This verifies this and returns a set of TlsCertificateFlags indicating any problems found with it.
This can be used to verify a certificate outside the context of making a connection, or to check a certificate against a CA that is not part of the system CA database.
If this is valid, g_tls_certificate_flags_none is returned.
If identity is not null, this's name(s) will be compared
against it, and g_tls_certificate_bad_identity will be set in the return value if it does not match. If
identity is null, that bit will never be set in the return value.
If trusted_ca is not null, then this (or one of the
certificates in its chain) must be signed by it, or else g_tls_certificate_unknown_ca will be set in the
return value. If trusted_ca is null, that bit will never be set in the return value.
GLib guarantees that if certificate verification fails, at least one error will be set in the return value, but it does not guarantee that all possible errors will be set. Accordingly, you may not safely decide to ignore any particular type of error. For example, it would be incorrect to mask g_tls_certificate_expired if you want to allow expired certificates, because this could potentially be the only error flag set even if other problems exist with the certificate.
Because TLS session context is not used, TlsCertificate may not perform as many checks on the certificates as TlsConnection would. For example, certificate constraints may not be honored, and revocation checks may not be performed. The best way to verify TLS certificates used by a TLS connection is to let TlsConnection handle the verification.
| this | |
| identity |
the expected peer identity |
| trusted_ca |
the certificate of a trusted authority |
|
the appropriate TlsCertificateFlags |