Validate

[Adamk93]

It passes tests on the server side.
Tests on:

• Structural wellformedness of the chain;
• Date validity;
• Certificates not in the CRLs declared in the chain;
  These tests are test the 2 different combos of inputs:
• Only certificates unique identifiers
• Only certificates
• with and without data
• Chain partially stored on the KMS, meaning that the rest are provided as an input(Vector of certificates).

On the client side I am not very sure to how to do it. Anyway, if you could give me a hint would be a big plus.

[tbrezot]

What is the semantic of this option? Isn't the empty vector enough?

[Adamk93]

Idk I prefer to deal with Option. I can change if you don't really like it

[tbrezot]

As you prefer. IMHO, an empty collection is what you want: you can then iterate on it without handling the None case.

[Adamk93]

@tbrezot @Manuthor I think the PR is ready. If you've other comments, please do.

[itchenrenfu]

How to use gui Certificate validate?

[itchenrenfu]

[Manuthor]

Hello,
The certificate chain must be given either using unique identifiers either DER string arrays, or both eventually (as specified in https://docs.oasis-open.org/kmip/kmip-spec/v2.0/os/kmip-spec-v2.0-os.html#_Toc6497577).
But for simplicity, I would recommend to only use unique identifiers to give all certificates of the chain in the Validate operation (ids of root, intermediate and leaf certificates for example).
In 4.17.0 KMS server version, validation of certificate is a bit restrictive (self-signed certificate cannot be validate for example).

About your certificate, can you confirm the certificate behind your id is DER encoded (not PEM). OpenSSL error gives a format problem.

[itchenrenfu]

hello,
Does AES support rotation?