GTlsCertificateFlags verify ( GTlsCertificate* cert, GSocketConnectable* identity, GTlsCertificate* trusted_ca )
cert and returns a set of
indicating any problems found with it. This can be used to verify a
certificate outside the context of making a connection, or to
check a certificate against a CA that is not part of the system
cert is valid,
G_TLS_CERTIFICATE_NO_FLAGS is returned.
identity is not
cert‘s name(s) will be compared against
G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return
value if it does not match. If
NULL, that bit will
never be set in the return value.
trusted_ca is not
cert (or one of the certificates
in its chain) must be signed by it, or else
G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If
NULL, that bit will never be set in the return value.
GLib guarantees that if certificate verification fails, at least one
error will be set in the return value, but it does not guarantee
that all possible errors will be set. Accordingly, you may not safely
decide to ignore any particular type of error. For example, it would
be incorrect to mask
G_TLS_CERTIFICATE_EXPIRED if you want to allow
expired certificates, because this could potentially be the only
error flag set even if other problems exist with the certificate.
Because TLS session context is not used,
GTlsCertificate may not
perform as many checks on the certificates as
For example, certificate constraints may not be honored, and
revocation checks may not be performed. The best way to verify TLS
certificates used by a TLS connection is to let
handle the verification.
Available since: 2.28