

#include <gnutls/gnutls.h>
#include <gnutls/x509.h>

/* This function will try to verify the peer's certificate, and
 * also check if the hostname matches, and the activation, expiration dates.
 */
void verify_certificate( gnutls_session session, const char* hostname)
{
   int status;
   const gnutls_datum* cert_list;
   int cert_list_size;
   gnutls_x509_crt cert;


   /* This verification function uses the trusted CAs in the credentials
    * structure. So you must have installed one or more CA certificates.
    */
   status = gnutls_certificate_verify_peers(session);

   if (status == GNUTLS_E_NO_CERTIFICATE_FOUND) {
      printf("No certificate was sent\n");
      return;
   }

   if (status & GNUTLS_CERT_INVALID)
      printf("The certificate is not trusted.\n");

   if (status & GNUTLS_CERT_ISSUER_NOT_FOUND)
      printf("The certificate hasn't got a known issuer.\n");

   if (status & GNUTLS_CERT_REVOKED)
     printf("The certificate has been revoked.\n");


   /* Up to here the process is the same for X.509 certificates and
    * OpenPGP keys. From now on X.509 certificates are assumed. This can
    * be easily extended to work with openpgp keys as well.
    */
   if ( gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
      return;

   if ( gnutls_x509_crt_init( &cert) < 0) {
      printf("error in initialization\n");
      return;
   }

   cert_list = gnutls_certificate_get_peers( session, &cert_list_size);
   if ( cert_list == NULL) {
      printf("No certificate was found!\n");
      return;
   }

   /* This is not a real world example, since we only check the first 
    * certificate in the given chain.
    */
   if ( gnutls_x509_crt_import( cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0) {
      printf("error parsing certificate\n");
      return;
   }

   /* Beware here we do not check for errors.
    */
   if ( gnutls_x509_crt_get_expiration( cert) < time(0)) {
      printf("The certificate has expired\n");
      return;
   }

   if ( gnutls_x509_crt_get_activation_time( cert) > time(0)) {
      printf("The certificate is not yet activated\n");
      return;
   }

   if ( !gnutls_x509_crt_check_hostname( cert, hostname)) {
      printf("The certificate's owner does not match hostname '%s'\n", hostname);
      return;
   }

   gnutls_x509_crt_deinit( cert);

   return;
}

