8_KEY ||
+          bag->element[0].type == GNUTLS_BAG_PKCS8_ENCRYPTED_KEY ||
+          bag->element[0].type == GNUTLS_BAG_ENCRYPTED)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INVALID_REQUEST;
+        }
+    }
+
+  ret =
+    _gnutls_set_datum (&bag->element[bag->bag_elements].data,
+                       data->data, data->size);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  bag->element[bag->bag_elements].type = type;
+
+  bag->bag_elements++;
+
+  return bag->bag_elements - 1;
+}
+
+/**
+  * gnutls_pkcs12_bag_set_crt - This function inserts a certificate into the bag
+  * @bag: The bag
+  * @crt: the certificate to be copied.
+  *
+  * This function will insert the given certificate into the
+  * bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().
+  *
+  * Returns the index of the added bag on success, or a negative
+  * value on failure.
+  *
+  **/
+int
+gnutls_pkcs12_bag_set_crt (gnutls_pkcs12_bag_t bag, gnutls_x509_crt_t crt)
+{
+  int ret;
+  gnutls_datum_t data;
+
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_x509_der_encode (crt->cert, "", &data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_pkcs12_bag_set_data (bag, GNUTLS_BAG_CERTIFICATE, &data);
+
+  _gnutls_free_datum (&data);
+
+  return ret;
+}
+
+/**
+  * gnutls_pkcs12_bag_set_crl - This function inserts the CRL into the bag
+  * @bag: The bag
+  * @crl: the CRL to be copied.
+  *
+  * This function will insert the given CRL into the
+  * bag. This is just a wrapper over gnutls_pkcs12_bag_set_data().
+  *
+  * Returns the index of the added bag on success, or a negative
+  * value on failure.
+  *
+  **/
+int
+gnutls_pkcs12_bag_set_crl (gnutls_pkcs12_bag_t bag, gnutls_x509_crl_t crl)
+{
+  int ret;
+  gnutls_datum_t data;
+
+
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_x509_der_encode (crl->crl, "", &data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_pkcs12_bag_set_data (bag, GNUTLS_BAG_CRL, &data);
+
+  _gnutls_free_datum (&data);
+
+  return ret;
+}
+
+/**
+  * gnutls_pkcs12_bag_set_key_id - This function sets a key ID into the bag element
+  * @bag: The bag
+  * @indx: The bag's element to add the id
+  * @id: the ID
+  *
+  * This function will add the given key ID, to the specified, by the index, bag
+  * element. The key ID will be encoded as a 'Local key identifier' bag attribute,
+  * which is usually used to distinguish the local private key and the certificate pair.
+  * 
+  * Returns 0 on success, or a negative value on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_set_key_id (gnutls_pkcs12_bag_t bag, int indx,
+                              const gnutls_datum_t * id)
+{
+  int ret;
+
+
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx > bag->bag_elements - 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_set_datum (&bag->element[indx].local_key_id,
+                           id->data, id->size);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_pkcs12_bag_get_key_id - This function gets the key ID from the bag element
+  * @bag: The bag
+  * @indx: The bag's element to add the id
+  * @id: where the ID will be copied (to be treated as const)
+  *
+  * This function will return the key ID, of the specified bag element.
+  * The key ID is usually used to distinguish the local private key and the certificate pair.
+  * 
+  * Returns 0 on success, or a negative value on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_get_key_id (gnutls_pkcs12_bag_t bag, int indx,
+                              gnutls_datum_t * id)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx > bag->bag_elements - 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  id->data = bag->element[indx].local_key_id.data;
+  id->size = bag->element[indx].local_key_id.size;
+
+  return 0;
+}
+
+/**
+  * gnutls_pkcs12_bag_get_friendly_name - This function returns the friendly name of the bag element
+  * @bag: The bag
+  * @indx: The bag's element to add the id
+  * @name: will hold a pointer to the name (to be treated as const)
+  *
+  * This function will return the friendly name, of the specified bag element.
+  * The key ID is usually used to distinguish the local private key and the certificate pair.
+  * 
+  * Returns 0 on success, or a negative value on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_get_friendly_name (gnutls_pkcs12_bag_t bag, int indx,
+                                     char **name)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx > bag->bag_elements - 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  *name = bag->element[indx].friendly_name;
+
+  return 0;
+}
+
+
+/**
+  * gnutls_pkcs12_bag_set_friendly_name - This function sets a friendly name into the bag element
+  * @bag: The bag
+  * @indx: The bag's element to add the id
+  * @name: the name
+  *
+  * This function will add the given key friendly name, to the specified, by the index, bag
+  * element. The name will be encoded as a 'Friendly name' bag attribute,
+  * which is usually used to set a user name to the local private key and the certificate pair.
+  * 
+  * Returns 0 on success, or a negative value on error.
+  *
+  **/
+int
+gnutls_pkcs12_bag_set_friendly_name (gnutls_pkcs12_bag_t bag, int indx,
+                                     const char *name)
+{
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx > bag->bag_elements - 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  bag->element[indx].friendly_name = gnutls_strdup (name);
+
+  if (name == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+}
+
+
+/**
+  * gnutls_pkcs12_bag_decrypt - This function will decrypt an encrypted bag
+  * @bag: The bag
+  * @pass: The password used for encryption. This can only be ASCII.
+  *
+  * This function will decrypt the given encrypted bag and return 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_bag_decrypt (gnutls_pkcs12_bag_t bag, const char *pass)
+{
+  int ret;
+  gnutls_datum_t dec;
+
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (bag->element[0].type != GNUTLS_BAG_ENCRYPTED)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_pkcs7_decrypt_data (&bag->element[0].data, pass, &dec);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* decryption succeeded. Now decode the SafeContents
+   * stuff, and parse it.
+   */
+
+  _gnutls_free_datum (&bag->element[0].data);
+
+  ret = _pkcs12_decode_safe_contents (&dec, bag);
+
+  _gnutls_free_datum (&dec);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_pkcs12_bag_encrypt - This function will encrypt a bag
+  * @bag: The bag
+  * @pass: The password used for encryption. This can only be ASCII.
+  * @flags: should be one of gnutls_pkcs_encrypt_flags_t elements bitwise or'd
+  *
+  * This function will encrypt the given bag and return 0 on success.
+  *
+  **/
+int
+gnutls_pkcs12_bag_encrypt (gnutls_pkcs12_bag_t bag, const char *pass,
+                           unsigned int flags)
+{
+  int ret;
+  ASN1_TYPE safe_cont = ASN1_TYPE_EMPTY;
+  gnutls_datum_t der = { NULL, 0 };
+  gnutls_datum_t enc = { NULL, 0 };
+  schema_id id;
+
+  if (bag == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (bag->element[0].type == GNUTLS_BAG_ENCRYPTED)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Encode the whole bag to a safe contents
+   * structure.
+   */
+  ret = _pkcs12_encode_safe_contents (bag, &safe_cont, NULL);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* DER encode the SafeContents.
+   */
+  ret = _gnutls_x509_der_encode (safe_cont, "", &der, 0);
+
+  asn1_delete_structure (&safe_cont);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (flags & GNUTLS_PKCS_PLAIN)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (flags & GNUTLS_PKCS_USE_PKCS12_ARCFOUR)
+    id = PKCS12_ARCFOUR_SHA1;
+  else if (flags & GNUTLS_PKCS_USE_PKCS12_RC2_40)
+    id = PKCS12_RC2_40_SHA1;
+  else if (flags & GNUTLS_PKCS_USE_PBES2_3DES)
+    id = PBES2;
+  else
+    id = PKCS12_3DES_SHA1;
+
+  /* Now encrypt them.
+   */
+  ret = _gnutls_pkcs7_encrypt_data (id, &der, pass, &enc);
+
+  _gnutls_free_datum (&der);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* encryption succeeded. 
+   */
+
+  _pkcs12_bag_free_data (bag);
+
+  bag->element[0].type = GNUTLS_BAG_ENCRYPTED;
+  bag->element[0].data = enc;
+
+  bag->bag_elements = 1;
+
+
+  return 0;
+}
+
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/pkcs12_encr.c b/src/daemon/https/x509/pkcs12_encr.c
new file mode 100644
index 00000000..c80d23a3
--- /dev/null
+++ b/src/daemon/https/x509/pkcs12_encr.c
@@ -0,0 +1,169 @@
+/* minip12.c - A mini pkcs-12 implementation (modified for gnutls)
+ *
+ * Copyright (C) 2002, 2004, 2005 Free Software Foundation, Inc.
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gcrypt.h>
+#include <gc.h>
+#include <gnutls_errors.h>
+
+/* Returns 0 if the password is ok, or a negative error
+ * code instead.
+ */
+static int
+_pkcs12_check_pass (const char *pass, size_t plen)
+{
+  const unsigned char *p = pass;
+  unsigned int i;
+
+  for (i = 0; i < plen; i++)
+    {
+      if (isascii (p[i]))
+        continue;
+      return GNUTLS_E_INVALID_PASSWORD;
+    }
+
+  return 0;
+}
+
+/* ID should be:
+ * 3 for MAC
+ * 2 for IV
+ * 1 for encryption key
+ */
+int
+_pkcs12_string_to_key (unsigned int id, const opaque * salt,
+                       unsigned int salt_size, unsigned int iter,
+                       const char *pw, unsigned int req_keylen,
+                       opaque * keybuf)
+{
+  int rc;
+  unsigned int i, j;
+  gc_hash_handle md;
+  mpi_t num_b1 = NULL;
+  unsigned int pwlen;
+  opaque hash[20], buf_b[64], buf_i[128], *p;
+  size_t cur_keylen;
+  size_t n;
+
+  cur_keylen = 0;
+
+  if (pw == NULL)
+    pwlen = 0;
+  else
+    pwlen = strlen (pw);
+
+  if (pwlen > 63 / 2)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((rc = _pkcs12_check_pass (pw, pwlen)) < 0)
+    {
+      gnutls_assert ();
+      return rc;
+    }
+
+  /* Store salt and password in BUF_I */
+  p = buf_i;
+  for (i = 0; i < 64; i++)
+    *p++ = salt[i % salt_size];
+  if (pw)
+    {
+      for (i = j = 0; i < 64; i += 2)
+        {
+          *p++ = 0;
+          *p++ = pw[j];
+          if (++j > pwlen)      /* Note, that we include the trailing zero */
+            j = 0;
+        }
+    }
+  else
+    memset (p, 0, 64);
+
+  for (;;)
+    {
+      rc = gc_hash_open (GC_SHA1, 0, &md);
+      if (rc)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_DECRYPTION_FAILED;
+        }
+      for (i = 0; i < 64; i++)
+        {
+          unsigned char lid = id & 0xFF;
+          gc_hash_write (md, 1, &lid);
+        }
+      gc_hash_write (md, pw ? 128 : 64, buf_i);
+      memcpy (hash, gc_hash_read (md), 20);
+      gc_hash_close (md);
+      for (i = 1; i < iter; i++)
+        gc_hash_buffer (GC_SHA1, hash, 20, hash);
+      for (i = 0; i < 20 && cur_keylen < req_keylen; i++)
+        keybuf[cur_keylen++] = hash[i];
+      if (cur_keylen == req_keylen)
+        {
+          gcry_mpi_release (num_b1);
+          return 0;             /* ready */
+        }
+
+      /* need more bytes. */
+      for (i = 0; i < 64; i++)
+        buf_b[i] = hash[i % 20];
+      n = 64;
+      rc = _gnutls_mpi_scan (&num_b1, buf_b, &n);
+      if (rc < 0)
+        {
+          gnutls_assert ();
+          return rc;
+        }
+      gcry_mpi_add_ui (num_b1, num_b1, 1);
+      for (i = 0; i < 128; i += 64)
+        {
+          mpi_t num_ij;
+
+          n = 64;
+          rc = _gnutls_mpi_scan (&num_ij, buf_i + i, &n);
+          if (rc < 0)
+            {
+              gnutls_assert ();
+              return rc;
+            }
+          gcry_mpi_add (num_ij, num_ij, num_b1);
+          gcry_mpi_clear_highbit (num_ij, 64 * 8);
+          n = 64;
+          rc = _gnutls_mpi_print (buf_i + i, &n, num_ij);
+          if (rc < 0)
+            {
+              gnutls_assert ();
+              return rc;
+            }
+          gcry_mpi_release (num_ij);
+        }
+    }
+}
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/pkcs7.c b/src/daemon/https/x509/pkcs7.c
new file mode 100644
index 00000000..35f21b12
--- /dev/null
+++ b/src/daemon/https/x509/pkcs7.c
@@ -0,0 +1,1023 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate on PKCS7 certificate lists parsing.
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <x509_b64.h>
+#include <pkcs7.h>
+#include <dn.h>
+
+#define SIGNED_DATA_OID "1.2.840.113549.1.7.2"
+
+/* Decodes the PKCS #7 signed data, and returns an ASN1_TYPE, 
+ * which holds them. If raw is non null then the raw decoded
+ * data are copied (they are locally allocated) there.
+ */
+static int
+_decode_pkcs7_signed_data (ASN1_TYPE pkcs7, ASN1_TYPE * sdata,
+                           gnutls_datum_t * raw)
+{
+  char oid[128];
+  ASN1_TYPE c2;
+  opaque *tmp = NULL;
+  int tmp_size, len, result;
+
+  len = sizeof (oid) - 1;
+  result = asn1_read_value (pkcs7, "contentType", oid, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (strcmp (oid, SIGNED_DATA_OID) != 0)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("Unknown PKCS7 Content OID '%s'\n", oid);
+      return GNUTLS_E_UNKNOWN_PKCS_CONTENT_TYPE;
+    }
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-7-SignedData", &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* the Signed-data has been created, so
+   * decode them.
+   */
+  tmp_size = 0;
+  result = asn1_read_value (pkcs7, "content", NULL, &tmp_size);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  tmp = gnutls_malloc (tmp_size);
+  if (tmp == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  result = asn1_read_value (pkcs7, "content", tmp, &tmp_size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* tmp, tmp_size hold the data and the size of the CertificateSet structure
+   * actually the ANY stuff.
+   */
+
+  /* Step 1. In case of a signed structure extract certificate set.
+   */
+
+  result = asn1_der_decoding (&c2, tmp, tmp_size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if (raw == NULL)
+    {
+      gnutls_free (tmp);
+    }
+  else
+    {
+      raw->data = tmp;
+      raw->size = tmp_size;
+    }
+
+  *sdata = c2;
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  gnutls_free (tmp);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_init - This function initializes a gnutls_pkcs7_t structure
+  * @pkcs7: The structure to be initialized
+  *
+  * This function will initialize a PKCS7 structure. PKCS7 structures
+  * usually contain lists of X.509 Certificates and X.509 Certificate
+  * revocation lists.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_init (gnutls_pkcs7_t * pkcs7)
+{
+  *pkcs7 = gnutls_calloc (1, sizeof (gnutls_pkcs7_int));
+
+  if (*pkcs7)
+    {
+      int result = asn1_create_element (_gnutls_get_pkix (),
+                                        "PKIX1.pkcs-7-ContentInfo",
+                                        &(*pkcs7)->pkcs7);
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          gnutls_free (*pkcs7);
+          return _gnutls_asn2err (result);
+        }
+      return 0;                 /* success */
+    }
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+  * gnutls_pkcs7_deinit - This function deinitializes memory used by a gnutls_pkcs7_t structure
+  * @pkcs7: The structure to be initialized
+  *
+  * This function will deinitialize a PKCS7 structure. 
+  *
+  **/
+void
+gnutls_pkcs7_deinit (gnutls_pkcs7_t pkcs7)
+{
+  if (!pkcs7)
+    return;
+
+  if (pkcs7->pkcs7)
+    asn1_delete_structure (&pkcs7->pkcs7);
+
+  gnutls_free (pkcs7);
+}
+
+/**
+  * gnutls_pkcs7_import - This function will import a DER or PEM encoded PKCS7
+  * @pkcs7: The structure to store the parsed PKCS7.
+  * @data: The DER or PEM encoded PKCS7.
+  * @format: One of DER or PEM
+  *
+  * This function will convert the given DER or PEM encoded PKCS7
+  * to the native gnutls_pkcs7_t format. The output will be stored in 'pkcs7'.
+  *
+  * If the PKCS7 is PEM encoded it should have a header of "PKCS7".
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_import (gnutls_pkcs7_t pkcs7, const gnutls_datum_t * data,
+                     gnutls_x509_crt_fmt_t format)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  /* If the PKCS7 is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      result = _gnutls_fbase64_decode (PEM_PKCS7, data->data, data->size,
+                                       &out);
+
+      if (result <= 0)
+        {
+          if (result == 0)
+            result = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_assert ();
+          return result;
+        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+
+  result = asn1_der_decoding (&pkcs7->pkcs7, _data.data, _data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if (need_free)
+    _gnutls_free_datum (&_data);
+
+  return 0;
+
+cleanup:
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_get_crt_raw - This function returns a certificate in a PKCS7 certificate set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @indx: contains the index of the certificate to extract
+  * @certificate: the contents of the certificate will be copied there (may be null)
+  * @certificate_size: should hold the size of the certificate
+  *
+  * This function will return a certificate of the PKCS7 or RFC2630 certificate set.
+  * Returns 0 on success. If the provided buffer is not long enough,
+  * then @certificate_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+  *
+  * After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+  * will be returned.
+  *
+  **/
+int
+gnutls_pkcs7_get_crt_raw (gnutls_pkcs7_t pkcs7,
+                          int indx, void *certificate,
+                          size_t * certificate_size)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, len;
+  char root2[MAX_NAME_SIZE];
+  char oid[128];
+  gnutls_datum_t tmp = { NULL, 0 };
+
+  if (certificate_size == NULL || pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, &tmp);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Parse the CertificateSet 
+   */
+
+  snprintf (root2, sizeof (root2), "certificates.?%u", indx + 1);
+
+  len = sizeof (oid) - 1;
+
+  result = asn1_read_value (c2, root2, oid, &len);
+
+  if (result == ASN1_VALUE_NOT_FOUND)
+    {
+      result = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+      goto cleanup;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* if 'Certificate' is the choice found: 
+   */
+  if (strcmp (oid, "certificate") == 0)
+    {
+      int start, end;
+
+      result = asn1_der_decoding_startEnd (c2, tmp.data, tmp.size,
+                                           root2, &start, &end);
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          result = _gnutls_asn2err (result);
+          goto cleanup;
+        }
+
+      end = end - start + 1;
+
+      if ((unsigned) end > *certificate_size)
+        {
+          *certificate_size = end;
+          result = GNUTLS_E_SHORT_MEMORY_BUFFER;
+          goto cleanup;
+        }
+
+      if (certificate)
+        memcpy (certificate, &tmp.data[start], end);
+
+      *certificate_size = end;
+
+      result = 0;
+
+    }
+  else
+    {
+      result = GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
+    }
+
+cleanup:
+  _gnutls_free_datum (&tmp);
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_get_crt_count - This function returns the number of certificates in a PKCS7 certificate set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  *
+  * This function will return the number of certifcates in the PKCS7 or 
+  * RFC2630 certificate set.
+  *
+  * Returns a negative value on failure.
+  *
+  **/
+int
+gnutls_pkcs7_get_crt_count (gnutls_pkcs7_t pkcs7)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, count;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Count the CertificateSet */
+
+  result = asn1_number_of_elements (c2, "certificates", &count);
+
+  asn1_delete_structure (&c2);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return 0;                 /* no certificates */
+    }
+
+  return count;
+
+}
+
+/**
+  * gnutls_pkcs7_export - This function will export the pkcs7 structure
+  * @pkcs7: Holds the pkcs7 structure
+  * @format: the format of output params. One of PEM or DER.
+  * @output_data: will contain a structure PEM or DER encoded
+  * @output_data_size: holds the size of output_data (and will be
+  *   replaced by the actual size of parameters)
+  *
+  * This function will export the pkcs7 structure to DER or PEM format.
+  *
+  * If the buffer provided is not long enough to hold the output, then
+  * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+  * be returned.
+  *
+  * If the structure is PEM encoded, it will have a header
+  * of "BEGIN PKCS7".
+  *
+  * Return value: In case of failure a negative value will be
+  *   returned, and 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_export (gnutls_pkcs7_t pkcs7,
+                     gnutls_x509_crt_fmt_t format, void *output_data,
+                     size_t * output_data_size)
+{
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  return _gnutls_x509_export_int (pkcs7->pkcs7, format, PEM_PKCS7,
+                                  output_data, output_data_size);
+}
+
+/* Creates an empty signed data structure in the pkcs7
+ * structure and returns a handle to the signed data.
+ */
+static int
+create_empty_signed_data (ASN1_TYPE pkcs7, ASN1_TYPE * sdata)
+{
+  uint8_t one = 1;
+  int result;
+
+  *sdata = ASN1_TYPE_EMPTY;
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.pkcs-7-SignedData",
+        sdata)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Use version 1
+   */
+  result = asn1_write_value (*sdata, "version", &one, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Use no digest algorithms
+   */
+
+  /* id-data */
+  result =
+    asn1_write_value (*sdata, "encapContentInfo.eContentType",
+                      "1.2.840.113549.1.7.5", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_write_value (*sdata, "encapContentInfo.eContent", NULL, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Add no certificates.
+   */
+
+  /* Add no crls.
+   */
+
+  /* Add no signerInfos.
+   */
+
+  /* Write the content type of the signed data
+   */
+  result = asn1_write_value (pkcs7, "contentType", SIGNED_DATA_OID, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  return 0;
+
+cleanup:
+  asn1_delete_structure (sdata);
+  return result;
+
+}
+
+/**
+  * gnutls_pkcs7_set_crt_raw - This function adds a certificate in a PKCS7 certificate set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @crt: the DER encoded certificate to be added
+  *
+  * This function will add a certificate to the PKCS7 or RFC2630 certificate set.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_set_crt_raw (gnutls_pkcs7_t pkcs7, const gnutls_datum_t * crt)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0 && result != GNUTLS_E_ASN1_VALUE_NOT_FOUND)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* If the signed data are uninitialized
+   * then create them.
+   */
+  if (result == GNUTLS_E_ASN1_VALUE_NOT_FOUND)
+    {
+      /* The pkcs7 structure is new, so create the
+       * signedData.
+       */
+      result = create_empty_signed_data (pkcs7->pkcs7, &c2);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+
+  /* Step 2. Append the new certificate.
+   */
+
+  result = asn1_write_value (c2, "certificates", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_write_value (c2, "certificates.?LAST", "certificate", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result =
+    asn1_write_value (c2, "certificates.?LAST.certificate", crt->data,
+                      crt->size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Step 3. Replace the old content with the new
+   */
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs7->pkcs7, "content", 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_set_crt - This function adds a parsed certificate in a PKCS7 certificate set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @crt: the certificate to be copied.
+  *
+  * This function will add a parsed certificate to the PKCS7 or RFC2630 certificate set.
+  * This is a wrapper function over gnutls_pkcs7_set_crt_raw() .
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_set_crt (gnutls_pkcs7_t pkcs7, gnutls_x509_crt_t crt)
+{
+  int ret;
+  gnutls_datum_t data;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  ret = _gnutls_x509_der_encode (crt->cert, "", &data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_pkcs7_set_crt_raw (pkcs7, &data);
+
+  _gnutls_free_datum (&data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+
+/**
+  * gnutls_pkcs7_delete_crt - This function deletes a certificate from a PKCS7 certificate set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @indx: the index of the certificate to delete
+  *
+  * This function will delete a certificate from a PKCS7 or RFC2630 certificate set.
+  * Index starts from 0. Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_delete_crt (gnutls_pkcs7_t pkcs7, int indx)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+  char root2[MAX_NAME_SIZE];
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. Decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Delete the certificate.
+   */
+
+  snprintf (root2, sizeof (root2), "certificates.?%u", indx + 1);
+
+  result = asn1_write_value (c2, root2, NULL, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Step 3. Replace the old content with the new
+   */
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs7->pkcs7, "content", 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/* Read and write CRLs
+ */
+
+/**
+  * gnutls_pkcs7_get_crl_raw - This function returns a crl in a PKCS7 crl set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @indx: contains the index of the crl to extract
+  * @crl: the contents of the crl will be copied there (may be null)
+  * @crl_size: should hold the size of the crl
+  *
+  * This function will return a crl of the PKCS7 or RFC2630 crl set.
+  * Returns 0 on success. If the provided buffer is not long enough,
+  * then @crl_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+  *
+  * After the last crl has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+  * will be returned.
+  *
+  **/
+int
+gnutls_pkcs7_get_crl_raw (gnutls_pkcs7_t pkcs7,
+                          int indx, void *crl, size_t * crl_size)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+  char root2[MAX_NAME_SIZE];
+  gnutls_datum_t tmp = { NULL, 0 };
+  int start, end;
+
+  if (pkcs7 == NULL || crl_size == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, &tmp);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Parse the CertificateSet 
+   */
+
+  snprintf (root2, sizeof (root2), "crls.?%u", indx + 1);
+
+  /* Get the raw CRL 
+   */
+  result = asn1_der_decoding_startEnd (c2, tmp.data, tmp.size,
+                                       root2, &start, &end);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  end = end - start + 1;
+
+  if ((unsigned) end > *crl_size)
+    {
+      *crl_size = end;
+      result = GNUTLS_E_SHORT_MEMORY_BUFFER;
+      goto cleanup;
+    }
+
+  if (crl)
+    memcpy (crl, &tmp.data[start], end);
+
+  *crl_size = end;
+
+  result = 0;
+
+cleanup:
+  _gnutls_free_datum (&tmp);
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_get_crl_count - This function returns the number of crls in a PKCS7 crl set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  *
+  * This function will return the number of certifcates in the PKCS7 or 
+  * RFC2630 crl set.
+  *
+  * Returns a negative value on failure.
+  *
+  **/
+int
+gnutls_pkcs7_get_crl_count (gnutls_pkcs7_t pkcs7)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, count;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Count the CertificateSet */
+
+  result = asn1_number_of_elements (c2, "crls", &count);
+
+  asn1_delete_structure (&c2);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return 0;                 /* no crls */
+    }
+
+  return count;
+
+}
+
+/**
+  * gnutls_pkcs7_set_crl_raw - This function adds a crl in a PKCS7 crl set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @crl: the DER encoded crl to be added
+  *
+  * This function will add a crl to the PKCS7 or RFC2630 crl set.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_set_crl_raw (gnutls_pkcs7_t pkcs7, const gnutls_datum_t * crl)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0 && result != GNUTLS_E_ASN1_VALUE_NOT_FOUND)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* If the signed data are uninitialized
+   * then create them.
+   */
+  if (result == GNUTLS_E_ASN1_VALUE_NOT_FOUND)
+    {
+      /* The pkcs7 structure is new, so create the
+       * signedData.
+       */
+      result = create_empty_signed_data (pkcs7->pkcs7, &c2);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+
+  /* Step 2. Append the new crl.
+   */
+
+  result = asn1_write_value (c2, "crls", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_write_value (c2, "crls.?LAST", crl->data, crl->size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Step 3. Replace the old content with the new
+   */
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs7->pkcs7, "content", 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+/**
+  * gnutls_pkcs7_set_crl - This function adds a parsed crl in a PKCS7 crl set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @crl: the DER encoded crl to be added
+  *
+  * This function will add a parsed crl to the PKCS7 or RFC2630 crl set.
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_set_crl (gnutls_pkcs7_t pkcs7, gnutls_x509_crl_t crl)
+{
+  int ret;
+  gnutls_datum_t data;
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  ret = _gnutls_x509_der_encode (crl->crl, "", &data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_pkcs7_set_crl_raw (pkcs7, &data);
+
+  _gnutls_free_datum (&data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_pkcs7_delete_crl - This function deletes a crl from a PKCS7 crl set
+  * @pkcs7_struct: should contain a gnutls_pkcs7_t structure
+  * @indx: the index of the crl to delete
+  *
+  * This function will delete a crl from a PKCS7 or RFC2630 crl set.
+  * Index starts from 0. Returns 0 on success.
+  *
+  **/
+int
+gnutls_pkcs7_delete_crl (gnutls_pkcs7_t pkcs7, int indx)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result;
+  char root2[MAX_NAME_SIZE];
+
+  if (pkcs7 == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* Step 1. Decode the signed data.
+   */
+  result = _decode_pkcs7_signed_data (pkcs7->pkcs7, &c2, NULL);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Delete the crl.
+   */
+
+  snprintf (root2, sizeof (root2), "crls.?%u", indx + 1);
+
+  result = asn1_write_value (c2, root2, NULL, 0);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Step 3. Replace the old content with the new
+   */
+  result =
+    _gnutls_x509_der_encode_and_copy (c2, "", pkcs7->pkcs7, "content", 0);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+
+cleanup:
+  if (c2)
+    asn1_delete_structure (&c2);
+  return result;
+}
+
+#endif /* ENABLE_PKI */
diff --git a/src/daemon/https/x509/pkcs7.h b/src/daemon/https/x509/pkcs7.h
new file mode 100644
index 00000000..ee1990c3
--- /dev/null
+++ b/src/daemon/https/x509/pkcs7.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "x509.h"
+
+typedef struct gnutls_pkcs7_int
+{
+  ASN1_TYPE pkcs7;
+} gnutls_pkcs7_int;
diff --git a/src/daemon/https/x509/privkey.h b/src/daemon/https/x509/privkey.h
new file mode 100644
index 00000000..6e645b9d
--- /dev/null
+++ b/src/daemon/https/x509/privkey.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "x509.h"
+
+ASN1_TYPE _gnutls_privkey_decode_pkcs1_rsa_key (const gnutls_datum_t *
+                                                raw_key,
+                                                gnutls_x509_privkey_t pkey);
+
+int _gnutls_asn1_encode_dsa (ASN1_TYPE * c2, mpi_t * params);
diff --git a/src/daemon/https/x509/privkey_pkcs8.c b/src/daemon/https/x509/privkey_pkcs8.c
new file mode 100644
index 00000000..2f1921bb
--- /dev/null
+++ b/src/daemon/https/x509/privkey_pkcs8.c
@@ -0,0 +1,2219 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <gnutls_rsa_export.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <x509.h>
+#include <dn.h>
+#include <pkcs12.h>
+#include <privkey.h>
+#include <extensions.h>
+#include <mpi.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_num.h>
+#include "gc.h"
+
+#define PBES2_OID "1.2.840.113549.1.5.13"
+#define PBKDF2_OID "1.2.840.113549.1.5.12"
+#define DES_EDE3_CBC_OID "1.2.840.113549.3.7"
+#define DES_CBC_OID "1.3.14.3.2.7"
+
+/* oid_pbeWithSHAAnd3_KeyTripleDES_CBC */
+#define PKCS12_PBE_3DES_SHA1_OID "1.2.840.113549.1.12.1.3"
+#define PKCS12_PBE_ARCFOUR_SHA1_OID "1.2.840.113549.1.12.1.1"
+#define PKCS12_PBE_RC2_40_SHA1_OID "1.2.840.113549.1.12.1.6"
+
+struct pbkdf2_params
+  {
+    opaque salt[32];
+    int salt_size;
+    unsigned int iter_count;
+    unsigned int key_size;
+  };
+
+struct pbe_enc_params
+  {
+    gnutls_cipher_algorithm_t cipher;
+    opaque iv[8];
+    int iv_size;
+  };
+
+static int generate_key (schema_id schema, const char *password,
+    struct pbkdf2_params *kdf_params,
+    struct pbe_enc_params *enc_params,
+    gnutls_datum_t * key);
+static int read_pbkdf2_params (ASN1_TYPE pbes2_asn,
+    const gnutls_datum_t * der,
+    struct pbkdf2_params *params);
+static int read_pbe_enc_params (ASN1_TYPE pbes2_asn,
+    const gnutls_datum_t * der,
+    struct pbe_enc_params *params);
+static int decrypt_data (schema_id, ASN1_TYPE pkcs8_asn, const char *root,
+    const char *password,
+    const struct pbkdf2_params *kdf_params,
+    const struct pbe_enc_params *enc_params,
+    gnutls_datum_t * decrypted_data);
+static int decode_private_key_info (const gnutls_datum_t * der,
+    gnutls_x509_privkey_t pkey);
+static int write_schema_params (schema_id schema, ASN1_TYPE pkcs8_asn,
+    const char *where,
+    const struct pbkdf2_params *kdf_params,
+    const struct pbe_enc_params *enc_params);
+static int encrypt_data (const gnutls_datum_t * plain,
+    const struct pbe_enc_params *enc_params,
+    gnutls_datum_t * key, gnutls_datum_t * encrypted);
+
+static int read_pkcs12_kdf_params (ASN1_TYPE pbes2_asn,
+    struct pbkdf2_params *params);
+static int write_pkcs12_kdf_params (ASN1_TYPE pbes2_asn,
+    const struct pbkdf2_params *params);
+
+#define PEM_PKCS8 "ENCRYPTED PRIVATE KEY"
+#define PEM_UNENCRYPTED_PKCS8 "PRIVATE KEY"
+
+/* Returns a negative error code if the encryption schema in
+ * the OID is not supported. The schema ID is returned.
+ */
+inline static int
+check_schema (const char *oid)
+  {
+
+    if (strcmp (oid, PBES2_OID) == 0)
+    return PBES2;
+
+    if (strcmp (oid, PKCS12_PBE_3DES_SHA1_OID) == 0)
+    return PKCS12_3DES_SHA1;
+
+    if (strcmp (oid, PKCS12_PBE_ARCFOUR_SHA1_OID) == 0)
+    return PKCS12_ARCFOUR_SHA1;
+
+    if (strcmp (oid, PKCS12_PBE_RC2_40_SHA1_OID) == 0)
+    return PKCS12_RC2_40_SHA1;
+
+    _gnutls_x509_log ("PKCS encryption schema OID '%s' is unsupported.\n", oid);
+
+    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+  }
+
+/* Encodes a private key to the raw format PKCS #8 needs.
+ * For RSA it is a PKCS #1 DER private key and for DSA it is
+ * an ASN.1 INTEGER of the x value.
+ */
+inline static int
+_encode_privkey (gnutls_x509_privkey pkey, gnutls_datum * raw)
+  {
+    size_t size = 0;
+    opaque *data = NULL;
+    int ret;
+    ASN1_TYPE spk = ASN1_TYPE_EMPTY;
+
+    switch (pkey->pk_algorithm)
+      {
+        case GNUTLS_PK_RSA:
+        ret =
+        gnutls_x509_privkey_export (pkey, GNUTLS_X509_FMT_DER, NULL, &size);
+        if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        data = gnutls_malloc (size);
+        if (data == NULL)
+          {
+            gnutls_assert ();
+            ret = GNUTLS_E_MEMORY_ERROR;
+            goto error;
+          }
+
+        ret =
+        gnutls_x509_privkey_export (pkey, GNUTLS_X509_FMT_DER, data, &size);
+        if (ret < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        raw->data = data;
+        raw->size = size;
+        break;
+        default:
+        gnutls_assert ();
+        return GNUTLS_E_INVALID_REQUEST;
+      }
+
+    return 0;
+
+    error:
+    gnutls_free (data);
+    asn1_delete_structure (&spk);
+    return ret;
+
+  }
+
+/* 
+ * Encodes a PKCS #1 private key to a PKCS #8 private key
+ * info. The output will be allocated and stored into der. Also
+ * the ASN1_TYPE of private key info will be returned.
+ */
+static int
+encode_to_private_key_info (gnutls_x509_privkey_t pkey,
+    gnutls_datum_t * der, ASN1_TYPE * pkey_info)
+  {
+    int result, len;
+    opaque null = 0;
+    const char *oid;
+    gnutls_datum algo_params =
+      { NULL, 0};
+    gnutls_datum algo_privkey =
+      { NULL, 0};
+
+    if (pkey->pk_algorithm == GNUTLS_PK_RSA)
+      {
+        oid = PK_PKIX1_RSA_OID;
+        /* parameters are null 
+         */
+      }
+    else
+      {
+        oid = PK_DSA_OID;
+        result =
+        _gnutls_x509_write_dsa_params (pkey->params, pkey->params_size,
+            &algo_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            return result;
+          }
+      }
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-8-PrivateKeyInfo",
+                pkey_info)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Write the version.
+     */
+    result = asn1_write_value (*pkey_info, "version", &null, 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* write the privateKeyAlgorithm
+     * fields. (OID+NULL data)
+     */
+    result =
+    asn1_write_value (*pkey_info, "privateKeyAlgorithm.algorithm", oid, 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    result =
+    asn1_write_value (*pkey_info, "privateKeyAlgorithm.parameters",
+        algo_params.data, algo_params.size);
+    _gnutls_free_datum (&algo_params);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Write the raw private key
+     */
+    result = _encode_privkey (pkey, &algo_privkey);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    result =
+    asn1_write_value (*pkey_info, "privateKey", algo_privkey.data,
+        algo_privkey.size);
+    _gnutls_free_datum (&algo_privkey);
+
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Append an empty Attributes field.
+     */
+    result = asn1_write_value (*pkey_info, "attributes", NULL, 0);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* DER Encode the generated private key info.
+     */
+    len = 0;
+    result = asn1_der_coding (*pkey_info, "", NULL, &len, NULL);
+    if (result != ASN1_MEM_ERROR)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* allocate data for the der
+     */
+    der->size = len;
+    der->data = gnutls_malloc (len);
+    if (der->data == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_MEMORY_ERROR;
+      }
+
+    result = asn1_der_coding (*pkey_info, "", der->data, &len, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    return 0;
+
+    error:
+    asn1_delete_structure (pkey_info);
+    _gnutls_free_datum (&algo_params);
+    _gnutls_free_datum (&algo_privkey);
+    return result;
+
+  }
+
+/* Converts a PKCS #8 private key info to
+ * a PKCS #8 EncryptedPrivateKeyInfo.
+ */
+static int
+encode_to_pkcs8_key (schema_id schema, const gnutls_datum_t * der_key,
+    const char *password, ASN1_TYPE * out)
+  {
+    int result;
+    gnutls_datum_t key =
+      { NULL, 0};
+    gnutls_datum_t tmp =
+      { NULL, 0};
+    ASN1_TYPE pkcs8_asn = ASN1_TYPE_EMPTY;
+    struct pbkdf2_params kdf_params;
+    struct pbe_enc_params enc_params;
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-8-EncryptedPrivateKeyInfo",
+                &pkcs8_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Write the encryption schema OID
+     */
+    switch (schema)
+      {
+        case PBES2:
+        result =
+        asn1_write_value (pkcs8_asn, "encryptionAlgorithm.algorithm",
+            PBES2_OID, 1);
+        break;
+        case PKCS12_3DES_SHA1:
+        result =
+        asn1_write_value (pkcs8_asn, "encryptionAlgorithm.algorithm",
+            PKCS12_PBE_3DES_SHA1_OID, 1);
+        break;
+        case PKCS12_ARCFOUR_SHA1:
+        result =
+        asn1_write_value (pkcs8_asn, "encryptionAlgorithm.algorithm",
+            PKCS12_PBE_ARCFOUR_SHA1_OID, 1);
+        break;
+        case PKCS12_RC2_40_SHA1:
+        result =
+        asn1_write_value (pkcs8_asn, "encryptionAlgorithm.algorithm",
+            PKCS12_PBE_RC2_40_SHA1_OID, 1);
+        break;
+
+      }
+
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Generate a symmetric key.
+     */
+
+    result = generate_key (schema, password, &kdf_params, &enc_params, &key);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    result =
+    write_schema_params (schema, pkcs8_asn,
+        "encryptionAlgorithm.parameters", &kdf_params,
+        &enc_params);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    /* Parameters have been encoded. Now
+     * encrypt the Data.
+     */
+    result = encrypt_data (der_key, &enc_params, &key, &tmp);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    /* write the encrypted data.
+     */
+    result = asn1_write_value (pkcs8_asn, "encryptedData", tmp.data, tmp.size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    _gnutls_free_datum (&tmp);
+    _gnutls_free_datum (&key);
+
+    *out = pkcs8_asn;
+
+    return 0;
+
+    error:
+    _gnutls_free_datum (&key);
+    _gnutls_free_datum (&tmp);
+    asn1_delete_structure (&pkcs8_asn);
+    return result;
+  }
+
+/**
+ * gnutls_x509_privkey_export_pkcs8 - This function will export the private key to PKCS8 format
+ * @key: Holds the key
+ * @format: the format of output params. One of PEM or DER.
+ * @password: the password that will be used to encrypt the key. 
+ * @flags: an ORed sequence of gnutls_pkcs_encrypt_flags_t
+ * @output_data: will contain a private key PEM or DER encoded
+ * @output_data_size: holds the size of output_data (and will be
+ *   replaced by the actual size of parameters)
+ *
+ * This function will export the private key to a PKCS8 structure.
+ * Both RSA and DSA keys can be exported. For DSA keys we use
+ * PKCS #11 definitions. If the flags do not specify the encryption 
+ * cipher, then the default 3DES (PBES2) will be used.
+ *
+ * The @password can be either ASCII or UTF-8 in the default PBES2
+ * encryption schemas, or ASCII for the PKCS12 schemas.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.
+ *
+ * If the structure is PEM encoded, it will have a header
+ * of "BEGIN ENCRYPTED PRIVATE KEY" or "BEGIN PRIVATE KEY" if
+ * encryption is not used.
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_export_pkcs8 (gnutls_x509_privkey_t key,
+    gnutls_x509_crt_fmt_t format,
+    const char *password,
+    unsigned int flags,
+    void *output_data,
+    size_t * output_data_size)
+  {
+    ASN1_TYPE pkcs8_asn, pkey_info;
+    int ret;
+    gnutls_datum_t tmp;
+    schema_id schema;
+
+    if (key == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_INVALID_REQUEST;
+      }
+
+    /* Get the private key info
+     * tmp holds the DER encoding.
+     */
+    ret = encode_to_private_key_info (key, &tmp, &pkey_info);
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        return ret;
+      }
+
+    if (flags & GNUTLS_PKCS_USE_PKCS12_3DES)
+    schema = PKCS12_3DES_SHA1;
+    else if (flags & GNUTLS_PKCS_USE_PKCS12_ARCFOUR)
+    schema = PKCS12_ARCFOUR_SHA1;
+    else if (flags & GNUTLS_PKCS_USE_PKCS12_RC2_40)
+    schema = PKCS12_RC2_40_SHA1;
+    else
+    schema = PBES2;
+
+    if ((flags & GNUTLS_PKCS_PLAIN) || password == NULL)
+      {
+        _gnutls_free_datum (&tmp);
+
+        ret =
+        _gnutls_x509_export_int (pkey_info, format,
+            PEM_UNENCRYPTED_PKCS8,
+            output_data, output_data_size);
+
+        asn1_delete_structure (&pkey_info);
+      }
+    else
+      {
+        asn1_delete_structure (&pkey_info); /* we don't need it */
+
+        ret = encode_to_pkcs8_key (schema, &tmp, password, &pkcs8_asn);
+        _gnutls_free_datum (&tmp);
+
+        if (ret < 0)
+          {
+            gnutls_assert ();
+            return ret;
+          }
+
+        ret =
+        _gnutls_x509_export_int (pkcs8_asn, format, PEM_PKCS8,
+            output_data, output_data_size);
+
+        asn1_delete_structure (&pkcs8_asn);
+      }
+
+    return ret;
+  }
+
+/* Read the parameters cipher, IV, salt etc using the given
+ * schema ID.
+ */
+static int
+read_pkcs_schema_params (schema_id schema, const char *password,
+    const opaque * data, int data_size,
+    struct pbkdf2_params *kdf_params,
+    struct pbe_enc_params *enc_params)
+  {
+    ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY;
+    int result;
+    gnutls_datum_t tmp;
+
+    switch (schema)
+      {
+
+        case PBES2:
+
+        /* Now check the key derivation and the encryption
+         * functions.
+         */
+        if ((result =
+                asn1_create_element (_gnutls_get_pkix (),
+                    "PKIX1.pkcs-5-PBES2-params",
+                    &pbes2_asn)) != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        /* Decode the parameters.
+         */
+        result = asn1_der_decoding (&pbes2_asn, data, data_size, NULL);
+        if (result != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        tmp.data = (opaque *) data;
+        tmp.size = data_size;
+
+        result = read_pbkdf2_params (pbes2_asn, &tmp, kdf_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        result = read_pbe_enc_params (pbes2_asn, &tmp, enc_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        asn1_delete_structure (&pbes2_asn);
+        return 0;
+        break;
+
+        case PKCS12_3DES_SHA1:
+        case PKCS12_ARCFOUR_SHA1:
+        case PKCS12_RC2_40_SHA1:
+
+        if ((schema) == PKCS12_3DES_SHA1)
+          {
+            enc_params->cipher = GNUTLS_CIPHER_3DES_CBC;
+            enc_params->iv_size = 8;
+          }
+        else if ((schema) == PKCS12_ARCFOUR_SHA1)
+          {
+            enc_params->cipher = GNUTLS_CIPHER_ARCFOUR_128;
+            enc_params->iv_size = 0;
+          }
+        else if ((schema) == PKCS12_RC2_40_SHA1)
+          {
+            enc_params->cipher = GNUTLS_CIPHER_RC2_40_CBC;
+            enc_params->iv_size = 8;
+          }
+
+        if ((result =
+                asn1_create_element (_gnutls_get_pkix (),
+                    "PKIX1.pkcs-12-PbeParams",
+                    &pbes2_asn)) != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        /* Decode the parameters.
+         */
+        result = asn1_der_decoding (&pbes2_asn, data, data_size, NULL);
+        if (result != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        result = read_pkcs12_kdf_params (pbes2_asn, kdf_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        if (enc_params->iv_size)
+          {
+            result =
+            _pkcs12_string_to_key (2 /*IV*/, kdf_params->salt,
+                kdf_params->salt_size,
+                kdf_params->iter_count, password,
+                enc_params->iv_size, enc_params->iv);
+            if (result < 0)
+              {
+                gnutls_assert ();
+                goto error;
+              }
+
+          }
+
+        asn1_delete_structure (&pbes2_asn);
+
+        return 0;
+        break;
+
+      } /* switch */
+
+    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+
+    error:
+    asn1_delete_structure (&pbes2_asn);
+    return result;
+  }
+
+/* Converts a PKCS #8 key to
+ * an internal structure (gnutls_private_key)
+ * (normally a PKCS #1 encoded RSA key)
+ */
+static int
+decode_pkcs8_key (const gnutls_datum_t * raw_key,
+    const char *password, gnutls_x509_privkey_t pkey)
+  {
+    int result, len;
+    char enc_oid[64];
+    gnutls_datum_t tmp;
+    ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY, pkcs8_asn = ASN1_TYPE_EMPTY;
+    int params_start, params_end, params_len;
+    struct pbkdf2_params kdf_params;
+    struct pbe_enc_params enc_params;
+    schema_id schema;
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-8-EncryptedPrivateKeyInfo",
+                &pkcs8_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    result = asn1_der_decoding (&pkcs8_asn, raw_key->data, raw_key->size, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Check the encryption schema OID
+     */
+    len = sizeof (enc_oid);
+    result =
+    asn1_read_value (pkcs8_asn, "encryptionAlgorithm.algorithm",
+        enc_oid, &len);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    if ((result = check_schema (enc_oid)) < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    schema = result;
+
+    /* Get the DER encoding of the parameters.
+     */
+    result =
+    asn1_der_decoding_startEnd (pkcs8_asn, raw_key->data,
+        raw_key->size,
+        "encryptionAlgorithm.parameters",
+        &params_start, &params_end);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    params_len = params_end - params_start + 1;
+
+    result =
+    read_pkcs_schema_params (schema, password,
+        &raw_key->data[params_start],
+        params_len, &kdf_params, &enc_params);
+
+    /* Parameters have been decoded. Now
+     * decrypt the EncryptedData.
+     */
+    result =
+    decrypt_data (schema, pkcs8_asn, "encryptedData", password,
+        &kdf_params, &enc_params, &tmp);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    asn1_delete_structure (&pkcs8_asn);
+
+    result = decode_private_key_info (&tmp, pkey);
+    _gnutls_free_datum (&tmp);
+
+    if (result < 0)
+      {
+        /* We've gotten this far. In the real world it's almost certain
+         * that we're dealing with a good file, but wrong password.
+         * Sadly like 90% of random data is somehow valid DER for the
+         * a first small number of bytes, so no easy way to guarantee. */
+        if (result == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND ||
+            result == GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND ||
+            result == GNUTLS_E_ASN1_DER_ERROR ||
+            result == GNUTLS_E_ASN1_VALUE_NOT_FOUND ||
+            result == GNUTLS_E_ASN1_GENERIC_ERROR ||
+            result == GNUTLS_E_ASN1_VALUE_NOT_VALID ||
+            result == GNUTLS_E_ASN1_TAG_ERROR ||
+            result == GNUTLS_E_ASN1_TAG_IMPLICIT ||
+            result == GNUTLS_E_ASN1_TYPE_ANY_ERROR ||
+            result == GNUTLS_E_ASN1_SYNTAX_ERROR ||
+            result == GNUTLS_E_ASN1_DER_OVERFLOW)
+          {
+            result = GNUTLS_E_DECRYPTION_FAILED;
+          }
+
+        gnutls_assert ();
+        goto error;
+      }
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbes2_asn);
+    asn1_delete_structure (&pkcs8_asn);
+    return result;
+  }
+
+/* Decodes an RSA privateKey from a PKCS8 structure.
+ */
+static int
+_decode_pkcs8_rsa_key (ASN1_TYPE pkcs8_asn, gnutls_x509_privkey pkey)
+  {
+    int ret;
+    gnutls_datum tmp;
+
+    ret = _gnutls_x509_read_value (pkcs8_asn, "privateKey", &tmp, 0);
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    pkey->key = _gnutls_privkey_decode_pkcs1_rsa_key (&tmp, pkey);
+    _gnutls_free_datum (&tmp);
+    if (pkey->key == NULL)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    return 0;
+
+    error:
+    gnutls_x509_privkey_deinit (pkey);
+    return ret;
+  }
+
+/* Decodes an DSA privateKey and params from a PKCS8 structure.
+ */
+static int
+_decode_pkcs8_dsa_key (ASN1_TYPE pkcs8_asn, gnutls_x509_privkey pkey)
+  {
+    int ret;
+    gnutls_datum tmp;
+
+    ret = _gnutls_x509_read_value (pkcs8_asn, "privateKey", &tmp, 0);
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    ret = _gnutls_x509_read_der_int (tmp.data, tmp.size, &pkey->params[4]);
+    _gnutls_free_datum (&tmp);
+
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    ret =
+    _gnutls_x509_read_value (pkcs8_asn, "privateKeyAlgorithm.parameters",
+        &tmp, 0);
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    ret = _gnutls_x509_read_dsa_params (tmp.data, tmp.size, pkey->params);
+    _gnutls_free_datum (&tmp);
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    /* the public key can be generated as g^x mod p */
+    pkey->params[3] = _gnutls_mpi_alloc_like (pkey->params[0]);
+    if (pkey->params[3] == NULL)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    _gnutls_mpi_powm (pkey->params[3], pkey->params[2], pkey->params[4],
+        pkey->params[0]);
+
+    if (!pkey->crippled)
+      {
+        ret = _gnutls_asn1_encode_dsa (&pkey->key, pkey->params);
+        if (ret < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+      }
+
+    pkey->params_size = DSA_PRIVATE_PARAMS;
+
+    return 0;
+
+    error:
+    gnutls_x509_privkey_deinit (pkey);
+    return ret;
+  }
+
+static int
+decode_private_key_info (const gnutls_datum_t * der,
+    gnutls_x509_privkey_t pkey)
+  {
+    int result, len;
+    opaque oid[64];
+    ASN1_TYPE pkcs8_asn = ASN1_TYPE_EMPTY;
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-8-PrivateKeyInfo",
+                &pkcs8_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    result = asn1_der_decoding (&pkcs8_asn, der->data, der->size, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Check the private key algorithm OID
+     */
+    len = sizeof (oid);
+    result =
+    asn1_read_value (pkcs8_asn, "privateKeyAlgorithm.algorithm", oid, &len);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* we only support RSA and DSA private keys.
+     */
+    if (strcmp (oid, PK_PKIX1_RSA_OID) == 0)
+    pkey->pk_algorithm = GNUTLS_PK_RSA;
+    else
+      {
+        gnutls_assert ();
+        _gnutls_x509_log
+        ("PKCS #8 private key OID '%s' is unsupported.\n", oid);
+        result = GNUTLS_E_UNKNOWN_PK_ALGORITHM;
+        goto error;
+      }
+
+    /* Get the DER encoding of the actual private key.
+     */
+
+    if (pkey->pk_algorithm == GNUTLS_PK_RSA)
+    result = _decode_pkcs8_rsa_key (pkcs8_asn, pkey);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        return result;
+      }
+
+    result = 0;
+
+    error:
+    asn1_delete_structure (&pkcs8_asn);
+
+    return result;
+
+  }
+
+/**
+ * gnutls_x509_privkey_import_pkcs8 - This function will import a DER or PEM PKCS8 encoded key
+ * @key: The structure to store the parsed key
+ * @data: The DER or PEM encoded key.
+ * @format: One of DER or PEM
+ * @password: the password to decrypt the key (if it is encrypted).
+ * @flags: 0 if encrypted or GNUTLS_PKCS_PLAIN if not encrypted.
+ *
+ * This function will convert the given DER or PEM encoded PKCS8 2.0 encrypted key
+ * to the native gnutls_x509_privkey_t format. The output will be stored in @key.
+ * Both RSA and DSA keys can be imported, and flags can only be used to indicate
+ * an unencrypted key.
+ *
+ * The @password can be either ASCII or UTF-8 in the default PBES2
+ * encryption schemas, or ASCII for the PKCS12 schemas.
+ *
+ * If the Certificate is PEM encoded it should have a header of "ENCRYPTED PRIVATE KEY",
+ * or "PRIVATE KEY". You only need to specify the flags if the key is DER encoded, since
+ * in that case the encryption status cannot be auto-detected.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_import_pkcs8 (gnutls_x509_privkey_t key,
+    const gnutls_datum_t * data,
+    gnutls_x509_crt_fmt_t format,
+    const char *password, unsigned int flags)
+  {
+    int result = 0, need_free = 0;
+    gnutls_datum_t _data;
+
+    if (key == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_INVALID_REQUEST;
+      }
+
+    _data.data = data->data;
+    _data.size = data->size;
+
+    key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+
+    /* If the Certificate is in PEM format then decode it
+     */
+    if (format == GNUTLS_X509_FMT_PEM)
+      {
+        opaque *out;
+
+        /* Try the first header 
+         */
+        result =
+        _gnutls_fbase64_decode (PEM_UNENCRYPTED_PKCS8,
+            data->data, data->size, &out);
+
+        if (result < 0)
+          { /* Try the encrypted header 
+           */
+            result =
+            _gnutls_fbase64_decode (PEM_PKCS8, data->data, data->size, &out);
+
+            if (result <= 0)
+              {
+                if (result == 0)
+                result = GNUTLS_E_INTERNAL_ERROR;
+                gnutls_assert ();
+                return result;
+              }
+          }
+        else if (flags == 0)
+        flags |= GNUTLS_PKCS_PLAIN;
+
+        _data.data = out;
+        _data.size = result;
+
+        need_free = 1;
+      }
+
+    if (flags & GNUTLS_PKCS_PLAIN)
+      {
+        result = decode_private_key_info (&_data, key);
+      }
+    else
+      { /* encrypted. */
+        result = decode_pkcs8_key (&_data, password, key);
+      }
+
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto cleanup;
+      }
+
+    if (need_free)
+    _gnutls_free_datum (&_data);
+
+    /* The key has now been decoded.
+     */
+
+    return 0;
+
+    cleanup:
+    key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+    if (need_free)
+    _gnutls_free_datum (&_data);
+    return result;
+  }
+
+/* Reads the PBKDF2 parameters.
+ */
+static int
+read_pbkdf2_params (ASN1_TYPE pbes2_asn,
+    const gnutls_datum_t * der, struct pbkdf2_params *params)
+  {
+    int params_start, params_end;
+    int params_len, len, result;
+    ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
+    char oid[64];
+
+    memset (params, 0, sizeof (params));
+
+    /* Check the key derivation algorithm
+     */
+    len = sizeof (oid);
+    result =
+    asn1_read_value (pbes2_asn, "keyDerivationFunc.algorithm", oid, &len);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+    _gnutls_hard_log ("keyDerivationFunc.algorithm: %s\n", oid);
+
+    if (strcmp (oid, PBKDF2_OID) != 0)
+      {
+        gnutls_assert ();
+        _gnutls_x509_log
+        ("PKCS #8 key derivation OID '%s' is unsupported.\n", oid);
+        return _gnutls_asn2err (result);
+      }
+
+    result =
+    asn1_der_decoding_startEnd (pbes2_asn, der->data, der->size,
+        "keyDerivationFunc.parameters",
+        &params_start, &params_end);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+    params_len = params_end - params_start + 1;
+
+    /* Now check the key derivation and the encryption
+     * functions.
+     */
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-5-PBKDF2-params",
+                &pbkdf2_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    result =
+    asn1_der_decoding (&pbkdf2_asn, &der->data[params_start],
+        params_len, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* read the salt */
+    params->salt_size = sizeof (params->salt);
+    result =
+    asn1_read_value (pbkdf2_asn, "salt.specified", params->salt,
+        &params->salt_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("salt.specified.size: %d\n", params->salt_size);
+
+    /* read the iteration count 
+     */
+    result =
+    _gnutls_x509_read_uint (pbkdf2_asn, "iterationCount",
+        &params->iter_count);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    _gnutls_hard_log ("iterationCount: %d\n", params->iter_count);
+
+    /* read the keylength, if it is set.
+     */
+    result =
+    _gnutls_x509_read_uint (pbkdf2_asn, "keyLength", &params->key_size);
+    if (result < 0)
+      {
+        params->key_size = 0;
+      }
+    _gnutls_hard_log ("keyLength: %d\n", params->key_size);
+
+    /* We don't read the PRF. We only use the default.
+     */
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbkdf2_asn);
+    return result;
+
+  }
+
+/* Reads the PBE parameters from PKCS-12 schemas (*&#%*&#% RSA).
+ */
+static int
+read_pkcs12_kdf_params (ASN1_TYPE pbes2_asn, struct pbkdf2_params *params)
+  {
+    int result;
+
+    memset (params, 0, sizeof (params));
+
+    /* read the salt */
+    params->salt_size = sizeof (params->salt);
+    result =
+    asn1_read_value (pbes2_asn, "salt", params->salt, &params->salt_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("salt.size: %d\n", params->salt_size);
+
+    /* read the iteration count 
+     */
+    result =
+    _gnutls_x509_read_uint (pbes2_asn, "iterations", &params->iter_count);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    _gnutls_hard_log ("iterationCount: %d\n", params->iter_count);
+
+    params->key_size = 0;
+
+    return 0;
+
+    error:
+    return result;
+
+  }
+
+/* Writes the PBE parameters for PKCS-12 schemas.
+ */
+static int
+write_pkcs12_kdf_params (ASN1_TYPE pbes2_asn,
+    const struct pbkdf2_params *kdf_params)
+  {
+    int result;
+
+    /* write the salt 
+     */
+    result =
+    asn1_write_value (pbes2_asn, "salt",
+        kdf_params->salt, kdf_params->salt_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("salt.size: %d\n", kdf_params->salt_size);
+
+    /* write the iteration count 
+     */
+    result =
+    _gnutls_x509_write_uint32 (pbes2_asn, "iterations",
+        kdf_params->iter_count);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    _gnutls_hard_log ("iterationCount: %d\n", kdf_params->iter_count);
+
+    return 0;
+
+    error:
+    return result;
+
+  }
+
+/* Converts an OID to a gnutls cipher type.
+ */
+inline static int
+oid2cipher (const char *oid, gnutls_cipher_algorithm_t * algo)
+  {
+
+    *algo = 0;
+
+    if (strcmp (oid, DES_EDE3_CBC_OID) == 0)
+      {
+        *algo = GNUTLS_CIPHER_3DES_CBC;
+        return 0;
+      }
+
+    if (strcmp (oid, DES_CBC_OID) == 0)
+      {
+        *algo = GNUTLS_CIPHER_DES_CBC;
+        return 0;
+      }
+
+    _gnutls_x509_log ("PKCS #8 encryption OID '%s' is unsupported.\n", oid);
+    return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
+  }
+
+static int
+read_pbe_enc_params (ASN1_TYPE pbes2_asn,
+    const gnutls_datum_t * der,
+    struct pbe_enc_params *params)
+  {
+    int params_start, params_end;
+    int params_len, len, result;
+    ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
+    char oid[64];
+
+    memset (params, 0, sizeof (params));
+
+    /* Check the encryption algorithm
+     */
+    len = sizeof (oid);
+    result =
+    asn1_read_value (pbes2_asn, "encryptionScheme.algorithm", oid, &len);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    _gnutls_hard_log ("encryptionScheme.algorithm: %s\n", oid);
+
+    if ((result = oid2cipher (oid, &params->cipher)) < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    result =
+    asn1_der_decoding_startEnd (pbes2_asn, der->data, der->size,
+        "encryptionScheme.parameters",
+        &params_start, &params_end);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+    params_len = params_end - params_start + 1;
+
+    /* Now check the encryption parameters.
+     */
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-5-des-EDE3-CBC-params",
+                &pbe_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    result =
+    asn1_der_decoding (&pbe_asn, &der->data[params_start], params_len, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* read the IV */
+    params->iv_size = sizeof (params->iv);
+    result = asn1_read_value (pbe_asn, "", params->iv, &params->iv_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("IV.size: %d\n", params->iv_size);
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbe_asn);
+    return result;
+
+  }
+
+static int
+decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
+    const char *root, const char *password,
+    const struct pbkdf2_params *kdf_params,
+    const struct pbe_enc_params *enc_params,
+    gnutls_datum_t * decrypted_data)
+  {
+    int result;
+    int data_size;
+    opaque *data = NULL, *key = NULL;
+    gnutls_datum_t dkey, d_iv;
+    cipher_hd_t ch = NULL;
+    int key_size;
+
+    data_size = 0;
+    result = asn1_read_value (pkcs8_asn, root, NULL, &data_size);
+    if (result != ASN1_MEM_ERROR)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    data = gnutls_malloc (data_size);
+    if (data == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_MEMORY_ERROR;
+      }
+
+    result = asn1_read_value (pkcs8_asn, root, data, &data_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    if (kdf_params->key_size == 0)
+      {
+        key_size = gnutls_cipher_get_key_size (enc_params->cipher);
+      }
+    else
+    key_size = kdf_params->key_size;
+
+    key = gnutls_alloca (key_size);
+    if (key == NULL)
+      {
+        gnutls_assert ();
+        result = GNUTLS_E_MEMORY_ERROR;
+        goto error;
+      }
+
+    /* generate the key
+     */
+    if (schema == PBES2)
+      {
+        result = gc_pbkdf2_sha1 (password, strlen (password),
+            kdf_params->salt, kdf_params->salt_size,
+            kdf_params->iter_count, key, key_size);
+
+        if (result != GC_OK)
+          {
+            gnutls_assert ();
+            result = GNUTLS_E_DECRYPTION_FAILED;
+            goto error;
+          }
+      }
+    else
+      {
+        result =
+        _pkcs12_string_to_key (1 /*KEY*/, kdf_params->salt,
+            kdf_params->salt_size,
+            kdf_params->iter_count, password,
+            key_size, key);
+
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+      }
+
+    /* do the decryption.
+     */
+    dkey.data = key;
+    dkey.size = key_size;
+
+    d_iv.data = (opaque *) enc_params->iv;
+    d_iv.size = enc_params->iv_size;
+    ch = _gnutls_cipher_init (enc_params->cipher, &dkey, &d_iv);
+
+    gnutls_afree (key);
+    key = NULL;
+
+    if (ch == NULL)
+      {
+        gnutls_assert ();
+        result = GNUTLS_E_DECRYPTION_FAILED;
+        goto error;
+      }
+
+    result = _gnutls_cipher_decrypt (ch, data, data_size);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    decrypted_data->data = data;
+
+    if (_gnutls_cipher_get_block_size (enc_params->cipher) != 1)
+    decrypted_data->size = data_size - data[data_size - 1];
+    else
+    decrypted_data->size = data_size;
+
+    _gnutls_cipher_deinit (ch);
+
+    return 0;
+
+    error:
+    gnutls_free (data);
+    gnutls_afree (key);
+    if (ch != NULL)
+    _gnutls_cipher_deinit (ch);
+    return result;
+  }
+
+/* Writes the PBKDF2 parameters.
+ */
+static int
+write_pbkdf2_params (ASN1_TYPE pbes2_asn,
+    const struct pbkdf2_params *kdf_params)
+  {
+    int result;
+    ASN1_TYPE pbkdf2_asn = ASN1_TYPE_EMPTY;
+    opaque tmp[64];
+
+    /* Write the key derivation algorithm
+     */
+    result =
+    asn1_write_value (pbes2_asn, "keyDerivationFunc.algorithm",
+        PBKDF2_OID, 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    /* Now write the key derivation and the encryption
+     * functions.
+     */
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-5-PBKDF2-params",
+                &pbkdf2_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    result = asn1_write_value (pbkdf2_asn, "salt", "specified", 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* write the salt 
+     */
+    result =
+    asn1_write_value (pbkdf2_asn, "salt.specified",
+        kdf_params->salt, kdf_params->salt_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("salt.specified.size: %d\n", kdf_params->salt_size);
+
+    /* write the iteration count 
+     */
+    _gnutls_write_uint32 (kdf_params->iter_count, tmp);
+
+    result = asn1_write_value (pbkdf2_asn, "iterationCount", tmp, 4);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("iterationCount: %d\n", kdf_params->iter_count);
+
+    /* write the keylength, if it is set.
+     */
+    result = asn1_write_value (pbkdf2_asn, "keyLength", NULL, 0);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* We write an emptry prf.
+     */
+    result = asn1_write_value (pbkdf2_asn, "prf", NULL, 0);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* now encode them an put the DER output
+     * in the keyDerivationFunc.parameters
+     */
+    result = _gnutls_x509_der_encode_and_copy (pbkdf2_asn, "",
+        pbes2_asn,
+        "keyDerivationFunc.parameters",
+        0);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbkdf2_asn);
+    return result;
+
+  }
+
+static int
+write_pbe_enc_params (ASN1_TYPE pbes2_asn,
+    const struct pbe_enc_params *params)
+  {
+    int result;
+    ASN1_TYPE pbe_asn = ASN1_TYPE_EMPTY;
+
+    /* Write the encryption algorithm
+     */
+    result =
+    asn1_write_value (pbes2_asn, "encryptionScheme.algorithm",
+        DES_EDE3_CBC_OID, 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    _gnutls_hard_log ("encryptionScheme.algorithm: %s\n", DES_EDE3_CBC_OID);
+
+    /* Now check the encryption parameters.
+     */
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-5-des-EDE3-CBC-params",
+                &pbe_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        return _gnutls_asn2err (result);
+      }
+
+    /* read the salt */
+    result = asn1_write_value (pbe_asn, "", params->iv, params->iv_size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    _gnutls_hard_log ("IV.size: %d\n", params->iv_size);
+
+    /* now encode them an put the DER output
+     * in the encryptionScheme.parameters
+     */
+    result = _gnutls_x509_der_encode_and_copy (pbe_asn, "",
+        pbes2_asn,
+        "encryptionScheme.parameters",
+        0);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbe_asn);
+    return result;
+
+  }
+
+/* Generates a key and also stores the key parameters.
+ */
+static int
+generate_key (schema_id schema,
+    const char *password,
+    struct pbkdf2_params *kdf_params,
+    struct pbe_enc_params *enc_params, gnutls_datum_t * key)
+  {
+    opaque rnd[2];
+    int ret;
+
+    /* We should use the flags here to use different
+     * encryption algorithms etc. 
+     */
+
+    if (schema == PKCS12_ARCFOUR_SHA1)
+    enc_params->cipher = GNUTLS_CIPHER_ARCFOUR_128;
+    else if (schema == PKCS12_3DES_SHA1)
+    enc_params->cipher = GNUTLS_CIPHER_3DES_CBC;
+    else if (schema == PKCS12_RC2_40_SHA1)
+    enc_params->cipher = GNUTLS_CIPHER_RC2_40_CBC;
+
+    if (gc_pseudo_random (rnd, 2) != GC_OK)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_RANDOM_FAILED;
+      }
+
+    /* generate salt */
+
+    if (schema == PBES2)
+      {
+        kdf_params->salt_size = MIN (sizeof (kdf_params->salt), (unsigned) (10 + (rnd[1] % 10)));
+      }
+    else
+    kdf_params->salt_size = 8;
+
+    if (gc_pseudo_random (kdf_params->salt, kdf_params->salt_size) != GC_OK)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_RANDOM_FAILED;
+      }
+
+    kdf_params->iter_count = 256 + rnd[0];
+    key->size = kdf_params->key_size =
+    gnutls_cipher_get_key_size (enc_params->cipher);
+
+    enc_params->iv_size = _gnutls_cipher_get_iv_size (enc_params->cipher);
+
+    key->data = gnutls_secure_malloc (key->size);
+    if (key->data == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_MEMORY_ERROR;
+      }
+
+    /* now generate the key. 
+     */
+
+    if (schema == PBES2)
+      {
+
+        ret = gc_pbkdf2_sha1 (password, strlen (password),
+            kdf_params->salt, kdf_params->salt_size,
+            kdf_params->iter_count,
+            key->data, kdf_params->key_size);
+        if (ret != GC_OK)
+          {
+            gnutls_assert ();
+            return GNUTLS_E_ENCRYPTION_FAILED;
+          }
+
+        if (enc_params->iv_size &&
+            gc_nonce (enc_params->iv, enc_params->iv_size) != GC_OK)
+          {
+            gnutls_assert ();
+            return GNUTLS_E_RANDOM_FAILED;
+          }
+      }
+    else
+      { /* PKCS12 schemas */
+        ret =
+        _pkcs12_string_to_key (1 /*KEY*/, kdf_params->salt,
+            kdf_params->salt_size,
+            kdf_params->iter_count, password,
+            kdf_params->key_size, key->data);
+        if (ret < 0)
+          {
+            gnutls_assert ();
+            return ret;
+          }
+
+        /* Now generate the IV
+         */
+        if (enc_params->iv_size)
+          {
+            ret =
+            _pkcs12_string_to_key (2 /*IV*/, kdf_params->salt,
+                kdf_params->salt_size,
+                kdf_params->iter_count, password,
+                enc_params->iv_size, enc_params->iv);
+            if (ret < 0)
+              {
+                gnutls_assert ();
+                return ret;
+              }
+          }
+      }
+
+    return 0;
+  }
+
+/* Encodes the parameters to be written in the encryptionAlgorithm.parameters
+ * part.
+ */
+static int
+write_schema_params (schema_id schema, ASN1_TYPE pkcs8_asn,
+    const char *where,
+    const struct pbkdf2_params *kdf_params,
+    const struct pbe_enc_params *enc_params)
+  {
+    int result;
+    ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY;
+
+    if (schema == PBES2)
+      {
+        if ((result =
+                asn1_create_element (_gnutls_get_pkix (),
+                    "PKIX1.pkcs-5-PBES2-params",
+                    &pbes2_asn)) != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            return _gnutls_asn2err (result);
+          }
+
+        result = write_pbkdf2_params (pbes2_asn, kdf_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        result = write_pbe_enc_params (pbes2_asn, enc_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        result = _gnutls_x509_der_encode_and_copy (pbes2_asn, "",
+            pkcs8_asn, where, 0);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        asn1_delete_structure (&pbes2_asn);
+      }
+    else
+      { /* PKCS12 schemas */
+
+        if ((result =
+                asn1_create_element (_gnutls_get_pkix (),
+                    "PKIX1.pkcs-12-PbeParams",
+                    &pbes2_asn)) != ASN1_SUCCESS)
+          {
+            gnutls_assert ();
+            result = _gnutls_asn2err (result);
+            goto error;
+          }
+
+        result = write_pkcs12_kdf_params (pbes2_asn, kdf_params);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        result = _gnutls_x509_der_encode_and_copy (pbes2_asn, "",
+            pkcs8_asn, where, 0);
+        if (result < 0)
+          {
+            gnutls_assert ();
+            goto error;
+          }
+
+        asn1_delete_structure (&pbes2_asn);
+
+      }
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbes2_asn);
+    return result;
+
+  }
+
+static int
+encrypt_data (const gnutls_datum_t * plain,
+    const struct pbe_enc_params *enc_params,
+    gnutls_datum_t * key, gnutls_datum_t * encrypted)
+  {
+    int result;
+    int data_size;
+    opaque *data = NULL;
+    gnutls_datum_t d_iv;
+    cipher_hd_t ch = NULL;
+    opaque pad, pad_size;
+
+    pad_size = _gnutls_cipher_get_block_size (enc_params->cipher);
+
+    if (pad_size == 1) /* stream */
+    pad_size = 0;
+
+    data = gnutls_malloc (plain->size + pad_size);
+    if (data == NULL)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_MEMORY_ERROR;
+      }
+
+    memcpy (data, plain->data, plain->size);
+
+    if (pad_size> 0)
+      {
+        pad = pad_size - (plain->size % pad_size);
+        if (pad == 0)
+        pad = pad_size;
+        memset (&data[plain->size], pad, pad);
+      }
+    else
+    pad = 0;
+
+    data_size = plain->size + pad;
+
+    d_iv.data = (opaque *) enc_params->iv;
+    d_iv.size = enc_params->iv_size;
+    ch = _gnutls_cipher_init (enc_params->cipher, key, &d_iv);
+
+    if (ch == GNUTLS_CIPHER_FAILED)
+      {
+        gnutls_assert ();
+        result = GNUTLS_E_ENCRYPTION_FAILED;
+        goto error;
+      }
+
+    result = _gnutls_cipher_encrypt (ch, data, data_size);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    encrypted->data = data;
+    encrypted->size = data_size;
+
+    _gnutls_cipher_deinit (ch);
+
+    return 0;
+
+    error:
+    gnutls_free (data);
+    if (ch != NULL)
+    _gnutls_cipher_deinit (ch);
+    return result;
+  }
+
+/* Decrypts a PKCS #7 encryptedData. The output is allocated
+ * and stored in dec.
+ */
+int
+_gnutls_pkcs7_decrypt_data (const gnutls_datum_t * data,
+    const char *password, gnutls_datum_t * dec)
+  {
+    int result, len;
+    char enc_oid[64];
+    gnutls_datum_t tmp;
+    ASN1_TYPE pbes2_asn = ASN1_TYPE_EMPTY, pkcs7_asn = ASN1_TYPE_EMPTY;
+    int params_start, params_end, params_len;
+    struct pbkdf2_params kdf_params;
+    struct pbe_enc_params enc_params;
+    schema_id schema;
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-7-EncryptedData",
+                &pkcs7_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    result = asn1_der_decoding (&pkcs7_asn, data->data, data->size, NULL);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Check the encryption schema OID
+     */
+    len = sizeof (enc_oid);
+    result =
+    asn1_read_value (pkcs7_asn,
+        "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+        enc_oid, &len);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    if ((result = check_schema (enc_oid)) < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+    schema = result;
+
+    /* Get the DER encoding of the parameters.
+     */
+    result =
+    asn1_der_decoding_startEnd (pkcs7_asn, data->data, data->size,
+        "encryptedContentInfo.contentEncryptionAlgorithm.parameters",
+        &params_start, &params_end);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+    params_len = params_end - params_start + 1;
+
+    result =
+    read_pkcs_schema_params (schema, password,
+        &data->data[params_start],
+        params_len, &kdf_params, &enc_params);
+    if (result < ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Parameters have been decoded. Now
+     * decrypt the EncryptedData.
+     */
+
+    result =
+    decrypt_data (schema, pkcs7_asn,
+        "encryptedContentInfo.encryptedContent", password,
+        &kdf_params, &enc_params, &tmp);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    asn1_delete_structure (&pkcs7_asn);
+
+    *dec = tmp;
+
+    return 0;
+
+    error:
+    asn1_delete_structure (&pbes2_asn);
+    asn1_delete_structure (&pkcs7_asn);
+    return result;
+  }
+
+/* Encrypts to a PKCS #7 encryptedData. The output is allocated
+ * and stored in enc.
+ */
+int
+_gnutls_pkcs7_encrypt_data (schema_id schema,
+    const gnutls_datum_t * data,
+    const char *password, gnutls_datum_t * enc)
+  {
+    int result;
+    gnutls_datum_t key =
+      { NULL, 0};
+    gnutls_datum_t tmp =
+      { NULL, 0};
+    ASN1_TYPE pkcs7_asn = ASN1_TYPE_EMPTY;
+    struct pbkdf2_params kdf_params;
+    struct pbe_enc_params enc_params;
+
+    if ((result =
+            asn1_create_element (_gnutls_get_pkix (),
+                "PKIX1.pkcs-7-EncryptedData",
+                &pkcs7_asn)) != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Write the encryption schema OID
+     */
+    switch (schema)
+      {
+        case PBES2:
+        result =
+        asn1_write_value (pkcs7_asn,
+            "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+            PBES2_OID, 1);
+        break;
+        case PKCS12_3DES_SHA1:
+        result =
+        asn1_write_value (pkcs7_asn,
+            "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+            PKCS12_PBE_3DES_SHA1_OID, 1);
+        break;
+        case PKCS12_ARCFOUR_SHA1:
+        result =
+        asn1_write_value (pkcs7_asn,
+            "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+            PKCS12_PBE_ARCFOUR_SHA1_OID, 1);
+        break;
+        case PKCS12_RC2_40_SHA1:
+        result =
+        asn1_write_value (pkcs7_asn,
+            "encryptedContentInfo.contentEncryptionAlgorithm.algorithm",
+            PKCS12_PBE_RC2_40_SHA1_OID, 1);
+        break;
+
+      }
+
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Generate a symmetric key.
+     */
+
+    result = generate_key (schema, password, &kdf_params, &enc_params, &key);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    result = write_schema_params (schema, pkcs7_asn,
+        "encryptedContentInfo.contentEncryptionAlgorithm.parameters",
+        &kdf_params, &enc_params);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    /* Parameters have been encoded. Now
+     * encrypt the Data.
+     */
+    result = encrypt_data (data, &enc_params, &key, &tmp);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    /* write the encrypted data.
+     */
+    result =
+    asn1_write_value (pkcs7_asn,
+        "encryptedContentInfo.encryptedContent", tmp.data,
+        tmp.size);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    _gnutls_free_datum (&tmp);
+    _gnutls_free_datum (&key);
+
+    /* Now write the rest of the pkcs-7 stuff.
+     */
+
+    result = _gnutls_x509_write_uint32 (pkcs7_asn, "version", 0);
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    result =
+    asn1_write_value (pkcs7_asn, "encryptedContentInfo.contentType",
+        DATA_OID, 1);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    result = asn1_write_value (pkcs7_asn, "unprotectedAttrs", NULL, 0);
+    if (result != ASN1_SUCCESS)
+      {
+        gnutls_assert ();
+        result = _gnutls_asn2err (result);
+        goto error;
+      }
+
+    /* Now encode and copy the DER stuff.
+     */
+    result = _gnutls_x509_der_encode (pkcs7_asn, "", enc, 0);
+
+    asn1_delete_structure (&pkcs7_asn);
+
+    if (result < 0)
+      {
+        gnutls_assert ();
+        goto error;
+      }
+
+    error:
+    _gnutls_free_datum (&key);
+    _gnutls_free_datum (&tmp);
+    asn1_delete_structure (&pkcs7_asn);
+    return result;
+  }
+
+#endif
diff --git a/src/daemon/https/x509/rfc2818.h b/src/daemon/https/x509/rfc2818.h
new file mode 100644
index 00000000..c3399145
--- /dev/null
+++ b/src/daemon/https/x509/rfc2818.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_hostname_compare (const char *certname, const char *hostname);
+#define MAX_CN 256
diff --git a/src/daemon/https/x509/rfc2818_hostname.c b/src/daemon/https/x509/rfc2818_hostname.c
new file mode 100644
index 00000000..93a96589
--- /dev/null
+++ b/src/daemon/https/x509/rfc2818_hostname.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ * Copyright (C) 2002 Andrew McDonald
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <x509.h>
+#include <dn.h>
+#include <common.h>
+#include <rfc2818.h>
+#include <gnutls_errors.h>
+
+/* compare hostname against certificate, taking account of wildcards
+ * return 1 on success or 0 on error
+ */
+int
+_gnutls_hostname_compare (const char *certname, const char *hostname)
+{
+  const char *cmpstr1, *cmpstr2;
+
+  if (strlen (certname) == 0 || strlen (hostname) == 0)
+    return 0;
+
+  if (strlen (certname) > 2 && strncmp (certname, "*.", 2) == 0)
+    {
+      /* a wildcard certificate */
+
+      cmpstr1 = certname + 1;
+
+      /* find the first dot in hostname, compare from there on */
+      cmpstr2 = strchr (hostname, '.');
+
+      if (cmpstr2 == NULL)
+        {
+          /* error, the hostname we're connecting to is only a local part */
+          return 0;
+        }
+
+      if (strcasecmp (cmpstr1, cmpstr2) == 0)
+        {
+          return 1;
+        }
+
+      return 0;
+    }
+
+  if (strcasecmp (certname, hostname) == 0)
+    {
+      return 1;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_check_hostname - This function compares the given hostname with the hostname in the certificate
+  * @cert: should contain an gnutls_x509_crt_t structure
+  * @hostname: A null terminated string that contains a DNS name
+  *
+  * This function will check if the given certificate's subject
+  * matches the given hostname.  This is a basic implementation of the
+  * matching described in RFC2818 (HTTPS), which takes into account
+  * wildcards, and the DNSName/IPAddress subject alternative name PKIX
+  * extension.
+  *
+  * Returns non zero for a successful match, and zero on failure.
+  **/
+int
+gnutls_x509_crt_check_hostname (gnutls_x509_crt_t cert, const char *hostname)
+{
+
+  char dnsname[MAX_CN];
+  size_t dnsnamesize;
+  int found_dnsname = 0;
+  int ret = 0;
+  int i = 0;
+
+  /* try matching against:
+   *  1) a DNS name as an alternative name (subjectAltName) extension
+   *     in the certificate
+   *  2) the common name (CN) in the certificate
+   *
+   *  either of these may be of the form: *.domain.tld
+   *
+   *  only try (2) if there is no subjectAltName extension of
+   *  type dNSName
+   */
+
+  /* Check through all included subjectAltName extensions, comparing
+   * against all those of type dNSName.
+   */
+  for (i = 0; !(ret < 0); i++)
+    {
+
+      dnsnamesize = sizeof (dnsname);
+      ret = gnutls_x509_crt_get_subject_alt_name (cert, i,
+                                                  dnsname, &dnsnamesize,
+                                                  NULL);
+
+      if (ret == GNUTLS_SAN_DNSNAME)
+        {
+          found_dnsname = 1;
+          if (_gnutls_hostname_compare (dnsname, hostname))
+            {
+              return 1;
+            }
+        }
+      else if (ret == GNUTLS_SAN_IPADDRESS)
+        {
+          found_dnsname = 1;    /* RFC 2818 is unclear whether the CN
+                                   should be compared for IP addresses
+                                   too, but we won't do it.  */
+          if (_gnutls_hostname_compare (dnsname, hostname))
+            {
+              return 1;
+            }
+        }
+    }
+
+  if (!found_dnsname)
+    {
+      /* not got the necessary extension, use CN instead
+       */
+      dnsnamesize = sizeof (dnsname);
+      if (gnutls_x509_crt_get_dn_by_oid (cert, OID_X520_COMMON_NAME, 0,
+                                         0, dnsname, &dnsnamesize) < 0)
+        {
+          /* got an error, can't find a name
+           */
+          return 0;
+        }
+
+      if (_gnutls_hostname_compare (dnsname, hostname))
+        {
+          return 1;
+        }
+    }
+
+  /* not found a matching name
+   */
+  return 0;
+}
diff --git a/src/daemon/https/x509/sign.c b/src/daemon/https/x509/sign.c
new file mode 100644
index 00000000..275fc3f7
--- /dev/null
+++ b/src/daemon/https/x509/sign.c
@@ -0,0 +1,346 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* All functions which relate to X.509 certificate signing stuff are
+ * included here
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_errors.h>
+#include <gnutls_cert.h>
+#include <libtasn1.h>
+#include <gnutls_global.h>
+#include <gnutls_num.h>         /* MAX */
+#include <gnutls_sig.h>
+#include <gnutls_str.h>
+#include <gnutls_datum.h>
+#include <dn.h>
+#include <x509.h>
+#include <mpi.h>
+#include <sign.h>
+#include <common.h>
+#include <verify.h>
+
+/* Writes the digest information and the digest in a DER encoded
+ * structure. The digest info is allocated and stored into the info structure.
+ */
+static int
+encode_ber_digest_info (gnutls_digest_algorithm_t hash,
+                        const gnutls_datum_t * digest, gnutls_datum_t * info)
+{
+  ASN1_TYPE dinfo = ASN1_TYPE_EMPTY;
+  int result;
+  const char *algo;
+
+  algo = _gnutls_x509_mac_to_oid ((gnutls_mac_algorithm_t) hash);
+  if (algo == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("Hash algorithm: %d\n", hash);
+      return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
+    }
+
+  if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
+                                     "GNUTLS.DigestInfo",
+                                     &dinfo)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (dinfo, "digestAlgorithm.algorithm", algo, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Write an ASN.1 NULL in the parameters field.  This matches RFC
+     3279 and RFC 4055, although is arguable incorrect from a historic
+     perspective (see those documents for more information).
+     Regardless of what is correct, this appears to be what most
+     implementations do.  */
+  result = asn1_write_value (dinfo, "digestAlgorithm.parameters",
+                             "\x05\x00", 2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_write_value (dinfo, "digest", digest->data, digest->size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  info->size = 0;
+  asn1_der_coding (dinfo, "", NULL, &info->size, NULL);
+
+  info->data = gnutls_malloc (info->size);
+  if (info->data == NULL)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_der_coding (dinfo, "", info->data, &info->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  asn1_delete_structure (&dinfo);
+
+  return 0;
+}
+
+/* if hash==MD5 then we do RSA-MD5
+ * if hash==SHA then we do RSA-SHA
+ * params[0] is modulus
+ * params[1] is public key
+ */
+static int
+pkcs1_rsa_sign (gnutls_digest_algorithm_t hash, const gnutls_datum_t * text,
+                mpi_t * params, int params_len, gnutls_datum_t * signature)
+{
+  int ret;
+  opaque _digest[MAX_HASH_SIZE];
+  GNUTLS_HASH_HANDLE hd;
+  gnutls_datum_t digest, info;
+
+  hd = _gnutls_hash_init (HASH2MAC (hash));
+  if (hd == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (hd, text->data, text->size);
+  _gnutls_hash_deinit (hd, _digest);
+
+  digest.data = _digest;
+  digest.size = _gnutls_hash_get_algo_len (HASH2MAC (hash));
+
+  /* Encode the digest as a DigestInfo
+   */
+  if ((ret = encode_ber_digest_info (hash, &digest, &info)) != 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if ((ret =
+       _gnutls_sign (GNUTLS_PK_RSA, params, params_len, &info,
+                     signature)) < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&info);
+      return ret;
+    }
+
+  _gnutls_free_datum (&info);
+
+  return 0;
+}
+
+/* Signs the given data using the parameters from the signer's
+ * private key.
+ *
+ * returns 0 on success.
+ * 
+ * 'tbs' is the data to be signed
+ * 'signature' will hold the signature!
+ * 'hash' is only used in PKCS1 RSA signing.
+ */
+int
+_gnutls_x509_sign (const gnutls_datum_t * tbs,
+                   gnutls_digest_algorithm_t hash,
+                   gnutls_x509_privkey_t signer, gnutls_datum_t * signature)
+{
+  int ret;
+
+  switch (signer->pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+      ret =
+        pkcs1_rsa_sign (hash, tbs, signer->params, signer->params_size,
+                        signature);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      return 0;
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+}
+
+/* This is the same as the _gnutls_x509_sign, but this one will decode
+ * the ASN1_TYPE given, and sign the DER data. Actually used to get the DER
+ * of the TBS and sign it on the fly.
+ */
+int
+_gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
+                       gnutls_digest_algorithm_t hash,
+                       gnutls_x509_privkey_t signer,
+                       gnutls_datum_t * signature)
+{
+  int result;
+  opaque *buf;
+  int buf_size;
+  gnutls_datum_t tbs;
+
+  buf_size = 0;
+  asn1_der_coding (cert, tbs_name, NULL, &buf_size, NULL);
+
+  buf = gnutls_alloca (buf_size);
+  if (buf == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_der_coding (cert, tbs_name, buf, &buf_size, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_afree (buf);
+      return _gnutls_asn2err (result);
+    }
+
+  tbs.data = buf;
+  tbs.size = buf_size;
+
+  result = _gnutls_x509_sign (&tbs, hash, signer, signature);
+  gnutls_afree (buf);
+
+  return result;
+}
+
+/*-
+ * _gnutls_x509_pkix_sign - This function will sign a CRL or a certificate with a key
+ * @src: should contain an ASN1_TYPE
+ * @issuer: is the certificate of the certificate issuer
+ * @issuer_key: holds the issuer's private key
+ *
+ * This function will sign a CRL or a certificate with the issuer's private key, and
+ * will copy the issuer's information into the CRL or certificate.
+ *
+ * Returns 0 on success.
+ *
+ -*/
+int
+_gnutls_x509_pkix_sign (ASN1_TYPE src, const char *src_name,
+                        gnutls_digest_algorithm_t dig,
+                        gnutls_x509_crt_t issuer,
+                        gnutls_x509_privkey_t issuer_key)
+{
+  int result;
+  gnutls_datum_t signature;
+  char name[128];
+
+  /* Step 1. Copy the issuer's name into the certificate.
+   */
+  _gnutls_str_cpy (name, sizeof (name), src_name);
+  _gnutls_str_cat (name, sizeof (name), ".issuer");
+
+  result = asn1_copy_node (src, name, issuer->cert, "tbsCertificate.subject");
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* Step 1.5. Write the signature stuff in the tbsCertificate.
+   */
+  _gnutls_str_cpy (name, sizeof (name), src_name);
+  _gnutls_str_cat (name, sizeof (name), ".signature");
+
+  result = _gnutls_x509_write_sig_params (src, name,
+                                          issuer_key->pk_algorithm, dig,
+                                          issuer_key->params,
+                                          issuer_key->params_size);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* Step 2. Sign the certificate.
+   */
+  result = _gnutls_x509_sign_tbs (src, src_name, dig, issuer_key, &signature);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  /* write the signature (bits)
+   */
+  result =
+    asn1_write_value (src, "signature", signature.data, signature.size * 8);
+
+  _gnutls_free_datum (&signature);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* Step 3. Move up and write the AlgorithmIdentifier, which is also
+   * the same. 
+   */
+
+  result = _gnutls_x509_write_sig_params (src, "signatureAlgorithm",
+                                          issuer_key->pk_algorithm, dig,
+                                          issuer_key->params,
+                                          issuer_key->params_size);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+#endif
diff --git a/src/daemon/https/x509/sign.h b/src/daemon/https/x509/sign.h
new file mode 100644
index 00000000..e1bf46d4
--- /dev/null
+++ b/src/daemon/https/x509/sign.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_x509_sign (const gnutls_datum_t * tbs,
+                       gnutls_digest_algorithm_t hash,
+                       gnutls_x509_privkey_t signer,
+                       gnutls_datum_t * signature);
+int _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
+                           gnutls_digest_algorithm_t hash,
+                           gnutls_x509_privkey_t signer,
+                           gnutls_datum_t * signature);
+int _gnutls_x509_pkix_sign (ASN1_TYPE src, const char *src_name,
+                            gnutls_digest_algorithm_t,
+                            gnutls_x509_crt_t issuer,
+                            gnutls_x509_privkey_t issuer_key);
diff --git a/src/daemon/https/x509/verify.h b/src/daemon/https/x509/verify.h
new file mode 100644
index 00000000..d7ca5151
--- /dev/null
+++ b/src/daemon/https/x509/verify.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "x509.h"
+
+int gnutls_x509_crt_is_issuer (gnutls_x509_crt_t cert,
+                               gnutls_x509_crt_t issuer);
+int _gnutls_x509_verify_signature (const gnutls_datum_t * tbs,
+                                   const gnutls_datum_t * signature,
+                                   gnutls_x509_crt_t issuer);
+int _gnutls_x509_privkey_verify_signature (const gnutls_datum_t * tbs,
+                                           const gnutls_datum_t * signature,
+                                           gnutls_x509_privkey_t issuer);
diff --git a/src/daemon/https/x509/x509-api.texi b/src/daemon/https/x509/x509-api.texi
new file mode 100644
index 00000000..f4dd35b9
--- /dev/null
+++ b/src/daemon/https/x509/x509-api.texi
@@ -0,0 +1,2943 @@
+
+@subheading gnutls_x509_crl_init
+@anchor{gnutls_x509_crl_init}
+@deftypefun {int} {gnutls_x509_crl_init} (gnutls_x509_crl_t * @var{crl})
+@var{crl}: The structure to be initialized
+
+This function will initialize a CRL structure. CRL stands for
+Certificate Revocation List. A revocation list usually contains
+lists of certificate serial numbers that have been revoked
+by an Authority. The revocation lists are always signed with
+the authority's private key.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_deinit
+@anchor{gnutls_x509_crl_deinit}
+@deftypefun {void} {gnutls_x509_crl_deinit} (gnutls_x509_crl_t @var{crl})
+@var{crl}: The structure to be initialized
+
+This function will deinitialize a CRL structure. 
+@end deftypefun
+
+@subheading gnutls_x509_crl_import
+@anchor{gnutls_x509_crl_import}
+@deftypefun {int} {gnutls_x509_crl_import} (gnutls_x509_crl_t @var{crl}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
+@var{crl}: The structure to store the parsed CRL.
+
+@var{data}: The DER or PEM encoded CRL.
+
+@var{format}: One of DER or PEM
+
+This function will convert the given DER or PEM encoded CRL
+to the native gnutls_x509_crl_t format. The output will be stored in 'crl'.
+
+If the CRL is PEM encoded it should have a header of "X509 CRL".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_issuer_dn
+@anchor{gnutls_x509_crl_get_issuer_dn}
+@deftypefun {int} {gnutls_x509_crl_get_issuer_dn} (const gnutls_x509_crl_t @var{crl}, char * @var{buf}, size_t * @var{sizeof_buf})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{buf}: a pointer to a structure to hold the peer's name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will copy the name of the CRL issuer in the provided buffer. The name 
+will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output
+string will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If buf is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+in that case the sizeof_buf will be updated with the required size, and
+0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_issuer_dn_by_oid
+@anchor{gnutls_x509_crl_get_issuer_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crl_get_issuer_dn_by_oid} (gnutls_x509_crl_t @var{crl}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+
+@var{raw_flag}: If non zero returns the raw DER data of the DN part.
+
+@var{buf}: a pointer to a structure to hold the peer's name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will extract the part of the name of the CRL issuer specified
+by the given OID. The output will be encoded as described in RFC2253. The output
+string will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+If raw flag is zero, this function will only return known OIDs as text. Other OIDs 
+will be DER encoded, as described in RFC2253 -- in hex format with a '\#' prefix.
+You can check about known OIDs using @code{gnutls_x509_dn_oid_known()}.
+
+If buf is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+in that case the sizeof_buf will be updated with the required size,
+and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_dn_oid
+@anchor{gnutls_x509_crl_get_dn_oid}
+@deftypefun {int} {gnutls_x509_crl_get_dn_oid} (gnutls_x509_crl_t @var{crl}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{indx}: Specifies which DN OID to send. Use zero to get the first one.
+
+@var{oid}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_oid}: initially holds the size of 'oid'
+
+This function will extract the requested OID of the name of the CRL issuer, specified
+by the given index. 
+
+If oid is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough, and
+in that case the sizeof_oid will be updated with the required size.
+On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_signature_algorithm
+@anchor{gnutls_x509_crl_get_signature_algorithm}
+@deftypefun {int} {gnutls_x509_crl_get_signature_algorithm} (gnutls_x509_crl_t @var{crl})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+This function will return a value of the gnutls_sign_algorithm_t enumeration that 
+is the signature algorithm. 
+
+Returns a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_signature
+@anchor{gnutls_x509_crl_get_signature}
+@deftypefun {int} {gnutls_x509_crl_get_signature} (gnutls_x509_crl_t @var{crl}, char * @var{sig}, size_t * @var{sizeof_sig})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{sig}: a pointer where the signature part will be copied (may be null).
+
+@var{sizeof_sig}: initially holds the size of @code{sig}
+
+This function will extract the signature field of a CRL.
+
+Returns 0 on success, and a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_version
+@anchor{gnutls_x509_crl_get_version}
+@deftypefun {int} {gnutls_x509_crl_get_version} (gnutls_x509_crl_t @var{crl})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+This function will return the version of the specified CRL.
+
+Returns a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_this_update
+@anchor{gnutls_x509_crl_get_this_update}
+@deftypefun {time_t} {gnutls_x509_crl_get_this_update} (gnutls_x509_crl_t @var{crl})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+This function will return the time this CRL was issued.
+
+Returns (time_t)-1 on error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_next_update
+@anchor{gnutls_x509_crl_get_next_update}
+@deftypefun {time_t} {gnutls_x509_crl_get_next_update} (gnutls_x509_crl_t @var{crl})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+This function will return the time the next CRL will be issued.
+This field is optional in a CRL so it might be normal to get
+an error instead.
+
+Returns (time_t)-1 on error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_crt_count
+@anchor{gnutls_x509_crl_get_crt_count}
+@deftypefun {int} {gnutls_x509_crl_get_crt_count} (gnutls_x509_crl_t @var{crl})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+This function will return the number of revoked certificates in the
+given CRL.
+
+Returns a negative value on failure.
+@end deftypefun
+
+@subheading gnutls_x509_crl_get_crt_serial
+@anchor{gnutls_x509_crl_get_crt_serial}
+@deftypefun {int} {gnutls_x509_crl_get_crt_serial} (gnutls_x509_crl_t @var{crl}, int @var{indx}, unsigned char * @var{serial}, size_t * @var{serial_size}, time_t * @var{t})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{indx}: the index of the certificate to extract (starting from 0)
+
+@var{serial}: where the serial number will be copied
+
+@var{serial_size}: initially holds the size of serial
+
+@var{t}: if non null, will hold the time this certificate was revoked
+
+This function will return the serial number of the specified, by
+the index, revoked certificate.
+
+Returns a negative value on failure.
+@end deftypefun
+
+@subheading gnutls_x509_crl_export
+@anchor{gnutls_x509_crl_export}
+@deftypefun {int} {gnutls_x509_crl_export} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{crl}: Holds the revocation list
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a private key PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be replaced by the actual size of parameters)
+
+This function will export the revocation list to DER or PEM format.
+
+If the buffer provided is not long enough to hold the output, then
+GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN X509 CRL".
+
+Returns 0 on success, and a negative value on failure.
+@end deftypefun
+
+@subheading gnutls_x509_rdn_get
+@anchor{gnutls_x509_rdn_get}
+@deftypefun {int} {gnutls_x509_rdn_get} (const gnutls_datum_t * @var{idn}, char * @var{buf}, size_t * @var{sizeof_buf})
+@var{idn}: should contain a DER encoded RDN sequence
+
+@var{buf}: a pointer to a structure to hold the peer's name
+
+@var{sizeof_buf}: holds the size of @code{buf}
+
+This function will return the name of the given RDN sequence.  The
+name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in
+RFC2253.
+
+If the provided buffer is not long enough, returns
+GNUTLS_E_SHORT_MEMORY_BUFFER and *sizeof_buf will be updated.  On
+success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_rdn_get_by_oid
+@anchor{gnutls_x509_rdn_get_by_oid}
+@deftypefun {int} {gnutls_x509_rdn_get_by_oid} (const gnutls_datum_t * @var{idn}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{idn}: should contain a DER encoded RDN sequence
+
+@var{oid}: an Object Identifier
+
+@var{indx}: In case multiple same OIDs exist in the RDN indicates which
+to send. Use 0 for the first one.
+
+@var{raw_flag}: If non zero then the raw DER data are returned.
+
+@var{buf}: a pointer to a structure to hold the peer's name
+
+@var{sizeof_buf}: holds the size of @code{buf}
+
+This function will return the name of the given Object identifier,
+of the RDN sequence.  The name will be encoded using the rules
+from RFC2253.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
+the provided buffer is not long enough, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_rdn_get_oid
+@anchor{gnutls_x509_rdn_get_oid}
+@deftypefun {int} {gnutls_x509_rdn_get_oid} (const gnutls_datum_t * @var{idn}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{idn}: should contain a DER encoded RDN sequence
+
+@var{indx}: Indicates which OID to return. Use 0 for the first one.
+
+This function will return the specified Object identifier, of the
+RDN sequence.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER and updates *sizeof_buf if
+the provided buffer is not long enough, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_dn_oid_known
+@anchor{gnutls_x509_dn_oid_known}
+@deftypefun {int} {gnutls_x509_dn_oid_known} (const char * @var{oid})
+@var{oid}: holds an Object Identifier in a null terminated string
+
+This function will inform about known DN OIDs. This is useful since functions
+like @code{gnutls_x509_crt_set_dn_by_oid()} use the information on known
+OIDs to properly encode their input. Object Identifiers that are not
+known are not encoded by these functions, and their input is stored directly
+into the ASN.1 structure. In that case of unknown OIDs, you have
+the responsibility of DER encoding your data.
+
+Returns 1 on known OIDs and 0 otherwise.
+@end deftypefun
+
+@subheading gnutls_x509_crt_init
+@anchor{gnutls_x509_crt_init}
+@deftypefun {int} {gnutls_x509_crt_init} (gnutls_x509_crt_t * @var{cert})
+@var{cert}: The structure to be initialized
+
+This function will initialize an X.509 certificate structure.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_deinit
+@anchor{gnutls_x509_crt_deinit}
+@deftypefun {void} {gnutls_x509_crt_deinit} (gnutls_x509_crt_t @var{cert})
+@var{cert}: The structure to be initialized
+
+This function will deinitialize a CRL structure. 
+@end deftypefun
+
+@subheading gnutls_x509_crt_import
+@anchor{gnutls_x509_crt_import}
+@deftypefun {int} {gnutls_x509_crt_import} (gnutls_x509_crt_t @var{cert}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
+@var{cert}: The structure to store the parsed certificate.
+
+@var{data}: The DER or PEM encoded certificate.
+
+@var{format}: One of DER or PEM
+
+This function will convert the given DER or PEM encoded Certificate
+to the native gnutls_x509_crt_t format. The output will be stored in @code{cert}.
+
+If the Certificate is PEM encoded it should have a header of "X509 CERTIFICATE", or
+"CERTIFICATE".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_issuer_dn
+@anchor{gnutls_x509_crt_get_issuer_dn}
+@deftypefun {int} {gnutls_x509_crt_get_issuer_dn} (gnutls_x509_crt_t @var{cert}, char * @var{buf}, size_t * @var{sizeof_buf})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will copy the name of the Certificate issuer in the
+provided buffer. The name will be in the form
+"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_issuer_dn_by_oid
+@anchor{gnutls_x509_crt_get_issuer_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crt_get_issuer_dn_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+
+@var{raw_flag}: If non zero returns the raw DER data of the DN part.
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will extract the part of the name of the Certificate
+issuer specified by the given OID. The output, if the raw flag is not
+used, will be encoded as described in RFC2253. Thus a string that is
+ASCII or UTF-8 encoded, depending on the certificate data.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+If raw flag is zero, this function will only return known OIDs as
+text. Other OIDs will be DER encoded, as described in RFC2253 --
+in hex format with a '\#' prefix.  You can check about known OIDs
+using @code{gnutls_x509_dn_oid_known()}.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_issuer_dn_oid
+@anchor{gnutls_x509_crt_get_issuer_dn_oid}
+@deftypefun {int} {gnutls_x509_crt_get_issuer_dn_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: This specifies which OID to return. Use zero to get the first one.
+
+@var{oid}: a pointer to a buffer to hold the OID (may be null)
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+This function will extract the OIDs of the name of the Certificate
+issuer specified by the given index.
+
+If @code{oid} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_oid will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_dn
+@anchor{gnutls_x509_crt_get_dn}
+@deftypefun {int} {gnutls_x509_crt_get_dn} (gnutls_x509_crt_t @var{cert}, char * @var{buf}, size_t * @var{sizeof_buf})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will copy the name of the Certificate in the
+provided buffer. The name will be in the form
+"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_dn_by_oid
+@anchor{gnutls_x509_crt_get_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crt_get_dn_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+
+@var{raw_flag}: If non zero returns the raw DER data of the DN part.
+
+@var{buf}: a pointer where the DN part will be copied (may be null).
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will extract the part of the name of the Certificate
+subject specified by the given OID. The output, if the raw flag is not
+used, will be encoded as described in RFC2253. Thus a string that is
+ASCII or UTF-8 encoded, depending on the certificate data.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+If raw flag is zero, this function will only return known OIDs as
+text. Other OIDs will be DER encoded, as described in RFC2253 --
+in hex format with a '\#' prefix.  You can check about known OIDs
+using @code{gnutls_x509_dn_oid_known()}.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_dn_oid
+@anchor{gnutls_x509_crt_get_dn_oid}
+@deftypefun {int} {gnutls_x509_crt_get_dn_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: This specifies which OID to return. Use zero to get the first one.
+
+@var{oid}: a pointer to a buffer to hold the OID (may be null)
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+This function will extract the OIDs of the name of the Certificate
+subject specified by the given index.
+
+If oid is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_oid will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_signature_algorithm
+@anchor{gnutls_x509_crt_get_signature_algorithm}
+@deftypefun {int} {gnutls_x509_crt_get_signature_algorithm} (gnutls_x509_crt_t @var{cert})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+This function will return a value of the gnutls_sign_algorithm_t enumeration that 
+is the signature algorithm. 
+
+Returns a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_signature
+@anchor{gnutls_x509_crt_get_signature}
+@deftypefun {int} {gnutls_x509_crt_get_signature} (gnutls_x509_crt_t @var{cert}, char * @var{sig}, size_t * @var{sizeof_sig})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{sig}: a pointer where the signature part will be copied (may be null).
+
+@var{sizeof_sig}: initially holds the size of @code{sig}
+
+This function will extract the signature field of a certificate.
+
+Returns 0 on success, and a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_version
+@anchor{gnutls_x509_crt_get_version}
+@deftypefun {int} {gnutls_x509_crt_get_version} (gnutls_x509_crt_t @var{cert})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+This function will return the version of the specified Certificate.
+
+Returns a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_activation_time
+@anchor{gnutls_x509_crt_get_activation_time}
+@deftypefun {time_t} {gnutls_x509_crt_get_activation_time} (gnutls_x509_crt_t @var{cert})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+This function will return the time this Certificate was or will be activated.
+
+Returns (time_t)-1 on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_expiration_time
+@anchor{gnutls_x509_crt_get_expiration_time}
+@deftypefun {time_t} {gnutls_x509_crt_get_expiration_time} (gnutls_x509_crt_t @var{cert})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+This function will return the time this Certificate was or will be expired.
+
+Returns (time_t)-1 on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_serial
+@anchor{gnutls_x509_crt_get_serial}
+@deftypefun {int} {gnutls_x509_crt_get_serial} (gnutls_x509_crt_t @var{cert}, void * @var{result}, size_t * @var{result_size})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{result}: The place where the serial number will be copied
+
+@var{result_size}: Holds the size of the result field.
+
+This function will return the X.509 certificate's serial number. 
+This is obtained by the X509 Certificate serialNumber
+field. Serial is not always a 32 or 64bit number. Some CAs use
+large serial numbers, thus it may be wise to handle it as something
+opaque. 
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_subject_key_id
+@anchor{gnutls_x509_crt_get_subject_key_id}
+@deftypefun {int} {gnutls_x509_crt_get_subject_key_id} (gnutls_x509_crt_t @var{cert}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{ret}: The place where the identifier will be copied
+
+@var{ret_size}: Holds the size of the result field.
+
+@var{critical}: will be non zero if the extension is marked as critical (may be null)
+
+This function will return the X.509v3 certificate's subject key identifier.
+This is obtained by the X.509 Subject Key identifier extension
+field (2.5.29.14). 
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_authority_key_id
+@anchor{gnutls_x509_crt_get_authority_key_id}
+@deftypefun {int} {gnutls_x509_crt_get_authority_key_id} (gnutls_x509_crt_t @var{cert}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{critical}: will be non zero if the extension is marked as critical (may be null)
+
+This function will return the X.509v3 certificate authority's key identifier.
+This is obtained by the X.509 Authority Key identifier extension
+field (2.5.29.35). Note that this function only returns the keyIdentifier
+field of the extension.
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_pk_algorithm
+@anchor{gnutls_x509_crt_get_pk_algorithm}
+@deftypefun {int} {gnutls_x509_crt_get_pk_algorithm} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{bits})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{bits}: if bits is non null it will hold the size of the parameters' in bits
+
+This function will return the public key algorithm of an X.509 
+certificate.
+
+If bits is non null, it should have enough size to hold the parameters
+size in bits. For RSA the bits returned is the modulus. 
+For DSA the bits returned are of the public
+exponent.
+
+Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_subject_alt_name
+@anchor{gnutls_x509_crt_get_subject_alt_name}
+@deftypefun {int} {gnutls_x509_crt_get_subject_alt_name} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+
+@var{ret}: is the place where the alternative name will be copied to
+
+@var{ret_size}: holds the size of ret.
+
+@var{critical}: will be non zero if the extension is marked as critical (may be null)
+
+This function will return the alternative names, contained in the
+given certificate.
+
+This is specified in X509v3 Certificate Extensions.  GNUTLS will
+return the Alternative name (2.5.29.17), or a negative error code.
+
+When the SAN type is otherName, it will extract the data in the
+otherName's value field, and @code{GNUTLS_SAN_OTHERNAME} is returned.
+You may use @code{gnutls_x509_crt_get_subject_alt_othername_oid()} to get
+the corresponding OID and the "virtual" SAN types (e.g.,
+@code{GNUTLS_SAN_OTHERNAME_XMPP}).
+
+If an otherName OID is known, the data will be decoded.  Otherwise
+the returned data will be DER encoded, and you will have to decode
+it yourself.  Currently, only the RFC 3920 id-on-xmppAddr SAN is
+recognized.
+
+Returns the alternative subject name type on success.  The type is
+one of the enumerated gnutls_x509_subject_alt_name_t.  It will
+return @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if @code{ret_size} is not large
+enough to hold the value.  In that case @code{ret_size} will be updated
+with the required size.  If the certificate does not have an
+Alternative name with the specified sequence number then
+@code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_subject_alt_name2
+@anchor{gnutls_x509_crt_get_subject_alt_name2}
+@deftypefun {int} {gnutls_x509_crt_get_subject_alt_name2} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int* @var{ret_type}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+
+@var{ret}: is the place where the alternative name will be copied to
+
+@var{ret_size}: holds the size of ret.
+
+@var{ret_type}: holds the type of the alternative name (one of gnutls_x509_subject_alt_name_t).
+
+@var{critical}: will be non zero if the extension is marked as critical (may be null)
+
+This function will return the alternative names, contained in the
+given certificate. It is the same as @code{gnutls_x509_crt_get_subject_alt_name()}
+except for the fact that it will return the type of the alternative
+name in @code{ret_type} even if the function fails for some reason (i.e.
+the buffer provided is not enough).
+
+The return values are the same as with @code{gnutls_x509_crt_get_subject_alt_name()}.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_subject_alt_othername_oid
+@anchor{gnutls_x509_crt_get_subject_alt_othername_oid}
+@deftypefun {int} {gnutls_x509_crt_get_subject_alt_othername_oid} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{seq}: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+
+@var{ret}: is the place where the otherName OID will be copied to
+
+@var{ret_size}: holds the size of ret.
+
+This function will extract the type OID of an otherName Subject
+Alternative Name, contained in the given certificate, and return
+the type as an enumerated element.
+
+This function is only useful if
+@code{gnutls_x509_crt_get_subject_alt_name()} returned
+@code{GNUTLS_SAN_OTHERNAME}.
+
+Returns the alternative subject name type on success.  The type is
+one of the enumerated gnutls_x509_subject_alt_name_t.  For
+supported OIDs, it will return one of the virtual
+(GNUTLS_SAN_OTHERNAME_*) types, e.g. @code{GNUTLS_SAN_OTHERNAME_XMPP},
+and @code{GNUTLS_SAN_OTHERNAME} for unknown OIDs.  It will return
+@code{GNUTLS_E_SHORT_MEMORY_BUFFER} if @code{ret_size} is not large enough to
+hold the value.  In that case @code{ret_size} will be updated with the
+required size.  If the certificate does not have an Alternative
+name with the specified sequence number and with the otherName type
+then @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_basic_constraints
+@anchor{gnutls_x509_crt_get_basic_constraints}
+@deftypefun {int} {gnutls_x509_crt_get_basic_constraints} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical}, int * @var{ca}, int * @var{pathlen})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{critical}: will be non zero if the extension is marked as critical
+
+@var{ca}: pointer to output integer indicating CA status, may be NULL,
+value is 1 if the certificate CA flag is set, 0 otherwise.
+
+@var{pathlen}: pointer to output integer indicating path length (may be
+NULL), non-negative values indicate a present pathLenConstraint
+field and the actual value, -1 indicate that the field is absent.
+
+This function will read the certificate's basic constraints, and
+return the certificates CA status.  It reads the basicConstraints
+X.509 extension (2.5.29.19).
+
+@strong{Return value:} If the certificate is a CA a positive value will be
+returned, or zero if the certificate does not have CA flag set.  A
+negative value may be returned in case of errors.  If the
+certificate does not contain the basicConstraints extension
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_ca_status
+@anchor{gnutls_x509_crt_get_ca_status}
+@deftypefun {int} {gnutls_x509_crt_get_ca_status} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{critical}: will be non zero if the extension is marked as critical
+
+This function will return certificates CA status, by reading the
+basicConstraints X.509 extension (2.5.29.19). If the certificate is
+a CA a positive value will be returned, or zero if the certificate
+does not have CA flag set.
+
+Use @code{gnutls_x509_crt_get_basic_constraints()} if you want to read the
+pathLenConstraint field too.
+
+A negative value may be returned in case of parsing error.
+If the certificate does not contain the basicConstraints extension
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_key_usage
+@anchor{gnutls_x509_crt_get_key_usage}
+@deftypefun {int} {gnutls_x509_crt_get_key_usage} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{key_usage}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{key_usage}: where the key usage bits will be stored
+
+@var{critical}: will be non zero if the extension is marked as critical
+
+This function will return certificate's key usage, by reading the 
+keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the:
+GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION,
+GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT,
+GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN,
+GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY,
+GNUTLS_KEY_DECIPHER_ONLY.
+
+A negative value may be returned in case of parsing error.
+If the certificate does not contain the keyUsage extension
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_proxy
+@anchor{gnutls_x509_crt_get_proxy}
+@deftypefun {int} {gnutls_x509_crt_get_proxy} (gnutls_x509_crt_t @var{cert}, unsigned int * @var{critical}, int * @var{pathlen}, char ** @var{policyLanguage}, char ** @var{policy}, size_t * @var{sizeof_policy})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{critical}: will be non zero if the extension is marked as critical
+
+@var{pathlen}: pointer to output integer indicating path length (may be
+NULL), non-negative values indicate a present pCPathLenConstraint
+field and the actual value, -1 indicate that the field is absent.
+
+This function will read the certificate's basic constraints, and
+return the certificates CA status.  It reads the basicConstraints
+X.509 extension (2.5.29.19).
+
+@strong{Return value:} If the certificate is a CA a positive value will be
+returned, or zero if the certificate does not have CA flag set.  A
+negative value may be returned in case of errors.  If the
+certificate does not contain the basicConstraints extension
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_extension_by_oid
+@anchor{gnutls_x509_crt_get_extension_by_oid}
+@deftypefun {int} {gnutls_x509_crt_get_extension_by_oid} (gnutls_x509_crt_t @var{cert}, const char * @var{oid}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the extensions, this specifies which to send. Use zero to get the first one.
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+@var{critical}: will be non zero if the extension is marked as critical
+
+This function will return the extension specified by the OID in the certificate.
+The extensions will be returned as binary data DER encoded, in the provided
+buffer.
+
+A negative value may be returned in case of parsing error.
+If the certificate does not contain the specified extension
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_extension_oid
+@anchor{gnutls_x509_crt_get_extension_oid}
+@deftypefun {int} {gnutls_x509_crt_get_extension_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
+
+@var{oid}: a pointer to a structure to hold the OID (may be null)
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+This function will return the requested extension OID in the certificate.
+The extension OID will be stored as a string in the provided buffer.
+
+A negative value may be returned in case of parsing error.
+If your have reached the last extension available 
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_extension_info
+@anchor{gnutls_x509_crt_get_extension_info}
+@deftypefun {int} {gnutls_x509_crt_get_extension_info} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid}, int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
+
+@var{oid}: a pointer to a structure to hold the OID
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+@var{critical}: output variable with critical flag, may be NULL.
+
+This function will return the requested extension OID in the
+certificate, and the critical flag for it.  The extension OID will
+be stored as a string in the provided buffer.  Use
+@code{gnutls_x509_crt_get_extension_data()} to extract the data.
+
+Return 0 on success.  A negative value may be returned in case of
+parsing error.  If you have reached the last extension available
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_extension_data
+@anchor{gnutls_x509_crt_get_extension_data}
+@deftypefun {int} {gnutls_x509_crt_get_extension_data} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{data}, size_t * @var{sizeof_data})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: Specifies which extension OID to send. Use zero to get the first one.
+
+@var{data}: a pointer to a structure to hold the data (may be null)
+
+@var{sizeof_data}: initially holds the size of @code{oid}
+
+This function will return the requested extension data in the
+certificate.  The extension data will be stored as a string in the
+provided buffer.
+
+Use @code{gnutls_x509_crt_get_extension_info()} to extract the OID and
+critical flag.  Use @code{gnutls_x509_crt_get_extension_by_oid()} instead,
+if you want to get data indexed by the extension OID rather than
+sequence.
+
+Return 0 on success.  A negative value may be returned in case of
+parsing error.  If you have reached the last extension available
+GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_raw_issuer_dn
+@anchor{gnutls_x509_crt_get_raw_issuer_dn}
+@deftypefun {int} {gnutls_x509_crt_get_raw_issuer_dn} (gnutls_x509_crt_t @var{cert}, gnutls_datum_t * @var{start})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{start}: will hold the starting point of the DN
+
+This function will return a pointer to the DER encoded DN structure
+and the length.
+
+Returns 0 on success or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_raw_dn
+@anchor{gnutls_x509_crt_get_raw_dn}
+@deftypefun {int} {gnutls_x509_crt_get_raw_dn} (gnutls_x509_crt_t @var{cert}, gnutls_datum_t * @var{start})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{start}: will hold the starting point of the DN
+
+This function will return a pointer to the DER encoded DN structure and
+the length.
+
+Returns 0 on success, or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_subject
+@anchor{gnutls_x509_crt_get_subject}
+@deftypefun {int} {gnutls_x509_crt_get_subject} (gnutls_x509_crt_t @var{cert}, gnutls_x509_dn_t * @var{dn})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{dn}: output variable with pointer to opaque DN.
+
+Return the Certificate's Subject DN as an opaque data type.  You
+may use @code{gnutls_x509_dn_get_rdn_ava()} to decode the DN.
+
+@strong{Returns:} Returns 0 on success, or an error code.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_issuer
+@anchor{gnutls_x509_crt_get_issuer}
+@deftypefun {int} {gnutls_x509_crt_get_issuer} (gnutls_x509_crt_t @var{cert}, gnutls_x509_dn_t * @var{dn})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{dn}: output variable with pointer to opaque DN
+
+Return the Certificate's Issuer DN as an opaque data type.  You may
+use @code{gnutls_x509_dn_get_rdn_ava()} to decode the DN.
+
+Note that @code{dn} points into the @code{cert} object, and thus you may not
+deallocate @code{cert} and continue to access @code{dn}.
+
+@strong{Returns:} Returns 0 on success, or an error code.
+@end deftypefun
+
+@subheading gnutls_x509_dn_get_rdn_ava
+@anchor{gnutls_x509_dn_get_rdn_ava}
+@deftypefun {int} {gnutls_x509_dn_get_rdn_ava} (gnutls_x509_dn_t @var{dn}, int @var{irdn}, int @var{iava}, gnutls_x509_ava_st * @var{ava})
+@var{dn}: input variable with opaque DN pointer
+
+@var{irdn}: index of RDN
+
+@var{iava}: index of AVA.
+
+@var{ava}: Pointer to structure which will hold output information.
+
+Get pointers to data within the DN.
+
+Note that @code{ava} will contain pointers into the @code{dn} structure, so you
+should not modify any data or deallocate it.  Note also that the DN
+in turn points into the original certificate structure, and thus
+you may not deallocate the certificate and continue to access @code{dn}.
+
+@strong{Returns:} Returns 0 on success, or an error code.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_fingerprint
+@anchor{gnutls_x509_crt_get_fingerprint}
+@deftypefun {int} {gnutls_x509_crt_get_fingerprint} (gnutls_x509_crt_t @var{cert}, gnutls_digest_algorithm_t @var{algo}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{algo}: is a digest algorithm
+
+@var{buf}: a pointer to a structure to hold the fingerprint (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will calculate and copy the certificate's fingerprint
+in the provided buffer.
+
+If the buffer is null then only the size will be filled.
+
+@strong{Returns:} @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if the provided buffer is
+not long enough, and in that case the *sizeof_buf will be updated
+with the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_export
+@anchor{gnutls_x509_crt_export}
+@deftypefun {int} {gnutls_x509_crt_export} (gnutls_x509_crt_t @var{cert}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{cert}: Holds the certificate
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a certificate PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the certificate to DER or PEM format.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN CERTIFICATE".
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_key_id
+@anchor{gnutls_x509_crt_get_key_id}
+@deftypefun {int} {gnutls_x509_crt_get_key_id} (gnutls_x509_crt_t @var{crt}, unsigned int @var{flags}, unsigned char * @var{output_data}, size_t * @var{output_data_size})
+@var{crt}: Holds the certificate
+
+@var{flags}: should be 0 for now
+
+@var{output_data}: will contain the key ID
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will return a unique ID the depends on the public
+key parameters. This ID can be used in checking whether a
+certificate corresponds to the given private key.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.  The output will normally be a SHA-1 hash output,
+which is 20 bytes.
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_check_revocation
+@anchor{gnutls_x509_crt_check_revocation}
+@deftypefun {int} {gnutls_x509_crt_check_revocation} (gnutls_x509_crt_t @var{cert}, const gnutls_x509_crl_t * @var{crl_list}, int @var{crl_list_length})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{crl_list}: should contain a list of gnutls_x509_crl_t structures
+
+@var{crl_list_length}: the length of the crl_list
+
+This function will return check if the given certificate is
+revoked.  It is assumed that the CRLs have been verified before.
+
+@strong{Returns:} 0 if the certificate is NOT revoked, and 1 if it is.  A
+negative value is returned on error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_verify_data
+@anchor{gnutls_x509_crt_verify_data}
+@deftypefun {int} {gnutls_x509_crt_verify_data} (gnutls_x509_crt_t @var{crt}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, const gnutls_datum_t * @var{signature})
+@var{crt}: Holds the certificate
+
+@var{flags}: should be 0 for now
+
+@var{data}: holds the data to be signed
+
+@var{signature}: contains the signature
+
+This function will verify the given signed data, using the
+parameters from the certificate.
+
+@strong{Returns:} In case of a verification failure 0 is returned, and 1 on
+success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_crl_dist_points
+@anchor{gnutls_x509_crt_get_crl_dist_points}
+@deftypefun {int} {gnutls_x509_crt_get_crl_dist_points} (gnutls_x509_crt_t @var{cert}, unsigned int @var{seq}, void * @var{ret}, size_t * @var{ret_size}, unsigned int * @var{reason_flags}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{seq}: specifies the sequence number of the distribution point (0 for the first one, 1 for the second etc.)
+
+@var{ret}: is the place where the distribution point will be copied to
+
+@var{ret_size}: holds the size of ret.
+
+@var{reason_flags}: Revocation reasons flags.
+
+@var{critical}: will be non zero if the extension is marked as critical (may be null)
+
+This function will return the CRL distribution points (2.5.29.31),
+contained in the given certificate.
+
+@code{reason_flags} should be an ORed sequence of
+GNUTLS_CRL_REASON_UNUSED, GNUTLS_CRL_REASON_KEY_COMPROMISE,
+GNUTLS_CRL_REASON_CA_COMPROMISE,
+GNUTLS_CRL_REASON_AFFILIATION_CHANGED,
+GNUTLS_CRL_REASON_SUPERSEEDED,
+GNUTLS_CRL_REASON_CESSATION_OF_OPERATION,
+GNUTLS_CRL_REASON_CERTIFICATE_HOLD,
+GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN,
+GNUTLS_CRL_REASON_AA_COMPROMISE, or zero for all possible reasons.
+
+This is specified in X509v3 Certificate Extensions. GNUTLS will
+return the distribution point type, or a negative error code on
+error.
+
+Returns @code{GNUTLS_E_SHORT_MEMORY_BUFFER} and updates &@code{ret_size} if
+&@code{ret_size} is not enough to hold the distribution point, or the
+type of the distribution point if everything was ok. The type is
+one of the enumerated @code{gnutls_x509_subject_alt_name_t}.  If the
+certificate does not have an Alternative name with the specified
+sequence number then @code{GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE} is
+returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_key_purpose_oid
+@anchor{gnutls_x509_crt_get_key_purpose_oid}
+@deftypefun {int} {gnutls_x509_crt_get_key_purpose_oid} (gnutls_x509_crt_t @var{cert}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid}, unsigned int * @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{indx}: This specifies which OID to return. Use zero to get the first one.
+
+@var{oid}: a pointer to a buffer to hold the OID (may be null)
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+This function will extract the key purpose OIDs of the Certificate
+specified by the given index. These are stored in the Extended Key
+Usage extension (2.5.29.37) See the GNUTLS_KP_* definitions for
+human readable names.
+
+If @code{oid} is null then only the size will be filled.
+
+@strong{Returns:} @code{GNUTLS_E_SHORT_MEMORY_BUFFER} if the provided buffer is
+not long enough, and in that case the *sizeof_oid will be updated
+with the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_pk_rsa_raw
+@anchor{gnutls_x509_crt_get_pk_rsa_raw}
+@deftypefun {int} {gnutls_x509_crt_get_pk_rsa_raw} (gnutls_x509_crt_t @var{crt}, gnutls_datum_t * @var{m}, gnutls_datum_t * @var{e})
+@var{crt}: Holds the certificate
+
+@var{m}: will hold the modulus
+
+@var{e}: will hold the public exponent
+
+This function will export the RSA public key's parameters found in
+the given structure.  The new parameters will be allocated using
+@code{gnutls_malloc()} and will be stored in the appropriate datum.
+
+@strong{Returns:} @code{GNUTLS_E_SUCCESS} on success, otherwise an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_get_pk_dsa_raw
+@anchor{gnutls_x509_crt_get_pk_dsa_raw}
+@deftypefun {int} {gnutls_x509_crt_get_pk_dsa_raw} (gnutls_x509_crt_t @var{crt}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{g}, gnutls_datum_t * @var{y})
+@var{crt}: Holds the certificate
+
+@var{p}: will hold the p
+
+@var{q}: will hold the q
+
+@var{g}: will hold the g
+
+@var{y}: will hold the y
+
+This function will export the DSA public key's parameters found in
+the given certificate.  The new parameters will be allocated using
+@code{gnutls_malloc()} and will be stored in the appropriate datum.
+
+@strong{Returns:} @code{GNUTLS_E_SUCCESS} on success, otherwise an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_list_import
+@anchor{gnutls_x509_crt_list_import}
+@deftypefun {int} {gnutls_x509_crt_list_import} (gnutls_x509_crt_t * @var{certs}, unsigned int * @var{cert_max}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, unsigned int @var{flags})
+@var{certs}: The structures to store the parsed certificate. Must not be initialized.
+
+@var{cert_max}: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
+
+@var{data}: The PEM encoded certificate.
+
+@var{format}: One of DER or PEM.
+
+@var{flags}: must be zero or an OR'd sequence of gnutls_certificate_import_flags.
+
+This function will convert the given PEM encoded certificate list
+to the native gnutls_x509_crt_t format. The output will be stored
+in @code{certs}.  They will be automatically initialized.
+
+If the Certificate is PEM encoded it should have a header of "X509
+CERTIFICATE", or "CERTIFICATE".
+
+@strong{Returns:} the number of certificates read or a negative error value.
+@end deftypefun
+
+@subheading gnutls_x509_crt_check_hostname
+@anchor{gnutls_x509_crt_check_hostname}
+@deftypefun {int} {gnutls_x509_crt_check_hostname} (gnutls_x509_crt_t @var{cert}, const char * @var{hostname})
+@var{cert}: should contain an gnutls_x509_crt_t structure
+
+@var{hostname}: A null terminated string that contains a DNS name
+
+This function will check if the given certificate's subject
+matches the given hostname.  This is a basic implementation of the
+matching described in RFC2818 (HTTPS), which takes into account
+wildcards, and the DNSName/IPAddress subject alternative name PKIX
+extension.
+
+Returns non zero for a successful match, and zero on failure.
+@end deftypefun
+
+@subheading gnutls_x509_crt_check_issuer
+@anchor{gnutls_x509_crt_check_issuer}
+@deftypefun {int} {gnutls_x509_crt_check_issuer} (gnutls_x509_crt_t @var{cert}, gnutls_x509_crt_t @var{issuer})
+@var{cert}: is the certificate to be checked
+
+@var{issuer}: is the certificate of a possible issuer
+
+This function will check if the given certificate was issued by the
+given issuer. It will return true (1) if the given certificate is issued
+by the given issuer, and false (0) if not.
+
+A negative value is returned in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_list_verify
+@anchor{gnutls_x509_crt_list_verify}
+@deftypefun {int} {gnutls_x509_crt_list_verify} (const gnutls_x509_crt_t * @var{cert_list}, int @var{cert_list_length}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, const gnutls_x509_crl_t * @var{CRL_list}, int @var{CRL_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
+@var{cert_list}: is the certificate list to be verified
+
+@var{cert_list_length}: holds the number of certificate in cert_list
+
+@var{CA_list}: is the CA list which will be used in verification
+
+@var{CA_list_length}: holds the number of CA certificate in CA_list
+
+@var{CRL_list}: holds a list of CRLs.
+
+@var{CRL_list_length}: the length of CRL list.
+
+@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+
+@var{verify}: will hold the certificate verification output.
+
+This function will try to verify the given certificate list and return its status.
+Note that expiration and activation dates are not checked
+by this function, you should check them using the appropriate functions.
+
+If no flags are specified (0), this function will use the 
+basicConstraints (2.5.29.19) PKIX extension. This means that only a certificate 
+authority is allowed to sign a certificate.
+
+You must also check the peer's name in order to check if the verified 
+certificate belongs to the actual peer. 
+
+The certificate verification output will be put in @code{verify} and will be
+one or more of the gnutls_certificate_status_t enumerated elements bitwise or'd.
+For a more detailed verification status use @code{gnutls_x509_crt_verify()} per list
+element.
+
+@strong{GNUTLS_CERT_INVALID:} the certificate chain is not valid.
+
+@strong{GNUTLS_CERT_REVOKED:} a certificate in the chain has been revoked.
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_verify
+@anchor{gnutls_x509_crt_verify}
+@deftypefun {int} {gnutls_x509_crt_verify} (gnutls_x509_crt_t @var{cert}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
+@var{cert}: is the certificate to be verified
+
+@var{CA_list}: is one certificate that is considered to be trusted one
+
+@var{CA_list_length}: holds the number of CA certificate in CA_list
+
+@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+
+@var{verify}: will hold the certificate verification output.
+
+This function will try to verify the given certificate and return its status. 
+The verification output in this functions cannot be GNUTLS_CERT_NOT_VALID.
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_check_issuer
+@anchor{gnutls_x509_crl_check_issuer}
+@deftypefun {int} {gnutls_x509_crl_check_issuer} (gnutls_x509_crl_t @var{cert}, gnutls_x509_crt_t @var{issuer})
+@var{issuer}: is the certificate of a possible issuer
+
+This function will check if the given CRL was issued by the
+given issuer certificate. It will return true (1) if the given CRL was issued
+by the given issuer, and false (0) if not.
+
+A negative value is returned in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_verify
+@anchor{gnutls_x509_crl_verify}
+@deftypefun {int} {gnutls_x509_crl_verify} (gnutls_x509_crl_t @var{crl}, const gnutls_x509_crt_t * @var{CA_list}, int @var{CA_list_length}, unsigned int @var{flags}, unsigned int * @var{verify})
+@var{crl}: is the crl to be verified
+
+@var{CA_list}: is a certificate list that is considered to be trusted one
+
+@var{CA_list_length}: holds the number of CA certificates in CA_list
+
+@var{flags}: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+
+@var{verify}: will hold the crl verification output.
+
+This function will try to verify the given crl and return its status.
+See @code{gnutls_x509_crt_list_verify()} for a detailed description of
+return values.
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_init
+@anchor{gnutls_x509_privkey_init}
+@deftypefun {int} {gnutls_x509_privkey_init} (gnutls_x509_privkey_t * @var{key})
+@var{key}: The structure to be initialized
+
+This function will initialize an private key structure. 
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_deinit
+@anchor{gnutls_x509_privkey_deinit}
+@deftypefun {void} {gnutls_x509_privkey_deinit} (gnutls_x509_privkey_t @var{key})
+@var{key}: The structure to be initialized
+
+This function will deinitialize a private key structure. 
+@end deftypefun
+
+@subheading gnutls_x509_privkey_cpy
+@anchor{gnutls_x509_privkey_cpy}
+@deftypefun {int} {gnutls_x509_privkey_cpy} (gnutls_x509_privkey_t @var{dst}, gnutls_x509_privkey_t @var{src})
+@var{dst}: The destination key, which should be initialized.
+
+@var{src}: The source key
+
+This function will copy a private key from source to destination key.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_import
+@anchor{gnutls_x509_privkey_import}
+@deftypefun {int} {gnutls_x509_privkey_import} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
+@var{key}: The structure to store the parsed key
+
+@var{data}: The DER or PEM encoded certificate.
+
+@var{format}: One of DER or PEM
+
+This function will convert the given DER or PEM encoded key
+to the native gnutls_x509_privkey_t format. The output will be stored in @code{key} .
+
+If the key is PEM encoded it should have a header of "RSA PRIVATE KEY", or
+"DSA PRIVATE KEY".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_import_rsa_raw
+@anchor{gnutls_x509_privkey_import_rsa_raw}
+@deftypefun {int} {gnutls_x509_privkey_import_rsa_raw} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{m}, const gnutls_datum_t * @var{e}, const gnutls_datum_t * @var{d}, const gnutls_datum_t * @var{p}, const gnutls_datum_t * @var{q}, const gnutls_datum_t * @var{u})
+@var{key}: The structure to store the parsed key
+
+@var{m}: holds the modulus
+
+@var{e}: holds the public exponent
+
+@var{d}: holds the private exponent
+
+@var{p}: holds the first prime (p)
+
+@var{q}: holds the second prime (q)
+
+@var{u}: holds the coefficient
+
+This function will convert the given RSA raw parameters
+to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_import_dsa_raw
+@anchor{gnutls_x509_privkey_import_dsa_raw}
+@deftypefun {int} {gnutls_x509_privkey_import_dsa_raw} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{p}, const gnutls_datum_t * @var{q}, const gnutls_datum_t * @var{g}, const gnutls_datum_t * @var{y}, const gnutls_datum_t * @var{x})
+@var{key}: The structure to store the parsed key
+
+@var{p}: holds the p
+
+@var{q}: holds the q
+
+@var{g}: holds the g
+
+@var{y}: holds the y
+
+@var{x}: holds the x
+
+This function will convert the given DSA raw parameters
+to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_get_pk_algorithm
+@anchor{gnutls_x509_privkey_get_pk_algorithm}
+@deftypefun {int} {gnutls_x509_privkey_get_pk_algorithm} (gnutls_x509_privkey_t @var{key})
+@var{key}: should contain a gnutls_x509_privkey_t structure
+
+This function will return the public key algorithm of a private
+key.
+
+Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_export
+@anchor{gnutls_x509_privkey_export}
+@deftypefun {int} {gnutls_x509_privkey_export} (gnutls_x509_privkey_t @var{key}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{key}: Holds the key
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a private key PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the private key to a PKCS1 structure for
+RSA keys, or an integer sequence for DSA keys. The DSA keys are in
+the same format with the parameters used by openssl.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN RSA PRIVATE KEY".
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_export_rsa_raw
+@anchor{gnutls_x509_privkey_export_rsa_raw}
+@deftypefun {int} {gnutls_x509_privkey_export_rsa_raw} (gnutls_x509_privkey_t @var{key}, gnutls_datum_t * @var{m}, gnutls_datum_t * @var{e}, gnutls_datum_t * @var{d}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{u})
+@var{key}: a structure that holds the rsa parameters
+
+@var{m}: will hold the modulus
+
+@var{e}: will hold the public exponent
+
+@var{d}: will hold the private exponent
+
+@var{p}: will hold the first prime (p)
+
+@var{q}: will hold the second prime (q)
+
+@var{u}: will hold the coefficient
+
+This function will export the RSA private key's parameters found in the given
+structure. The new parameters will be allocated using
+@code{gnutls_malloc()} and will be stored in the appropriate datum.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_export_dsa_raw
+@anchor{gnutls_x509_privkey_export_dsa_raw}
+@deftypefun {int} {gnutls_x509_privkey_export_dsa_raw} (gnutls_x509_privkey_t @var{key}, gnutls_datum_t * @var{p}, gnutls_datum_t * @var{q}, gnutls_datum_t * @var{g}, gnutls_datum_t * @var{y}, gnutls_datum_t * @var{x})
+@var{p}: will hold the p
+
+@var{q}: will hold the q
+
+@var{g}: will hold the g
+
+@var{y}: will hold the y
+
+@var{x}: will hold the x
+
+This function will export the DSA private key's parameters found in the given
+structure. The new parameters will be allocated using
+@code{gnutls_malloc()} and will be stored in the appropriate datum.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_generate
+@anchor{gnutls_x509_privkey_generate}
+@deftypefun {int} {gnutls_x509_privkey_generate} (gnutls_x509_privkey_t @var{key}, gnutls_pk_algorithm_t @var{algo}, unsigned int @var{bits}, unsigned int @var{flags})
+@var{key}: should contain a gnutls_x509_privkey_t structure
+
+@var{algo}: is one of RSA or DSA.
+
+@var{bits}: the size of the modulus
+
+@var{flags}: unused for now. Must be 0.
+
+This function will generate a random private key. Note that
+this function must be called on an empty private key. 
+
+Returns 0 on success or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_get_key_id
+@anchor{gnutls_x509_privkey_get_key_id}
+@deftypefun {int} {gnutls_x509_privkey_get_key_id} (gnutls_x509_privkey_t @var{key}, unsigned int @var{flags}, unsigned char * @var{output_data}, size_t * @var{output_data_size})
+@var{key}: Holds the key
+
+@var{flags}: should be 0 for now
+
+@var{output_data}: will contain the key ID
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will return a unique ID the depends on the public key
+parameters. This ID can be used in checking whether a certificate
+corresponds to the given key.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.  The output will normally be a SHA-1 hash output,
+which is 20 bytes.
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_sign_data
+@anchor{gnutls_x509_privkey_sign_data}
+@deftypefun {int} {gnutls_x509_privkey_sign_data} (gnutls_x509_privkey_t @var{key}, gnutls_digest_algorithm_t @var{digest}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, void * @var{signature}, size_t * @var{signature_size})
+@var{key}: Holds the key
+
+@var{digest}: should be MD5 or SHA1
+
+@var{flags}: should be 0 for now
+
+@var{data}: holds the data to be signed
+
+@var{signature}: will contain the signature
+
+@var{signature_size}: holds the size of signature (and will be replaced
+by the new size)
+
+This function will sign the given data using a signature algorithm
+supported by the private key. Signature algorithms are always used
+together with a hash functions.  Different hash functions may be
+used for the RSA algorithm, but only SHA-1 for the DSA keys.
+
+If the buffer provided is not long enough to hold the output, then
+*signature_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.
+
+In case of failure a negative value will be returned, and
+0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_sign_hash
+@anchor{gnutls_x509_privkey_sign_hash}
+@deftypefun {int} {gnutls_x509_privkey_sign_hash} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{hash}, gnutls_datum_t * @var{signature})
+@var{key}: Holds the key
+
+@var{hash}: holds the data to be signed
+
+@var{signature}: will contain newly allocated signature
+
+This function will sign the given hash using the private key.
+
+@strong{Return value:} In case of failure a negative value will be returned,
+and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_verify_data
+@anchor{gnutls_x509_privkey_verify_data}
+@deftypefun {int} {gnutls_x509_privkey_verify_data} (gnutls_x509_privkey_t @var{key}, unsigned int @var{flags}, const gnutls_datum_t * @var{data}, const gnutls_datum_t * @var{signature})
+@var{key}: Holds the key
+
+@var{flags}: should be 0 for now
+
+@var{data}: holds the data to be signed
+
+@var{signature}: contains the signature
+
+This function will verify the given signed data, using the parameters in the
+private key.
+
+In case of a verification failure 0 is returned, and
+1 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_fix
+@anchor{gnutls_x509_privkey_fix}
+@deftypefun {int} {gnutls_x509_privkey_fix} (gnutls_x509_privkey_t @var{key})
+@var{key}: Holds the key
+
+This function will recalculate the secondary parameters in a key.
+In RSA keys, this can be the coefficient and exponent1,2.
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_init
+@anchor{gnutls_pkcs7_init}
+@deftypefun {int} {gnutls_pkcs7_init} (gnutls_pkcs7_t * @var{pkcs7})
+@var{pkcs7}: The structure to be initialized
+
+This function will initialize a PKCS7 structure. PKCS7 structures
+usually contain lists of X.509 Certificates and X.509 Certificate
+revocation lists.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_deinit
+@anchor{gnutls_pkcs7_deinit}
+@deftypefun {void} {gnutls_pkcs7_deinit} (gnutls_pkcs7_t @var{pkcs7})
+@var{pkcs7}: The structure to be initialized
+
+This function will deinitialize a PKCS7 structure. 
+@end deftypefun
+
+@subheading gnutls_pkcs7_import
+@anchor{gnutls_pkcs7_import}
+@deftypefun {int} {gnutls_pkcs7_import} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
+@var{pkcs7}: The structure to store the parsed PKCS7.
+
+@var{data}: The DER or PEM encoded PKCS7.
+
+@var{format}: One of DER or PEM
+
+This function will convert the given DER or PEM encoded PKCS7
+to the native gnutls_pkcs7_t format. The output will be stored in 'pkcs7'.
+
+If the PKCS7 is PEM encoded it should have a header of "PKCS7".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_get_crt_raw
+@anchor{gnutls_pkcs7_get_crt_raw}
+@deftypefun {int} {gnutls_pkcs7_get_crt_raw} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx}, void * @var{certificate}, size_t * @var{certificate_size})
+@var{indx}: contains the index of the certificate to extract
+
+@var{certificate}: the contents of the certificate will be copied there (may be null)
+
+@var{certificate_size}: should hold the size of the certificate
+
+This function will return a certificate of the PKCS7 or RFC2630 certificate set.
+Returns 0 on success. If the provided buffer is not long enough,
+then @code{certificate_size} is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+
+After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+will be returned.
+@end deftypefun
+
+@subheading gnutls_pkcs7_get_crt_count
+@anchor{gnutls_pkcs7_get_crt_count}
+@deftypefun {int} {gnutls_pkcs7_get_crt_count} (gnutls_pkcs7_t @var{pkcs7})
+This function will return the number of certifcates in the PKCS7 or 
+RFC2630 certificate set.
+
+Returns a negative value on failure.
+@end deftypefun
+
+@subheading gnutls_pkcs7_export
+@anchor{gnutls_pkcs7_export}
+@deftypefun {int} {gnutls_pkcs7_export} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{pkcs7}: Holds the pkcs7 structure
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a structure PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the pkcs7 structure to DER or PEM format.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN PKCS7".
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_set_crt_raw
+@anchor{gnutls_pkcs7_set_crt_raw}
+@deftypefun {int} {gnutls_pkcs7_set_crt_raw} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{crt})
+@var{crt}: the DER encoded certificate to be added
+
+This function will add a certificate to the PKCS7 or RFC2630 certificate set.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_set_crt
+@anchor{gnutls_pkcs7_set_crt}
+@deftypefun {int} {gnutls_pkcs7_set_crt} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crt_t @var{crt})
+@var{crt}: the certificate to be copied.
+
+This function will add a parsed certificate to the PKCS7 or RFC2630 certificate set.
+This is a wrapper function over @code{gnutls_pkcs7_set_crt_raw()} .
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_delete_crt
+@anchor{gnutls_pkcs7_delete_crt}
+@deftypefun {int} {gnutls_pkcs7_delete_crt} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx})
+@var{indx}: the index of the certificate to delete
+
+This function will delete a certificate from a PKCS7 or RFC2630 certificate set.
+Index starts from 0. Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_get_crl_raw
+@anchor{gnutls_pkcs7_get_crl_raw}
+@deftypefun {int} {gnutls_pkcs7_get_crl_raw} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx}, void * @var{crl}, size_t * @var{crl_size})
+@var{indx}: contains the index of the crl to extract
+
+@var{crl}: the contents of the crl will be copied there (may be null)
+
+@var{crl_size}: should hold the size of the crl
+
+This function will return a crl of the PKCS7 or RFC2630 crl set.
+Returns 0 on success. If the provided buffer is not long enough,
+then @code{crl_size} is updated and GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+
+After the last crl has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+will be returned.
+@end deftypefun
+
+@subheading gnutls_pkcs7_get_crl_count
+@anchor{gnutls_pkcs7_get_crl_count}
+@deftypefun {int} {gnutls_pkcs7_get_crl_count} (gnutls_pkcs7_t @var{pkcs7})
+This function will return the number of certifcates in the PKCS7 or 
+RFC2630 crl set.
+
+Returns a negative value on failure.
+@end deftypefun
+
+@subheading gnutls_pkcs7_set_crl_raw
+@anchor{gnutls_pkcs7_set_crl_raw}
+@deftypefun {int} {gnutls_pkcs7_set_crl_raw} (gnutls_pkcs7_t @var{pkcs7}, const gnutls_datum_t * @var{crl})
+@var{crl}: the DER encoded crl to be added
+
+This function will add a crl to the PKCS7 or RFC2630 crl set.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_set_crl
+@anchor{gnutls_pkcs7_set_crl}
+@deftypefun {int} {gnutls_pkcs7_set_crl} (gnutls_pkcs7_t @var{pkcs7}, gnutls_x509_crl_t @var{crl})
+@var{crl}: the DER encoded crl to be added
+
+This function will add a parsed crl to the PKCS7 or RFC2630 crl set.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs7_delete_crl
+@anchor{gnutls_pkcs7_delete_crl}
+@deftypefun {int} {gnutls_pkcs7_delete_crl} (gnutls_pkcs7_t @var{pkcs7}, int @var{indx})
+@var{indx}: the index of the crl to delete
+
+This function will delete a crl from a PKCS7 or RFC2630 crl set.
+Index starts from 0. Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_init
+@anchor{gnutls_x509_crq_init}
+@deftypefun {int} {gnutls_x509_crq_init} (gnutls_x509_crq_t * @var{crq})
+@var{crq}: The structure to be initialized
+
+This function will initialize a PKCS10 certificate request structure. 
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_deinit
+@anchor{gnutls_x509_crq_deinit}
+@deftypefun {void} {gnutls_x509_crq_deinit} (gnutls_x509_crq_t @var{crq})
+@var{crq}: The structure to be initialized
+
+This function will deinitialize a CRL structure. 
+@end deftypefun
+
+@subheading gnutls_x509_crq_import
+@anchor{gnutls_x509_crq_import}
+@deftypefun {int} {gnutls_x509_crq_import} (gnutls_x509_crq_t @var{crq}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format})
+@var{crq}: The structure to store the parsed certificate request.
+
+@var{data}: The DER or PEM encoded certificate.
+
+@var{format}: One of DER or PEM
+
+This function will convert the given DER or PEM encoded Certificate
+to the native gnutls_x509_crq_t format. The output will be stored in @code{cert}.
+
+If the Certificate is PEM encoded it should have a header of "NEW CERTIFICATE REQUEST".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_dn
+@anchor{gnutls_x509_crq_get_dn}
+@deftypefun {int} {gnutls_x509_crq_get_dn} (gnutls_x509_crq_t @var{crq}, char * @var{buf}, size_t * @var{sizeof_buf})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will copy the name of the Certificate request
+subject in the provided buffer. The name will be in the form
+"C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+will be ASCII or UTF-8 encoded, depending on the certificate data.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_dn_by_oid
+@anchor{gnutls_x509_crq_get_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crq_get_dn_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, int @var{indx}, unsigned int @var{raw_flag}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the RDN, this specifies
+which to send. Use zero to get the first one.
+
+@var{raw_flag}: If non zero returns the raw DER data of the DN part.
+
+@var{buf}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will extract the part of the name of the Certificate
+request subject, specified by the given OID. The output will be
+encoded as described in RFC2253. The output string will be ASCII
+or UTF-8 encoded, depending on the certificate data.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+If raw flag is zero, this function will only return known OIDs as
+text. Other OIDs will be DER encoded, as described in RFC2253 --
+in hex format with a '\#' prefix.  You can check about known OIDs
+using @code{gnutls_x509_dn_oid_known()}.
+
+If @code{buf} is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_buf will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_dn_oid
+@anchor{gnutls_x509_crq_get_dn_oid}
+@deftypefun {int} {gnutls_x509_crq_get_dn_oid} (gnutls_x509_crq_t @var{crq}, int @var{indx}, void * @var{oid}, size_t * @var{sizeof_oid})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{indx}: Specifies which DN OID to send. Use zero to get the first one.
+
+@var{oid}: a pointer to a structure to hold the name (may be null)
+
+@var{sizeof_oid}: initially holds the size of @code{oid}
+
+This function will extract the requested OID of the name of the
+Certificate request subject, specified by the given index.
+
+If oid is null then only the size will be filled.
+
+Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+long enough, and in that case the *sizeof_oid will be updated with
+the required size.  On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_challenge_password
+@anchor{gnutls_x509_crq_get_challenge_password}
+@deftypefun {int} {gnutls_x509_crq_get_challenge_password} (gnutls_x509_crq_t @var{crq}, char * @var{pass}, size_t * @var{sizeof_pass})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{pass}: will hold a null terminated password
+
+@var{sizeof_pass}: Initially holds the size of @code{pass}.
+
+This function will return the challenge password in the
+request.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_set_attribute_by_oid
+@anchor{gnutls_x509_crq_set_attribute_by_oid}
+@deftypefun {int} {gnutls_x509_crq_set_attribute_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, void * @var{buf}, size_t @var{sizeof_buf})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{buf}: a pointer to a structure that holds the attribute data
+
+@var{sizeof_buf}: holds the size of @code{buf}
+
+This function will set the attribute in the certificate request specified
+by the given Object ID. The attribute must be be DER encoded.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_attribute_by_oid
+@anchor{gnutls_x509_crq_get_attribute_by_oid}
+@deftypefun {int} {gnutls_x509_crq_get_attribute_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, int @var{indx}, void * @var{buf}, size_t * @var{sizeof_buf})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{indx}: In case multiple same OIDs exist in the attribute list, this specifies
+which to send. Use zero to get the first one.
+
+@var{buf}: a pointer to a structure to hold the attribute data (may be null)
+
+@var{sizeof_buf}: initially holds the size of @code{buf}
+
+This function will return the attribute in the certificate request specified
+by the given Object ID. The attribute will be DER encoded.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_set_dn_by_oid
+@anchor{gnutls_x509_crq_set_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crq_set_dn_by_oid} (gnutls_x509_crq_t @var{crq}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{data}, unsigned int @var{sizeof_data})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{oid}: holds an Object Identifier in a null terminated string
+
+@var{raw_flag}: must be 0, or 1 if the data are DER encoded
+
+@var{data}: a pointer to the input data
+
+@var{sizeof_data}: holds the size of @code{data}
+
+This function will set the part of the name of the Certificate request subject, specified
+by the given OID. The input string should be ASCII or UTF-8 encoded.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+With this function you can only set the known OIDs. You can test
+for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
+not known (by gnutls) you should properly DER encode your data, and
+call this function with raw_flag set.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_set_version
+@anchor{gnutls_x509_crq_set_version}
+@deftypefun {int} {gnutls_x509_crq_set_version} (gnutls_x509_crq_t @var{crq}, unsigned int @var{version})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{version}: holds the version number. For v1 Requests must be 1.
+
+This function will set the version of the certificate request. For
+version 1 requests this must be one.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_version
+@anchor{gnutls_x509_crq_get_version}
+@deftypefun {int} {gnutls_x509_crq_get_version} (gnutls_x509_crq_t @var{crq})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+This function will return the version of the specified Certificate request.
+
+Returns a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_crq_set_key
+@anchor{gnutls_x509_crq_set_key}
+@deftypefun {int} {gnutls_x509_crq_set_key} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{key}: holds a private key
+
+This function will set the public parameters from the given private key to the
+request. Only RSA keys are currently supported.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_set_challenge_password
+@anchor{gnutls_x509_crq_set_challenge_password}
+@deftypefun {int} {gnutls_x509_crq_set_challenge_password} (gnutls_x509_crq_t @var{crq}, const char * @var{pass})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{pass}: holds a null terminated password
+
+This function will set a challenge password to be used when revoking the request.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_sign2
+@anchor{gnutls_x509_crq_sign2}
+@deftypefun {int} {gnutls_x509_crq_sign2} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{key}: holds a private key
+
+@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+
+@var{flags}: must be 0
+
+This function will sign the certificate request with a private key.
+This must be the same key as the one used in @code{gnutls_x509_crt_set_key()} since a
+certificate request is self signed.
+
+This must be the last step in a certificate request generation since all
+the previously set parameters are now signed.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_sign
+@anchor{gnutls_x509_crq_sign}
+@deftypefun {int} {gnutls_x509_crq_sign} (gnutls_x509_crq_t @var{crq}, gnutls_x509_privkey_t @var{key})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{key}: holds a private key
+
+This function is the same a @code{gnutls_x509_crq_sign2()} with no flags, and
+SHA1 as the hash algorithm.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_export
+@anchor{gnutls_x509_crq_export}
+@deftypefun {int} {gnutls_x509_crq_export} (gnutls_x509_crq_t @var{crq}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{crq}: Holds the request
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a certificate request PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the certificate request to a PKCS10
+
+If the buffer provided is not long enough to hold the output, then
+GNUTLS_E_SHORT_MEMORY_BUFFER will be returned and
+*output_data_size will be updated.
+
+If the structure is PEM encoded, it will have a header of "BEGIN
+NEW CERTIFICATE REQUEST".
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crq_get_pk_algorithm
+@anchor{gnutls_x509_crq_get_pk_algorithm}
+@deftypefun {int} {gnutls_x509_crq_get_pk_algorithm} (gnutls_x509_crq_t @var{crq}, unsigned int * @var{bits})
+@var{crq}: should contain a gnutls_x509_crq_t structure
+
+@var{bits}: if bits is non null it will hold the size of the parameters' in bits
+
+This function will return the public key algorithm of a PKCS \@code{10} 
+certificate request.
+
+If bits is non null, it should have enough size to hold the parameters
+size in bits. For RSA the bits returned is the modulus. 
+For DSA the bits returned are of the public
+exponent.
+
+Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_export_pkcs8
+@anchor{gnutls_x509_privkey_export_pkcs8}
+@deftypefun {int} {gnutls_x509_privkey_export_pkcs8} (gnutls_x509_privkey_t @var{key}, gnutls_x509_crt_fmt_t @var{format}, const char * @var{password}, unsigned int @var{flags}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{key}: Holds the key
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{password}: the password that will be used to encrypt the key. 
+
+@var{flags}: an ORed sequence of gnutls_pkcs_encrypt_flags_t
+
+@var{output_data}: will contain a private key PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the private key to a PKCS8 structure.
+Both RSA and DSA keys can be exported. For DSA keys we use
+PKCS @code{11} definitions. If the flags do not specify the encryption 
+cipher, then the default 3DES (PBES2) will be used.
+
+The @code{password} can be either ASCII or UTF-8 in the default PBES2
+encryption schemas, or ASCII for the PKCS12 schemas.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN ENCRYPTED PRIVATE KEY" or "BEGIN PRIVATE KEY" if
+encryption is not used.
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_privkey_import_pkcs8
+@anchor{gnutls_x509_privkey_import_pkcs8}
+@deftypefun {int} {gnutls_x509_privkey_import_pkcs8} (gnutls_x509_privkey_t @var{key}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, const char * @var{password}, unsigned int @var{flags})
+@var{key}: The structure to store the parsed key
+
+@var{data}: The DER or PEM encoded key.
+
+@var{format}: One of DER or PEM
+
+@var{password}: the password to decrypt the key (if it is encrypted).
+
+@var{flags}: 0 if encrypted or GNUTLS_PKCS_PLAIN if not encrypted.
+
+This function will convert the given DER or PEM encoded PKCS8 2.0 encrypted key
+to the native gnutls_x509_privkey_t format. The output will be stored in @code{key}.
+Both RSA and DSA keys can be imported, and flags can only be used to indicate
+an unencrypted key.
+
+The @code{password} can be either ASCII or UTF-8 in the default PBES2
+encryption schemas, or ASCII for the PKCS12 schemas.
+
+If the Certificate is PEM encoded it should have a header of "ENCRYPTED PRIVATE KEY",
+or "PRIVATE KEY". You only need to specify the flags if the key is DER encoded, since
+in that case the encryption status cannot be auto-detected.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_init
+@anchor{gnutls_pkcs12_init}
+@deftypefun {int} {gnutls_pkcs12_init} (gnutls_pkcs12_t * @var{pkcs12})
+@var{pkcs12}: The structure to be initialized
+
+This function will initialize a PKCS12 structure. PKCS12 structures
+usually contain lists of X.509 Certificates and X.509 Certificate
+revocation lists.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_deinit
+@anchor{gnutls_pkcs12_deinit}
+@deftypefun {void} {gnutls_pkcs12_deinit} (gnutls_pkcs12_t @var{pkcs12})
+@var{pkcs12}: The structure to be initialized
+
+This function will deinitialize a PKCS12 structure. 
+@end deftypefun
+
+@subheading gnutls_pkcs12_import
+@anchor{gnutls_pkcs12_import}
+@deftypefun {int} {gnutls_pkcs12_import} (gnutls_pkcs12_t @var{pkcs12}, const gnutls_datum_t * @var{data}, gnutls_x509_crt_fmt_t @var{format}, unsigned int @var{flags})
+@var{pkcs12}: The structure to store the parsed PKCS12.
+
+@var{data}: The DER or PEM encoded PKCS12.
+
+@var{format}: One of DER or PEM
+
+@var{flags}: an ORed sequence of gnutls_privkey_pkcs8_flags
+
+This function will convert the given DER or PEM encoded PKCS12
+to the native gnutls_pkcs12_t format. The output will be stored in 'pkcs12'.
+
+If the PKCS12 is PEM encoded it should have a header of "PKCS12".
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_export
+@anchor{gnutls_pkcs12_export}
+@deftypefun {int} {gnutls_pkcs12_export} (gnutls_pkcs12_t @var{pkcs12}, gnutls_x509_crt_fmt_t @var{format}, void * @var{output_data}, size_t * @var{output_data_size})
+@var{pkcs12}: Holds the pkcs12 structure
+
+@var{format}: the format of output params. One of PEM or DER.
+
+@var{output_data}: will contain a structure PEM or DER encoded
+
+@var{output_data_size}: holds the size of output_data (and will be
+replaced by the actual size of parameters)
+
+This function will export the pkcs12 structure to DER or PEM format.
+
+If the buffer provided is not long enough to hold the output, then
+*output_data_size will be updated and GNUTLS_E_SHORT_MEMORY_BUFFER
+will be returned.
+
+If the structure is PEM encoded, it will have a header
+of "BEGIN PKCS12".
+
+@strong{Return value:} In case of failure a negative value will be
+returned, and 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_get_bag
+@anchor{gnutls_pkcs12_get_bag}
+@deftypefun {int} {gnutls_pkcs12_get_bag} (gnutls_pkcs12_t @var{pkcs12}, int @var{indx}, gnutls_pkcs12_bag_t @var{bag})
+@var{pkcs12}: should contain a gnutls_pkcs12_t structure
+
+@var{indx}: contains the index of the bag to extract
+
+@var{bag}: An initialized bag, where the contents of the bag will be copied
+
+This function will return a Bag from the PKCS12 structure.
+Returns 0 on success.
+
+After the last Bag has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+will be returned.
+@end deftypefun
+
+@subheading gnutls_pkcs12_set_bag
+@anchor{gnutls_pkcs12_set_bag}
+@deftypefun {int} {gnutls_pkcs12_set_bag} (gnutls_pkcs12_t @var{pkcs12}, gnutls_pkcs12_bag_t @var{bag})
+@var{pkcs12}: should contain a gnutls_pkcs12_t structure
+
+@var{bag}: An initialized bag
+
+This function will insert a Bag into the PKCS12 structure.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_generate_mac
+@anchor{gnutls_pkcs12_generate_mac}
+@deftypefun {int} {gnutls_pkcs12_generate_mac} (gnutls_pkcs12_t @var{pkcs12}, const char * @var{pass})
+@var{pkcs12}: should contain a gnutls_pkcs12_t structure
+
+@var{pass}: The password for the MAC
+
+This function will generate a MAC for the PKCS12 structure.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_verify_mac
+@anchor{gnutls_pkcs12_verify_mac}
+@deftypefun {int} {gnutls_pkcs12_verify_mac} (gnutls_pkcs12_t @var{pkcs12}, const char * @var{pass})
+@var{pkcs12}: should contain a gnutls_pkcs12_t structure
+
+@var{pass}: The password for the MAC
+
+This function will verify the MAC for the PKCS12 structure.
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_init
+@anchor{gnutls_pkcs12_bag_init}
+@deftypefun {int} {gnutls_pkcs12_bag_init} (gnutls_pkcs12_bag_t * @var{bag})
+@var{bag}: The structure to be initialized
+
+This function will initialize a PKCS12 bag structure. PKCS12 Bags
+usually contain private keys, lists of X.509 Certificates and X.509 Certificate
+revocation lists.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_deinit
+@anchor{gnutls_pkcs12_bag_deinit}
+@deftypefun {void} {gnutls_pkcs12_bag_deinit} (gnutls_pkcs12_bag_t @var{bag})
+@var{bag}: The structure to be initialized
+
+This function will deinitialize a PKCS12 Bag structure. 
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_get_type
+@anchor{gnutls_pkcs12_bag_get_type}
+@deftypefun {gnutls_pkcs12_bag_type_t} {gnutls_pkcs12_bag_get_type} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx})
+@var{bag}: The bag
+
+@var{indx}: The element of the bag to get the type
+
+This function will return the bag's type. One of the gnutls_pkcs12_bag_type_t
+enumerations.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_get_count
+@anchor{gnutls_pkcs12_bag_get_count}
+@deftypefun {int} {gnutls_pkcs12_bag_get_count} (gnutls_pkcs12_bag_t @var{bag})
+@var{bag}: The bag
+
+This function will return the number of the elements withing the bag. 
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_get_data
+@anchor{gnutls_pkcs12_bag_get_data}
+@deftypefun {int} {gnutls_pkcs12_bag_get_data} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, gnutls_datum_t * @var{data})
+@var{bag}: The bag
+
+@var{indx}: The element of the bag to get the data from
+
+@var{data}: where the bag's data will be. Should be treated as constant.
+
+This function will return the bag's data. The data is a constant
+that is stored into the bag. Should not be accessed after the bag
+is deleted.
+
+Returns 0 on success and a negative error code on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_set_data
+@anchor{gnutls_pkcs12_bag_set_data}
+@deftypefun {int} {gnutls_pkcs12_bag_set_data} (gnutls_pkcs12_bag_t @var{bag}, gnutls_pkcs12_bag_type_t @var{type}, const gnutls_datum_t * @var{data})
+@var{bag}: The bag
+
+@var{type}: The data's type
+
+@var{data}: the data to be copied.
+
+This function will insert the given data of the given type into the
+bag. 
+
+Returns the index of the added bag on success, or a negative
+value on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_set_crt
+@anchor{gnutls_pkcs12_bag_set_crt}
+@deftypefun {int} {gnutls_pkcs12_bag_set_crt} (gnutls_pkcs12_bag_t @var{bag}, gnutls_x509_crt_t @var{crt})
+@var{bag}: The bag
+
+@var{crt}: the certificate to be copied.
+
+This function will insert the given certificate into the
+bag. This is just a wrapper over @code{gnutls_pkcs12_bag_set_data()}.
+
+Returns the index of the added bag on success, or a negative
+value on failure.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_set_crl
+@anchor{gnutls_pkcs12_bag_set_crl}
+@deftypefun {int} {gnutls_pkcs12_bag_set_crl} (gnutls_pkcs12_bag_t @var{bag}, gnutls_x509_crl_t @var{crl})
+@var{bag}: The bag
+
+@var{crl}: the CRL to be copied.
+
+This function will insert the given CRL into the
+bag. This is just a wrapper over @code{gnutls_pkcs12_bag_set_data()}.
+
+Returns the index of the added bag on success, or a negative
+value on failure.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_set_key_id
+@anchor{gnutls_pkcs12_bag_set_key_id}
+@deftypefun {int} {gnutls_pkcs12_bag_set_key_id} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, const gnutls_datum_t * @var{id})
+@var{bag}: The bag
+
+@var{indx}: The bag's element to add the id
+
+@var{id}: the ID
+
+This function will add the given key ID, to the specified, by the index, bag
+element. The key ID will be encoded as a 'Local key identifier' bag attribute,
+which is usually used to distinguish the local private key and the certificate pair.
+
+Returns 0 on success, or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_get_key_id
+@anchor{gnutls_pkcs12_bag_get_key_id}
+@deftypefun {int} {gnutls_pkcs12_bag_get_key_id} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, gnutls_datum_t * @var{id})
+@var{bag}: The bag
+
+@var{indx}: The bag's element to add the id
+
+@var{id}: where the ID will be copied (to be treated as const)
+
+This function will return the key ID, of the specified bag element.
+The key ID is usually used to distinguish the local private key and the certificate pair.
+
+Returns 0 on success, or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_get_friendly_name
+@anchor{gnutls_pkcs12_bag_get_friendly_name}
+@deftypefun {int} {gnutls_pkcs12_bag_get_friendly_name} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, char ** @var{name})
+@var{bag}: The bag
+
+@var{indx}: The bag's element to add the id
+
+@var{name}: will hold a pointer to the name (to be treated as const)
+
+This function will return the friendly name, of the specified bag element.
+The key ID is usually used to distinguish the local private key and the certificate pair.
+
+Returns 0 on success, or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_set_friendly_name
+@anchor{gnutls_pkcs12_bag_set_friendly_name}
+@deftypefun {int} {gnutls_pkcs12_bag_set_friendly_name} (gnutls_pkcs12_bag_t @var{bag}, int @var{indx}, const char * @var{name})
+@var{bag}: The bag
+
+@var{indx}: The bag's element to add the id
+
+@var{name}: the name
+
+This function will add the given key friendly name, to the specified, by the index, bag
+element. The name will be encoded as a 'Friendly name' bag attribute,
+which is usually used to set a user name to the local private key and the certificate pair.
+
+Returns 0 on success, or a negative value on error.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_decrypt
+@anchor{gnutls_pkcs12_bag_decrypt}
+@deftypefun {int} {gnutls_pkcs12_bag_decrypt} (gnutls_pkcs12_bag_t @var{bag}, const char * @var{pass})
+@var{bag}: The bag
+
+@var{pass}: The password used for encryption. This can only be ASCII.
+
+This function will decrypt the given encrypted bag and return 0 on success.
+@end deftypefun
+
+@subheading gnutls_pkcs12_bag_encrypt
+@anchor{gnutls_pkcs12_bag_encrypt}
+@deftypefun {int} {gnutls_pkcs12_bag_encrypt} (gnutls_pkcs12_bag_t @var{bag}, const char * @var{pass}, unsigned int @var{flags})
+@var{bag}: The bag
+
+@var{pass}: The password used for encryption. This can only be ASCII.
+
+@var{flags}: should be one of gnutls_pkcs_encrypt_flags_t elements bitwise or'd
+
+This function will encrypt the given bag and return 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_dn_by_oid
+@anchor{gnutls_x509_crt_set_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crt_set_dn_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identifier in a null terminated string
+
+@var{raw_flag}: must be 0, or 1 if the data are DER encoded
+
+@var{name}: a pointer to the name
+
+@var{sizeof_name}: holds the size of @code{name}
+
+This function will set the part of the name of the Certificate subject, specified
+by the given OID. The input string should be ASCII or UTF-8 encoded.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+With this function you can only set the known OIDs. You can test
+for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
+not known (by gnutls) you should properly DER encode your data, and
+call this function with raw_flag set.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_issuer_dn_by_oid
+@anchor{gnutls_x509_crt_set_issuer_dn_by_oid}
+@deftypefun {int} {gnutls_x509_crt_set_issuer_dn_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identifier in a null terminated string
+
+@var{raw_flag}: must be 0, or 1 if the data are DER encoded
+
+@var{name}: a pointer to the name
+
+@var{sizeof_name}: holds the size of @code{name}
+
+This function will set the part of the name of the Certificate issuer, specified
+by the given OID. The input string should be ASCII or UTF-8 encoded.
+
+Some helper macros with popular OIDs can be found in gnutls/x509.h
+With this function you can only set the known OIDs. You can test
+for known OIDs using @code{gnutls_x509_dn_oid_known()}. For OIDs that are
+not known (by gnutls) you should properly DER encode your data, and
+call this function with raw_flag set.
+
+Normally you do not need to call this function, since the signing
+operation will copy the signer's name as the issuer of the certificate.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_proxy_dn
+@anchor{gnutls_x509_crt_set_proxy_dn}
+@deftypefun {int} {gnutls_x509_crt_set_proxy_dn} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{eecrt}, unsigned int @var{raw_flag}, const void * @var{name}, unsigned int @var{sizeof_name})
+@var{crt}: a gnutls_x509_crt_t structure with the new proxy cert
+
+@var{eecrt}: the end entity certificate that will be issuing the proxy
+
+@var{raw_flag}: must be 0, or 1 if the CN is DER encoded
+
+@var{name}: a pointer to the CN name, may be NULL (but MUST then be added later)
+
+@var{sizeof_name}: holds the size of @code{name}
+
+This function will set the subject in @code{crt} to the end entity's
+@code{eecrt} subject name, and add a single Common Name component @code{name}
+of size @code{sizeof_name}.  This corresponds to the required proxy
+certificate naming style.  Note that if @code{name} is @code{NULL}, you MUST
+set it later by using @code{gnutls_x509_crt_set_dn_by_oid()} or similar.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_version
+@anchor{gnutls_x509_crt_set_version}
+@deftypefun {int} {gnutls_x509_crt_set_version} (gnutls_x509_crt_t @var{crt}, unsigned int @var{version})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{version}: holds the version number. For X.509v1 certificates must be 1.
+
+This function will set the version of the certificate.  This must
+be one for X.509 version 1, and so on.  Plain certificates without
+extensions must have version set to one.
+
+To create well-formed certificates, you must specify version 3 if
+you use any certificate extensions.  Extensions are created by
+functions such as gnutls_x509_crt_set_subject_alternative_name or
+gnutls_x509_crt_set_key_usage.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_key
+@anchor{gnutls_x509_crt_set_key}
+@deftypefun {int} {gnutls_x509_crt_set_key} (gnutls_x509_crt_t @var{crt}, gnutls_x509_privkey_t @var{key})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{key}: holds a private key
+
+This function will set the public parameters from the given private key to the
+certificate. Only RSA keys are currently supported.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_crq
+@anchor{gnutls_x509_crt_set_crq}
+@deftypefun {int} {gnutls_x509_crt_set_crq} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crq_t @var{crq})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{crq}: holds a certificate request
+
+This function will set the name and public parameters from the given certificate request to the
+certificate. Only RSA keys are currently supported.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_extension_by_oid
+@anchor{gnutls_x509_crt_set_extension_by_oid}
+@deftypefun {int} {gnutls_x509_crt_set_extension_by_oid} (gnutls_x509_crt_t @var{crt}, const char * @var{oid}, const void * @var{buf}, size_t @var{sizeof_buf}, unsigned int @var{critical})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: holds an Object Identified in null terminated string
+
+@var{buf}: a pointer to a DER encoded data
+
+@var{sizeof_buf}: holds the size of @code{buf}
+
+@var{critical}: should be non zero if the extension is to be marked as critical
+
+This function will set an the extension, by the specified OID, in the certificate.
+The extension data should be binary data DER encoded.
+
+Returns 0 on success and a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_basic_constraints
+@anchor{gnutls_x509_crt_set_basic_constraints}
+@deftypefun {int} {gnutls_x509_crt_set_basic_constraints} (gnutls_x509_crt_t @var{crt}, unsigned int @var{ca}, int @var{pathLenConstraint})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{ca}: true(1) or false(0). Depending on the Certificate authority status.
+
+@var{pathLenConstraint}: non-negative values indicate maximum length of path,
+and negative values indicate that the pathLenConstraints field should
+not be present.
+
+This function will set the basicConstraints certificate extension.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_ca_status
+@anchor{gnutls_x509_crt_set_ca_status}
+@deftypefun {int} {gnutls_x509_crt_set_ca_status} (gnutls_x509_crt_t @var{crt}, unsigned int @var{ca})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{ca}: true(1) or false(0). Depending on the Certificate authority status.
+
+This function will set the basicConstraints certificate extension.
+Use @code{gnutls_x509_crt_set_basic_constraints()} if you want to control
+the pathLenConstraint field too.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_key_usage
+@anchor{gnutls_x509_crt_set_key_usage}
+@deftypefun {int} {gnutls_x509_crt_set_key_usage} (gnutls_x509_crt_t @var{crt}, unsigned int @var{usage})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{usage}: an ORed sequence of the GNUTLS_KEY_* elements.
+
+This function will set the keyUsage certificate extension. 
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_subject_alternative_name
+@anchor{gnutls_x509_crt_set_subject_alternative_name}
+@deftypefun {int} {gnutls_x509_crt_set_subject_alternative_name} (gnutls_x509_crt_t @var{crt}, gnutls_x509_subject_alt_name_t            @var{type}, const char * @var{data_string})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{type}: is one of the gnutls_x509_subject_alt_name_t enumerations
+
+@var{data_string}: The data to be set
+
+This function will set the subject alternative name certificate extension. 
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_proxy
+@anchor{gnutls_x509_crt_set_proxy}
+@deftypefun {int} {gnutls_x509_crt_set_proxy} (gnutls_x509_crt_t @var{crt}, int @var{pathLenConstraint}, const char * @var{policyLanguage}, const char * @var{policy}, size_t @var{sizeof_policy})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{pathLenConstraint}: non-negative values indicate maximum length of path,
+and negative values indicate that the pathLenConstraints field should
+not be present.
+
+@var{policyLanguage}: OID describing the language of @code{policy}.
+
+@var{policy}: opaque byte array with policy language, can be @code{NULL} 
+
+@var{sizeof_policy}: size of @code{policy}.
+
+This function will set the proxyCertInfo extension.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_sign2
+@anchor{gnutls_x509_crt_sign2}
+@deftypefun {int} {gnutls_x509_crt_sign2} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{issuer}: is the certificate of the certificate issuer
+
+@var{issuer_key}: holds the issuer's private key
+
+@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+
+@var{flags}: must be 0
+
+This function will sign the certificate with the issuer's private key, and
+will copy the issuer's information into the certificate.
+
+This must be the last step in a certificate generation since all
+the previously set parameters are now signed.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_sign
+@anchor{gnutls_x509_crt_sign}
+@deftypefun {int} {gnutls_x509_crt_sign} (gnutls_x509_crt_t @var{crt}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{issuer}: is the certificate of the certificate issuer
+
+@var{issuer_key}: holds the issuer's private key
+
+This function is the same a @code{gnutls_x509_crt_sign2()} with no flags, and
+SHA1 as the hash algorithm.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_activation_time
+@anchor{gnutls_x509_crt_set_activation_time}
+@deftypefun {int} {gnutls_x509_crt_set_activation_time} (gnutls_x509_crt_t @var{cert}, time_t @var{act_time})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{act_time}: The actual time
+
+This function will set the time this Certificate was or will be activated.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_expiration_time
+@anchor{gnutls_x509_crt_set_expiration_time}
+@deftypefun {int} {gnutls_x509_crt_set_expiration_time} (gnutls_x509_crt_t @var{cert}, time_t @var{exp_time})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{exp_time}: The actual time
+
+This function will set the time this Certificate will expire.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_serial
+@anchor{gnutls_x509_crt_set_serial}
+@deftypefun {int} {gnutls_x509_crt_set_serial} (gnutls_x509_crt_t @var{cert}, const void * @var{serial}, size_t @var{serial_size})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{serial}: The serial number
+
+@var{serial_size}: Holds the size of the serial field.
+
+This function will set the X.509 certificate's serial number. 
+Serial is not always a 32 or 64bit number. Some CAs use
+large serial numbers, thus it may be wise to handle it as something
+opaque. 
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_crl_dist_points
+@anchor{gnutls_x509_crt_set_crl_dist_points}
+@deftypefun {int} {gnutls_x509_crt_set_crl_dist_points} (gnutls_x509_crt_t @var{crt}, gnutls_x509_subject_alt_name_t          @var{type}, const void * @var{data_string}, unsigned int @var{reason_flags})
+@var{crt}: should contain a gnutls_x509_crt_t structure
+
+@var{type}: is one of the gnutls_x509_subject_alt_name_t enumerations
+
+@var{data_string}: The data to be set
+
+@var{reason_flags}: revocation reasons
+
+This function will set the CRL distribution points certificate extension. 
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_cpy_crl_dist_points
+@anchor{gnutls_x509_crt_cpy_crl_dist_points}
+@deftypefun {int} {gnutls_x509_crt_cpy_crl_dist_points} (gnutls_x509_crt_t @var{dst}, gnutls_x509_crt_t @var{src})
+@var{dst}: should contain a gnutls_x509_crt_t structure
+
+@var{src}: the certificate where the dist points will be copied from
+
+This function will copy the CRL distribution points certificate 
+extension, from the source to the destination certificate.
+This may be useful to copy from a CA certificate to issued ones.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_subject_key_id
+@anchor{gnutls_x509_crt_set_subject_key_id}
+@deftypefun {int} {gnutls_x509_crt_set_subject_key_id} (gnutls_x509_crt_t @var{cert}, const void * @var{id}, size_t @var{id_size})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{id}: The key ID
+
+@var{id_size}: Holds the size of the serial field.
+
+This function will set the X.509 certificate's subject key ID extension.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_authority_key_id
+@anchor{gnutls_x509_crt_set_authority_key_id}
+@deftypefun {int} {gnutls_x509_crt_set_authority_key_id} (gnutls_x509_crt_t @var{cert}, const void * @var{id}, size_t @var{id_size})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{id}: The key ID
+
+@var{id_size}: Holds the size of the serial field.
+
+This function will set the X.509 certificate's authority key ID extension.
+Only the keyIdentifier field can be set with this function.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_set_key_purpose_oid
+@anchor{gnutls_x509_crt_set_key_purpose_oid}
+@deftypefun {int} {gnutls_x509_crt_set_key_purpose_oid} (gnutls_x509_crt_t @var{cert}, const void * @var{oid}, unsigned int @var{critical})
+@var{cert}: should contain a gnutls_x509_crt_t structure
+
+@var{oid}: a pointer to a null terminated string that holds the OID
+
+@var{critical}: Whether this extension will be critical or not
+
+This function will set the key purpose OIDs of the Certificate.
+These are stored in the Extended Key Usage extension (2.5.29.37)
+See the GNUTLS_KP_* definitions for human readable names.
+
+Subsequent calls to this function will append OIDs to the OID list.
+
+On success 0 is returned.
+@end deftypefun
+
+@subheading gnutls_x509_crl_set_version
+@anchor{gnutls_x509_crl_set_version}
+@deftypefun {int} {gnutls_x509_crl_set_version} (gnutls_x509_crl_t @var{crl}, unsigned int @var{version})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{version}: holds the version number. For CRLv1 crls must be 1.
+
+This function will set the version of the CRL. This
+must be one for CRL version 1, and so on. The CRLs generated
+by gnutls should have a version number of 2.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_sign2
+@anchor{gnutls_x509_crl_sign2}
+@deftypefun {int} {gnutls_x509_crl_sign2} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key}, gnutls_digest_algorithm_t @var{dig}, unsigned int @var{flags})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{issuer}: is the certificate of the certificate issuer
+
+@var{issuer_key}: holds the issuer's private key
+
+@var{dig}: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+
+@var{flags}: must be 0
+
+This function will sign the CRL with the issuer's private key, and
+will copy the issuer's information into the CRL.
+
+This must be the last step in a certificate CRL since all
+the previously set parameters are now signed.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_sign
+@anchor{gnutls_x509_crl_sign}
+@deftypefun {int} {gnutls_x509_crl_sign} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{issuer}, gnutls_x509_privkey_t @var{issuer_key})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{issuer}: is the certificate of the certificate issuer
+
+@var{issuer_key}: holds the issuer's private key
+
+This function is the same a @code{gnutls_x509_crl_sign2()} with no flags, and
+SHA1 as the hash algorithm.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_set_this_update
+@anchor{gnutls_x509_crl_set_this_update}
+@deftypefun {int} {gnutls_x509_crl_set_this_update} (gnutls_x509_crl_t @var{crl}, time_t @var{act_time})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{act_time}: The actual time
+
+This function will set the time this CRL was issued.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_set_next_update
+@anchor{gnutls_x509_crl_set_next_update}
+@deftypefun {int} {gnutls_x509_crl_set_next_update} (gnutls_x509_crl_t @var{crl}, time_t @var{exp_time})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{exp_time}: The actual time
+
+This function will set the time this CRL will be updated.
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_set_crt_serial
+@anchor{gnutls_x509_crl_set_crt_serial}
+@deftypefun {int} {gnutls_x509_crl_set_crt_serial} (gnutls_x509_crl_t @var{crl}, const void * @var{serial}, size_t @var{serial_size}, time_t @var{revocation_time})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{serial}: The revoked certificate's serial number
+
+@var{serial_size}: Holds the size of the serial field.
+
+@var{revocation_time}: The time this certificate was revoked
+
+This function will set a revoked certificate's serial number to the CRL. 
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crl_set_crt
+@anchor{gnutls_x509_crl_set_crt}
+@deftypefun {int} {gnutls_x509_crl_set_crt} (gnutls_x509_crl_t @var{crl}, gnutls_x509_crt_t @var{crt}, time_t @var{revocation_time})
+@var{crl}: should contain a gnutls_x509_crl_t structure
+
+@var{crt}: should contain a gnutls_x509_crt_t structure with the revoked certificate
+
+@var{revocation_time}: The time this certificate was revoked
+
+This function will set a revoked certificate's serial number to the CRL. 
+
+Returns 0 on success, or a negative value in case of an error.
+@end deftypefun
+
+@subheading gnutls_x509_crt_print
+@anchor{gnutls_x509_crt_print}
+@deftypefun {int} {gnutls_x509_crt_print} (gnutls_x509_crt_t @var{cert}, gnutls_certificate_print_formats_t @var{format}, gnutls_datum_t * @var{out})
+@var{cert}: The structure to be printed
+
+@var{format}: Indicate the format to use
+
+@var{out}: Newly allocated datum with zero terminated string.
+
+This function will pretty print a X.509 certificate, suitable for
+display to a human.
+
+If the format is @code{GNUTLS_X509_CRT_FULL} then all fields of the
+certificate will be output, on multiple lines.  The
+@code{GNUTLS_X509_CRT_ONELINE} format will generate one line with some
+selected fields, which is useful for logging purposes.
+
+The output @code{out} needs to be deallocate using @code{gnutls_free()}.
+
+Returns 0 on success.
+@end deftypefun
+
+@subheading gnutls_x509_crl_print
+@anchor{gnutls_x509_crl_print}
+@deftypefun {int} {gnutls_x509_crl_print} (gnutls_x509_crl_t @var{crl}, gnutls_certificate_print_formats_t @var{format}, gnutls_datum_t * @var{out})
+@var{crl}: The structure to be printed
+
+@var{format}: Indicate the format to use
+
+@var{out}: Newly allocated datum with zero terminated string.
+
+This function will pretty print a X.509 certificate revocation
+list, suitable for display to a human.
+
+The output @code{out} needs to be deallocate using @code{gnutls_free()}.
+
+Returns 0 on success.
+@end deftypefun
+
diff --git a/src/daemon/https/x509/x509.c b/src/daemon/https/x509/x509.c
new file mode 100644
index 00000000..96999d27
--- /dev/null
+++ b/src/daemon/https/x509/x509.c
@@ -0,0 +1,2851 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ * Author: Nikos Mavrogiannopoulos, Simon Josefsson, Howard Chu
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions on X.509 Certificate parsing
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <x509.h>
+#include <dn.h>
+#include <extensions.h>
+#include <libtasn1.h>
+#include <mpi.h>
+#include <privkey.h>
+#include <verify.h>
+
+/**
+ * gnutls_x509_crt_init - This function initializes a gnutls_x509_crt_t structure
+ * @cert: The structure to be initialized
+ *
+ * This function will initialize an X.509 certificate structure.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_init (gnutls_x509_crt_t * cert)
+{
+  gnutls_x509_crt_t tmp = gnutls_calloc (1, sizeof (gnutls_x509_crt_int));
+  int result;
+
+  if (!tmp)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  result = asn1_create_element (_gnutls_get_pkix (),
+                                "PKIX1.Certificate", &tmp->cert);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_free (tmp);
+      return _gnutls_asn2err (result);
+    }
+
+  *cert = tmp;
+
+  return 0;                     /* success */
+}
+
+/*-
+ * _gnutls_x509_crt_cpy - This function copies a gnutls_x509_crt_t structure
+ * @dest: The structure where to copy
+ * @src: The structure to be copied
+ *
+ * This function will copy an X.509 certificate structure. 
+ *
+ * Returns 0 on success.
+ *
+ -*/
+int
+_gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
+{
+  int ret;
+  size_t der_size;
+  opaque *der;
+  gnutls_datum_t tmp;
+
+  ret = gnutls_x509_crt_export (src, GNUTLS_X509_FMT_DER, NULL, &der_size);
+  if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  der = gnutls_alloca (der_size);
+  if (der == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  ret = gnutls_x509_crt_export (src, GNUTLS_X509_FMT_DER, der, &der_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (der);
+      return ret;
+    }
+
+  tmp.data = der;
+  tmp.size = der_size;
+  ret = gnutls_x509_crt_import (dest, &tmp, GNUTLS_X509_FMT_DER);
+
+  gnutls_afree (der);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_deinit - This function deinitializes memory used by a gnutls_x509_crt_t structure
+ * @cert: The structure to be initialized
+ *
+ * This function will deinitialize a CRL structure. 
+ *
+ **/
+void
+gnutls_x509_crt_deinit (gnutls_x509_crt_t cert)
+{
+  if (!cert)
+    return;
+
+  if (cert->cert)
+    asn1_delete_structure (&cert->cert);
+
+  gnutls_free (cert);
+}
+
+/**
+ * gnutls_x509_crt_import - This function will import a DER or PEM encoded Certificate
+ * @cert: The structure to store the parsed certificate.
+ * @data: The DER or PEM encoded certificate.
+ * @format: One of DER or PEM
+ *
+ * This function will convert the given DER or PEM encoded Certificate
+ * to the native gnutls_x509_crt_t format. The output will be stored in @cert.
+ *
+ * If the Certificate is PEM encoded it should have a header of "X509 CERTIFICATE", or
+ * "CERTIFICATE".
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_import (gnutls_x509_crt_t cert,
+                        const gnutls_datum_t * data,
+                        gnutls_x509_crt_fmt_t format)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+  opaque *signature = NULL;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  /* If the Certificate is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      /* Try the first header */
+      result = _gnutls_fbase64_decode (PEM_X509_CERT2, data->data, data->size,
+                                       &out);
+
+      if (result <= 0)
+        {
+          /* try for the second header */
+          result = _gnutls_fbase64_decode (PEM_X509_CERT, data->data,
+                                           data->size, &out);
+
+          if (result <= 0)
+            {
+              if (result == 0)
+                result = GNUTLS_E_INTERNAL_ERROR;
+              gnutls_assert ();
+              return result;
+            }
+        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+  result = asn1_der_decoding (&cert->cert, _data.data, _data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err (result);
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* Since we do not want to disable any extension
+   */
+  cert->use_extensions = 1;
+  if (need_free)
+    _gnutls_free_datum (&_data);
+
+  return 0;
+
+cleanup:gnutls_free (signature);
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_get_issuer_dn - This function returns the Certificate's issuer distinguished name
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @buf: a pointer to a structure to hold the name (may be null)
+ * @sizeof_buf: initially holds the size of @buf
+ *
+ * This function will copy the name of the Certificate issuer in the
+ * provided buffer. The name will be in the form
+ * "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+ * will be ASCII or UTF-8 encoded, depending on the certificate data.
+ *
+ * If @buf is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_buf will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_issuer_dn (gnutls_x509_crt_t cert,
+                               char *buf, size_t * sizeof_buf)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn (cert->cert,
+                                "tbsCertificate.issuer.rdnSequence", buf,
+                                sizeof_buf);
+}
+
+/**
+ * gnutls_x509_crt_get_issuer_dn_by_oid - This function returns the Certificate's issuer distinguished name
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @oid: holds an Object Identified in null terminated string
+ * @indx: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+ * @raw_flag: If non zero returns the raw DER data of the DN part.
+ * @buf: a pointer to a structure to hold the name (may be null)
+ * @sizeof_buf: initially holds the size of @buf
+ *
+ * This function will extract the part of the name of the Certificate
+ * issuer specified by the given OID. The output, if the raw flag is not
+ * used, will be encoded as described in RFC2253. Thus a string that is
+ * ASCII or UTF-8 encoded, depending on the certificate data.
+ *
+ * Some helper macros with popular OIDs can be found in gnutls/x509.h
+ * If raw flag is zero, this function will only return known OIDs as
+ * text. Other OIDs will be DER encoded, as described in RFC2253 --
+ * in hex format with a '\#' prefix.  You can check about known OIDs
+ * using gnutls_x509_dn_oid_known().
+ *
+ * If @buf is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_buf will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_issuer_dn_by_oid (gnutls_x509_crt_t cert,
+                                      const char *oid,
+                                      int indx,
+                                      unsigned int raw_flag,
+                                      void *buf, size_t * sizeof_buf)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn_oid (cert->cert,
+                                    "tbsCertificate.issuer.rdnSequence", oid,
+                                    indx, raw_flag, buf, sizeof_buf);
+}
+
+/**
+ * gnutls_x509_crt_get_issuer_dn_oid - This function returns the Certificate's issuer distinguished name OIDs
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: This specifies which OID to return. Use zero to get the first one.
+ * @oid: a pointer to a buffer to hold the OID (may be null)
+ * @sizeof_oid: initially holds the size of @oid
+ *
+ * This function will extract the OIDs of the name of the Certificate
+ * issuer specified by the given index.
+ *
+ * If @oid is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_oid will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_issuer_dn_oid (gnutls_x509_crt_t cert,
+                                   int indx, void *oid, size_t * sizeof_oid)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_get_dn_oid (cert->cert,
+                                  "tbsCertificate.issuer.rdnSequence", indx,
+                                  oid, sizeof_oid);
+}
+
+/**
+ * gnutls_x509_crt_get_dn - This function returns the Certificate's distinguished name
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @buf: a pointer to a structure to hold the name (may be null)
+ * @sizeof_buf: initially holds the size of @buf
+ *
+ * This function will copy the name of the Certificate in the
+ * provided buffer. The name will be in the form
+ * "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253. The output string
+ * will be ASCII or UTF-8 encoded, depending on the certificate data.
+ *
+ * If @buf is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_buf will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_dn (gnutls_x509_crt_t cert,
+                        char *buf, size_t * sizeof_buf)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn (cert->cert,
+                                "tbsCertificate.subject.rdnSequence", buf,
+                                sizeof_buf);
+}
+
+/**
+ * gnutls_x509_crt_get_dn_by_oid - This function returns the Certificate's distinguished name
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @oid: holds an Object Identified in null terminated string
+ * @indx: In case multiple same OIDs exist in the RDN, this specifies which to send. Use zero to get the first one.
+ * @raw_flag: If non zero returns the raw DER data of the DN part.
+ * @buf: a pointer where the DN part will be copied (may be null).
+ * @sizeof_buf: initially holds the size of @buf
+ *
+ * This function will extract the part of the name of the Certificate
+ * subject specified by the given OID. The output, if the raw flag is not
+ * used, will be encoded as described in RFC2253. Thus a string that is
+ * ASCII or UTF-8 encoded, depending on the certificate data.
+ *
+ * Some helper macros with popular OIDs can be found in gnutls/x509.h
+ * If raw flag is zero, this function will only return known OIDs as
+ * text. Other OIDs will be DER encoded, as described in RFC2253 --
+ * in hex format with a '\#' prefix.  You can check about known OIDs
+ * using gnutls_x509_dn_oid_known().
+ *
+ * If @buf is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_buf will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_dn_by_oid (gnutls_x509_crt_t cert,
+                               const char *oid,
+                               int indx,
+                               unsigned int raw_flag,
+                               void *buf, size_t * sizeof_buf)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_parse_dn_oid (cert->cert,
+                                    "tbsCertificate.subject.rdnSequence", oid,
+                                    indx, raw_flag, buf, sizeof_buf);
+}
+
+/**
+ * gnutls_x509_crt_get_dn_oid - This function returns the Certificate's subject distinguished name OIDs
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: This specifies which OID to return. Use zero to get the first one.
+ * @oid: a pointer to a buffer to hold the OID (may be null)
+ * @sizeof_oid: initially holds the size of @oid
+ *
+ * This function will extract the OIDs of the name of the Certificate
+ * subject specified by the given index.
+ *
+ * If oid is null then only the size will be filled.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not
+ * long enough, and in that case the *sizeof_oid will be updated with
+ * the required size.  On success 0 is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_dn_oid (gnutls_x509_crt_t cert,
+                            int indx, void *oid, size_t * sizeof_oid)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_get_dn_oid (cert->cert,
+                                  "tbsCertificate.subject.rdnSequence", indx,
+                                  oid, sizeof_oid);
+}
+
+/**
+ * gnutls_x509_crt_get_signature_algorithm - This function returns the Certificate's signature algorithm
+ * @cert: should contain a gnutls_x509_crt_t structure
+ *
+ * This function will return a value of the gnutls_sign_algorithm_t enumeration that 
+ * is the signature algorithm. 
+ *
+ * Returns a negative value on error.
+ *
+ **/
+int
+gnutls_x509_crt_get_signature_algorithm (gnutls_x509_crt_t cert)
+{
+  int result;
+  gnutls_datum_t sa;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Read the signature algorithm. Note that parameters are not
+   * read. They will be read from the issuer's certificate if needed.
+   */
+  result =
+    _gnutls_x509_read_value (cert->cert, "signatureAlgorithm.algorithm", &sa,
+                             0);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_oid2sign_algorithm (sa.data);
+
+  _gnutls_free_datum (&sa);
+
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_get_signature - Returns the Certificate's signature
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @sig: a pointer where the signature part will be copied (may be null).
+ * @sizeof_sig: initially holds the size of @sig
+ *
+ * This function will extract the signature field of a certificate.
+ *
+ * Returns 0 on success, and a negative value on error.
+ **/
+int
+gnutls_x509_crt_get_signature (gnutls_x509_crt_t cert,
+                               char *sig, size_t * sizeof_sig)
+{
+  int result;
+  int bits, len;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  bits = 0;
+  result = asn1_read_value (cert->cert, "signature", NULL, &bits);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (bits % 8 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CERTIFICATE_ERROR;
+    }
+
+  len = bits / 8;
+
+  if (*sizeof_sig < len)
+    {
+      *sizeof_sig = bits / 8;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  result = asn1_read_value (cert->cert, "signature", sig, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_version - This function returns the Certificate's version number
+ * @cert: should contain a gnutls_x509_crt_t structure
+ *
+ * This function will return the version of the specified Certificate.
+ *
+ * Returns a negative value on error.
+ *
+ **/
+int
+gnutls_x509_crt_get_version (gnutls_x509_crt_t cert)
+{
+  opaque version[5];
+  int len, result;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  len = sizeof (version);
+  if ((result =
+       asn1_read_value (cert->cert, "tbsCertificate.version", version,
+                        &len)) != ASN1_SUCCESS)
+    {
+
+      if (result == ASN1_ELEMENT_NOT_FOUND)
+        return 1;               /* the DEFAULT version */
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return (int) version[0] + 1;
+}
+
+/**
+ * gnutls_x509_crt_get_activation_time - This function returns the Certificate's activation time
+ * @cert: should contain a gnutls_x509_crt_t structure
+ *
+ * This function will return the time this Certificate was or will be activated.
+ *
+ * Returns (time_t)-1 on error.
+ *
+ **/
+time_t
+gnutls_x509_crt_get_activation_time (gnutls_x509_crt_t cert)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  return _gnutls_x509_get_time (cert->cert,
+                                "tbsCertificate.validity.notBefore");
+}
+
+/**
+ * gnutls_x509_crt_get_expiration_time - This function returns the Certificate's expiration time
+ * @cert: should contain a gnutls_x509_crt_t structure
+ *
+ * This function will return the time this Certificate was or will be expired.
+ *
+ * Returns (time_t)-1 on error.
+ *
+ **/
+time_t
+gnutls_x509_crt_get_expiration_time (gnutls_x509_crt_t cert)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  return _gnutls_x509_get_time (cert->cert,
+                                "tbsCertificate.validity.notAfter");
+}
+
+/**
+ * gnutls_x509_crt_get_serial - This function returns the certificate's serial number
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @result: The place where the serial number will be copied
+ * @result_size: Holds the size of the result field.
+ *
+ * This function will return the X.509 certificate's serial number. 
+ * This is obtained by the X509 Certificate serialNumber
+ * field. Serial is not always a 32 or 64bit number. Some CAs use
+ * large serial numbers, thus it may be wise to handle it as something
+ * opaque. 
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_get_serial (gnutls_x509_crt_t cert,
+                            void *result, size_t * result_size)
+{
+  int ret, len;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  len = *result_size;
+  ret
+    =
+    asn1_read_value (cert->cert, "tbsCertificate.serialNumber", result, &len);
+  *result_size = len;
+
+  if (ret != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_subject_key_id - This function returns the certificate's key identifier
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @ret: The place where the identifier will be copied
+ * @ret_size: Holds the size of the result field.
+ * @critical: will be non zero if the extension is marked as critical (may be null)
+ *
+ * This function will return the X.509v3 certificate's subject key identifier.
+ * This is obtained by the X.509 Subject Key identifier extension
+ * field (2.5.29.14). 
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_get_subject_key_id (gnutls_x509_crt_t cert,
+                                    void *ret,
+                                    size_t * ret_size, unsigned int *critical)
+{
+  int result, len;
+  gnutls_datum_t id;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (ret)
+    memset (ret, 0, *ret_size);
+  else
+    *ret_size = 0;
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, "2.5.29.14", 0, &id,
+                                                critical)) < 0)
+    {
+      return result;
+    }
+
+  if (id.size == 0 || id.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.SubjectKeyIdentifier",
+                         &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&id);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, id.data, id.size, NULL);
+  _gnutls_free_datum (&id);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  len = *ret_size;
+  result = asn1_read_value (c2, "", ret, &len);
+
+  *ret_size = len;
+  asn1_delete_structure (&c2);
+
+  if (result == ASN1_VALUE_NOT_FOUND || result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_authority_key_id - This function returns the certificate authority's identifier
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @result: The place where the identifier will be copied
+ * @result_size: Holds the size of the result field.
+ * @critical: will be non zero if the extension is marked as critical (may be null)
+ *
+ * This function will return the X.509v3 certificate authority's key identifier.
+ * This is obtained by the X.509 Authority Key identifier extension
+ * field (2.5.29.35). Note that this function only returns the keyIdentifier
+ * field of the extension.
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_get_authority_key_id (gnutls_x509_crt_t cert,
+                                      void *ret,
+                                      size_t * ret_size,
+                                      unsigned int *critical)
+{
+  int result, len;
+  gnutls_datum_t id;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (ret)
+    memset (ret, 0, *ret_size);
+  else
+    *ret_size = 0;
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, "2.5.29.35", 0, &id,
+                                                critical)) < 0)
+    {
+      return result;
+    }
+
+  if (id.size == 0 || id.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.AuthorityKeyIdentifier",
+                         &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&id);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, id.data, id.size, NULL);
+  _gnutls_free_datum (&id);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  len = *ret_size;
+  result = asn1_read_value (c2, "keyIdentifier", ret, &len);
+
+  *ret_size = len;
+  asn1_delete_structure (&c2);
+
+  if (result == ASN1_VALUE_NOT_FOUND || result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_pk_algorithm - This function returns the certificate's PublicKey algorithm
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @bits: if bits is non null it will hold the size of the parameters' in bits
+ *
+ * This function will return the public key algorithm of an X.509 
+ * certificate.
+ *
+ * If bits is non null, it should have enough size to hold the parameters
+ * size in bits. For RSA the bits returned is the modulus. 
+ * For DSA the bits returned are of the public
+ * exponent.
+ *
+ * Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+ * or a negative value on error.
+ *
+ **/
+int
+gnutls_x509_crt_get_pk_algorithm (gnutls_x509_crt_t cert, unsigned int *bits)
+{
+  int result;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_get_pk_algorithm (cert->cert,
+                                          "tbsCertificate.subjectPublicKeyInfo",
+                                          bits);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return result;
+
+}
+
+inline static int
+is_type_printable (int type)
+{
+  if (type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME || type
+      == GNUTLS_SAN_URI)
+    return 1;
+  else
+    return 0;
+}
+
+#define XMPP_OID "1.3.6.1.5.5.7.8.5"
+
+/* returns the type and the name on success.
+ * Type is also returned as a parameter in case of an error.
+ */
+static int
+parse_general_name (ASN1_TYPE src,
+                    const char *src_name,
+                    int seq,
+                    void *name,
+                    size_t * name_size,
+                    unsigned int *ret_type, int othername_oid)
+{
+  int len;
+  char nptr[MAX_NAME_SIZE];
+  int result;
+  opaque choice_type[128];
+  gnutls_x509_subject_alt_name_t type;
+
+  seq++;                        /* 0->1, 1->2 etc */
+
+  if (src_name[0] != 0)
+    snprintf (nptr, sizeof (nptr), "%s.?%u", src_name, seq);
+  else
+    snprintf (nptr, sizeof (nptr), "?%u", seq);
+
+  len = sizeof (choice_type);
+  result = asn1_read_value (src, nptr, choice_type, &len);
+
+  if (result == ASN1_VALUE_NOT_FOUND || result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  type = _gnutls_x509_san_find_type (choice_type);
+  if (type == (gnutls_x509_subject_alt_name_t) - 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_X509_UNKNOWN_SAN;
+    }
+
+  if (ret_type)
+    *ret_type = type;
+
+  if (type == GNUTLS_SAN_OTHERNAME)
+    {
+      if (othername_oid)
+        _gnutls_str_cat (nptr, sizeof (nptr), ".otherName.type-id");
+      else
+        _gnutls_str_cat (nptr, sizeof (nptr), ".otherName.value");
+
+      len = *name_size;
+      result = asn1_read_value (src, nptr, name, &len);
+      *name_size = len;
+
+      if (result == ASN1_MEM_ERROR)
+        return GNUTLS_E_SHORT_MEMORY_BUFFER;
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      if (othername_oid)
+        {
+          if (len > strlen (XMPP_OID) && strcmp (name, XMPP_OID) == 0)
+            type = GNUTLS_SAN_OTHERNAME_XMPP;
+        }
+      else
+        {
+          char oid[42];
+
+          if (src_name[0] != 0)
+            snprintf (nptr, sizeof (nptr), "%s.?%u.otherName.type-id",
+                      src_name, seq);
+          else
+            snprintf (nptr, sizeof (nptr), "?%u.otherName.type-id", seq);
+
+          len = sizeof (oid);
+          result = asn1_read_value (src, nptr, oid, &len);
+          if (result != ASN1_SUCCESS)
+            {
+              gnutls_assert ();
+              return _gnutls_asn2err (result);
+            }
+
+          if (len > strlen (XMPP_OID) && strcmp (oid, XMPP_OID) == 0)
+            {
+              ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+              result =
+                asn1_create_element (_gnutls_get_pkix (), "PKIX1.XmppAddr",
+                                     &c2);
+              if (result != ASN1_SUCCESS)
+                {
+                  gnutls_assert ();
+                  return _gnutls_asn2err (result);
+                }
+
+              result = asn1_der_decoding (&c2, name, *name_size, NULL);
+              if (result != ASN1_SUCCESS)
+                {
+                  gnutls_assert ();
+                  asn1_delete_structure (&c2);
+                  return _gnutls_asn2err (result);
+                }
+
+              result = asn1_read_value (c2, "", name, &len);
+              *name_size = len;
+              if (result != ASN1_SUCCESS)
+                {
+                  gnutls_assert ();
+                  asn1_delete_structure (&c2);
+                  return _gnutls_asn2err (result);
+                }
+              asn1_delete_structure (&c2);
+            }
+        }
+    }
+  else if (type == GNUTLS_SAN_DN)
+    {
+      _gnutls_str_cat (nptr, sizeof (nptr), ".directoryName");
+      result = _gnutls_x509_parse_dn (src, nptr, name, name_size);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+  else if (othername_oid)
+    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+  else
+    {
+      size_t orig_name_size = *name_size;
+
+      _gnutls_str_cat (nptr, sizeof (nptr), ".");
+      _gnutls_str_cat (nptr, sizeof (nptr), choice_type);
+
+      len = *name_size;
+      result = asn1_read_value (src, nptr, name, &len);
+      *name_size = len;
+
+      if (result == ASN1_MEM_ERROR)
+        {
+          if (is_type_printable (type))
+            (*name_size)++;
+          return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        }
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          return _gnutls_asn2err (result);
+        }
+
+      if (is_type_printable (type))
+        {
+
+          if (len + 1 > orig_name_size)
+            {
+              gnutls_assert ();
+              (*name_size)++;
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+
+          /* null terminate it */
+          ((char *) name)[*name_size] = 0;
+        }
+
+    }
+
+  return type;
+}
+
+static int
+get_subject_alt_name (gnutls_x509_crt_t cert,
+                      unsigned int seq,
+                      void *ret,
+                      size_t * ret_size,
+                      unsigned int *ret_type,
+                      unsigned int *critical, int othername_oid)
+{
+  int result;
+  gnutls_datum_t dnsname;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  gnutls_x509_subject_alt_name_t type;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (ret)
+    memset (ret, 0, *ret_size);
+  else
+    *ret_size = 0;
+
+  if ((result =
+       _gnutls_x509_crt_get_extension (cert, "2.5.29.17", 0, &dnsname,
+                                       critical)) < 0)
+    {
+      return result;
+    }
+
+  if (dnsname.size == 0 || dnsname.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.SubjectAltName", &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&dnsname);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, dnsname.data, dnsname.size, NULL);
+  _gnutls_free_datum (&dnsname);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  result = parse_general_name (c2, "", seq, ret, ret_size, ret_type,
+                               othername_oid);
+
+  asn1_delete_structure (&c2);
+
+  if (result < 0)
+    {
+      return result;
+    }
+
+  type = result;
+
+  return type;
+}
+
+/**
+ * gnutls_x509_crt_get_subject_alt_name - Get certificate's alternative name, if any
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+ * @ret: is the place where the alternative name will be copied to
+ * @ret_size: holds the size of ret.
+ * @critical: will be non zero if the extension is marked as critical (may be null)
+ *
+ * This function will return the alternative names, contained in the
+ * given certificate.
+ *
+ * This is specified in X509v3 Certificate Extensions.  GNUTLS will
+ * return the Alternative name (2.5.29.17), or a negative error code.
+ *
+ * When the SAN type is otherName, it will extract the data in the
+ * otherName's value field, and %GNUTLS_SAN_OTHERNAME is returned.
+ * You may use gnutls_x509_crt_get_subject_alt_othername_oid() to get
+ * the corresponding OID and the "virtual" SAN types (e.g.,
+ * %GNUTLS_SAN_OTHERNAME_XMPP).
+ *
+ * If an otherName OID is known, the data will be decoded.  Otherwise
+ * the returned data will be DER encoded, and you will have to decode
+ * it yourself.  Currently, only the RFC 3920 id-on-xmppAddr SAN is
+ * recognized.
+ *
+ * Returns the alternative subject name type on success.  The type is
+ * one of the enumerated gnutls_x509_subject_alt_name_t.  It will
+ * return %GNUTLS_E_SHORT_MEMORY_BUFFER if @ret_size is not large
+ * enough to hold the value.  In that case @ret_size will be updated
+ * with the required size.  If the certificate does not have an
+ * Alternative name with the specified sequence number then
+ * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_subject_alt_name (gnutls_x509_crt_t cert,
+                                      unsigned int seq,
+                                      void *ret,
+                                      size_t * ret_size,
+                                      unsigned int *critical)
+{
+  return get_subject_alt_name (cert, seq, ret, ret_size, NULL, critical, 0);
+}
+
+/**
+ * gnutls_x509_crt_get_subject_alt_name2 - Get certificate's alternative name, if any
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+ * @ret: is the place where the alternative name will be copied to
+ * @ret_size: holds the size of ret.
+ * @ret_type: holds the type of the alternative name (one of gnutls_x509_subject_alt_name_t).
+ * @critical: will be non zero if the extension is marked as critical (may be null)
+ *
+ * This function will return the alternative names, contained in the
+ * given certificate. It is the same as gnutls_x509_crt_get_subject_alt_name()
+ * except for the fact that it will return the type of the alternative
+ * name in @ret_type even if the function fails for some reason (i.e.
+ * the buffer provided is not enough).
+ *
+ * The return values are the same as with gnutls_x509_crt_get_subject_alt_name().
+ *
+ **/
+int
+gnutls_x509_crt_get_subject_alt_name2 (gnutls_x509_crt_t cert,
+                                       unsigned int seq,
+                                       void *ret,
+                                       size_t * ret_size,
+                                       unsigned int *ret_type,
+                                       unsigned int *critical)
+{
+  return get_subject_alt_name (cert, seq, ret, ret_size, ret_type, critical,
+                               0);
+}
+
+/**
+ * gnutls_x509_crt_get_subject_alt_othername_oid - Get SAN otherName OID
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+ * @ret: is the place where the otherName OID will be copied to
+ * @ret_size: holds the size of ret.
+ *
+ * This function will extract the type OID of an otherName Subject
+ * Alternative Name, contained in the given certificate, and return
+ * the type as an enumerated element.
+ *
+ * This function is only useful if
+ * gnutls_x509_crt_get_subject_alt_name() returned
+ * %GNUTLS_SAN_OTHERNAME.
+ *
+ * Returns the alternative subject name type on success.  The type is
+ * one of the enumerated gnutls_x509_subject_alt_name_t.  For
+ * supported OIDs, it will return one of the virtual
+ * (GNUTLS_SAN_OTHERNAME_*) types, e.g. %GNUTLS_SAN_OTHERNAME_XMPP,
+ * and %GNUTLS_SAN_OTHERNAME for unknown OIDs.  It will return
+ * %GNUTLS_E_SHORT_MEMORY_BUFFER if @ret_size is not large enough to
+ * hold the value.  In that case @ret_size will be updated with the
+ * required size.  If the certificate does not have an Alternative
+ * name with the specified sequence number and with the otherName type
+ * then %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.
+ **/
+int
+gnutls_x509_crt_get_subject_alt_othername_oid (gnutls_x509_crt_t cert,
+                                               unsigned int seq,
+                                               void *ret, size_t * ret_size)
+{
+  return get_subject_alt_name (cert, seq, ret, ret_size, NULL, NULL, 1);
+}
+
+/**
+ * gnutls_x509_crt_get_basic_constraints - This function returns the certificate basic constraints
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @critical: will be non zero if the extension is marked as critical
+ * @ca: pointer to output integer indicating CA status, may be NULL,
+ *   value is 1 if the certificate CA flag is set, 0 otherwise.
+ * @pathlen: pointer to output integer indicating path length (may be
+ *   NULL), non-negative values indicate a present pathLenConstraint
+ *   field and the actual value, -1 indicate that the field is absent.
+ *
+ * This function will read the certificate's basic constraints, and
+ * return the certificates CA status.  It reads the basicConstraints
+ * X.509 extension (2.5.29.19).
+ *
+ * Return value: If the certificate is a CA a positive value will be
+ * returned, or zero if the certificate does not have CA flag set.  A
+ * negative value may be returned in case of errors.  If the
+ * certificate does not contain the basicConstraints extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ **/
+int
+gnutls_x509_crt_get_basic_constraints (gnutls_x509_crt_t cert,
+                                       unsigned int *critical,
+                                       int *ca, int *pathlen)
+{
+  int result;
+  gnutls_datum_t basicConstraints;
+  int tmp_ca;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, "2.5.29.19", 0,
+                                                &basicConstraints, critical))
+      < 0)
+    {
+      return result;
+    }
+
+  if (basicConstraints.size == 0 || basicConstraints.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result = _gnutls_x509_ext_extract_basicConstraints (&tmp_ca, pathlen,
+                                                      basicConstraints.data,
+                                                      basicConstraints.size);
+  if (ca)
+    *ca = tmp_ca;
+  _gnutls_free_datum (&basicConstraints);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return tmp_ca;
+}
+
+/**
+ * gnutls_x509_crt_get_ca_status - This function returns the certificate CA status
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @critical: will be non zero if the extension is marked as critical
+ *
+ * This function will return certificates CA status, by reading the
+ * basicConstraints X.509 extension (2.5.29.19). If the certificate is
+ * a CA a positive value will be returned, or zero if the certificate
+ * does not have CA flag set.
+ *
+ * Use gnutls_x509_crt_get_basic_constraints() if you want to read the
+ * pathLenConstraint field too.
+ *
+ * A negative value may be returned in case of parsing error.
+ * If the certificate does not contain the basicConstraints extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_ca_status (gnutls_x509_crt_t cert, unsigned int *critical)
+{
+  int ca, pathlen;
+  return gnutls_x509_crt_get_basic_constraints (cert, critical, &ca,
+                                                &pathlen);
+}
+
+/**
+ * gnutls_x509_crt_get_key_usage - This function returns the certificate's key usage
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @key_usage: where the key usage bits will be stored
+ * @critical: will be non zero if the extension is marked as critical
+ *
+ * This function will return certificate's key usage, by reading the 
+ * keyUsage X.509 extension (2.5.29.15). The key usage value will ORed values of the:
+ * GNUTLS_KEY_DIGITAL_SIGNATURE, GNUTLS_KEY_NON_REPUDIATION,
+ * GNUTLS_KEY_KEY_ENCIPHERMENT, GNUTLS_KEY_DATA_ENCIPHERMENT,
+ * GNUTLS_KEY_KEY_AGREEMENT, GNUTLS_KEY_KEY_CERT_SIGN,
+ * GNUTLS_KEY_CRL_SIGN, GNUTLS_KEY_ENCIPHER_ONLY,
+ * GNUTLS_KEY_DECIPHER_ONLY.
+ *
+ * A negative value may be returned in case of parsing error.
+ * If the certificate does not contain the keyUsage extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_key_usage (gnutls_x509_crt_t cert,
+                               unsigned int *key_usage,
+                               unsigned int *critical)
+{
+  int result;
+  gnutls_datum_t keyUsage;
+  uint16_t _usage;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result =
+       _gnutls_x509_crt_get_extension (cert, "2.5.29.15", 0, &keyUsage,
+                                       critical)) < 0)
+    {
+      return result;
+    }
+
+  if (keyUsage.size == 0 || keyUsage.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result = _gnutls_x509_ext_extract_keyUsage (&_usage, keyUsage.data,
+                                              keyUsage.size);
+  _gnutls_free_datum (&keyUsage);
+
+  *key_usage = _usage;
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_proxy - This function returns the proxy certificate info
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @critical: will be non zero if the extension is marked as critical
+ * @pathlen: pointer to output integer indicating path length (may be
+ *   NULL), non-negative values indicate a present pCPathLenConstraint
+ *   field and the actual value, -1 indicate that the field is absent.
+ *
+ * This function will read the certificate's basic constraints, and
+ * return the certificates CA status.  It reads the basicConstraints
+ * X.509 extension (2.5.29.19).
+ *
+ * Return value: If the certificate is a CA a positive value will be
+ * returned, or zero if the certificate does not have CA flag set.  A
+ * negative value may be returned in case of errors.  If the
+ * certificate does not contain the basicConstraints extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ **/
+int
+gnutls_x509_crt_get_proxy (gnutls_x509_crt_t cert,
+                           unsigned int *critical,
+                           int *pathlen,
+                           char **policyLanguage,
+                           char **policy, size_t * sizeof_policy)
+{
+  int result;
+  gnutls_datum_t proxyCertInfo;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, "1.3.6.1.5.5.7.1.14", 0,
+                                                &proxyCertInfo,
+                                                critical)) < 0)
+    {
+      return result;
+    }
+
+  if (proxyCertInfo.size == 0 || proxyCertInfo.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result = _gnutls_x509_ext_extract_proxyCertInfo (pathlen, policyLanguage,
+                                                   policy, sizeof_policy,
+                                                   proxyCertInfo.data,
+                                                   proxyCertInfo.size);
+  _gnutls_free_datum (&proxyCertInfo);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_extension_by_oid - This function returns the specified extension
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @oid: holds an Object Identified in null terminated string
+ * @indx: In case multiple same OIDs exist in the extensions, this specifies which to send. Use zero to get the first one.
+ * @buf: a pointer to a structure to hold the name (may be null)
+ * @sizeof_buf: initially holds the size of @buf
+ * @critical: will be non zero if the extension is marked as critical
+ *
+ * This function will return the extension specified by the OID in the certificate.
+ * The extensions will be returned as binary data DER encoded, in the provided
+ * buffer.
+ *
+ * A negative value may be returned in case of parsing error.
+ * If the certificate does not contain the specified extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_extension_by_oid (gnutls_x509_crt_t cert,
+                                      const char *oid,
+                                      int indx,
+                                      void *buf,
+                                      size_t * sizeof_buf,
+                                      unsigned int *critical)
+{
+  int result;
+  gnutls_datum_t output;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, oid, indx, &output,
+                                                critical)) < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  if (output.size == 0 || output.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  if (output.size > (unsigned int) *sizeof_buf)
+    {
+      *sizeof_buf = output.size;
+      _gnutls_free_datum (&output);
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  *sizeof_buf = output.size;
+
+  if (buf)
+    memcpy (buf, output.data, output.size);
+
+  _gnutls_free_datum (&output);
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_get_extension_oid - This function returns the specified extension OID
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: Specifies which extension OID to send. Use zero to get the first one.
+ * @oid: a pointer to a structure to hold the OID (may be null)
+ * @sizeof_oid: initially holds the size of @oid
+ *
+ * This function will return the requested extension OID in the certificate.
+ * The extension OID will be stored as a string in the provided buffer.
+ *
+ * A negative value may be returned in case of parsing error.
+ * If your have reached the last extension available 
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_extension_oid (gnutls_x509_crt_t cert,
+                                   int indx, void *oid, size_t * sizeof_oid)
+{
+  int result;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_crt_get_extension_oid (cert, indx, oid, sizeof_oid);
+  if (result < 0)
+    {
+      return result;
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_get_extension_info - Get extension id and criticality
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: Specifies which extension OID to send. Use zero to get the first one.
+ * @oid: a pointer to a structure to hold the OID
+ * @sizeof_oid: initially holds the size of @oid
+ * @critical: output variable with critical flag, may be NULL.
+ *
+ * This function will return the requested extension OID in the
+ * certificate, and the critical flag for it.  The extension OID will
+ * be stored as a string in the provided buffer.  Use
+ * gnutls_x509_crt_get_extension_data() to extract the data.
+ *
+ * Return 0 on success.  A negative value may be returned in case of
+ * parsing error.  If you have reached the last extension available
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int
+gnutls_x509_crt_get_extension_info (gnutls_x509_crt_t cert,
+                                    int indx,
+                                    void *oid,
+                                    size_t * sizeof_oid, int *critical)
+{
+  int result;
+  char str_critical[10];
+  char name[MAX_NAME_SIZE];
+  int len;
+
+  if (!cert)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u.extnID",
+            indx + 1);
+
+  len = *sizeof_oid;
+  result = asn1_read_value (cert->cert, name, oid, &len);
+  *sizeof_oid = len;
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+  else if (result < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u.critical",
+            indx + 1);
+  len = sizeof (str_critical);
+  result = asn1_read_value (cert->cert, name, str_critical, &len);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (critical)
+    {
+      if (str_critical[0] == 'T')
+        *critical = 1;
+      else
+        *critical = 0;
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_get_extension_data - Get the specified extension data
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: Specifies which extension OID to send. Use zero to get the first one.
+ * @data: a pointer to a structure to hold the data (may be null)
+ * @sizeof_data: initially holds the size of @oid
+ *
+ * This function will return the requested extension data in the
+ * certificate.  The extension data will be stored as a string in the
+ * provided buffer.
+ *
+ * Use gnutls_x509_crt_get_extension_info() to extract the OID and
+ * critical flag.  Use gnutls_x509_crt_get_extension_by_oid() instead,
+ * if you want to get data indexed by the extension OID rather than
+ * sequence.
+ *
+ * Return 0 on success.  A negative value may be returned in case of
+ * parsing error.  If you have reached the last extension available
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ **/
+int
+gnutls_x509_crt_get_extension_data (gnutls_x509_crt_t cert,
+                                    int indx,
+                                    void *data, size_t * sizeof_data)
+{
+  int result, len;
+  char name[MAX_NAME_SIZE];
+
+  if (!cert)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  snprintf (name, sizeof (name), "tbsCertificate.extensions.?%u.extnValue",
+            indx + 1);
+
+  len = *sizeof_data;
+  result = asn1_read_value (cert->cert, name, data, &len);
+  *sizeof_data = len;
+
+  if (result == ASN1_ELEMENT_NOT_FOUND)
+    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+  else if (result < 0)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+static int
+_gnutls_x509_crt_get_raw_dn2 (gnutls_x509_crt_t cert,
+                              const char *whom, gnutls_datum_t * start)
+{
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  int result, len1;
+  int start1, end1;
+  gnutls_datum_t signed_data = { NULL,
+    0
+  };
+
+  /* get the issuer of 'cert'
+   */
+  if ((result =
+       asn1_create_element (_gnutls_get_pkix (), "PKIX1.TBSCertificate",
+                            &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_get_signed_data (cert->cert, "tbsCertificate",
+                                         &signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = asn1_der_decoding (&c2, signed_data.data, signed_data.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  result = asn1_der_decoding_startEnd (c2, signed_data.data, signed_data.size,
+                                       whom, &start1, &end1);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  len1 = end1 - start1 + 1;
+
+  _gnutls_set_datum (start, &signed_data.data[start1], len1);
+
+  result = 0;
+
+cleanup:asn1_delete_structure (&c2);
+  _gnutls_free_datum (&signed_data);
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_get_raw_issuer_dn - This function returns the issuer's DN DER encoded
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @start: will hold the starting point of the DN
+ *
+ * This function will return a pointer to the DER encoded DN structure
+ * and the length.
+ *
+ * Returns 0 on success or a negative value on error.
+ *
+ **/
+int
+gnutls_x509_crt_get_raw_issuer_dn (gnutls_x509_crt_t cert,
+                                   gnutls_datum_t * start)
+{
+  return _gnutls_x509_crt_get_raw_dn2 (cert, "issuer", start);
+}
+
+/**
+ * gnutls_x509_crt_get_raw_dn - This function returns the subject's DN DER encoded
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @start: will hold the starting point of the DN
+ *
+ * This function will return a pointer to the DER encoded DN structure and
+ * the length.
+ *
+ * Returns 0 on success, or a negative value on error.
+ *
+ **/
+int
+gnutls_x509_crt_get_raw_dn (gnutls_x509_crt_t cert, gnutls_datum_t * start)
+{
+  return _gnutls_x509_crt_get_raw_dn2 (cert, "subject", start);
+}
+
+static int
+get_dn (gnutls_x509_crt_t cert, const char *whom, gnutls_x509_dn_t * dn)
+{
+  *dn = asn1_find_node (cert->cert, whom);
+  if (!*dn)
+    return GNUTLS_E_ASN1_ELEMENT_NOT_FOUND;
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_subject: get opaque subject DN pointer
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @dn: output variable with pointer to opaque DN.
+ *
+ * Return the Certificate's Subject DN as an opaque data type.  You
+ * may use gnutls_x509_dn_get_rdn_ava() to decode the DN.
+ *
+ * Returns: Returns 0 on success, or an error code.
+ **/
+int
+gnutls_x509_crt_get_subject (gnutls_x509_crt_t cert, gnutls_x509_dn_t * dn)
+{
+  return get_dn (cert, "tbsCertificate.subject.rdnSequence", dn);
+}
+
+/**
+ * gnutls_x509_crt_get_issuer: get opaque issuer DN pointer
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @dn: output variable with pointer to opaque DN
+ *
+ * Return the Certificate's Issuer DN as an opaque data type.  You may
+ * use gnutls_x509_dn_get_rdn_ava() to decode the DN.
+ *
+ * Note that @dn points into the @cert object, and thus you may not
+ * deallocate @cert and continue to access @dn.
+ *
+ * Returns: Returns 0 on success, or an error code.
+ **/
+int
+gnutls_x509_crt_get_issuer (gnutls_x509_crt_t cert, gnutls_x509_dn_t * dn)
+{
+  return get_dn (cert, "tbsCertificate.issuer.rdnSequence", dn);
+}
+
+/**
+ * gnutls_x509_dn_get_rdn_ava:
+ * @dn: input variable with opaque DN pointer
+ * @irdn: index of RDN
+ * @iava: index of AVA.
+ * @ava: Pointer to structure which will hold output information.
+ *
+ * Get pointers to data within the DN.
+ *
+ * Note that @ava will contain pointers into the @dn structure, so you
+ * should not modify any data or deallocate it.  Note also that the DN
+ * in turn points into the original certificate structure, and thus
+ * you may not deallocate the certificate and continue to access @dn.
+ *
+ * Returns: Returns 0 on success, or an error code.
+ **/
+int
+gnutls_x509_dn_get_rdn_ava (gnutls_x509_dn_t dn,
+                            int irdn, int iava, gnutls_x509_ava_st * ava)
+{
+  ASN1_TYPE rdn, elem;
+  long len;
+  int lenlen, remlen, ret;
+  char rbuf[MAX_NAME_SIZE];
+  unsigned char cls, *ptr;
+
+  iava++;
+  irdn++;                       /* 0->1, 1->2 etc */
+
+  snprintf (rbuf, sizeof (rbuf), "rdnSequence.?%d.?%d", irdn, iava);
+  rdn = asn1_find_node (dn, rbuf);
+  if (!rdn)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_ELEMENT_NOT_FOUND;
+    }
+
+  snprintf (rbuf, sizeof (rbuf), "?%d.type", iava);
+  elem = asn1_find_node (rdn, rbuf);
+  if (!elem)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_ELEMENT_NOT_FOUND;
+    }
+
+  ava->oid.data = elem->value;
+  ava->oid.size = elem->value_len;
+
+  snprintf (rbuf, sizeof (rbuf), "?%d.value", iava);
+  elem = asn1_find_node (rdn, rbuf);
+  if (!elem)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_ELEMENT_NOT_FOUND;
+    }
+
+  /* The value still has the previous tag's length bytes, plus the
+   * current value's tag and length bytes. Decode them.
+   */
+
+  ptr = elem->value;
+  remlen = elem->value_len;
+  len = asn1_get_length_der (ptr, remlen, &lenlen);
+  if (len < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_DER_ERROR;
+    }
+
+  ptr += lenlen;
+  remlen -= lenlen;
+  ret = asn1_get_tag_der (ptr, remlen, &cls, &lenlen, &ava->value_tag);
+  if (ret)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  ptr += lenlen;
+  remlen -= lenlen;
+
+  ava->value.size = asn1_get_length_der (ptr, remlen, &lenlen);
+  if (ava->value.size < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_DER_ERROR;
+    }
+  ava->value.data = ptr + lenlen;
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_get_fingerprint - This function returns the Certificate's fingerprint
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @algo: is a digest algorithm
+ * @buf: a pointer to a structure to hold the fingerprint (may be null)
+ * @sizeof_buf: initially holds the size of @buf
+ *
+ * This function will calculate and copy the certificate's fingerprint
+ * in the provided buffer.
+ *
+ * If the buffer is null then only the size will be filled.
+ *
+ * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is
+ * not long enough, and in that case the *sizeof_buf will be updated
+ * with the required size.  On success 0 is returned.
+ **/
+int
+gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
+                                 gnutls_digest_algorithm_t algo,
+                                 void *buf, size_t * sizeof_buf)
+{
+  opaque *cert_buf;
+  int cert_buf_size;
+  int result;
+  gnutls_datum_t tmp;
+
+  if (sizeof_buf == 0 || cert == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  cert_buf_size = 0;
+  asn1_der_coding (cert->cert, "", NULL, &cert_buf_size, NULL);
+
+  cert_buf = gnutls_alloca (cert_buf_size);
+  if (cert_buf == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_der_coding (cert->cert, "", cert_buf, &cert_buf_size, NULL);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_afree (cert_buf);
+      return _gnutls_asn2err (result);
+    }
+
+  tmp.data = cert_buf;
+  tmp.size = cert_buf_size;
+
+  result = gnutls_fingerprint (algo, &tmp, buf, sizeof_buf);
+  gnutls_afree (cert_buf);
+
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_export - This function will export the certificate
+ * @cert: Holds the certificate
+ * @format: the format of output params. One of PEM or DER.
+ * @output_data: will contain a certificate PEM or DER encoded
+ * @output_data_size: holds the size of output_data (and will be
+ *   replaced by the actual size of parameters)
+ *
+ * This function will export the certificate to DER or PEM format.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.
+ *
+ * If the structure is PEM encoded, it will have a header
+ * of "BEGIN CERTIFICATE".
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ **/
+int
+gnutls_x509_crt_export (gnutls_x509_crt_t cert,
+                        gnutls_x509_crt_fmt_t format,
+                        void *output_data, size_t * output_data_size)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_export_int (cert->cert, format, "CERTIFICATE",
+                                  output_data, output_data_size);
+}
+
+static int
+rsadsa_get_key_id (gnutls_x509_crt_t crt,
+                   int pk,
+                   unsigned char *output_data, size_t * output_data_size)
+{
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE];
+  int params_size = MAX_PUBLIC_PARAMS_SIZE;
+  int i, result = 0;
+  gnutls_datum_t der = { NULL,
+    0
+  };
+  GNUTLS_HASH_HANDLE hd;
+
+  result = _gnutls_x509_crt_get_mpis (crt, params, &params_size);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  if (pk == GNUTLS_PK_RSA)
+    {
+      result = _gnutls_x509_write_rsa_params (params, params_size, &der);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+  else
+    return GNUTLS_E_INTERNAL_ERROR;
+
+  hd = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (hd == GNUTLS_HASH_FAILED)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  _gnutls_hash (hd, der.data, der.size);
+
+  _gnutls_hash_deinit (hd, output_data);
+  *output_data_size = 20;
+
+  result = 0;
+
+cleanup:
+
+  _gnutls_free_datum (&der);
+
+  /* release all allocated MPIs
+   */
+  for (i = 0; i < params_size; i++)
+    {
+      _gnutls_mpi_release (&params[i]);
+    }
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_get_key_id - Return unique ID of public key's parameters
+ * @crt: Holds the certificate
+ * @flags: should be 0 for now
+ * @output_data: will contain the key ID
+ * @output_data_size: holds the size of output_data (and will be
+ *   replaced by the actual size of parameters)
+ *
+ * This function will return a unique ID the depends on the public
+ * key parameters. This ID can be used in checking whether a
+ * certificate corresponds to the given private key.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.  The output will normally be a SHA-1 hash output,
+ * which is 20 bytes.
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ **/
+int
+gnutls_x509_crt_get_key_id (gnutls_x509_crt_t crt,
+                            unsigned int flags,
+                            unsigned char *output_data,
+                            size_t * output_data_size)
+{
+  int pk, result = 0;
+  gnutls_datum_t pubkey;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (*output_data_size < 20)
+    {
+      gnutls_assert ();
+      *output_data_size = 20;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  pk = gnutls_x509_crt_get_pk_algorithm (crt, NULL);
+  if (pk < 0)
+    {
+      gnutls_assert ();
+      return pk;
+    }
+
+  if (pk == GNUTLS_PK_RSA)
+    {
+      /* This is for compatibility with what GnuTLS has printed for
+         RSA/DSA before the code below was added.  The code below is
+         applicable to all types, and it would probably be a better
+         idea to use it for RSA/DSA too, but doing so would break
+         backwards compatibility.  */
+      return rsadsa_get_key_id (crt, pk, output_data, output_data_size);
+    }
+
+  pubkey.size = 0;
+  result = asn1_der_coding (crt->cert, "tbsCertificate.subjectPublicKeyInfo",
+                            NULL, &pubkey.size, NULL);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  pubkey.data = gnutls_alloca (pubkey.size);
+  if (pubkey.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_der_coding (crt->cert, "tbsCertificate.subjectPublicKeyInfo",
+                            pubkey.data, &pubkey.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_afree (pubkey.data);
+      return _gnutls_asn2err (result);
+    }
+
+  result = gnutls_fingerprint (GNUTLS_DIG_SHA1, &pubkey, output_data,
+                               output_data_size);
+
+  gnutls_afree (pubkey.data);
+
+  return result;
+}
+
+#ifdef ENABLE_PKI
+
+/**
+ * gnutls_x509_crt_check_revocation - This function checks if the given certificate is revoked
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @crl_list: should contain a list of gnutls_x509_crl_t structures
+ * @crl_list_length: the length of the crl_list
+ *
+ * This function will return check if the given certificate is
+ * revoked.  It is assumed that the CRLs have been verified before.
+ *
+ * Returns: 0 if the certificate is NOT revoked, and 1 if it is.  A
+ * negative value is returned on error.
+ **/
+int
+gnutls_x509_crt_check_revocation (gnutls_x509_crt_t cert,
+                                  const gnutls_x509_crl_t * crl_list,
+                                  int crl_list_length)
+{
+  opaque serial[64];
+  opaque cert_serial[64];
+  size_t serial_size, cert_serial_size;
+  int ncerts, ret, i, j;
+  gnutls_datum_t dn1, dn2;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  for (j = 0; j < crl_list_length; j++)
+    {                           /* do for all the crls */
+
+      /* Step 1. check if issuer's DN match
+       */
+      ret = _gnutls_x509_crl_get_raw_issuer_dn (crl_list[j], &dn1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = gnutls_x509_crt_get_raw_issuer_dn (cert, &dn2);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_x509_compare_raw_dn (&dn1, &dn2);
+      _gnutls_free_datum (&dn1);
+      _gnutls_free_datum (&dn2);
+      if (ret == 0)
+        {
+          /* issuers do not match so don't even
+           * bother checking.
+           */
+          continue;
+        }
+
+      /* Step 2. Read the certificate's serial number
+       */
+      cert_serial_size = sizeof (cert_serial);
+      ret = gnutls_x509_crt_get_serial (cert, cert_serial, &cert_serial_size);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* Step 3. cycle through the CRL serials and compare with
+       *   certificate serial we have.
+       */
+
+      ncerts = gnutls_x509_crl_get_crt_count (crl_list[j]);
+      if (ncerts < 0)
+        {
+          gnutls_assert ();
+          return ncerts;
+        }
+
+      for (i = 0; i < ncerts; i++)
+        {
+          serial_size = sizeof (serial);
+          ret = gnutls_x509_crl_get_crt_serial (crl_list[j], i, serial,
+                                                &serial_size, NULL);
+
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+
+          if (serial_size == cert_serial_size)
+            {
+              if (memcmp (serial, cert_serial, serial_size) == 0)
+                {
+                  /* serials match */
+                  return 1;     /* revoked! */
+                }
+            }
+        }
+
+    }
+  return 0;                     /* not revoked. */
+}
+
+/**
+ * gnutls_x509_crt_verify_data - This function will verify the given signed data.
+ * @crt: Holds the certificate
+ * @flags: should be 0 for now
+ * @data: holds the data to be signed
+ * @signature: contains the signature
+ *
+ * This function will verify the given signed data, using the
+ * parameters from the certificate.
+ *
+ * Returns: In case of a verification failure 0 is returned, and 1 on
+ * success.
+ **/
+int
+gnutls_x509_crt_verify_data (gnutls_x509_crt_t crt,
+                             unsigned int flags,
+                             const gnutls_datum_t * data,
+                             const gnutls_datum_t * signature)
+{
+  int result;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_verify_signature (data, signature, crt);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_get_crl_dist_points - This function returns the CRL distribution points
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @seq: specifies the sequence number of the distribution point (0 for the first one, 1 for the second etc.)
+ * @ret: is the place where the distribution point will be copied to
+ * @ret_size: holds the size of ret.
+ * @reason_flags: Revocation reasons flags.
+ * @critical: will be non zero if the extension is marked as critical (may be null)
+ *
+ * This function will return the CRL distribution points (2.5.29.31),
+ * contained in the given certificate.
+ *
+ * @reason_flags should be an ORed sequence of
+ * GNUTLS_CRL_REASON_UNUSED, GNUTLS_CRL_REASON_KEY_COMPROMISE,
+ * GNUTLS_CRL_REASON_CA_COMPROMISE,
+ * GNUTLS_CRL_REASON_AFFILIATION_CHANGED,
+ * GNUTLS_CRL_REASON_SUPERSEEDED,
+ * GNUTLS_CRL_REASON_CESSATION_OF_OPERATION,
+ * GNUTLS_CRL_REASON_CERTIFICATE_HOLD,
+ * GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN,
+ * GNUTLS_CRL_REASON_AA_COMPROMISE, or zero for all possible reasons.
+ *
+ * This is specified in X509v3 Certificate Extensions. GNUTLS will
+ * return the distribution point type, or a negative error code on
+ * error.
+ *
+ * Returns %GNUTLS_E_SHORT_MEMORY_BUFFER and updates &@ret_size if
+ * &@ret_size is not enough to hold the distribution point, or the
+ * type of the distribution point if everything was ok. The type is
+ * one of the enumerated %gnutls_x509_subject_alt_name_t.  If the
+ * certificate does not have an Alternative name with the specified
+ * sequence number then %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is
+ * returned.
+ **/
+int
+gnutls_x509_crt_get_crl_dist_points (gnutls_x509_crt_t cert,
+                                     unsigned int seq,
+                                     void *ret,
+                                     size_t * ret_size,
+                                     unsigned int *reason_flags,
+                                     unsigned int *critical)
+{
+  int result;
+  gnutls_datum_t dist_points = { NULL,
+    0
+  };
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+  char name[MAX_NAME_SIZE];
+  int len;
+  gnutls_x509_subject_alt_name_t type;
+  uint8_t reasons[2];
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (*ret_size > 0 && ret)
+    memset (ret, 0, *ret_size);
+  else
+    *ret_size = 0;
+
+  if (reason_flags)
+    *reason_flags = 0;
+
+  result = _gnutls_x509_crt_get_extension (cert, "2.5.29.31", 0, &dist_points,
+                                           critical);
+  if (result < 0)
+    {
+      return result;
+    }
+
+  if (dist_points.size == 0 || dist_points.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.CRLDistributionPoints",
+                         &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&dist_points);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, dist_points.data, dist_points.size, NULL);
+  _gnutls_free_datum (&dist_points);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Return the different names from the first CRLDistr. point.
+   * The whole thing is a mess.
+   */
+  _gnutls_str_cpy (name, sizeof (name), "?1.distributionPoint.fullName");
+
+  result = parse_general_name (c2, name, seq, ret, ret_size, NULL, 0);
+  if (result < 0)
+    {
+      asn1_delete_structure (&c2);
+      return result;
+    }
+
+  type = result;
+
+  /* Read the CRL reasons.
+   */
+  if (reason_flags)
+    {
+      _gnutls_str_cpy (name, sizeof (name), "?1.reasons");
+
+      reasons[0] = reasons[1] = 0;
+
+      len = sizeof (reasons);
+      result = asn1_read_value (c2, name, reasons, &len);
+
+      if (result != ASN1_VALUE_NOT_FOUND && result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          asn1_delete_structure (&c2);
+          return _gnutls_asn2err (result);
+        }
+
+      *reason_flags = reasons[0] | (reasons[1] << 8);
+    }
+
+  return type;
+}
+
+/**
+ * gnutls_x509_crt_get_key_purpose_oid - This function returns the Certificate's key purpose OIDs
+ * @cert: should contain a gnutls_x509_crt_t structure
+ * @indx: This specifies which OID to return. Use zero to get the first one.
+ * @oid: a pointer to a buffer to hold the OID (may be null)
+ * @sizeof_oid: initially holds the size of @oid
+ *
+ * This function will extract the key purpose OIDs of the Certificate
+ * specified by the given index. These are stored in the Extended Key
+ * Usage extension (2.5.29.37) See the GNUTLS_KP_* definitions for
+ * human readable names.
+ *
+ * If @oid is null then only the size will be filled.
+ *
+ * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is
+ * not long enough, and in that case the *sizeof_oid will be updated
+ * with the required size.  On success 0 is returned.
+ **/
+int
+gnutls_x509_crt_get_key_purpose_oid (gnutls_x509_crt_t cert,
+                                     int indx,
+                                     void *oid,
+                                     size_t * sizeof_oid,
+                                     unsigned int *critical)
+{
+  char tmpstr[MAX_NAME_SIZE];
+  int result, len;
+  gnutls_datum_t id;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (oid)
+    memset (oid, 0, *sizeof_oid);
+  else
+    *sizeof_oid = 0;
+
+  if ((result = _gnutls_x509_crt_get_extension (cert, "2.5.29.37", 0, &id,
+                                                critical)) < 0)
+    {
+      return result;
+    }
+
+  if (id.size == 0 || id.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  result =
+    asn1_create_element (_gnutls_get_pkix (), "PKIX1.ExtKeyUsageSyntax", &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&id);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, id.data, id.size, NULL);
+  _gnutls_free_datum (&id);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  indx++;
+  /* create a string like "?1"
+   */
+  snprintf (tmpstr, sizeof (tmpstr), "?%u", indx);
+
+  len = *sizeof_oid;
+  result = asn1_read_value (c2, tmpstr, oid, &len);
+
+  *sizeof_oid = len;
+  asn1_delete_structure (&c2);
+
+  if (result == ASN1_VALUE_NOT_FOUND || result == ASN1_ELEMENT_NOT_FOUND)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_get_pk_rsa_raw - This function will export the RSA public key
+ * @crt: Holds the certificate
+ * @m: will hold the modulus
+ * @e: will hold the public exponent
+ *
+ * This function will export the RSA public key's parameters found in
+ * the given structure.  The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, otherwise an error.
+ **/
+int
+gnutls_x509_crt_get_pk_rsa_raw (gnutls_x509_crt_t crt,
+                                gnutls_datum_t * m, gnutls_datum_t * e)
+{
+  int ret;
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE];
+  int params_size = MAX_PUBLIC_PARAMS_SIZE;
+  int i;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = gnutls_x509_crt_get_pk_algorithm (crt, NULL);
+  if (ret != GNUTLS_PK_RSA)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_x509_crt_get_mpis (crt, params, &params_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_mpi_dprint (m, params[0]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = _gnutls_mpi_dprint (e, params[1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (m);
+      goto cleanup;
+    }
+
+  ret = 0;
+
+cleanup:for (i = 0; i < params_size; i++)
+    {
+      _gnutls_mpi_release (&params[i]);
+    }
+  return ret;
+}
+
+/**
+ * gnutls_x509_crt_get_pk_dsa_raw - This function will export the DSA public key
+ * @crt: Holds the certificate
+ * @p: will hold the p
+ * @q: will hold the q
+ * @g: will hold the g
+ * @y: will hold the y
+ *
+ * This function will export the DSA public key's parameters found in
+ * the given certificate.  The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, otherwise an error.
+ **/
+int
+gnutls_x509_crt_get_pk_dsa_raw (gnutls_x509_crt_t crt,
+                                gnutls_datum_t * p,
+                                gnutls_datum_t * q,
+                                gnutls_datum_t * g, gnutls_datum_t * y)
+{
+  int ret;
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE];
+  int params_size = MAX_PUBLIC_PARAMS_SIZE;
+  int i;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = gnutls_x509_crt_get_pk_algorithm (crt, NULL);
+
+  ret = _gnutls_x509_crt_get_mpis (crt, params, &params_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* P */
+  ret = _gnutls_mpi_dprint (p, params[0]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* Q */
+  ret = _gnutls_mpi_dprint (q, params[1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      goto cleanup;
+    }
+
+  /* G */
+  ret = _gnutls_mpi_dprint (g, params[2]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      _gnutls_free_datum (q);
+      goto cleanup;
+    }
+
+  /* Y */
+  ret = _gnutls_mpi_dprint (y, params[3]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      _gnutls_free_datum (g);
+      _gnutls_free_datum (q);
+      goto cleanup;
+    }
+
+  ret = 0;
+
+cleanup:for (i = 0; i < params_size; i++)
+    {
+      _gnutls_mpi_release (&params[i]);
+    }
+  return ret;
+
+}
+
+#endif
+
+/**
+ * gnutls_x509_crt_list_import - This function will import a PEM encoded certificate list
+ * @certs: The structures to store the parsed certificate. Must not be initialized.
+ * @cert_max: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
+ * @data: The PEM encoded certificate.
+ * @format: One of DER or PEM.
+ * @flags: must be zero or an OR'd sequence of gnutls_certificate_import_flags.
+ *
+ * This function will convert the given PEM encoded certificate list
+ * to the native gnutls_x509_crt_t format. The output will be stored
+ * in @certs.  They will be automatically initialized.
+ *
+ * If the Certificate is PEM encoded it should have a header of "X509
+ * CERTIFICATE", or "CERTIFICATE".
+ *
+ * Returns: the number of certificates read or a negative error value.
+ **/
+int
+gnutls_x509_crt_list_import (gnutls_x509_crt_t * certs,
+                             unsigned int *cert_max,
+                             const gnutls_datum_t * data,
+                             gnutls_x509_crt_fmt_t format, unsigned int flags)
+{
+  int size;
+  const char *ptr;
+  gnutls_datum_t tmp;
+  int ret, nocopy = 0;
+  unsigned int count = 0, j;
+
+  if (format == GNUTLS_X509_FMT_DER)
+    {
+      if (*cert_max < 1)
+        {
+          *cert_max = 1;
+          return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        }
+
+      count = 1;                /* import only the first one */
+
+      ret = gnutls_x509_crt_init (&certs[0]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto error;
+        }
+
+      ret = gnutls_x509_crt_import (certs[0], data, format);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto error;
+        }
+
+      *cert_max = 1;
+      return 1;
+    }
+
+  /* move to the certificate
+   */
+  ptr = memmem (data->data, data->size,
+                PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+  if (ptr == NULL)
+    ptr = memmem (data->data, data->size,
+                  PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
+
+  if (ptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+  size = data->size - (ptr - (char *) data->data);
+
+  count = 0;
+
+  do
+    {
+      if (count >= *cert_max)
+        {
+          if (!(flags & GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED))
+            break;
+          else
+            nocopy = 1;
+        }
+
+      if (!nocopy)
+        {
+          ret = gnutls_x509_crt_init (&certs[count]);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto error;
+            }
+
+          tmp.data = (void *) ptr;
+          tmp.size = size;
+
+          ret =
+            gnutls_x509_crt_import (certs[count], &tmp, GNUTLS_X509_FMT_PEM);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto error;
+            }
+        }
+
+      /* now we move ptr after the pem header 
+       */
+      ptr++;
+      /* find the next certificate (if any)
+       */
+      size = data->size - (ptr - (char *) data->data);
+
+      if (size > 0)
+        {
+          char *ptr2;
+
+          ptr2 = memmem (ptr, size, PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+          if (ptr2 == NULL)
+            ptr2 =
+              memmem (ptr, size, PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
+
+          ptr = ptr2;
+        }
+      else
+        ptr = NULL;
+
+      count++;
+    }
+  while (ptr != NULL);
+
+  *cert_max = count;
+
+  if (nocopy == 0)
+    return count;
+  else
+    return GNUTLS_E_SHORT_MEMORY_BUFFER;
+
+error:for (j = 0; j < count; j++)
+    gnutls_x509_crt_deinit (certs[j]);
+  return ret;
+}
diff --git a/src/daemon/https/x509/x509.h b/src/daemon/https/x509/x509.h
new file mode 100644
index 00000000..c9bb22ef
--- /dev/null
+++ b/src/daemon/https/x509/x509.h
@@ -0,0 +1,928 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef X509_H
+# define X509_H
+
+#define MIN(X,Y) ((X) > (Y) ? (Y) : (X));
+
+#ifdef __cplusplus
+extern "C"
+  {
+#endif
+
+#include <gnutls.h>
+// TODO #include "libtasn1.h"
+#include "gnutls_mpi.h"
+
+/* Some OIDs usually found in Distinguished names, or
+ * in Subject Directory Attribute extensions.
+ */
+#define GNUTLS_OID_X520_COUNTRY_NAME    "2.5.4.6"
+#define GNUTLS_OID_X520_ORGANIZATION_NAME "2.5.4.10"
+#define GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME "2.5.4.11"
+#define GNUTLS_OID_X520_COMMON_NAME   "2.5.4.3"
+#define GNUTLS_OID_X520_LOCALITY_NAME   "2.5.4.7"
+#define GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME  "2.5.4.8"
+
+#define GNUTLS_OID_X520_INITIALS    "2.5.4.43"
+#define GNUTLS_OID_X520_GENERATION_QUALIFIER  "2.5.4.44"
+#define GNUTLS_OID_X520_SURNAME     "2.5.4.4"
+#define GNUTLS_OID_X520_GIVEN_NAME    "2.5.4.42"
+#define GNUTLS_OID_X520_TITLE     "2.5.4.12"
+#define GNUTLS_OID_X520_DN_QUALIFIER    "2.5.4.46"
+#define GNUTLS_OID_X520_PSEUDONYM   "2.5.4.65"
+
+#define GNUTLS_OID_LDAP_DC      "0.9.2342.19200300.100.1.25"
+#define GNUTLS_OID_LDAP_UID     "0.9.2342.19200300.100.1.1"
+
+/* The following should not be included in DN.
+ */
+#define GNUTLS_OID_PKCS9_EMAIL      "1.2.840.113549.1.9.1"
+
+#define GNUTLS_OID_PKIX_DATE_OF_BIRTH   "1.3.6.1.5.5.7.9.1"
+#define GNUTLS_OID_PKIX_PLACE_OF_BIRTH    "1.3.6.1.5.5.7.9.2"
+#define GNUTLS_OID_PKIX_GENDER      "1.3.6.1.5.5.7.9.3"
+#define GNUTLS_OID_PKIX_COUNTRY_OF_CITIZENSHIP  "1.3.6.1.5.5.7.9.4"
+#define GNUTLS_OID_PKIX_COUNTRY_OF_RESIDENCE  "1.3.6.1.5.5.7.9.5"
+
+/* Key purpose Object Identifiers.
+ */
+#define GNUTLS_KP_TLS_WWW_SERVER    "1.3.6.1.5.5.7.3.1"
+#define GNUTLS_KP_TLS_WWW_CLIENT                "1.3.6.1.5.5.7.3.2"
+#define GNUTLS_KP_CODE_SIGNING      "1.3.6.1.5.5.7.3.3"
+#define GNUTLS_KP_EMAIL_PROTECTION    "1.3.6.1.5.5.7.3.4"
+#define GNUTLS_KP_TIME_STAMPING     "1.3.6.1.5.5.7.3.8"
+#define GNUTLS_KP_OCSP_SIGNING      "1.3.6.1.5.5.7.3.9"
+#define GNUTLS_KP_ANY       "2.5.29.37.0"
+
+/* Certificate handling functions.
+ */
+typedef enum gnutls_certificate_import_flags
+  {
+    /* Fail if the certificates in the buffer are more than the space
+     * allocated for certificates. The error code will be
+     * GNUTLS_E_SHORT_MEMORY_BUFFER.
+     */
+    GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED = 1
+  } gnutls_certificate_import_flags;
+
+int gnutls_x509_crt_init(gnutls_x509_crt_t * cert);
+void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_import(gnutls_x509_crt_t cert,
+                           const gnutls_datum_t * data,
+                           gnutls_x509_crt_fmt_t format);
+int gnutls_x509_crt_list_import(gnutls_x509_crt_t * certs,
+                                unsigned int *cert_max,
+                                const gnutls_datum_t * data,
+                                gnutls_x509_crt_fmt_t format,
+                                unsigned int flags);
+int gnutls_x509_crt_export(gnutls_x509_crt_t cert,
+                           gnutls_x509_crt_fmt_t format,
+                           void *output_data,
+                           size_t * output_data_size);
+int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt_t cert,
+                                  char *buf,
+                                  size_t * sizeof_buf);
+int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert,
+                                      int indx,
+                                      void *oid,
+                                      size_t * sizeof_oid);
+int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
+                                         const char *oid,
+                                         int indx,
+                                         unsigned int raw_flag,
+                                         void *buf,
+                                         size_t * sizeof_buf);
+int gnutls_x509_crt_get_dn(gnutls_x509_crt_t cert,
+                           char *buf,
+                           size_t * sizeof_buf);
+int gnutls_x509_crt_get_dn_oid(gnutls_x509_crt_t cert,
+                               int indx,
+                               void *oid,
+                               size_t * sizeof_oid);
+int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert,
+                                  const char *oid,
+                                  int indx,
+                                  unsigned int raw_flag,
+                                  void *buf,
+                                  size_t * sizeof_buf);
+int gnutls_x509_crt_check_hostname(gnutls_x509_crt_t cert,
+                                   const char *hostname);
+
+int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert,
+                                  char *sig,
+                                  size_t *sizeof_sig);
+int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_get_key_id(gnutls_x509_crt_t crt,
+                               unsigned int flags,
+                               unsigned char *output_data,
+                               size_t * output_data_size);
+
+int gnutls_x509_crt_set_authority_key_id(gnutls_x509_crt_t cert,
+                                         const void *id,
+                                         size_t id_size);
+int gnutls_x509_crt_get_authority_key_id(gnutls_x509_crt_t cert,
+                                         void *ret,
+                                         size_t * ret_size,
+                                         unsigned int *critical);
+
+int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert,
+                                       void *ret,
+                                       size_t * ret_size,
+                                       unsigned int *critical);
+
+#define GNUTLS_CRL_REASON_UNUSED 128
+#define GNUTLS_CRL_REASON_KEY_COMPROMISE 64
+#define GNUTLS_CRL_REASON_CA_COMPROMISE 32
+#define GNUTLS_CRL_REASON_AFFILIATION_CHANGED 16
+#define GNUTLS_CRL_REASON_SUPERSEEDED 8
+#define GNUTLS_CRL_REASON_CESSATION_OF_OPERATION 4
+#define GNUTLS_CRL_REASON_CERTIFICATE_HOLD 2
+#define GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN 1
+#define GNUTLS_CRL_REASON_AA_COMPROMISE 32768
+
+int gnutls_x509_crt_get_crl_dist_points(gnutls_x509_crt_t cert,
+                                        unsigned int seq,
+                                        void *ret,
+                                        size_t * ret_size,
+                                        unsigned int *reason_flags,
+                                        unsigned int *critical);
+int gnutls_x509_crt_set_crl_dist_points(gnutls_x509_crt_t crt,
+                                        gnutls_x509_subject_alt_name_t
+                                        type,
+                                        const void *data_string,
+                                        unsigned int reason_flags);
+int gnutls_x509_crt_cpy_crl_dist_points(gnutls_x509_crt_t dst,
+                                        gnutls_x509_crt_t src);
+
+time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt_t cert);
+time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert,
+                               void *result,
+                               size_t * result_size);
+
+int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
+                                     unsigned int *bits);
+int gnutls_x509_crt_get_pk_rsa_raw(gnutls_x509_crt_t crt,
+                                   gnutls_datum_t * m,
+                                   gnutls_datum_t * e);
+int gnutls_x509_crt_get_pk_dsa_raw(gnutls_x509_crt_t crt,
+                                   gnutls_datum_t * p,
+                                   gnutls_datum_t * q,
+                                   gnutls_datum_t * g,
+                                   gnutls_datum_t * y);
+
+int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
+                                         unsigned int seq,
+                                         void *ret,
+                                         size_t * ret_size,
+                                         unsigned int *critical);
+int gnutls_x509_crt_get_subject_alt_name2(gnutls_x509_crt_t cert,
+                                          unsigned int seq,
+                                          void *ret,
+                                          size_t * ret_size,
+                                          unsigned int* ret_type,
+                                          unsigned int *critical);
+
+int gnutls_x509_crt_get_subject_alt_othername_oid(gnutls_x509_crt_t cert,
+                                                  unsigned int seq,
+                                                  void *ret,
+                                                  size_t * ret_size);
+
+int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
+                                  unsigned int *critical);
+int gnutls_x509_crt_get_basic_constraints(gnutls_x509_crt_t cert,
+                                          unsigned int *critical,
+                                          int *ca,
+                                          int *pathlen);
+
+/* The key_usage flags are defined in gnutls.h. They are the
+ * GNUTLS_KEY_* definitions.
+ */
+int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
+                                  unsigned int *key_usage,
+                                  unsigned int *critical);
+int gnutls_x509_crt_set_key_usage(gnutls_x509_crt_t crt,
+                                  unsigned int usage);
+
+int gnutls_x509_crt_get_proxy(gnutls_x509_crt_t cert,
+                              unsigned int *critical,
+                              int *pathlen,
+                              char **policyLanguage,
+                              char **policy,
+                              size_t *sizeof_policy);
+
+int gnutls_x509_dn_oid_known(const char *oid);
+
+/* Read extensions by OID. */
+int gnutls_x509_crt_get_extension_oid(gnutls_x509_crt_t cert,
+                                      int indx,
+                                      void *oid,
+                                      size_t * sizeof_oid);
+int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt_t cert,
+                                         const char *oid,
+                                         int indx,
+                                         void *buf,
+                                         size_t * sizeof_buf,
+                                         unsigned int *critical);
+
+/* Read extensions by sequence number. */
+int gnutls_x509_crt_get_extension_info(gnutls_x509_crt_t cert,
+                                       int indx,
+                                       void *oid,
+                                       size_t * sizeof_oid,
+                                       int *critical);
+int gnutls_x509_crt_get_extension_data(gnutls_x509_crt_t cert,
+                                       int indx,
+                                       void *data,
+                                       size_t * sizeof_data);
+
+int gnutls_x509_crt_set_extension_by_oid(gnutls_x509_crt_t crt,
+                                         const char *oid,
+                                         const void *buf,
+                                         size_t sizeof_buf,
+                                         unsigned int critical);
+
+/* X.509 Certificate writing.
+ */
+int gnutls_x509_crt_set_dn_by_oid(gnutls_x509_crt_t crt,
+                                  const char *oid,
+                                  unsigned int raw_flag,
+                                  const void *name,
+                                  unsigned int sizeof_name);
+int gnutls_x509_crt_set_issuer_dn_by_oid(gnutls_x509_crt_t crt,
+                                         const char *oid,
+                                         unsigned int raw_flag,
+                                         const void *name,
+                                         unsigned int sizeof_name);
+int gnutls_x509_crt_set_version(gnutls_x509_crt_t crt,
+                                unsigned int version);
+int gnutls_x509_crt_set_key(gnutls_x509_crt_t crt,
+                            gnutls_x509_privkey_t key);
+int gnutls_x509_crt_set_ca_status(gnutls_x509_crt_t crt,
+                                  unsigned int ca);
+int gnutls_x509_crt_set_basic_constraints(gnutls_x509_crt_t crt,
+                                          unsigned int ca,
+                                          int pathLenConstraint);
+int gnutls_x509_crt_set_subject_alternative_name(gnutls_x509_crt_t crt,
+                                                 gnutls_x509_subject_alt_name_t
+                                                 type,
+                                                 const char *data_string);
+int gnutls_x509_crt_sign(gnutls_x509_crt_t crt,
+                         gnutls_x509_crt_t issuer,
+                         gnutls_x509_privkey_t issuer_key);
+int gnutls_x509_crt_sign2(gnutls_x509_crt_t crt,
+                          gnutls_x509_crt_t issuer,
+                          gnutls_x509_privkey_t issuer_key,
+                          gnutls_digest_algorithm_t,
+                          unsigned int flags);
+int gnutls_x509_crt_set_activation_time(gnutls_x509_crt_t cert,
+                                        time_t act_time);
+int gnutls_x509_crt_set_expiration_time(gnutls_x509_crt_t cert,
+                                        time_t exp_time);
+int gnutls_x509_crt_set_serial(gnutls_x509_crt_t cert,
+                               const void *serial,
+                               size_t serial_size);
+
+int gnutls_x509_crt_set_subject_key_id(gnutls_x509_crt_t cert,
+                                       const void *id,
+                                       size_t id_size);
+
+int gnutls_x509_crt_set_proxy_dn(gnutls_x509_crt_t crt,
+                                 gnutls_x509_crt_t eecrt,
+                                 unsigned int raw_flag,
+                                 const void *name,
+                                 unsigned int sizeof_name);
+int gnutls_x509_crt_set_proxy(gnutls_x509_crt_t crt,
+                              int pathLenConstraint,
+                              const char *policyLanguage,
+                              const char *policy,
+                              size_t sizeof_policy);
+
+typedef enum gnutls_certificate_print_formats
+  {
+    GNUTLS_X509_CRT_FULL,
+    GNUTLS_X509_CRT_ONELINE,
+    GNUTLS_X509_CRT_UNSIGNED_FULL
+  } gnutls_certificate_print_formats_t;
+
+int gnutls_x509_crt_print(gnutls_x509_crt_t cert,
+                          gnutls_certificate_print_formats_t format,
+                          gnutls_datum_t *out);
+int gnutls_x509_crl_print(gnutls_x509_crl_t crl,
+                          gnutls_certificate_print_formats_t format,
+                          gnutls_datum_t *out);
+
+/* Access to internal Certificate fields.
+ */
+int gnutls_x509_crt_get_raw_issuer_dn(gnutls_x509_crt_t cert,
+                                      gnutls_datum_t * start);
+int gnutls_x509_crt_get_raw_dn(gnutls_x509_crt_t cert,
+                               gnutls_datum_t * start);
+
+/* RDN handling.
+ */
+int gnutls_x509_rdn_get(const gnutls_datum_t * idn,
+                        char *buf,
+                        size_t * sizeof_buf);
+int gnutls_x509_rdn_get_oid(const gnutls_datum_t * idn,
+                            int indx,
+                            void *buf,
+                            size_t * sizeof_buf);
+
+int gnutls_x509_rdn_get_by_oid(const gnutls_datum_t * idn,
+                               const char *oid,
+                               int indx,
+                               unsigned int raw_flag,
+                               void *buf,
+                               size_t * sizeof_buf);
+
+typedef void *gnutls_x509_dn_t;
+
+typedef struct gnutls_x509_ava_st
+  {
+    gnutls_datum_t oid;
+    gnutls_datum_t value;
+    unsigned long value_tag;
+  } gnutls_x509_ava_st;
+
+int gnutls_x509_crt_get_subject(gnutls_x509_crt_t cert,
+                                gnutls_x509_dn_t *dn);
+int gnutls_x509_crt_get_issuer(gnutls_x509_crt_t cert,
+                               gnutls_x509_dn_t *dn);
+int gnutls_x509_dn_get_rdn_ava(gnutls_x509_dn_t dn,
+                               int irdn,
+                               int iava,
+                               gnutls_x509_ava_st *avast);
+
+/* CRL handling functions.
+ */
+int gnutls_x509_crl_init(gnutls_x509_crl_t * crl);
+void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
+
+int gnutls_x509_crl_import(gnutls_x509_crl_t crl,
+                           const gnutls_datum_t * data,
+                           gnutls_x509_crt_fmt_t format);
+int gnutls_x509_crl_export(gnutls_x509_crl_t crl,
+                           gnutls_x509_crt_fmt_t format,
+                           void *output_data,
+                           size_t * output_data_size);
+
+int gnutls_x509_crl_get_issuer_dn(const gnutls_x509_crl_t crl,
+                                  char *buf,
+                                  size_t * sizeof_buf);
+int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl,
+                                         const char *oid,
+                                         int indx,
+                                         unsigned int raw_flag,
+                                         void *buf,
+                                         size_t * sizeof_buf);
+int gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl,
+                               int indx,
+                               void *oid,
+                               size_t * sizeof_oid);
+
+int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl);
+int gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl,
+                                  char *sig,
+                                  size_t *sizeof_sig);
+int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl);
+
+time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl);
+time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl);
+
+int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
+int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl,
+                                   int indx,
+                                   unsigned char *serial,
+                                   size_t * serial_size,
+                                   time_t * t);
+#define gnutls_x509_crl_get_certificate_count gnutls_x509_crl_get_crt_count
+#define gnutls_x509_crl_get_certificate gnutls_x509_crl_get_crt_serial
+
+int gnutls_x509_crl_check_issuer(gnutls_x509_crl_t crl,
+                                 gnutls_x509_crt_t issuer);
+
+/* CRL writing.
+ */
+int gnutls_x509_crl_set_version(gnutls_x509_crl_t crl,
+                                unsigned int version);
+int gnutls_x509_crl_sign(gnutls_x509_crl_t crl,
+                         gnutls_x509_crt_t issuer,
+                         gnutls_x509_privkey_t issuer_key);
+int gnutls_x509_crl_sign2(gnutls_x509_crl_t crl,
+                          gnutls_x509_crt_t issuer,
+                          gnutls_x509_privkey_t issuer_key,
+                          gnutls_digest_algorithm_t,
+                          unsigned int flags);
+int gnutls_x509_crl_set_this_update(gnutls_x509_crl_t crl,
+                                    time_t act_time);
+int gnutls_x509_crl_set_next_update(gnutls_x509_crl_t crl,
+                                    time_t exp_time);
+int gnutls_x509_crl_set_crt_serial(gnutls_x509_crl_t crl,
+                                   const void *serial,
+                                   size_t serial_size,
+                                   time_t revocation_time);
+int gnutls_x509_crl_set_crt(gnutls_x509_crl_t crl,
+                            gnutls_x509_crt_t crt,
+                            time_t revocation_time);
+
+/* PKCS7 structures handling
+ */
+struct gnutls_pkcs7_int;
+typedef struct gnutls_pkcs7_int *gnutls_pkcs7_t;
+
+int gnutls_pkcs7_init(gnutls_pkcs7_t * pkcs7);
+void gnutls_pkcs7_deinit(gnutls_pkcs7_t pkcs7);
+int gnutls_pkcs7_import(gnutls_pkcs7_t pkcs7,
+                        const gnutls_datum_t * data,
+                        gnutls_x509_crt_fmt_t format);
+int gnutls_pkcs7_export(gnutls_pkcs7_t pkcs7,
+                        gnutls_x509_crt_fmt_t format,
+                        void *output_data,
+                        size_t * output_data_size);
+
+int gnutls_pkcs7_get_crt_count(gnutls_pkcs7_t pkcs7);
+int gnutls_pkcs7_get_crt_raw(gnutls_pkcs7_t pkcs7,
+                             int indx,
+                             void *certificate,
+                             size_t * certificate_size);
+
+int gnutls_pkcs7_set_crt_raw(gnutls_pkcs7_t pkcs7,
+                             const gnutls_datum_t * crt);
+int gnutls_pkcs7_set_crt(gnutls_pkcs7_t pkcs7,
+                         gnutls_x509_crt_t crt);
+int gnutls_pkcs7_delete_crt(gnutls_pkcs7_t pkcs7,
+                            int indx);
+
+int gnutls_pkcs7_get_crl_raw(gnutls_pkcs7_t pkcs7,
+                             int indx,
+                             void *crl,
+                             size_t * crl_size);
+int gnutls_pkcs7_get_crl_count(gnutls_pkcs7_t pkcs7);
+
+int gnutls_pkcs7_set_crl_raw(gnutls_pkcs7_t pkcs7,
+                             const gnutls_datum_t * crt);
+int gnutls_pkcs7_set_crl(gnutls_pkcs7_t pkcs7,
+                         gnutls_x509_crl_t crl);
+int gnutls_pkcs7_delete_crl(gnutls_pkcs7_t pkcs7,
+                            int indx);
+
+/* X.509 Certificate verification functions.
+ */
+typedef enum gnutls_certificate_verify_flags
+  {
+    /* If set a signer does not have to be a certificate authority. This
+     * flag should normaly be disabled, unless you know what this means.
+     */
+    GNUTLS_VERIFY_DISABLE_CA_SIGN = 1,
+
+    /* Allow only trusted CA certificates that have version 1.  This is
+     * safer than GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT, and should be
+     * used instead. That way only signers in your trusted list will be
+     * allowed to have certificates of version 1.
+     */
+    GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT = 2,
+
+    /* If a certificate is not signed by anyone trusted but exists in
+     * the trusted CA list do not treat it as trusted.
+     */
+    GNUTLS_VERIFY_DO_NOT_ALLOW_SAME = 4,
+
+    /* Allow CA certificates that have version 1 (both root and
+     * intermediate). This might be dangerous since those haven't the
+     * basicConstraints extension. Must be used in combination with
+     * GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT.
+     */
+    GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT = 8,
+
+    /* Allow certificates to be signed using the broken MD2 algorithm.
+     */
+    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 = 16,
+
+    /* Allow certificates to be signed using the broken MD5 algorithm.
+     */
+    GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5 = 32
+  } gnutls_certificate_verify_flags;
+
+int gnutls_x509_crt_check_issuer(gnutls_x509_crt_t cert,
+                                 gnutls_x509_crt_t issuer);
+
+int gnutls_x509_crt_list_verify(const gnutls_x509_crt_t * cert_list,
+                                int cert_list_length,
+                                const gnutls_x509_crt_t * CA_list,
+                                int CA_list_length,
+                                const gnutls_x509_crl_t * CRL_list,
+                                int CRL_list_length,
+                                unsigned int flags,
+                                unsigned int *verify);
+
+int gnutls_x509_crt_verify(gnutls_x509_crt_t cert,
+                           const gnutls_x509_crt_t * CA_list,
+                           int CA_list_length,
+                           unsigned int flags,
+                           unsigned int *verify);
+int gnutls_x509_crl_verify(gnutls_x509_crl_t crl,
+                           const gnutls_x509_crt_t * CA_list,
+                           int CA_list_length,
+                           unsigned int flags,
+                           unsigned int *verify);
+
+int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
+                                     const gnutls_x509_crl_t *
+                                     crl_list,
+                                     int crl_list_length);
+
+int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt_t cert,
+                                    gnutls_digest_algorithm_t algo,
+                                    void *buf,
+                                    size_t * sizeof_buf);
+
+int gnutls_x509_crt_get_key_purpose_oid(gnutls_x509_crt_t cert,
+                                        int indx,
+                                        void *oid,
+                                        size_t * sizeof_oid,
+                                        unsigned int *critical);
+int gnutls_x509_crt_set_key_purpose_oid(gnutls_x509_crt_t cert,
+                                        const void *oid,
+                                        unsigned int critical);
+
+/* Private key handling.
+ */
+
+/* Flags for the gnutls_x509_privkey_export_pkcs8() function.
+ */
+typedef enum gnutls_pkcs_encrypt_flags_t
+  {
+    GNUTLS_PKCS_PLAIN = 1, /* if set the private key will not
+     * be encrypted.
+     */
+    GNUTLS_PKCS_USE_PKCS12_3DES = 2,
+    GNUTLS_PKCS_USE_PKCS12_ARCFOUR = 4,
+    GNUTLS_PKCS_USE_PKCS12_RC2_40 = 8,
+    GNUTLS_PKCS_USE_PBES2_3DES = 16
+  } gnutls_pkcs_encrypt_flags_t;
+
+#define GNUTLS_PKCS8_PLAIN GNUTLS_PKCS_PLAIN
+#define GNUTLS_PKCS8_USE_PKCS12_3DES GNUTLS_PKCS_USE_PKCS12_3DES
+#define GNUTLS_PKCS8_USE_PKCS12_ARCFOUR GNUTLS_PKCS_USE_PKCS12_ARCFOUR
+#define GNUTLS_PKCS8_USE_PKCS12_RC2_40 GNUTLS_PKCS_USE_PKCS12_RC2_40
+
+int gnutls_x509_privkey_init(gnutls_x509_privkey_t * key);
+void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
+int gnutls_x509_privkey_cpy(gnutls_x509_privkey_t dst,
+                            gnutls_x509_privkey_t src);
+int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
+                               const gnutls_datum_t * data,
+                               gnutls_x509_crt_fmt_t format);
+int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey_t key,
+                                     const gnutls_datum_t * data,
+                                     gnutls_x509_crt_fmt_t format,
+                                     const char *pass,
+                                     unsigned int flags);
+int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
+                                       const gnutls_datum_t * m,
+                                       const gnutls_datum_t * e,
+                                       const gnutls_datum_t * d,
+                                       const gnutls_datum_t * p,
+                                       const gnutls_datum_t * q,
+                                       const gnutls_datum_t * u);
+int gnutls_x509_privkey_fix(gnutls_x509_privkey_t key);
+
+int gnutls_x509_privkey_export_dsa_raw(gnutls_x509_privkey_t key,
+                                       gnutls_datum_t * p,
+                                       gnutls_datum_t * q,
+                                       gnutls_datum_t * g,
+                                       gnutls_datum_t * y,
+                                       gnutls_datum_t * x);
+int gnutls_x509_privkey_import_dsa_raw(gnutls_x509_privkey_t key,
+                                       const gnutls_datum_t * p,
+                                       const gnutls_datum_t * q,
+                                       const gnutls_datum_t * g,
+                                       const gnutls_datum_t * y,
+                                       const gnutls_datum_t * x);
+
+int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
+int gnutls_x509_privkey_get_key_id(gnutls_x509_privkey_t key,
+                                   unsigned int flags,
+                                   unsigned char *output_data,
+                                   size_t * output_data_size);
+
+int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
+                                 gnutls_pk_algorithm_t algo,
+                                 unsigned int bits,
+                                 unsigned int flags);
+
+int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
+                               gnutls_x509_crt_fmt_t format,
+                               void *output_data,
+                               size_t * output_data_size);
+int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey_t key,
+                                     gnutls_x509_crt_fmt_t format,
+                                     const char *password,
+                                     unsigned int flags,
+                                     void *output_data,
+                                     size_t * output_data_size);
+int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
+                                       gnutls_datum_t * m,
+                                       gnutls_datum_t * e,
+                                       gnutls_datum_t * d,
+                                       gnutls_datum_t * p,
+                                       gnutls_datum_t * q,
+                                       gnutls_datum_t * u);
+
+/* Signing stuff.
+ */
+int gnutls_x509_privkey_sign_data(gnutls_x509_privkey_t key,
+                                  gnutls_digest_algorithm_t digest,
+                                  unsigned int flags,
+                                  const gnutls_datum_t * data,
+                                  void *signature,
+                                  size_t * signature_size);
+int gnutls_x509_privkey_verify_data(gnutls_x509_privkey_t key,
+                                    unsigned int flags,
+                                    const gnutls_datum_t * data,
+                                    const gnutls_datum_t * signature);
+int gnutls_x509_crt_verify_data(gnutls_x509_crt_t crt,
+                                unsigned int flags,
+                                const gnutls_datum_t * data,
+                                const gnutls_datum_t * signature);
+
+int gnutls_x509_privkey_sign_hash(gnutls_x509_privkey_t key,
+                                  const gnutls_datum_t * hash,
+                                  gnutls_datum_t * signature);
+
+/* Certificate request stuff.
+ */
+struct gnutls_x509_crq_int;
+typedef struct gnutls_x509_crq_int *gnutls_x509_crq_t;
+
+int gnutls_x509_crq_init(gnutls_x509_crq_t * crq);
+void gnutls_x509_crq_deinit(gnutls_x509_crq_t crq);
+int gnutls_x509_crq_import(gnutls_x509_crq_t crq,
+                           const gnutls_datum_t * data,
+                           gnutls_x509_crt_fmt_t format);
+int gnutls_x509_crq_get_pk_algorithm(gnutls_x509_crq_t crq,
+                                     unsigned int *bits);
+int gnutls_x509_crq_get_dn(gnutls_x509_crq_t crq,
+                           char *buf,
+                           size_t * sizeof_buf);
+int gnutls_x509_crq_get_dn_oid(gnutls_x509_crq_t crq,
+                               int indx,
+                               void *oid,
+                               size_t * sizeof_oid);
+int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq_t crq,
+                                  const char *oid,
+                                  int indx,
+                                  unsigned int raw_flag,
+                                  void *buf,
+                                  size_t * sizeof_buf);
+int gnutls_x509_crq_set_dn_by_oid(gnutls_x509_crq_t crq,
+                                  const char *oid,
+                                  unsigned int raw_flag,
+                                  const void *name,
+                                  unsigned int sizeof_name);
+int gnutls_x509_crq_set_version(gnutls_x509_crq_t crq,
+                                unsigned int version);
+int gnutls_x509_crq_set_key(gnutls_x509_crq_t crq,
+                            gnutls_x509_privkey_t key);
+int gnutls_x509_crq_sign2(gnutls_x509_crq_t crq,
+                          gnutls_x509_privkey_t key,
+                          gnutls_digest_algorithm_t,
+                          unsigned int flags);
+int gnutls_x509_crq_sign(gnutls_x509_crq_t crq,
+                         gnutls_x509_privkey_t key);
+
+int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq_t crq,
+                                           const char *pass);
+int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq_t crq,
+                                           char *pass,
+                                           size_t * sizeof_pass);
+
+int gnutls_x509_crq_set_attribute_by_oid(gnutls_x509_crq_t crq,
+                                         const char *oid,
+                                         void *buf,
+                                         size_t sizeof_buf);
+int gnutls_x509_crq_get_attribute_by_oid(gnutls_x509_crq_t crq,
+                                         const char *oid,
+                                         int indx,
+                                         void *buf,
+                                         size_t * sizeof_buf);
+
+int gnutls_x509_crq_export(gnutls_x509_crq_t crq,
+                           gnutls_x509_crt_fmt_t format,
+                           void *output_data,
+                           size_t * output_data_size);
+
+int gnutls_x509_crt_set_crq(gnutls_x509_crt_t crt,
+                            gnutls_x509_crq_t crq);
+
+#ifdef __cplusplus
+}
+#endif
+
+#define HASH_OID_SHA1 "1.3.14.3.2.26"
+#define HASH_OID_MD5 "1.2.840.113549.2.5"
+#define HASH_OID_MD2 "1.2.840.113549.2.2"
+#define HASH_OID_RMD160 "1.3.36.3.2.1"
+#define HASH_OID_SHA256 "2.16.840.1.101.3.4.2.1"
+#define HASH_OID_SHA384 "2.16.840.1.101.3.4.2.2"
+#define HASH_OID_SHA512 "2.16.840.1.101.3.4.2.3"
+
+typedef struct gnutls_x509_crl_int
+  {
+    ASN1_TYPE crl;
+  } gnutls_x509_crl_int;
+
+typedef struct gnutls_x509_crt_int
+  {
+    ASN1_TYPE cert;
+    int use_extensions;
+  } gnutls_x509_crt_int;
+
+#define MAX_PRIV_PARAMS_SIZE 6  /* ok for RSA and DSA */
+
+/* parameters should not be larger than this limit */
+#define DSA_PRIVATE_PARAMS 5
+#define DSA_PUBLIC_PARAMS 4
+#define RSA_PRIVATE_PARAMS 6
+#define RSA_PUBLIC_PARAMS 2
+
+#if MAX_PRIV_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0
+# error INCREASE MAX_PRIV_PARAMS
+#endif
+
+#if MAX_PRIV_PARAMS_SIZE - DSA_PRIVATE_PARAMS < 0
+# error INCREASE MAX_PRIV_PARAMS
+#endif
+
+typedef struct gnutls_x509_privkey_int
+  {
+    mpi_t params[MAX_PRIV_PARAMS_SIZE]; /* the size of params depends on the public 
+     * key algorithm 
+     */
+    /*
+     * RSA: [0] is modulus
+     *      [1] is public exponent
+     *      [2] is private exponent
+     *      [3] is prime1 (p)
+     *      [4] is prime2 (q)
+     *      [5] is coefficient (u == inverse of p mod q)
+     *          note that other packages used inverse of q mod p,
+     *          so we need to perform conversions.
+     * DSA: [0] is p
+     *      [1] is q
+     *      [2] is g
+     *      [3] is y (public key)
+     *      [4] is x (private key)
+     */
+    int params_size; /* holds the number of params */
+
+    gnutls_pk_algorithm_t pk_algorithm;
+
+    int crippled; /* The crippled keys will not use the ASN1_TYPE key.
+     * The encoding will only be performed at the export
+     * phase, to optimize copying etc. Cannot be used with
+     * the exported API (used internally only).
+     */
+    ASN1_TYPE key;
+  } gnutls_x509_privkey_int;
+
+int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt_t cert,
+                                         const char *oid,
+                                         int indx,
+                                         unsigned int raw_flag,
+                                         void *buf,
+                                         size_t * sizeof_buf);
+int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt_t cert,
+                                         unsigned int seq,
+                                         void *ret,
+                                         size_t * ret_size,
+                                         unsigned int *critical);
+int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt_t cert,
+                                  const char *oid,
+                                  int indx,
+                                  unsigned int raw_flag,
+                                  void *buf,
+                                  size_t * sizeof_buf);
+int gnutls_x509_crt_get_ca_status(gnutls_x509_crt_t cert,
+                                  unsigned int *critical);
+int gnutls_x509_crt_get_pk_algorithm(gnutls_x509_crt_t cert,
+                                     unsigned int *bits);
+
+int _gnutls_x509_crt_cpy(gnutls_x509_crt_t dest,
+                         gnutls_x509_crt_t src);
+
+int gnutls_x509_crt_get_serial(gnutls_x509_crt_t cert,
+                               void *result,
+                               size_t * result_size);
+
+int _gnutls_x509_compare_raw_dn(const gnutls_datum_t * dn1,
+                                const gnutls_datum_t * dn2);
+
+int gnutls_x509_crt_check_revocation(gnutls_x509_crt_t cert,
+                                     const gnutls_x509_crl_t * crl_list,
+                                     int crl_list_length);
+
+int _gnutls_x509_crl_cpy(gnutls_x509_crl_t dest,
+                         gnutls_x509_crl_t src);
+int _gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl,
+                                       gnutls_datum_t * dn);
+int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl);
+int gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl,
+                                   int indx,
+                                   unsigned char *serial,
+                                   size_t * serial_size,
+                                   time_t * t);
+
+void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl);
+int gnutls_x509_crl_init(gnutls_x509_crl_t * crl);
+int gnutls_x509_crl_import(gnutls_x509_crl_t crl,
+                           const gnutls_datum_t * data,
+                           gnutls_x509_crt_fmt_t format);
+int gnutls_x509_crl_export(gnutls_x509_crl_t crl,
+                           gnutls_x509_crt_fmt_t format,
+                           void *output_data,
+                           size_t * output_data_size);
+
+int gnutls_x509_crt_init(gnutls_x509_crt_t * cert);
+void gnutls_x509_crt_deinit(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_import(gnutls_x509_crt_t cert,
+                           const gnutls_datum_t * data,
+                           gnutls_x509_crt_fmt_t format);
+int gnutls_x509_crt_export(gnutls_x509_crt_t cert,
+                           gnutls_x509_crt_fmt_t format,
+                           void *output_data,
+                           size_t * output_data_size);
+
+int gnutls_x509_crt_get_key_usage(gnutls_x509_crt_t cert,
+                                  unsigned int *key_usage,
+                                  unsigned int *critical);
+int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
+int gnutls_x509_crt_get_version(gnutls_x509_crt_t cert);
+
+int gnutls_x509_privkey_init(gnutls_x509_privkey_t * key);
+void gnutls_x509_privkey_deinit(gnutls_x509_privkey_t key);
+
+int gnutls_x509_privkey_generate(gnutls_x509_privkey_t key,
+                                 gnutls_pk_algorithm_t algo,
+                                 unsigned int bits,
+                                 unsigned int flags);
+
+int gnutls_x509_privkey_import(gnutls_x509_privkey_t key,
+                               const gnutls_datum_t * data,
+                               gnutls_x509_crt_fmt_t format);
+int gnutls_x509_privkey_get_pk_algorithm(gnutls_x509_privkey_t key);
+int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey_t key,
+                                       const gnutls_datum_t * m,
+                                       const gnutls_datum_t * e,
+                                       const gnutls_datum_t * d,
+                                       const gnutls_datum_t * p,
+                                       const gnutls_datum_t * q,
+                                       const gnutls_datum_t * u);
+int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey_t key,
+                                       gnutls_datum_t * m,
+                                       gnutls_datum_t * e,
+                                       gnutls_datum_t * d,
+                                       gnutls_datum_t * p,
+                                       gnutls_datum_t * q,
+                                       gnutls_datum_t * u);
+int gnutls_x509_privkey_export(gnutls_x509_privkey_t key,
+                               gnutls_x509_crt_fmt_t format,
+                               void *output_data,
+                               size_t * output_data_size);
+
+#define GNUTLS_CRL_REASON_UNUSED 128
+#define GNUTLS_CRL_REASON_KEY_COMPROMISE 64
+#define GNUTLS_CRL_REASON_CA_COMPROMISE 32
+#define GNUTLS_CRL_REASON_AFFILIATION_CHANGED 16
+#define GNUTLS_CRL_REASON_SUPERSEEDED 8
+#define GNUTLS_CRL_REASON_CESSATION_OF_OPERATION 4
+#define GNUTLS_CRL_REASON_CERTIFICATE_HOLD 2
+#define GNUTLS_CRL_REASON_PRIVILEGE_WITHDRAWN 1
+#define GNUTLS_CRL_REASON_AA_COMPROMISE 32768
+
+#endif
diff --git a/src/daemon/https/x509/x509_privkey.c b/src/daemon/https/x509/x509_privkey.c
new file mode 100644
index 00000000..f5c64dee
--- /dev/null
+++ b/src/daemon/https/x509/x509_privkey.c
@@ -0,0 +1,1509 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <gnutls_rsa_export.h>
+#include <gnutls_sig.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <x509.h>
+#include <dn.h>
+#include <mpi.h>
+#include <extensions.h>
+#include <sign.h>
+#include <dsa.h>
+#include <verify.h>
+
+static int _gnutls_asn1_encode_rsa (ASN1_TYPE * c2, mpi_t * params);
+int _gnutls_asn1_encode_dsa (ASN1_TYPE * c2, mpi_t * params);
+
+/* remove this when libgcrypt can handle the PKCS #1 coefficients from
+ * rsa keys
+ */
+#define CALC_COEFF 1
+
+/**
+ * gnutls_x509_privkey_init - This function initializes a gnutls_crl structure
+ * @key: The structure to be initialized
+ *
+ * This function will initialize an private key structure. 
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_init (gnutls_x509_privkey_t * key)
+{
+  *key = gnutls_calloc (1, sizeof (gnutls_x509_privkey_int));
+
+  if (*key)
+    {
+      (*key)->key = ASN1_TYPE_EMPTY;
+      (*key)->pk_algorithm = GNUTLS_PK_UNKNOWN;
+      return 0;                 /* success */
+    }
+
+  return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+ * gnutls_x509_privkey_deinit - This function deinitializes memory used by a gnutls_x509_privkey_t structure
+ * @key: The structure to be initialized
+ *
+ * This function will deinitialize a private key structure. 
+ *
+ **/
+void
+gnutls_x509_privkey_deinit (gnutls_x509_privkey_t key)
+{
+  int i;
+
+  if (!key)
+    return;
+
+  for (i = 0; i < key->params_size; i++)
+    {
+      _gnutls_mpi_release (&key->params[i]);
+    }
+
+  asn1_delete_structure (&key->key);
+  gnutls_free (key);
+}
+
+/**
+ * gnutls_x509_privkey_cpy - This function copies a private key
+ * @dst: The destination key, which should be initialized.
+ * @src: The source key
+ *
+ * This function will copy a private key from source to destination key.
+ *
+ **/
+int
+gnutls_x509_privkey_cpy (gnutls_x509_privkey_t dst, gnutls_x509_privkey_t src)
+{
+  int i, ret;
+
+  if (!src || !dst)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  for (i = 0; i < src->params_size; i++)
+    {
+      dst->params[i] = _gnutls_mpi_copy (src->params[i]);
+      if (dst->params[i] == NULL)
+        return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  dst->params_size = src->params_size;
+  dst->pk_algorithm = src->pk_algorithm;
+  dst->crippled = src->crippled;
+
+  if (!src->crippled)
+    {
+      switch (dst->pk_algorithm)
+        {
+        case GNUTLS_PK_RSA:
+          ret = _gnutls_asn1_encode_rsa (&dst->key, dst->params);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+          break;
+        default:
+          gnutls_assert ();
+          return GNUTLS_E_INVALID_REQUEST;
+        }
+    }
+
+  return 0;
+}
+
+/* Converts an RSA PKCS#1 key to
+ * an internal structure (gnutls_private_key)
+ */
+ASN1_TYPE
+_gnutls_privkey_decode_pkcs1_rsa_key (const gnutls_datum_t * raw_key,
+                                      gnutls_x509_privkey_t pkey)
+{
+  int result;
+  ASN1_TYPE pkey_asn;
+
+  if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
+                                     "GNUTLS.RSAPrivateKey",
+                                     &pkey_asn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if ((sizeof (pkey->params) / sizeof (mpi_t)) < RSA_PRIVATE_PARAMS)
+    {
+      gnutls_assert ();
+      /* internal error. Increase the mpi_ts in params */
+      return NULL;
+    }
+
+  result = asn1_der_decoding (&pkey_asn, raw_key->data, raw_key->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (pkey_asn, "modulus", &pkey->params[0]))
+      < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (pkey_asn, "publicExponent",
+                                       &pkey->params[1])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (pkey_asn, "privateExponent",
+                                       &pkey->params[2])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (pkey_asn, "prime1", &pkey->params[3]))
+      < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (pkey_asn, "prime2", &pkey->params[4]))
+      < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+#ifdef CALC_COEFF
+  /* Calculate the coefficient. This is because the gcrypt
+   * library is uses the p,q in the reverse order.
+   */
+  pkey->params[5] =
+    _gnutls_mpi_snew (_gnutls_mpi_get_nbits (pkey->params[0]));
+
+  if (pkey->params[5] == NULL)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  _gnutls_mpi_invm (pkey->params[5], pkey->params[3], pkey->params[4]);
+  /* p, q */
+#else
+  if ((result = _gnutls_x509_read_int (pkey_asn, "coefficient",
+                                       &pkey->params[5])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+#endif
+  pkey->params_size = 6;
+
+  return pkey_asn;
+
+error:asn1_delete_structure (&pkey_asn);
+  _gnutls_mpi_release (&pkey->params[0]);
+  _gnutls_mpi_release (&pkey->params[1]);
+  _gnutls_mpi_release (&pkey->params[2]);
+  _gnutls_mpi_release (&pkey->params[3]);
+  _gnutls_mpi_release (&pkey->params[4]);
+  _gnutls_mpi_release (&pkey->params[5]);
+  return NULL;
+
+}
+
+static ASN1_TYPE
+decode_dsa_key (const gnutls_datum_t * raw_key, gnutls_x509_privkey_t pkey)
+{
+  int result;
+  ASN1_TYPE dsa_asn;
+
+  if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
+                                     "GNUTLS.DSAPrivateKey",
+                                     &dsa_asn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if ((sizeof (pkey->params) / sizeof (mpi_t)) < DSA_PRIVATE_PARAMS)
+    {
+      gnutls_assert ();
+      /* internal error. Increase the mpi_ts in params */
+      return NULL;
+    }
+
+  result = asn1_der_decoding (&dsa_asn, raw_key->data, raw_key->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (dsa_asn, "p", &pkey->params[0])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (dsa_asn, "q", &pkey->params[1])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (dsa_asn, "g", &pkey->params[2])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result = _gnutls_x509_read_int (dsa_asn, "Y", &pkey->params[3])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  if ((result =
+       _gnutls_x509_read_int (dsa_asn, "priv", &pkey->params[4])) < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pkey->params_size = 5;
+
+  return dsa_asn;
+
+error:asn1_delete_structure (&dsa_asn);
+  _gnutls_mpi_release (&pkey->params[0]);
+  _gnutls_mpi_release (&pkey->params[1]);
+  _gnutls_mpi_release (&pkey->params[2]);
+  _gnutls_mpi_release (&pkey->params[3]);
+  _gnutls_mpi_release (&pkey->params[4]);
+  return NULL;
+
+}
+
+#define PEM_KEY_DSA "DSA PRIVATE KEY"
+#define PEM_KEY_RSA "RSA PRIVATE KEY"
+
+/**
+ * gnutls_x509_privkey_import - This function will import a DER or PEM encoded key
+ * @key: The structure to store the parsed key
+ * @data: The DER or PEM encoded certificate.
+ * @format: One of DER or PEM
+ *
+ * This function will convert the given DER or PEM encoded key
+ * to the native gnutls_x509_privkey_t format. The output will be stored in @key .
+ *
+ * If the key is PEM encoded it should have a header of "RSA PRIVATE KEY", or
+ * "DSA PRIVATE KEY".
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_import (gnutls_x509_privkey_t key,
+                            const gnutls_datum_t * data,
+                            gnutls_x509_crt_fmt_t format)
+{
+  int result = 0, need_free = 0;
+  gnutls_datum_t _data;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  _data.data = data->data;
+  _data.size = data->size;
+
+  key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+
+  /* If the Certificate is in PEM format then decode it
+   */
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      /* Try the first header */
+      result
+        = _gnutls_fbase64_decode (PEM_KEY_RSA, data->data, data->size, &out);
+      key->pk_algorithm = GNUTLS_PK_RSA;
+
+      // TODO rm
+//      if (result == GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR)
+//        {
+//          /* try for the second header */
+//          result = _gnutls_fbase64_decode(PEM_KEY_DSA, data->data, data->size,
+//          &out);
+//          key->pk_algorithm = GNUTLS_PK_DSA;
+//
+//          if (result <= 0)
+//            {
+//              if (result == 0)
+//                result = GNUTLS_E_INTERNAL_ERROR;
+//              gnutls_assert ();
+//              return result;
+//            }
+//        }
+
+      _data.data = out;
+      _data.size = result;
+
+      need_free = 1;
+    }
+
+  if (key->pk_algorithm == GNUTLS_PK_RSA)
+    {
+      key->key = _gnutls_privkey_decode_pkcs1_rsa_key (&_data, key);
+      if (key->key == NULL)
+        gnutls_assert ();
+    }
+  else
+    {
+      /* Try decoding with both, and accept the one that 
+       * succeeds.
+       */
+      key->pk_algorithm = GNUTLS_PK_RSA;
+      key->key = _gnutls_privkey_decode_pkcs1_rsa_key (&_data, key);
+
+      // TODO rm
+//      if (key->key == NULL)
+//        {
+//          key->pk_algorithm = GNUTLS_PK_DSA;
+//          key->key = decode_dsa_key(&_data, key);
+//          if (key->key == NULL)
+//            gnutls_assert();
+//        }
+    }
+
+  if (key->key == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_ASN1_DER_ERROR;
+      goto cleanup;
+    }
+
+  if (need_free)
+    _gnutls_free_datum (&_data);
+
+  /* The key has now been decoded.
+   */
+
+  return 0;
+
+cleanup:key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+  if (need_free)
+    _gnutls_free_datum (&_data);
+  return result;
+}
+
+#define FREE_RSA_PRIVATE_PARAMS for (i=0;i<RSA_PRIVATE_PARAMS;i++) \
+                _gnutls_mpi_release(&key->params[i])
+#define FREE_DSA_PRIVATE_PARAMS for (i=0;i<DSA_PRIVATE_PARAMS;i++) \
+                _gnutls_mpi_release(&key->params[i])
+
+/**
+ * gnutls_x509_privkey_import_rsa_raw - This function will import a raw RSA key
+ * @key: The structure to store the parsed key
+ * @m: holds the modulus
+ * @e: holds the public exponent
+ * @d: holds the private exponent
+ * @p: holds the first prime (p)
+ * @q: holds the second prime (q)
+ * @u: holds the coefficient
+ *
+ * This function will convert the given RSA raw parameters
+ * to the native gnutls_x509_privkey_t format. The output will be stored in @key.
+ * 
+ **/
+int
+gnutls_x509_privkey_import_rsa_raw (gnutls_x509_privkey_t key,
+                                    const gnutls_datum_t * m,
+                                    const gnutls_datum_t * e,
+                                    const gnutls_datum_t * d,
+                                    const gnutls_datum_t * p,
+                                    const gnutls_datum_t * q,
+                                    const gnutls_datum_t * u)
+{
+  int i = 0, ret;
+  size_t siz = 0;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  siz = m->size;
+  if (_gnutls_mpi_scan_nz (&key->params[0], m->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  siz = e->size;
+  if (_gnutls_mpi_scan_nz (&key->params[1], e->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  siz = d->size;
+  if (_gnutls_mpi_scan_nz (&key->params[2], d->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  siz = p->size;
+  if (_gnutls_mpi_scan_nz (&key->params[3], p->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  siz = q->size;
+  if (_gnutls_mpi_scan_nz (&key->params[4], q->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+#ifdef CALC_COEFF
+  key->params[5] = _gnutls_mpi_snew (_gnutls_mpi_get_nbits (key->params[0]));
+
+  if (key->params[5] == NULL)
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_mpi_invm (key->params[5], key->params[3], key->params[4]);
+#else
+  siz = u->size;
+  if (_gnutls_mpi_scan_nz (&key->params[5], u->data, &siz))
+    {
+      gnutls_assert ();
+      FREE_RSA_PRIVATE_PARAMS;
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+#endif
+
+  if (!key->crippled)
+    {
+      ret = _gnutls_asn1_encode_rsa (&key->key, key->params);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          FREE_RSA_PRIVATE_PARAMS;
+          return ret;
+        }
+    }
+
+  key->params_size = RSA_PRIVATE_PARAMS;
+  key->pk_algorithm = GNUTLS_PK_RSA;
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_privkey_get_pk_algorithm - This function returns the key's PublicKey algorithm
+ * @key: should contain a gnutls_x509_privkey_t structure
+ *
+ * This function will return the public key algorithm of a private
+ * key.
+ *
+ * Returns a member of the gnutls_pk_algorithm_t enumeration on success,
+ * or a negative value on error.
+ *
+ **/
+int
+gnutls_x509_privkey_get_pk_algorithm (gnutls_x509_privkey_t key)
+{
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return key->pk_algorithm;
+}
+
+/**
+ * gnutls_x509_privkey_export - This function will export the private key
+ * @key: Holds the key
+ * @format: the format of output params. One of PEM or DER.
+ * @output_data: will contain a private key PEM or DER encoded
+ * @output_data_size: holds the size of output_data (and will be
+ *   replaced by the actual size of parameters)
+ *
+ * This function will export the private key to a PKCS1 structure for
+ * RSA keys, or an integer sequence for DSA keys. The DSA keys are in
+ * the same format with the parameters used by openssl.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.
+ *
+ * If the structure is PEM encoded, it will have a header
+ * of "BEGIN RSA PRIVATE KEY".
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_export (gnutls_x509_privkey_t key,
+                            gnutls_x509_crt_fmt_t format,
+                            void *output_data, size_t * output_data_size)
+{
+  char *msg;
+  int ret;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (key->pk_algorithm == GNUTLS_PK_RSA)
+    msg = PEM_KEY_RSA;
+  else
+    msg = NULL;
+
+  if (key->crippled)
+    {                           /* encode the parameters on the fly.
+                                 */
+      switch (key->pk_algorithm)
+        {
+        case GNUTLS_PK_RSA:
+          ret = _gnutls_asn1_encode_rsa (&key->key, key->params);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+          break;
+        default:
+          gnutls_assert ();
+          return GNUTLS_E_INVALID_REQUEST;
+        }
+    }
+
+  return _gnutls_x509_export_int (key->key, format, msg, output_data,
+                                  output_data_size);
+}
+
+/**
+ * gnutls_x509_privkey_export_rsa_raw - This function will export the RSA private key
+ * @key: a structure that holds the rsa parameters
+ * @m: will hold the modulus
+ * @e: will hold the public exponent
+ * @d: will hold the private exponent
+ * @p: will hold the first prime (p)
+ * @q: will hold the second prime (q)
+ * @u: will hold the coefficient
+ *
+ * This function will export the RSA private key's parameters found in the given
+ * structure. The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ * 
+ **/
+int
+gnutls_x509_privkey_export_rsa_raw (gnutls_x509_privkey_t key,
+                                    gnutls_datum_t * m,
+                                    gnutls_datum_t * e,
+                                    gnutls_datum_t * d,
+                                    gnutls_datum_t * p,
+                                    gnutls_datum_t * q, gnutls_datum_t * u)
+{
+  int ret;
+  mpi_t coeff = NULL;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  m->data = e->data = d->data = p->data = q->data = u->data = NULL;
+  m->size = e->size = d->size = p->size = q->size = u->size = 0;
+
+  ret = _gnutls_mpi_dprint (m, key->params[0]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  /* E */
+  ret = _gnutls_mpi_dprint (e, key->params[1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  /* D */
+  ret = _gnutls_mpi_dprint (d, key->params[2]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  /* P */
+  ret = _gnutls_mpi_dprint (p, key->params[3]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  /* Q */
+  ret = _gnutls_mpi_dprint (q, key->params[4]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+#ifdef CALC_COEFF
+  coeff = _gnutls_mpi_snew (_gnutls_mpi_get_nbits (key->params[0]));
+
+  if (coeff == NULL)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_MEMORY_ERROR;
+      goto error;
+    }
+
+  _gnutls_mpi_invm (coeff, key->params[4], key->params[3]);
+  ret = _gnutls_mpi_dprint (u, coeff);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  _gnutls_mpi_release (&coeff);
+#else
+  /* U */
+  ret = _gnutls_mpi_dprint (u, key->params[5]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+#endif
+
+  return 0;
+
+error:_gnutls_free_datum (m);
+  _gnutls_free_datum (d);
+  _gnutls_free_datum (e);
+  _gnutls_free_datum (p);
+  _gnutls_free_datum (q);
+  _gnutls_mpi_release (&coeff);
+
+  return ret;
+}
+
+/**
+ * gnutls_x509_privkey_export_dsa_raw - This function will export the DSA private key
+ * @params: a structure that holds the DSA parameters
+ * @p: will hold the p
+ * @q: will hold the q
+ * @g: will hold the g
+ * @y: will hold the y
+ * @x: will hold the x
+ *
+ * This function will export the DSA private key's parameters found in the given
+ * structure. The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ * 
+ **/
+int
+gnutls_x509_privkey_export_dsa_raw (gnutls_x509_privkey_t key,
+                                    gnutls_datum_t * p,
+                                    gnutls_datum_t * q,
+                                    gnutls_datum_t * g,
+                                    gnutls_datum_t * y, gnutls_datum_t * x)
+{
+  int ret;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* P */
+  ret = _gnutls_mpi_dprint (p, key->params[0]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Q */
+  ret = _gnutls_mpi_dprint (q, key->params[1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      return ret;
+    }
+
+  /* G */
+  ret = _gnutls_mpi_dprint (g, key->params[2]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      _gnutls_free_datum (q);
+      return ret;
+    }
+
+  /* Y */
+  ret = _gnutls_mpi_dprint (y, key->params[3]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (p);
+      _gnutls_free_datum (g);
+      _gnutls_free_datum (q);
+      return ret;
+    }
+
+  /* X */
+  ret = _gnutls_mpi_dprint (x, key->params[4]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (y);
+      _gnutls_free_datum (p);
+      _gnutls_free_datum (g);
+      _gnutls_free_datum (q);
+      return ret;
+    }
+
+  return 0;
+}
+
+/* Encodes the RSA parameters into an ASN.1 RSA private key structure.
+ */
+static int
+_gnutls_asn1_encode_rsa (ASN1_TYPE * c2, mpi_t * params)
+{
+  int result, i;
+  size_t size[8], total;
+  opaque *m_data, *pube_data, *prie_data;
+  opaque *p1_data, *p2_data, *u_data, *exp1_data, *exp2_data;
+  opaque *all_data = NULL, *p;
+  mpi_t exp1 = NULL, exp2 = NULL, q1 = NULL, p1 = NULL, u = NULL;
+  opaque null = '\0';
+
+  /* Read all the sizes */
+  total = 0;
+  for (i = 0; i < 5; i++)
+    {
+      _gnutls_mpi_print_lz (NULL, &size[i], params[i]);
+      total += size[i];
+    }
+
+  /* Now generate exp1 and exp2
+   */
+  exp1 = _gnutls_mpi_salloc_like (params[0]);   /* like modulus */
+  if (exp1 == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  exp2 = _gnutls_mpi_salloc_like (params[0]);
+  if (exp2 == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  q1 = _gnutls_mpi_salloc_like (params[4]);
+  if (q1 == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  p1 = _gnutls_mpi_salloc_like (params[3]);
+  if (p1 == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  u = _gnutls_mpi_salloc_like (params[3]);
+  if (u == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  _gnutls_mpi_invm (u, params[4], params[3]);
+  /* inverse of q mod p */
+  _gnutls_mpi_print_lz (NULL, &size[5], u);
+  total += size[5];
+
+  _gnutls_mpi_sub_ui (p1, params[3], 1);
+  _gnutls_mpi_sub_ui (q1, params[4], 1);
+
+  _gnutls_mpi_mod (exp1, params[2], p1);
+  _gnutls_mpi_mod (exp2, params[2], q1);
+
+  /* calculate exp's size */
+  _gnutls_mpi_print_lz (NULL, &size[6], exp1);
+  total += size[6];
+
+  _gnutls_mpi_print_lz (NULL, &size[7], exp2);
+  total += size[7];
+
+  /* Encoding phase.
+   * allocate data enough to hold everything
+   */
+  all_data = gnutls_secure_malloc (total);
+  if (all_data == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  p = all_data;
+  m_data = p;
+  p += size[0];
+  pube_data = p;
+  p += size[1];
+  prie_data = p;
+  p += size[2];
+  p1_data = p;
+  p += size[3];
+  p2_data = p;
+  p += size[4];
+  u_data = p;
+  p += size[5];
+  exp1_data = p;
+  p += size[6];
+  exp2_data = p;
+
+  _gnutls_mpi_print_lz (m_data, &size[0], params[0]);
+  _gnutls_mpi_print_lz (pube_data, &size[1], params[1]);
+  _gnutls_mpi_print_lz (prie_data, &size[2], params[2]);
+  _gnutls_mpi_print_lz (p1_data, &size[3], params[3]);
+  _gnutls_mpi_print_lz (p2_data, &size[4], params[4]);
+  _gnutls_mpi_print_lz (u_data, &size[5], u);
+  _gnutls_mpi_print_lz (exp1_data, &size[6], exp1);
+  _gnutls_mpi_print_lz (exp2_data, &size[7], exp2);
+
+  /* Ok. Now we have the data. Create the asn1 structures
+   */
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.RSAPrivateKey",
+                            c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Write PRIME 
+   */
+  if ((result = asn1_write_value (*c2, "modulus", m_data, size[0]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "publicExponent", pube_data, size[1]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "privateExponent", prie_data, size[2]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "prime1", p1_data, size[3]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "prime2", p2_data, size[4]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "exponent1", exp1_data, size[6]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "exponent2", exp2_data, size[7]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "coefficient", u_data, size[5]))
+      != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  _gnutls_mpi_release (&exp1);
+  _gnutls_mpi_release (&exp2);
+  _gnutls_mpi_release (&q1);
+  _gnutls_mpi_release (&p1);
+  _gnutls_mpi_release (&u);
+  gnutls_free (all_data);
+
+  if ((result = asn1_write_value (*c2, "otherPrimeInfos",
+                                  NULL, 0)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "version", &null, 1)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  return 0;
+
+cleanup:_gnutls_mpi_release (&u);
+  _gnutls_mpi_release (&exp1);
+  _gnutls_mpi_release (&exp2);
+  _gnutls_mpi_release (&q1);
+  _gnutls_mpi_release (&p1);
+  asn1_delete_structure (c2);
+  gnutls_free (all_data);
+
+  return result;
+}
+
+/* Encodes the DSA parameters into an ASN.1 DSAPrivateKey structure.
+ */
+int
+_gnutls_asn1_encode_dsa (ASN1_TYPE * c2, mpi_t * params)
+{
+  int result, i;
+  size_t size[DSA_PRIVATE_PARAMS], total;
+  opaque *p_data, *q_data, *g_data, *x_data, *y_data;
+  opaque *all_data = NULL, *p;
+  opaque null = '\0';
+
+  /* Read all the sizes */
+  total = 0;
+  for (i = 0; i < DSA_PRIVATE_PARAMS; i++)
+    {
+      _gnutls_mpi_print_lz (NULL, &size[i], params[i]);
+      total += size[i];
+    }
+
+  /* Encoding phase.
+   * allocate data enough to hold everything
+   */
+  all_data = gnutls_secure_malloc (total);
+  if (all_data == NULL)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+
+  p = all_data;
+  p_data = p;
+  p += size[0];
+  q_data = p;
+  p += size[1];
+  g_data = p;
+  p += size[2];
+  y_data = p;
+  p += size[3];
+  x_data = p;
+
+  _gnutls_mpi_print_lz (p_data, &size[0], params[0]);
+  _gnutls_mpi_print_lz (q_data, &size[1], params[1]);
+  _gnutls_mpi_print_lz (g_data, &size[2], params[2]);
+  _gnutls_mpi_print_lz (y_data, &size[3], params[3]);
+  _gnutls_mpi_print_lz (x_data, &size[4], params[4]);
+
+  /* Ok. Now we have the data. Create the asn1 structures
+   */
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DSAPrivateKey",
+                            c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  /* Write PRIME 
+   */
+  if ((result = asn1_write_value (*c2, "p", p_data, size[0])) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "q", q_data, size[1])) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "g", g_data, size[2])) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result = asn1_write_value (*c2, "Y", y_data, size[3])) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  if ((result =
+       asn1_write_value (*c2, "priv", x_data, size[4])) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  gnutls_free (all_data);
+
+  if ((result = asn1_write_value (*c2, "version", &null, 1)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      result = _gnutls_asn2err (result);
+      goto cleanup;
+    }
+
+  return 0;
+
+cleanup:asn1_delete_structure (c2);
+  gnutls_free (all_data);
+
+  return result;
+}
+
+/**
+ * gnutls_x509_privkey_generate - This function will generate a private key
+ * @key: should contain a gnutls_x509_privkey_t structure
+ * @algo: is one of RSA or DSA.
+ * @bits: the size of the modulus
+ * @flags: unused for now. Must be 0.
+ *
+ * This function will generate a random private key. Note that
+ * this function must be called on an empty private key. 
+ *
+ * Returns 0 on success or a negative value on error.
+ *
+ **/
+int
+gnutls_x509_privkey_generate (gnutls_x509_privkey_t key,
+                              gnutls_pk_algorithm_t algo,
+                              unsigned int bits, unsigned int flags)
+{
+  int ret, params_len;
+  int i;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  switch (algo)
+    {
+    case GNUTLS_PK_RSA:
+      ret = _gnutls_rsa_generate_params (key->params, &params_len, bits);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      if (!key->crippled)
+        {
+          ret = _gnutls_asn1_encode_rsa (&key->key, key->params);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto cleanup;
+            }
+        }
+
+      key->params_size = params_len;
+      key->pk_algorithm = GNUTLS_PK_RSA;
+
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return 0;
+
+cleanup:key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+  key->params_size = 0;
+  for (i = 0; i < params_len; i++)
+    _gnutls_mpi_release (&key->params[i]);
+
+  return ret;
+}
+
+/**
+ * gnutls_x509_privkey_get_key_id - Return unique ID of the key's parameters
+ * @key: Holds the key
+ * @flags: should be 0 for now
+ * @output_data: will contain the key ID
+ * @output_data_size: holds the size of output_data (and will be
+ *   replaced by the actual size of parameters)
+ *
+ * This function will return a unique ID the depends on the public key
+ * parameters. This ID can be used in checking whether a certificate
+ * corresponds to the given key.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *output_data_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.  The output will normally be a SHA-1 hash output,
+ * which is 20 bytes.
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_get_key_id (gnutls_x509_privkey_t key,
+                                unsigned int flags,
+                                unsigned char *output_data,
+                                size_t * output_data_size)
+{
+  int result;
+  GNUTLS_HASH_HANDLE hd;
+  gnutls_datum_t der = { NULL,
+    0
+  };
+
+  if (key == NULL || key->crippled)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (*output_data_size < 20)
+    {
+      gnutls_assert ();
+      *output_data_size = 20;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  if (key->pk_algorithm == GNUTLS_PK_RSA)
+    {
+      result = _gnutls_x509_write_rsa_params (key->params, key->params_size,
+                                              &der);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+    }
+  else
+    return GNUTLS_E_INTERNAL_ERROR;
+
+  hd = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (hd == GNUTLS_HASH_FAILED)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  _gnutls_hash (hd, der.data, der.size);
+
+  _gnutls_hash_deinit (hd, output_data);
+  *output_data_size = 20;
+
+  result = 0;
+
+cleanup:
+
+  _gnutls_free_datum (&der);
+  return result;
+}
+
+#ifdef ENABLE_PKI
+
+/**
+ * gnutls_x509_privkey_sign_data - This function will sign the given data using the private key params
+ * @key: Holds the key
+ * @digest: should be MD5 or SHA1
+ * @flags: should be 0 for now
+ * @data: holds the data to be signed
+ * @signature: will contain the signature
+ * @signature_size: holds the size of signature (and will be replaced
+ *   by the new size)
+ *
+ * This function will sign the given data using a signature algorithm
+ * supported by the private key. Signature algorithms are always used
+ * together with a hash functions.  Different hash functions may be
+ * used for the RSA algorithm, but only SHA-1 for the DSA keys.
+ *
+ * If the buffer provided is not long enough to hold the output, then
+ * *signature_size is updated and GNUTLS_E_SHORT_MEMORY_BUFFER will
+ * be returned.
+ *
+ * In case of failure a negative value will be returned, and
+ * 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_sign_data (gnutls_x509_privkey_t key,
+                               gnutls_digest_algorithm_t digest,
+                               unsigned int flags,
+                               const gnutls_datum_t * data,
+                               void *signature, size_t * signature_size)
+{
+  int result;
+  gnutls_datum_t sig = { NULL, 0 };
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_sign (data, digest, key, &sig);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  if (*signature_size < sig.size)
+    {
+      *signature_size = sig.size;
+      _gnutls_free_datum (&sig);
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  *signature_size = sig.size;
+  memcpy (signature, sig.data, sig.size);
+
+  _gnutls_free_datum (&sig);
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_privkey_sign_hash - This function will sign the given data using the private key params
+ * @key: Holds the key
+ * @hash: holds the data to be signed
+ * @signature: will contain newly allocated signature
+ *
+ * This function will sign the given hash using the private key.
+ *
+ * Return value: In case of failure a negative value will be returned,
+ * and 0 on success.
+ **/
+int
+gnutls_x509_privkey_sign_hash (gnutls_x509_privkey_t key,
+                               const gnutls_datum_t * hash,
+                               gnutls_datum_t * signature)
+{
+  int result;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_sign (key->pk_algorithm, key->params,
+                         key->params_size, hash, signature);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_privkey_verify_data - This function will verify the given signed data.
+ * @key: Holds the key
+ * @flags: should be 0 for now
+ * @data: holds the data to be signed
+ * @signature: contains the signature
+ *
+ * This function will verify the given signed data, using the parameters in the
+ * private key.
+ *
+ * In case of a verification failure 0 is returned, and
+ * 1 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_verify_data (gnutls_x509_privkey_t key,
+                                 unsigned int flags,
+                                 const gnutls_datum_t * data,
+                                 const gnutls_datum_t * signature)
+{
+  int result;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_privkey_verify_signature (data, signature, key);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+
+  return result;
+}
+
+/**
+ * gnutls_x509_privkey_fix - This function will recalculate some parameters of the key.
+ * @key: Holds the key
+ *
+ * This function will recalculate the secondary parameters in a key.
+ * In RSA keys, this can be the coefficient and exponent1,2.
+ *
+ * Return value: In case of failure a negative value will be
+ *   returned, and 0 on success.
+ *
+ **/
+int
+gnutls_x509_privkey_fix (gnutls_x509_privkey_t key)
+{
+  int ret;
+
+  if (key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (!key->crippled)
+    asn1_delete_structure (&key->key);
+  switch (key->pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+      ret = _gnutls_asn1_encode_rsa (&key->key, key->params);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return 0;
+}
+
+#endif
diff --git a/src/daemon/https/x509/x509_verify.c b/src/daemon/https/x509/x509_verify.c
new file mode 100644
index 00000000..f01fed9d
--- /dev/null
+++ b/src/daemon/https/x509/x509_verify.c
@@ -0,0 +1,1037 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* All functions which relate to X.509 certificate verification stuff are
+ * included here
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_cert.h>
+#include <libtasn1.h>
+#include <gnutls_global.h>
+#include <gnutls_num.h>         /* MAX */
+#include <gnutls_sig.h>
+#include <gnutls_str.h>
+#include <gnutls_datum.h>
+#include <dn.h>
+#include <x509.h>
+#include <mpi.h>
+#include <common.h>
+#include <verify.h>
+
+static int _gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
+                                        const gnutls_x509_crt_t * trusted_cas,
+                                        int tcas_size,
+                                        unsigned int flags,
+                                        unsigned int *output);
+int _gnutls_x509_verify_signature (const gnutls_datum_t * signed_data,
+                                   const gnutls_datum_t * signature,
+                                   gnutls_x509_crt_t issuer);
+
+static
+  int is_crl_issuer (gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer_cert);
+static int _gnutls_verify_crl2 (gnutls_x509_crl_t crl,
+                                const gnutls_x509_crt_t * trusted_cas,
+                                int tcas_size,
+                                unsigned int flags, unsigned int *output);
+
+/* Checks if the issuer of a certificate is a
+ * Certificate Authority, or if the certificate is the same
+ * as the issuer (and therefore it doesn't need to be a CA).
+ *
+ * Returns true or false, if the issuer is a CA,
+ * or not.
+ */
+static int
+check_if_ca (gnutls_x509_crt_t cert,
+             gnutls_x509_crt_t issuer, unsigned int flags)
+{
+  gnutls_datum_t cert_signed_data = { NULL,
+    0
+  };
+  gnutls_datum_t issuer_signed_data = { NULL,
+    0
+  };
+  gnutls_datum_t cert_signature = { NULL,
+    0
+  };
+  gnutls_datum_t issuer_signature = { NULL,
+    0
+  };
+  int result;
+
+  /* Check if the issuer is the same with the
+   * certificate. This is added in order for trusted
+   * certificates to be able to verify themselves.
+   */
+
+  result = _gnutls_x509_get_signed_data (issuer->cert, "tbsCertificate",
+                                         &issuer_signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_get_signed_data (cert->cert, "tbsCertificate",
+                                         &cert_signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_get_signature (issuer->cert, "signature",
+                                       &issuer_signature);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result =
+    _gnutls_x509_get_signature (cert->cert, "signature", &cert_signature);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  /* If the subject certificate is the same as the issuer
+   * return true.
+   */
+  if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
+    if (cert_signed_data.size == issuer_signed_data.size)
+      {
+        if ((memcmp (cert_signed_data.data, issuer_signed_data.data,
+                     cert_signed_data.size) == 0) && (cert_signature.size
+                                                      ==
+                                                      issuer_signature.size)
+            &&
+            (memcmp
+             (cert_signature.data, issuer_signature.data,
+              cert_signature.size) == 0))
+          {
+            result = 1;
+            goto cleanup;
+          }
+      }
+
+  if (gnutls_x509_crt_get_ca_status (issuer, NULL) == 1)
+    {
+      result = 1;
+      goto cleanup;
+    }
+  else
+    gnutls_assert ();
+
+  result = 0;
+
+cleanup:_gnutls_free_datum (&cert_signed_data);
+  _gnutls_free_datum (&issuer_signed_data);
+  _gnutls_free_datum (&cert_signature);
+  _gnutls_free_datum (&issuer_signature);
+  return result;
+}
+
+/* This function checks if 'certs' issuer is 'issuer_cert'.
+ * This does a straight (DER) compare of the issuer/subject fields in
+ * the given certificates.
+ *
+ * Returns 1 if they match and zero if they don't match. Otherwise
+ * a negative value is returned to indicate error.
+ */
+static int
+is_issuer (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer_cert)
+{
+  gnutls_datum_t dn1 = { NULL,
+    0
+  }, dn2 =
+  {
+  NULL, 0};
+  int ret;
+
+  ret = gnutls_x509_crt_get_raw_issuer_dn (cert, &dn1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = gnutls_x509_crt_get_raw_dn (issuer_cert, &dn2);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = _gnutls_x509_compare_raw_dn (&dn1, &dn2);
+
+cleanup:_gnutls_free_datum (&dn1);
+  _gnutls_free_datum (&dn2);
+  return ret;
+
+}
+
+static inline gnutls_x509_crt_t
+find_issuer (gnutls_x509_crt_t cert,
+             const gnutls_x509_crt_t * trusted_cas, int tcas_size)
+{
+  int i;
+
+  /* this is serial search. 
+   */
+
+  for (i = 0; i < tcas_size; i++)
+    {
+      if (is_issuer (cert, trusted_cas[i]) == 1)
+        return trusted_cas[i];
+    }
+
+  gnutls_assert ();
+  return NULL;
+}
+
+/* 
+ * Verifies the given certificate again a certificate list of
+ * trusted CAs.
+ *
+ * Returns only 0 or 1. If 1 it means that the certificate 
+ * was successfuly verified.
+ *
+ * 'flags': an OR of the gnutls_certificate_verify_flags enumeration.
+ *
+ * Output will hold some extra information about the verification
+ * procedure.
+ */
+static int
+_gnutls_verify_certificate2 (gnutls_x509_crt_t cert,
+                             const gnutls_x509_crt_t * trusted_cas,
+                             int tcas_size,
+                             unsigned int flags, unsigned int *output)
+{
+  gnutls_datum_t cert_signed_data = { NULL,
+    0
+  };
+  gnutls_datum_t cert_signature = { NULL,
+    0
+  };
+  gnutls_x509_crt_t issuer;
+  int ret, issuer_version, result;
+
+  if (output)
+    *output = 0;
+
+  if (tcas_size >= 1)
+    issuer = find_issuer (cert, trusted_cas, tcas_size);
+  else
+    {
+      gnutls_assert ();
+      if (output)
+        *output |= GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_INVALID;
+      return 0;
+    }
+
+  /* issuer is not in trusted certificate
+   * authorities.
+   */
+  if (issuer == NULL)
+    {
+      if (output)
+        *output |= GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_INVALID;
+      gnutls_assert ();
+      return 0;
+    }
+
+  issuer_version = gnutls_x509_crt_get_version (issuer);
+  if (issuer_version < 0)
+    {
+      gnutls_assert ();
+      return issuer_version;
+    }
+
+  if (!(flags & GNUTLS_VERIFY_DISABLE_CA_SIGN) && !((flags
+                                                     &
+                                                     GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT)
+                                                    && issuer_version == 1))
+    {
+      if (check_if_ca (cert, issuer, flags) == 0)
+        {
+          gnutls_assert ();
+          if (output)
+            *output |= GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID;
+          return 0;
+        }
+    }
+
+  result = _gnutls_x509_get_signed_data (cert->cert, "tbsCertificate",
+                                         &cert_signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result =
+    _gnutls_x509_get_signature (cert->cert, "signature", &cert_signature);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = _gnutls_x509_verify_signature (&cert_signed_data, &cert_signature,
+                                       issuer);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+  else if (ret == 0)
+    {
+      gnutls_assert ();
+      /* error. ignore it */
+      if (output)
+        *output |= GNUTLS_CERT_INVALID;
+      ret = 0;
+    }
+
+  /* If the certificate is not self signed check if the algorithms
+   * used are secure. If the certificate is self signed it doesn't
+   * really matter.
+   */
+  if (is_issuer (cert, cert) == 0)
+    {
+      int sigalg;
+
+      sigalg = gnutls_x509_crt_get_signature_algorithm (cert);
+
+      if (((sigalg == GNUTLS_SIGN_RSA_MD2) && !(flags
+                                                &
+                                                GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2))
+          || ((sigalg == GNUTLS_SIGN_RSA_MD5)
+              && !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)))
+        {
+          if (output)
+            *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+        }
+    }
+
+  result = ret;
+
+cleanup:_gnutls_free_datum (&cert_signed_data);
+  _gnutls_free_datum (&cert_signature);
+
+  return result;
+}
+
+/**
+ * gnutls_x509_crt_check_issuer - This function checks if the certificate given has the given issuer
+ * @cert: is the certificate to be checked
+ * @issuer: is the certificate of a possible issuer
+ *
+ * This function will check if the given certificate was issued by the
+ * given issuer. It will return true (1) if the given certificate is issued
+ * by the given issuer, and false (0) if not.
+ *
+ * A negative value is returned in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_check_issuer (gnutls_x509_crt_t cert,
+                              gnutls_x509_crt_t issuer)
+{
+  return is_issuer (cert, issuer);
+}
+
+/* The algorithm used is:
+ * 1. Check last certificate in the chain. If it is not verified return.
+ * 2. Check if any certificates in the chain are revoked. If yes return.
+ * 3. Try to verify the rest of certificates in the chain. If not verified return.
+ * 4. Return 0.
+ *
+ * Note that the return value is an OR of GNUTLS_CERT_* elements.
+ *
+ * This function verifies a X.509 certificate list. The certificate list should
+ * lead to a trusted CA in order to be trusted.
+ */
+static unsigned int
+_gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
+                                 int clist_size,
+                                 const gnutls_x509_crt_t * trusted_cas,
+                                 int tcas_size,
+                                 const gnutls_x509_crl_t * CRLs,
+                                 int crls_size, unsigned int flags)
+{
+  int i = 0, ret;
+  unsigned int status = 0, output;
+
+  /* Verify the last certificate in the certificate path
+   * against the trusted CA certificate list.
+   *
+   * If no CAs are present returns CERT_INVALID. Thus works
+   * in self signed etc certificates.
+   */
+  ret = _gnutls_verify_certificate2 (certificate_list[clist_size - 1],
+                                     trusted_cas, tcas_size, flags, &output);
+
+  if (ret == 0)
+    {
+      /* if the last certificate in the certificate
+       * list is invalid, then the certificate is not
+       * trusted.
+       */
+      gnutls_assert ();
+      status |= output;
+      status |= GNUTLS_CERT_INVALID;
+      return status;
+    }
+
+  /* Check for revoked certificates in the chain
+   */
+#ifdef ENABLE_PKI
+  for (i = 0; i < clist_size; i++)
+    {
+      ret = gnutls_x509_crt_check_revocation (certificate_list[i],
+                                              CRLs, crls_size);
+      if (ret == 1)
+        {                       /* revoked */
+          status |= GNUTLS_CERT_REVOKED;
+          status |= GNUTLS_CERT_INVALID;
+          return status;
+        }
+    }
+#endif
+
+  /* Check if the last certificate in the path is self signed.
+   * In that case ignore it (a certificate is trusted only if it
+   * leads to a trusted party by us, not the server's).
+   */
+  if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
+                                    certificate_list[clist_size - 1]) > 0
+      && clist_size > 0)
+    {
+      clist_size--;
+    }
+
+  /* Verify the certificate path (chain) 
+   */
+  for (i = clist_size - 1; i > 0; i--)
+    {
+      if (i - 1 < 0)
+        break;
+
+      /* note that here we disable this V1 CA flag. So that no version 1
+       * certificates can exist in a supplied chain.
+       */
+      if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT))
+        flags ^= GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT;
+      if ((ret = _gnutls_verify_certificate2 (certificate_list[i - 1],
+                                              &certificate_list[i], 1, flags,
+                                              NULL)) == 0)
+        {
+          status |= GNUTLS_CERT_INVALID;
+          return status;
+        }
+    }
+
+  return 0;
+}
+
+/* Reads the digest information.
+ * we use DER here, although we should use BER. It works fine
+ * anyway.
+ */
+static int
+decode_ber_digest_info (const gnutls_datum_t * info,
+                        gnutls_mac_algorithm_t * hash,
+                        opaque * digest, int *digest_size)
+{
+  ASN1_TYPE dinfo = ASN1_TYPE_EMPTY;
+  int result;
+  char str[1024];
+  int len;
+
+  if ((result = asn1_create_element (_gnutls_get_gnutls_asn (),
+                                     "GNUTLS.DigestInfo",
+                                     &dinfo)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&dinfo, info->data, info->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  len = sizeof (str) - 1;
+  result = asn1_read_value (dinfo, "digestAlgorithm.algorithm", str, &len);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  *hash = _gnutls_x509_oid2mac_algorithm (str);
+
+  if (*hash == GNUTLS_MAC_UNKNOWN)
+    {
+
+      _gnutls_x509_log ("verify.c: HASH OID: %s\n", str);
+
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return GNUTLS_E_UNKNOWN_ALGORITHM;
+    }
+
+  len = sizeof (str) - 1;
+  result = asn1_read_value (dinfo, "digestAlgorithm.parameters", str, &len);
+  /* To avoid permitting garbage in the parameters field, either the
+     parameters field is not present, or it contains 0x05 0x00. */
+  if (!
+      (result == ASN1_ELEMENT_NOT_FOUND
+       || (result == ASN1_SUCCESS && len == 2 && str[0] == 0x05
+           && str[1] == 0x00)))
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  result = asn1_read_value (dinfo, "digest", digest, digest_size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&dinfo);
+      return _gnutls_asn2err (result);
+    }
+
+  asn1_delete_structure (&dinfo);
+
+  return 0;
+}
+
+/* if hash==MD5 then we do RSA-MD5
+ * if hash==SHA then we do RSA-SHA
+ * params[0] is modulus
+ * params[1] is public key
+ */
+static int
+_pkcs1_rsa_verify_sig (const gnutls_datum_t * text,
+                       const gnutls_datum_t * signature,
+                       mpi_t * params, int params_len)
+{
+  gnutls_mac_algorithm_t hash = GNUTLS_MAC_UNKNOWN;
+  int ret;
+  opaque digest[MAX_HASH_SIZE], md[MAX_HASH_SIZE];
+  int digest_size;
+  GNUTLS_HASH_HANDLE hd;
+  gnutls_datum_t decrypted;
+
+  ret =
+    _gnutls_pkcs1_rsa_decrypt (&decrypted, signature, params, params_len, 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* decrypted is a BER encoded data of type DigestInfo
+   */
+
+  digest_size = sizeof (digest);
+  if ((ret = decode_ber_digest_info (&decrypted, &hash, digest, &digest_size))
+      != 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&decrypted);
+      return ret;
+    }
+
+  _gnutls_free_datum (&decrypted);
+
+  if (digest_size != _gnutls_hash_get_algo_len (hash))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+
+  hd = _gnutls_hash_init (hash);
+  if (hd == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (hd, text->data, text->size);
+  _gnutls_hash_deinit (hd, md);
+
+  if (memcmp (md, digest, digest_size) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_SIG_VERIFY_FAILED;
+    }
+
+  return 0;
+}
+
+/* Hashes input data and verifies a DSA signature.
+ */
+static int
+dsa_verify_sig (const gnutls_datum_t * text,
+                const gnutls_datum_t * signature,
+                mpi_t * params, int params_len)
+{
+  int ret;
+  opaque _digest[MAX_HASH_SIZE];
+  gnutls_datum_t digest;
+  GNUTLS_HASH_HANDLE hd;
+
+  hd = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (hd == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (hd, text->data, text->size);
+  _gnutls_hash_deinit (hd, _digest);
+
+  digest.data = _digest;
+  digest.size = 20;
+
+  ret = _gnutls_dsa_verify (&digest, signature, params, params_len);
+
+  return ret;
+}
+
+/* Verifies the signature data, and returns 0 if not verified,
+ * or 1 otherwise.
+ */
+static int
+verify_sig (const gnutls_datum_t * tbs,
+            const gnutls_datum_t * signature,
+            gnutls_pk_algorithm_t pk,
+            mpi_t * issuer_params, int issuer_params_size)
+{
+
+  switch (pk)
+    {
+    case GNUTLS_PK_RSA:
+
+      if (_pkcs1_rsa_verify_sig
+          (tbs, signature, issuer_params, issuer_params_size) != 0)
+        {
+          gnutls_assert ();
+          return 0;
+        }
+
+      return 1;
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+
+    }
+}
+
+/* verifies if the certificate is properly signed.
+ * returns 0 on failure and 1 on success.
+ * 
+ * 'tbs' is the signed data
+ * 'signature' is the signature!
+ */
+int
+_gnutls_x509_verify_signature (const gnutls_datum_t * tbs,
+                               const gnutls_datum_t * signature,
+                               gnutls_x509_crt_t issuer)
+{
+  mpi_t issuer_params[MAX_PUBLIC_PARAMS_SIZE];
+  int ret, issuer_params_size, i;
+
+  /* Read the MPI parameters from the issuer's certificate.
+   */
+  issuer_params_size = MAX_PUBLIC_PARAMS_SIZE;
+  ret =
+    _gnutls_x509_crt_get_mpis (issuer, issuer_params, &issuer_params_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = verify_sig (tbs, signature, gnutls_x509_crt_get_pk_algorithm (issuer,
+                                                                      NULL),
+                    issuer_params, issuer_params_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  /* release all allocated MPIs
+   */
+  for (i = 0; i < issuer_params_size; i++)
+    {
+      _gnutls_mpi_release (&issuer_params[i]);
+    }
+
+  return ret;
+}
+
+/* verifies if the certificate is properly signed.
+ * returns 0 on failure and 1 on success.
+ * 
+ * 'tbs' is the signed data
+ * 'signature' is the signature!
+ */
+int
+_gnutls_x509_privkey_verify_signature (const gnutls_datum_t * tbs,
+                                       const gnutls_datum_t * signature,
+                                       gnutls_x509_privkey_t issuer)
+{
+  int ret;
+
+  ret = verify_sig (tbs, signature, issuer->pk_algorithm, issuer->params,
+                    issuer->params_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return ret;
+}
+
+/**
+ * gnutls_x509_crt_list_verify - This function verifies the given certificate list
+ * @cert_list: is the certificate list to be verified
+ * @cert_list_length: holds the number of certificate in cert_list
+ * @CA_list: is the CA list which will be used in verification
+ * @CA_list_length: holds the number of CA certificate in CA_list
+ * @CRL_list: holds a list of CRLs.
+ * @CRL_list_length: the length of CRL list.
+ * @flags: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+ * @verify: will hold the certificate verification output.
+ *
+ * This function will try to verify the given certificate list and return its status.
+ * Note that expiration and activation dates are not checked
+ * by this function, you should check them using the appropriate functions.
+ *
+ * If no flags are specified (0), this function will use the 
+ * basicConstraints (2.5.29.19) PKIX extension. This means that only a certificate 
+ * authority is allowed to sign a certificate.
+ *
+ * You must also check the peer's name in order to check if the verified 
+ * certificate belongs to the actual peer. 
+ *
+ * The certificate verification output will be put in @verify and will be
+ * one or more of the gnutls_certificate_status_t enumerated elements bitwise or'd.
+ * For a more detailed verification status use gnutls_x509_crt_verify() per list
+ * element.
+ *
+ * GNUTLS_CERT_INVALID: the certificate chain is not valid.
+ *
+ * GNUTLS_CERT_REVOKED: a certificate in the chain has been revoked.
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_list_verify (const gnutls_x509_crt_t * cert_list,
+                             int cert_list_length,
+                             const gnutls_x509_crt_t * CA_list,
+                             int CA_list_length,
+                             const gnutls_x509_crl_t * CRL_list,
+                             int CRL_list_length,
+                             unsigned int flags, unsigned int *verify)
+{
+  if (cert_list == NULL || cert_list_length == 0)
+    return GNUTLS_E_NO_CERTIFICATE_FOUND;
+
+  /* Verify certificate 
+   */
+  *verify = _gnutls_x509_verify_certificate (cert_list, cert_list_length,
+                                             CA_list, CA_list_length,
+                                             CRL_list, CRL_list_length,
+                                             flags);
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_verify - This function verifies the given certificate against a given trusted one
+ * @cert: is the certificate to be verified
+ * @CA_list: is one certificate that is considered to be trusted one
+ * @CA_list_length: holds the number of CA certificate in CA_list
+ * @flags: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+ * @verify: will hold the certificate verification output.
+ *
+ * This function will try to verify the given certificate and return its status. 
+ * The verification output in this functions cannot be GNUTLS_CERT_NOT_VALID.
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crt_verify (gnutls_x509_crt_t cert,
+                        const gnutls_x509_crt_t * CA_list,
+                        int CA_list_length,
+                        unsigned int flags, unsigned int *verify)
+{
+  int ret;
+  /* Verify certificate 
+   */
+  ret = _gnutls_verify_certificate2 (cert, CA_list, CA_list_length, flags,
+                                     verify);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+#ifdef ENABLE_PKI
+
+/**
+ * gnutls_x509_crl_check_issuer - This function checks if the CRL given has the given issuer
+ * @crl: is the CRL to be checked
+ * @issuer: is the certificate of a possible issuer
+ *
+ * This function will check if the given CRL was issued by the
+ * given issuer certificate. It will return true (1) if the given CRL was issued
+ * by the given issuer, and false (0) if not.
+ *
+ * A negative value is returned in case of an error.
+ *
+ **/
+int
+gnutls_x509_crl_check_issuer (gnutls_x509_crl_t cert,
+                              gnutls_x509_crt_t issuer)
+{
+  return is_crl_issuer (cert, issuer);
+}
+
+/**
+ * gnutls_x509_crl_verify - This function verifies the given crl against a given trusted one
+ * @crl: is the crl to be verified
+ * @CA_list: is a certificate list that is considered to be trusted one
+ * @CA_list_length: holds the number of CA certificates in CA_list
+ * @flags: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
+ * @verify: will hold the crl verification output.
+ *
+ * This function will try to verify the given crl and return its status.
+ * See gnutls_x509_crt_list_verify() for a detailed description of
+ * return values.
+ *
+ * Returns 0 on success and a negative value in case of an error.
+ *
+ **/
+int
+gnutls_x509_crl_verify (gnutls_x509_crl_t crl,
+                        const gnutls_x509_crt_t * CA_list,
+                        int CA_list_length, unsigned int flags,
+                        unsigned int *verify)
+{
+  int ret;
+  /* Verify crl 
+   */
+  ret = _gnutls_verify_crl2 (crl, CA_list, CA_list_length, flags, verify);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/* The same as above, but here we've got a CRL.
+ */
+static int
+is_crl_issuer (gnutls_x509_crl_t crl, gnutls_x509_crt_t issuer_cert)
+{
+  gnutls_datum_t dn1 = { NULL, 0 }, dn2 =
+  {
+  NULL, 0};
+  int ret;
+
+  ret = _gnutls_x509_crl_get_raw_issuer_dn (crl, &dn1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = gnutls_x509_crt_get_raw_dn (issuer_cert, &dn2);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_x509_compare_raw_dn (&dn1, &dn2);
+
+cleanup:
+  _gnutls_free_datum (&dn1);
+  _gnutls_free_datum (&dn2);
+
+  return ret;
+}
+
+static inline gnutls_x509_crt_t
+find_crl_issuer (gnutls_x509_crl_t crl,
+                 const gnutls_x509_crt_t * trusted_cas, int tcas_size)
+{
+  int i;
+
+  /* this is serial search. 
+   */
+
+  for (i = 0; i < tcas_size; i++)
+    {
+      if (is_crl_issuer (crl, trusted_cas[i]) == 1)
+        return trusted_cas[i];
+    }
+
+  gnutls_assert ();
+  return NULL;
+}
+
+/* 
+ * Returns only 0 or 1. If 1 it means that the CRL
+ * was successfuly verified.
+ *
+ * 'flags': an OR of the gnutls_certificate_verify_flags enumeration.
+ *
+ * Output will hold information about the verification
+ * procedure. 
+ */
+static int
+_gnutls_verify_crl2 (gnutls_x509_crl_t crl,
+                     const gnutls_x509_crt_t * trusted_cas,
+                     int tcas_size, unsigned int flags, unsigned int *output)
+{
+  /* CRL is ignored for now */
+  gnutls_datum_t crl_signed_data = { NULL, 0 };
+  gnutls_datum_t crl_signature = { NULL, 0 };
+  gnutls_x509_crt_t issuer;
+  int ret, result;
+
+  if (output)
+    *output = 0;
+
+  if (tcas_size >= 1)
+    issuer = find_crl_issuer (crl, trusted_cas, tcas_size);
+  else
+    {
+      gnutls_assert ();
+      if (output)
+        *output |= GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_INVALID;
+      return 0;
+    }
+
+  /* issuer is not in trusted certificate
+   * authorities.
+   */
+  if (issuer == NULL)
+    {
+      gnutls_assert ();
+      if (output)
+        *output |= GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_INVALID;
+      return 0;
+    }
+
+  if (!(flags & GNUTLS_VERIFY_DISABLE_CA_SIGN))
+    {
+      if (gnutls_x509_crt_get_ca_status (issuer, NULL) != 1)
+        {
+          gnutls_assert ();
+          if (output)
+            *output |= GNUTLS_CERT_SIGNER_NOT_CA | GNUTLS_CERT_INVALID;
+          return 0;
+        }
+    }
+
+  result =
+    _gnutls_x509_get_signed_data (crl->crl, "tbsCertList", &crl_signed_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  result = _gnutls_x509_get_signature (crl->crl, "signature", &crl_signature);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret =
+    _gnutls_x509_verify_signature (&crl_signed_data, &crl_signature, issuer);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+  else if (ret == 0)
+    {
+      gnutls_assert ();
+      /* error. ignore it */
+      if (output)
+        *output |= GNUTLS_CERT_INVALID;
+      ret = 0;
+    }
+
+  {
+    int sigalg;
+
+    sigalg = gnutls_x509_crl_get_signature_algorithm (crl);
+
+    if (((sigalg == GNUTLS_SIGN_RSA_MD2) &&
+         !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2)) ||
+        ((sigalg == GNUTLS_SIGN_RSA_MD5) &&
+         !(flags & GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5)))
+      {
+        if (output)
+          *output |= GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID;
+      }
+  }
+
+  result = ret;
+
+cleanup:
+  _gnutls_free_datum (&crl_signed_data);
+  _gnutls_free_datum (&crl_signature);
+
+  return result;
+}
+
+#endif
diff --git a/src/daemon/https/x509/x509_write.c b/src/daemon/https/x509/x509_write.c
new file mode 100644
index 00000000..d9529c33
--- /dev/null
+++ b/src/daemon/https/x509/x509_write.c
@@ -0,0 +1,1094 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains functions to handle X.509 certificate generation.
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_PKI
+
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <crq.h>
+#include <dn.h>
+#include <mpi.h>
+#include <sign.h>
+#include <extensions.h>
+#include <libtasn1.h>
+
+static void disable_optional_stuff (gnutls_x509_crt_t cert);
+
+/**
+  * gnutls_x509_crt_set_dn_by_oid - This function will set the Certificate request subject's distinguished name
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @oid: holds an Object Identifier in a null terminated string
+  * @raw_flag: must be 0, or 1 if the data are DER encoded
+  * @name: a pointer to the name
+  * @sizeof_name: holds the size of @name
+  *
+  * This function will set the part of the name of the Certificate subject, specified
+  * by the given OID. The input string should be ASCII or UTF-8 encoded.
+  *
+  * Some helper macros with popular OIDs can be found in gnutls/x509.h
+  * With this function you can only set the known OIDs. You can test
+  * for known OIDs using gnutls_x509_dn_oid_known(). For OIDs that are
+  * not known (by gnutls) you should properly DER encode your data, and
+  * call this function with raw_flag set.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_dn_by_oid (gnutls_x509_crt_t crt, const char *oid,
+                               unsigned int raw_flag, const void *name,
+                               unsigned int sizeof_name)
+{
+  if (sizeof_name == 0 || name == NULL || crt == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_set_dn_oid (crt->cert, "tbsCertificate.subject",
+                                  oid, raw_flag, name, sizeof_name);
+}
+
+/**
+  * gnutls_x509_crt_set_issuer_dn_by_oid - This function will set the Certificate request issuer's distinguished name
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @oid: holds an Object Identifier in a null terminated string
+  * @raw_flag: must be 0, or 1 if the data are DER encoded
+  * @name: a pointer to the name
+  * @sizeof_name: holds the size of @name
+  *
+  * This function will set the part of the name of the Certificate issuer, specified
+  * by the given OID. The input string should be ASCII or UTF-8 encoded.
+  *
+  * Some helper macros with popular OIDs can be found in gnutls/x509.h
+  * With this function you can only set the known OIDs. You can test
+  * for known OIDs using gnutls_x509_dn_oid_known(). For OIDs that are
+  * not known (by gnutls) you should properly DER encode your data, and
+  * call this function with raw_flag set.
+  *
+  * Normally you do not need to call this function, since the signing
+  * operation will copy the signer's name as the issuer of the certificate.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_issuer_dn_by_oid (gnutls_x509_crt_t crt,
+                                      const char *oid,
+                                      unsigned int raw_flag,
+                                      const void *name,
+                                      unsigned int sizeof_name)
+{
+  if (sizeof_name == 0 || name == NULL || crt == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_set_dn_oid (crt->cert, "tbsCertificate.issuer", oid,
+                                  raw_flag, name, sizeof_name);
+}
+
+/**
+ * gnutls_x509_crt_set_proxy_dn - Set Proxy Certificate subject's distinguished name 
+ * @crt: a gnutls_x509_crt_t structure with the new proxy cert
+ * @eecrt: the end entity certificate that will be issuing the proxy
+ * @raw_flag: must be 0, or 1 if the CN is DER encoded
+ * @name: a pointer to the CN name, may be NULL (but MUST then be added later)
+ * @sizeof_name: holds the size of @name
+ *
+ * This function will set the subject in @crt to the end entity's
+ * @eecrt subject name, and add a single Common Name component @name
+ * of size @sizeof_name.  This corresponds to the required proxy
+ * certificate naming style.  Note that if @name is %NULL, you MUST
+ * set it later by using gnutls_x509_crt_set_dn_by_oid() or similar.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_set_proxy_dn (gnutls_x509_crt_t crt, gnutls_x509_crt_t eecrt,
+                              unsigned int raw_flag, const void *name,
+                              unsigned int sizeof_name)
+{
+  int result;
+
+  if (crt == NULL || eecrt == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = asn1_copy_node (crt->cert, "tbsCertificate.subject",
+                           eecrt->cert, "tbsCertificate.subject");
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  if (name && sizeof_name)
+    {
+      return _gnutls_x509_set_dn_oid (crt->cert, "tbsCertificate.subject",
+                                      GNUTLS_OID_X520_COMMON_NAME,
+                                      raw_flag, name, sizeof_name);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_version - This function will set the Certificate request version
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @version: holds the version number. For X.509v1 certificates must be 1.
+  *
+  * This function will set the version of the certificate.  This must
+  * be one for X.509 version 1, and so on.  Plain certificates without
+  * extensions must have version set to one.
+  *
+  * To create well-formed certificates, you must specify version 3 if
+  * you use any certificate extensions.  Extensions are created by
+  * functions such as gnutls_x509_crt_set_subject_alternative_name or
+  * gnutls_x509_crt_set_key_usage.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_version (gnutls_x509_crt_t crt, unsigned int version)
+{
+  int result;
+  unsigned char null = version;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (null > 0)
+    null--;
+
+  result = asn1_write_value (crt->cert, "tbsCertificate.version", &null, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_key - This function will associate the Certificate with a key
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @key: holds a private key
+  *
+  * This function will set the public parameters from the given private key to the
+  * certificate. Only RSA keys are currently supported.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_key (gnutls_x509_crt_t crt, gnutls_x509_privkey_t key)
+{
+  int result;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_encode_and_copy_PKI_params (crt->cert,
+                                                    "tbsCertificate.subjectPublicKeyInfo",
+                                                    key->pk_algorithm,
+                                                    key->params,
+                                                    key->params_size);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_crq - This function will associate the Certificate with a request
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @crq: holds a certificate request
+  *
+  * This function will set the name and public parameters from the given certificate request to the
+  * certificate. Only RSA keys are currently supported.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_crq (gnutls_x509_crt_t crt, gnutls_x509_crq_t crq)
+{
+  int result;
+  int pk_algorithm;
+
+  if (crt == NULL || crq == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  pk_algorithm = gnutls_x509_crq_get_pk_algorithm (crq, NULL);
+
+  result = asn1_copy_node (crt->cert, "tbsCertificate.subject",
+                           crq->crq, "certificationRequestInfo.subject");
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result =
+    asn1_copy_node (crt->cert, "tbsCertificate.subjectPublicKeyInfo",
+                    crq->crq, "certificationRequestInfo.subjectPKInfo");
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_extension_by_oid - This function will set an arbitrary extension
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @oid: holds an Object Identified in null terminated string
+  * @buf: a pointer to a DER encoded data
+  * @sizeof_buf: holds the size of @buf
+  * @critical: should be non zero if the extension is to be marked as critical
+  *
+  * This function will set an the extension, by the specified OID, in the certificate.
+  * The extension data should be binary data DER encoded.
+  *
+  * Returns 0 on success and a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_extension_by_oid (gnutls_x509_crt_t crt,
+                                      const char *oid, const void *buf,
+                                      size_t sizeof_buf,
+                                      unsigned int critical)
+{
+  int result;
+  gnutls_datum_t der_data;
+
+  der_data.data = (void *) buf;
+  der_data.size = sizeof_buf;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, oid, &der_data, critical);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+
+}
+
+/**
+ * gnutls_x509_crt_set_basic_constraints - This function will set the basicConstraints extension
+ * @crt: should contain a gnutls_x509_crt_t structure
+ * @ca: true(1) or false(0). Depending on the Certificate authority status.
+ * @pathLenConstraint: non-negative values indicate maximum length of path,
+ *   and negative values indicate that the pathLenConstraints field should
+ *   not be present.
+ *
+ * This function will set the basicConstraints certificate extension.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_set_basic_constraints (gnutls_x509_crt_t crt,
+                                       unsigned int ca, int pathLenConstraint)
+{
+  int result;
+  gnutls_datum_t der_data;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result = _gnutls_x509_ext_gen_basicConstraints (ca, pathLenConstraint,
+                                                  &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, "2.5.29.19", &der_data, 1);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_set_ca_status - This function will set the basicConstraints extension
+ * @crt: should contain a gnutls_x509_crt_t structure
+ * @ca: true(1) or false(0). Depending on the Certificate authority status.
+ *
+ * This function will set the basicConstraints certificate extension.
+ * Use gnutls_x509_crt_set_basic_constraints() if you want to control
+ * the pathLenConstraint field too.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_set_ca_status (gnutls_x509_crt_t crt, unsigned int ca)
+{
+  return gnutls_x509_crt_set_basic_constraints (crt, ca, -1);
+}
+
+/**
+  * gnutls_x509_crt_set_key_usage - This function will set the keyUsage extension
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @usage: an ORed sequence of the GNUTLS_KEY_* elements.
+  *
+  * This function will set the keyUsage certificate extension. 
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_key_usage (gnutls_x509_crt_t crt, unsigned int usage)
+{
+  int result;
+  gnutls_datum_t der_data;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result = _gnutls_x509_ext_gen_keyUsage ((uint16_t) usage, &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, "2.5.29.15", &der_data, 1);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_subject_alternative_name - This function will set the subject Alternative Name
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @type: is one of the gnutls_x509_subject_alt_name_t enumerations
+  * @data_string: The data to be set
+  *
+  * This function will set the subject alternative name certificate extension. 
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_subject_alternative_name (gnutls_x509_crt_t crt,
+                                              gnutls_x509_subject_alt_name_t
+                                              type, const char *data_string)
+{
+  int result;
+  gnutls_datum_t der_data;
+  gnutls_datum_t dnsname;
+  unsigned int critical;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (crt, "2.5.29.17", 0, &dnsname, &critical);
+
+  if (result >= 0)
+    _gnutls_free_datum (&dnsname);
+  if (result != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result =
+    _gnutls_x509_ext_gen_subject_alt_name (type, data_string, &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, "2.5.29.17", &der_data, 0);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+ * gnutls_x509_crt_set_proxy - Set the proxyCertInfo extension
+ * @crt: should contain a gnutls_x509_crt_t structure
+ * @pathLenConstraint: non-negative values indicate maximum length of path,
+ *   and negative values indicate that the pathLenConstraints field should
+ *   not be present.
+ * @policyLanguage: OID describing the language of @policy.
+ * @policy: opaque byte array with policy language, can be %NULL 
+ * @sizeof_policy: size of @policy.
+ *
+ * This function will set the proxyCertInfo extension.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_x509_crt_set_proxy (gnutls_x509_crt_t crt,
+                           int pathLenConstraint,
+                           const char *policyLanguage,
+                           const char *policy, size_t sizeof_policy)
+{
+  int result;
+  gnutls_datum_t der_data;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result = _gnutls_x509_ext_gen_proxyCertInfo (pathLenConstraint,
+                                               policyLanguage,
+                                               policy, sizeof_policy,
+                                               &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, "1.3.6.1.5.5.7.1.14",
+                                           &der_data, 1);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_sign2 - This function will sign a certificate with a key
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @issuer: is the certificate of the certificate issuer
+  * @issuer_key: holds the issuer's private key
+  * @dig: The message digest to use. GNUTLS_DIG_SHA1 is the safe choice unless you know what you're doing.
+  * @flags: must be 0
+  *
+  * This function will sign the certificate with the issuer's private key, and
+  * will copy the issuer's information into the certificate.
+  *
+  * This must be the last step in a certificate generation since all
+  * the previously set parameters are now signed.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_sign2 (gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
+                       gnutls_x509_privkey_t issuer_key,
+                       gnutls_digest_algorithm_t dig, unsigned int flags)
+{
+  int result;
+
+  if (crt == NULL || issuer == NULL || issuer_key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* disable all the unneeded OPTIONAL fields.
+   */
+  disable_optional_stuff (crt);
+
+  result = _gnutls_x509_pkix_sign (crt->cert, "tbsCertificate",
+                                   dig, issuer, issuer_key);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_sign - This function will sign a certificate with a key
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @issuer: is the certificate of the certificate issuer
+  * @issuer_key: holds the issuer's private key
+  *
+  * This function is the same a gnutls_x509_crt_sign2() with no flags, and
+  * SHA1 as the hash algorithm.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_sign (gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
+                      gnutls_x509_privkey_t issuer_key)
+{
+  return gnutls_x509_crt_sign2 (crt, issuer, issuer_key, GNUTLS_DIG_SHA1, 0);
+}
+
+/**
+  * gnutls_x509_crt_set_activation_time - This function will set the Certificate's activation time
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @act_time: The actual time
+  *
+  * This function will set the time this Certificate was or will be activated.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_activation_time (gnutls_x509_crt_t cert, time_t act_time)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_x509_set_time (cert->cert,
+                                "tbsCertificate.validity.notBefore",
+                                act_time);
+}
+
+/**
+  * gnutls_x509_crt_set_expiration_time - This function will set the Certificate's expiration time
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @exp_time: The actual time
+  *
+  * This function will set the time this Certificate will expire.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_expiration_time (gnutls_x509_crt_t cert, time_t exp_time)
+{
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+  return _gnutls_x509_set_time (cert->cert,
+                                "tbsCertificate.validity.notAfter", exp_time);
+}
+
+/**
+  * gnutls_x509_crt_set_serial - This function will set the certificate's serial number
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @serial: The serial number
+  * @serial_size: Holds the size of the serial field.
+  *
+  * This function will set the X.509 certificate's serial number. 
+  * Serial is not always a 32 or 64bit number. Some CAs use
+  * large serial numbers, thus it may be wise to handle it as something
+  * opaque. 
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_serial (gnutls_x509_crt_t cert, const void *serial,
+                            size_t serial_size)
+{
+  int ret;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret =
+    asn1_write_value (cert->cert, "tbsCertificate.serialNumber", serial,
+                      serial_size);
+  if (ret != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (ret);
+    }
+
+  return 0;
+
+}
+
+/* If OPTIONAL fields have not been initialized then
+ * disable them.
+ */
+static void
+disable_optional_stuff (gnutls_x509_crt_t cert)
+{
+
+  asn1_write_value (cert->cert, "tbsCertificate.issuerUniqueID", NULL, 0);
+
+  asn1_write_value (cert->cert, "tbsCertificate.subjectUniqueID", NULL, 0);
+
+  if (cert->use_extensions == 0)
+    {
+      _gnutls_x509_log ("Disabling X.509 extensions.\n");
+      asn1_write_value (cert->cert, "tbsCertificate.extensions", NULL, 0);
+    }
+
+  return;
+}
+
+/**
+  * gnutls_x509_crt_set_crl_dist_points - This function will set the CRL dist points
+  * @crt: should contain a gnutls_x509_crt_t structure
+  * @type: is one of the gnutls_x509_subject_alt_name_t enumerations
+  * @data_string: The data to be set
+  * @reason_flags: revocation reasons
+  *
+  * This function will set the CRL distribution points certificate extension. 
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_set_crl_dist_points (gnutls_x509_crt_t crt,
+                                     gnutls_x509_subject_alt_name_t
+                                     type, const void *data_string,
+                                     unsigned int reason_flags)
+{
+  int result;
+  gnutls_datum_t der_data;
+  gnutls_datum_t oldname;
+  unsigned int critical;
+
+  if (crt == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (crt, "2.5.29.31", 0, &oldname, &critical);
+
+  if (result >= 0)
+    _gnutls_free_datum (&oldname);
+  if (result != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result =
+    _gnutls_x509_ext_gen_crl_dist_points (type, data_string,
+                                          reason_flags, &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (crt, "2.5.29.31", &der_data, 0);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  crt->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_cpy_crl_dist_points - This function will copy the CRL dist points
+  * @dst: should contain a gnutls_x509_crt_t structure
+  * @src: the certificate where the dist points will be copied from
+  *
+  * This function will copy the CRL distribution points certificate 
+  * extension, from the source to the destination certificate.
+  * This may be useful to copy from a CA certificate to issued ones.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_x509_crt_cpy_crl_dist_points (gnutls_x509_crt_t dst,
+                                     gnutls_x509_crt_t src)
+{
+  int result;
+  gnutls_datum_t der_data;
+  unsigned int critical;
+
+  if (dst == NULL || src == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (src, "2.5.29.31", 0, &der_data,
+                                    &critical);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result =
+    _gnutls_x509_crt_set_extension (dst, "2.5.29.31", &der_data, critical);
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  dst->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_subject_key_id - This function will set the certificate's subject key id
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @id: The key ID
+  * @id_size: Holds the size of the serial field.
+  *
+  * This function will set the X.509 certificate's subject key ID extension.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_subject_key_id (gnutls_x509_crt_t cert,
+                                    const void *id, size_t id_size)
+{
+  int result;
+  gnutls_datum_t old_id, der_data;
+  unsigned int critical;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (cert, "2.5.29.14", 0, &old_id, &critical);
+
+  if (result >= 0)
+    _gnutls_free_datum (&old_id);
+  if (result != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result = _gnutls_x509_ext_gen_key_id (id, id_size, &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (cert, "2.5.29.14", &der_data, 0);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  cert->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_authority_key_id - This function will set the certificate authority's key id
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @id: The key ID
+  * @id_size: Holds the size of the serial field.
+  *
+  * This function will set the X.509 certificate's authority key ID extension.
+  * Only the keyIdentifier field can be set with this function.
+  *
+  * Returns 0 on success, or a negative value in case of an error.
+  *
+  **/
+int
+gnutls_x509_crt_set_authority_key_id (gnutls_x509_crt_t cert,
+                                      const void *id, size_t id_size)
+{
+  int result;
+  gnutls_datum_t old_id, der_data;
+  unsigned int critical;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (cert, "2.5.29.35", 0, &old_id, &critical);
+
+  if (result >= 0)
+    _gnutls_free_datum (&old_id);
+  if (result != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* generate the extension.
+   */
+  result = _gnutls_x509_ext_gen_auth_key_id (id, id_size, &der_data);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  result = _gnutls_x509_crt_set_extension (cert, "2.5.29.35", &der_data, 0);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  cert->use_extensions = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_x509_crt_set_key_purpose_oid - This function sets the Certificate's key purpose OIDs
+  * @cert: should contain a gnutls_x509_crt_t structure
+  * @oid: a pointer to a null terminated string that holds the OID
+  * @critical: Whether this extension will be critical or not
+  *
+  * This function will set the key purpose OIDs of the Certificate.
+  * These are stored in the Extended Key Usage extension (2.5.29.37)
+  * See the GNUTLS_KP_* definitions for human readable names.
+  *
+  * Subsequent calls to this function will append OIDs to the OID list.
+  *
+  * On success 0 is returned.
+  *
+  **/
+int
+gnutls_x509_crt_set_key_purpose_oid (gnutls_x509_crt_t cert,
+                                     const void *oid, unsigned int critical)
+{
+  int result;
+  gnutls_datum_t old_id, der_data;
+  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  result = asn1_create_element
+    (_gnutls_get_pkix (), "PKIX1.ExtKeyUsageSyntax", &c2);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  /* Check if the extension already exists.
+   */
+  result =
+    _gnutls_x509_crt_get_extension (cert, "2.5.29.37", 0, &old_id, NULL);
+
+  if (result >= 0)
+    {
+      /* decode it.
+       */
+      result = asn1_der_decoding (&c2, old_id.data, old_id.size, NULL);
+      _gnutls_free_datum (&old_id);
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          asn1_delete_structure (&c2);
+          return _gnutls_asn2err (result);
+        }
+
+    }
+
+  /* generate the extension.
+   */
+  /* 1. create a new element.
+   */
+  result = asn1_write_value (c2, "", "NEW", 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  /* 2. Add the OID.
+   */
+  result = asn1_write_value (c2, "?LAST", oid, 1);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_der_encode (c2, "", &der_data, 0);
+  asn1_delete_structure (&c2);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_crt_set_extension (cert, "2.5.29.37",
+                                           &der_data, critical);
+
+  _gnutls_free_datum (&der_data);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  cert->use_extensions = 1;
+
+  return 0;
+
+}
+
+#endif /* ENABLE_PKI */