zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/EndpointI.h

@@ -1,95 +1,98 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_ENDPOINT_I_H
-#define ICE_SSL_ENDPOINT_I_H
+#ifndef ICESSL_ENDPOINT_I_H
+#define ICESSL_ENDPOINT_I_H
 
+#include <Ice/EndpointI.h>
 #include <Ice/IPEndpointI.h>
 #include <Ice/EndpointFactory.h>
-#include <Ice/WSEndpoint.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/EndpointInfo.h>
+#include <IceSSL/SSLEngineF.h>
 #include <Ice/Network.h>
 
 namespace IceSSL
 {
 
-class EndpointI : public IceInternal::IPEndpointI, public IceInternal::WSEndpointDelegate
+class EndpointI : public IceInternal::EndpointI
+#ifdef ICE_CPP11_MAPPING
+                , public std::enable_shared_from_this<EndpointI>
+#endif
 {
 public:
 
-    EndpointI(const InstancePtr&, const std::string&, Ice::Int, const IceInternal::Address&, Ice::Int,
-              const std::string&, bool);
-    EndpointI(const InstancePtr&);
-    EndpointI(const InstancePtr&, IceInternal::BasicStream*);
+    EndpointI(const InstancePtr&, const IceInternal::EndpointIPtr&);
 
-    virtual Ice::EndpointInfoPtr getInfo() const;
-    virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const;
+    virtual void streamWriteImpl(Ice::OutputStream*) const;
+
+    virtual Ice::EndpointInfoPtr getInfo() const ICE_NOEXCEPT;
+    virtual Ice::Short type() const;
+    virtual const std::string& protocol() const;
 
     virtual Ice::Int timeout() const;
     virtual IceInternal::EndpointIPtr timeout(Ice::Int) const;
+    virtual const std::string& connectionId() const;
+    virtual IceInternal::EndpointIPtr connectionId(const ::std::string&) const;
     virtual bool compress() const;
     virtual IceInternal::EndpointIPtr compress(bool) const;
     virtual bool datagram() const;
+    virtual bool secure() const;
 
     virtual IceInternal::TransceiverPtr transceiver() const;
+    virtual void connectors_async(Ice::EndpointSelectionType, const IceInternal::EndpointI_connectorsPtr&) const;
     virtual IceInternal::AcceptorPtr acceptor(const std::string&) const;
+    virtual std::vector<IceInternal::EndpointIPtr> expandIfWildcard() const;
+    virtual std::vector<IceInternal::EndpointIPtr> expandHost(IceInternal::EndpointIPtr&) const;
+    virtual bool equivalent(const IceInternal::EndpointIPtr&) const;
+    virtual ::Ice::Int hash() const;
     virtual std::string options() const;
 
+    EndpointIPtr endpoint(const IceInternal::EndpointIPtr&) const;
+
+#ifdef ICE_CPP11_MAPPING
+    virtual bool operator==(const Ice::Endpoint&) const;
+    virtual bool operator<(const Ice::Endpoint&) const;
+#else
     virtual bool operator==(const Ice::LocalObject&) const;
     virtual bool operator<(const Ice::LocalObject&) const;
-
-    virtual EndpointIPtr endpoint(const AcceptorIPtr&) const;
-
-    using IceInternal::IPEndpointI::connectionId;
+#endif
 
 protected:
 
-    virtual void streamWriteImpl(IceInternal::BasicStream*) const;
-    virtual void hashInit(Ice::Int&) const;
-    virtual void fillEndpointInfo(Ice::IPEndpointInfo*) const;
     virtual bool checkOption(const std::string&, const std::string&, const std::string&);
 
-    virtual IceInternal::ConnectorPtr createConnector(const IceInternal::Address&,
-                                                      const IceInternal::NetworkProxyPtr&) const;
-    virtual IceInternal::IPEndpointIPtr createEndpoint(const std::string&, int, const std::string&) const;
-
 private:
 
     //
     // All members are const, because endpoints are immutable.
     //
     const InstancePtr _instance;
-    const Ice::Int _timeout;
-    const bool _compress;
+    const IceInternal::EndpointIPtr _delegate;
 };
 
-class EndpointFactoryI : public IceInternal::EndpointFactory
+class EndpointFactoryI : public IceInternal::EndpointFactoryWithUnderlying
 {
 public:
 
-    virtual ~EndpointFactoryI();
+    EndpointFactoryI(const InstancePtr&, Ice::Short);
 
-    virtual Ice::Short type() const;
-    virtual std::string protocol() const;
-    virtual IceInternal::EndpointIPtr create(std::vector<std::string>&, bool) const;
-    virtual IceInternal::EndpointIPtr read(IceInternal::BasicStream*) const;
     virtual void destroy();
 
-    virtual IceInternal::EndpointFactoryPtr clone(const IceInternal::ProtocolInstancePtr&) const;
+    virtual IceInternal::EndpointFactoryPtr
+    cloneWithUnderlying(const IceInternal::ProtocolInstancePtr&, Ice::Short) const;
 
-private:
+protected:
+
+    virtual IceInternal::EndpointIPtr
+    createWithUnderlying(const IceInternal::EndpointIPtr&, std::vector<std::string>&, bool) const;
+    virtual IceInternal::EndpointIPtr
+    readWithUnderlying(const IceInternal::EndpointIPtr&, Ice::InputStream*) const;
 
-    EndpointFactoryI(const InstancePtr&);
-    friend class PluginI;
+private:
 
-    InstancePtr _instance;
+    InstancePtr _sslInstance;
 };
 
 }

data/ext/ice/cpp/src/IceSSL/EndpointInfo.cpp

@@ -1,13 +1,8 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
 //
-// **********************************************************************
-//
-// Ice version 3.6.5
+// Ice version 3.7.4
 //
 // <auto-generated>
 //
@@ -18,32 +13,63 @@
 // </auto-generated>
 //
 
-#ifndef ICE_SSL_API_EXPORTS
-#   define ICE_SSL_API_EXPORTS
+#ifndef ICESSL_API_EXPORTS
+#   define ICESSL_API_EXPORTS
 #endif
 #include <IceSSL/EndpointInfo.h>
 #include <IceUtil/PushDisableWarnings.h>
-#include <Ice/BasicStream.h>
-#include <IceUtil/Iterator.h>
+#include <Ice/InputStream.h>
+#include <Ice/OutputStream.h>
 #include <IceUtil/PopDisableWarnings.h>
 
+#if defined(_MSC_VER)
+#   pragma warning(disable:4458) // declaration of ... hides class member
+#elif defined(__clang__)
+#   pragma clang diagnostic ignored "-Wshadow"
+#elif defined(__GNUC__)
+#   pragma GCC diagnostic ignored "-Wshadow"
+#endif
+
 #ifndef ICE_IGNORE_VERSION
-#   if ICE_INT_VERSION / 100 != 306
+#   if ICE_INT_VERSION / 100 != 307
 #       error Ice version mismatch!
 #   endif
-#   if ICE_INT_VERSION % 100 > 50
+#   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 4
 #       error Ice patch level mismatch!
 #   endif
 #endif
 
+#ifdef ICE_CPP11_MAPPING // C++11 mapping
+
+namespace
+{
+
+}
+
+IceSSL::EndpointInfo::~EndpointInfo()
+{
+}
+
+#else // C++98 mapping
+
 namespace
 {
 
 }
 
-ICE_SSL_API ::Ice::LocalObject* IceSSL::upCast(::IceSSL::EndpointInfo* p) { return p; }
+IceSSL::EndpointInfo::~EndpointInfo()
+{
+}
+
+/// \cond INTERNAL
+ICESSL_API ::Ice::LocalObject* IceSSL::upCast(EndpointInfo* p) { return p; }
+/// \endcond
 
-ICE_SSL_API ::Ice::LocalObject* IceSSL::upCast(::IceSSL::WSSEndpointInfo* p) { return p; }
+namespace Ice
+{
+}
+
+#endif

data/ext/ice/cpp/src/IceSSL/Instance.cpp

@@ -1,19 +1,9 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#include <IceUtil/Config.h>
-#ifdef _WIN32
-#   include <winsock2.h>
-#endif
 #include <IceSSL/Instance.h>
 #include <IceSSL/SSLEngine.h>
-#include <Ice/Properties.h>
 
 using namespace std;
 using namespace Ice;

data/ext/ice/cpp/src/IceSSL/Instance.h

@@ -1,35 +1,30 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_INSTANCE_H
-#define ICE_SSL_INSTANCE_H
+#ifndef ICESSL_INSTANCE_H
+#define ICESSL_INSTANCE_H
 
-#include <IceSSL/InstanceF.h>
 #include <Ice/ProtocolInstance.h>
+#include <IceSSL/InstanceF.h>
 #include <IceSSL/SSLEngineF.h>
 
 namespace IceSSL
 {
 
-class Instance : public IceInternal::ProtocolInstance
+class ICESSL_API Instance : public IceInternal::ProtocolInstance
 {
 public:
 
     Instance(const SSLEnginePtr&, Ice::Short, const std::string&);
     virtual ~Instance();
 
-    SSLEnginePtr 
+    SSLEnginePtr
     engine() const
     {
         return _engine;
     }
-    
+
     bool initialized() const;
 
 private:

data/ext/ice/cpp/src/IceSSL/InstanceF.h

@@ -1,32 +1,31 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_INSTANCE_F_H
-#define ICE_SSL_INSTANCE_F_H
+#ifndef ICESSL_INSTANCE_F_H
+#define ICESSL_INSTANCE_F_H
 
 #include <IceUtil/Shared.h>
-
 #include <Ice/Handle.h>
+#include <IceSSL/Plugin.h>
 
 namespace IceSSL
 {
 
 class Instance;
-IceUtil::Shared* upCast(Instance*);
+ICESSL_API IceUtil::Shared* upCast(Instance*);
 typedef IceInternal::Handle<Instance> InstancePtr;
 
 class EndpointI;
-IceUtil::Shared* upCast(EndpointI*);
+#ifdef ICE_CPP11_MAPPING
+typedef ::std::shared_ptr<EndpointI> EndpointIPtr;
+#else
+ICESSL_API IceUtil::Shared* upCast(EndpointI*);
 typedef IceInternal::Handle<EndpointI> EndpointIPtr;
+#endif
 
 class AcceptorI;
-IceUtil::Shared* upCast(AcceptorI*);
+ICESSL_API IceUtil::Shared* upCast(AcceptorI*);
 typedef IceInternal::Handle<AcceptorI> AcceptorIPtr;
 
 }

data/ext/ice/cpp/src/IceSSL/OpenSSLCertificateI.cpp

@@ -0,0 +1,583 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#include <IceSSL/Plugin.h>
+#include <IceSSL/OpenSSL.h>
+#include <IceSSL/CertificateI.h>
+#include <IceSSL/OpenSSLUtil.h>
+#include <IceSSL/RFC2253.h>
+
+#include <IceUtil/Mutex.h>
+#include <IceUtil/MutexPtrLock.h>
+
+#include <openssl/x509v3.h>
+#include <openssl/pem.h>
+
+using namespace IceSSL;
+using namespace std;
+
+//
+// Avoid old style cast warnings from OpenSSL macros
+//
+#if defined(__GNUC__)
+#  pragma GCC diagnostic ignored "-Wold-style-cast"
+#endif
+
+#ifdef __SUNPRO_CC
+
+//
+// The call to sk_GENERAL_NAME_pop_free fails to compile if we don't
+// remove the extern "C" vs non extern "C" check with the macro below:
+//
+
+extern "C" typedef void (*FreeFunc)(void*);
+
+#undef CHECKED_SK_FREE_FUNC
+#define CHECKED_SK_FREE_FUNC(type, p) \
+    (FreeFunc) (p)
+
+#endif
+
+namespace
+{
+
+static string
+convertX509NameToString(X509_name_st* name)
+{
+    BIO* out = BIO_new(BIO_s_mem());
+    X509_NAME_print_ex(out, name, 0, XN_FLAG_RFC2253);
+    BUF_MEM* p;
+    BIO_get_mem_ptr(out, &p);
+    string result = string(p->data, p->length);
+    BIO_free(out);
+    return result;
+}
+
+static vector<pair<int, string> >
+convertGeneralNames(GENERAL_NAMES* gens)
+{
+    vector<pair<int, string> > alt;
+    if (gens == 0)
+    {
+        return alt;
+    }
+    for (int i = 0; i < sk_GENERAL_NAME_num(gens); ++i)
+    {
+        GENERAL_NAME* gen = sk_GENERAL_NAME_value(gens, i);
+        pair<int, string> p;
+        p.first = gen->type;
+        switch (gen->type)
+        {
+        case GEN_EMAIL:
+        {
+            ASN1_IA5STRING* str = gen->d.rfc822Name;
+            if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
+            {
+                p.second = string(reinterpret_cast<const char*>(str->data), str->length);
+            }
+            break;
+        }
+        case GEN_DNS:
+        {
+            ASN1_IA5STRING* str = gen->d.dNSName;
+            if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
+            {
+                p.second = string(reinterpret_cast<const char*>(str->data), str->length);
+            }
+            break;
+        }
+        case GEN_DIRNAME:
+        {
+            p.second = convertX509NameToString(gen->d.directoryName);
+            break;
+        }
+        case GEN_URI:
+        {
+            ASN1_IA5STRING* str = gen->d.uniformResourceIdentifier;
+            if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
+            {
+                p.second = string(reinterpret_cast<const char*>(str->data), str->length);
+            }
+            break;
+        }
+        case GEN_IPADD:
+        {
+            ASN1_OCTET_STRING* addr = gen->d.iPAddress;
+            // TODO: Support IPv6 someday.
+            if (addr && addr->type == V_ASN1_OCTET_STRING && addr->data && addr->length == 4)
+            {
+                ostringstream ostr;
+                for (int j = 0; j < 4; ++j)
+                {
+                    if (j > 0)
+                    {
+                        ostr << '.';
+                    }
+                    ostr << static_cast<int>(addr->data[j]);
+                }
+                p.second = ostr.str();
+            }
+            break;
+        }
+        case GEN_OTHERNAME:
+        case GEN_EDIPARTY:
+        case GEN_X400:
+        case GEN_RID:
+        {
+            //
+            // TODO: These types are not supported. If the user wants
+            // them, they have to get at the certificate data. Another
+            // alternative is to DER encode the data (as the Java
+            // certificate does).
+            //
+            break;
+        }
+        }
+        alt.push_back(p);
+    }
+    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
+    return alt;
+}
+
+class DistinguishedNameI : public IceSSL::DistinguishedName
+{
+public:
+
+    DistinguishedNameI(X509_name_st* name) :
+        IceSSL::DistinguishedName(IceSSL::RFC2253::parseStrict(convertX509NameToString(name)))
+    {
+        unescape();
+    }
+
+};
+
+IceUtil::Mutex* mut = 0;
+
+class Init
+{
+public:
+
+    Init()
+    {
+        mut = new IceUtil::Mutex;
+    }
+
+    ~Init()
+    {
+        delete mut;
+        mut = 0;
+    }
+};
+
+Init init;
+
+#ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#else
+static IceUtil::Time
+#endif
+ASMUtcTimeToTime(const ASN1_UTCTIME* s)
+{
+    struct tm tm;
+    int offset;
+
+    memset(&tm, '\0', sizeof tm);
+
+#  define g2(p) (((p)[0]-'0')*10+(p)[1]-'0')
+    tm.tm_year = g2(s->data);
+    if(tm.tm_year < 50)
+    {
+        tm.tm_year += 100;
+    }
+    tm.tm_mon = g2(s->data + 2) - 1;
+    tm.tm_mday = g2(s->data + 4);
+    tm.tm_hour = g2(s->data + 6);
+    tm.tm_min = g2(s->data + 8);
+    tm.tm_sec = g2(s->data + 10);
+    if(s->data[12] == 'Z')
+    {
+        offset = 0;
+    }
+    else
+    {
+        offset = g2(s->data + 13) * 60 + g2(s->data + 15);
+        if(s->data[12] == '-')
+        {
+            offset = -offset;
+        }
+    }
+#  undef g2
+
+    //
+    // If timegm was on all systems this code could be
+    // return IceUtil::Time::seconds(timegm(&tm) - offset*60);
+    //
+    // Windows doesn't support the re-entrant _r versions.
+    //
+#if defined(_MSC_VER)
+#   pragma warning(disable:4996) // localtime is depercated
+#endif
+    time_t tzone;
+    {
+        IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(mut);
+        time_t now = time(0);
+        tzone = mktime(localtime(&now)) - mktime(gmtime(&now));
+    }
+#if defined(_MSC_VER)
+#   pragma warning(default:4996) // localtime is depercated
+#endif
+
+    IceUtil::Time time = IceUtil::Time::seconds(mktime(&tm) - IceUtil::Int64(offset) * 60 + tzone);
+
+#ifdef ICE_CPP11_MAPPING
+    return chrono::system_clock::time_point(chrono::microseconds(time.toMicroSeconds()));
+#else
+    return time;
+#endif
+}
+
+class OpenSSLX509ExtensionI : public IceSSL::X509Extension
+{
+
+public:
+
+    OpenSSLX509ExtensionI(struct X509_extension_st*, const string&, x509_st*);
+    ~OpenSSLX509ExtensionI();
+    virtual bool isCritical() const;
+    virtual string getOID() const;
+    virtual vector<Ice::Byte> getData() const;
+
+private:
+
+    struct X509_extension_st* _extension;
+    string _oid;
+    x509_st* _cert;
+};
+
+class OpenSSLCertificateI : public IceSSL::OpenSSL::Certificate,
+                            public CertificateI,
+                            public IceUtil::Mutex
+{
+public:
+
+    OpenSSLCertificateI(x509_st*);
+    ~OpenSSLCertificateI();
+
+    virtual bool operator==(const IceSSL::Certificate&) const;
+
+    virtual vector<Ice::Byte> getAuthorityKeyIdentifier() const;
+    virtual vector<Ice::Byte> getSubjectKeyIdentifier() const;
+    virtual bool verify(const IceSSL::CertificatePtr&) const;
+    virtual string encode() const;
+
+#  ifdef ICE_CPP11_MAPPING
+    virtual chrono::system_clock::time_point getNotAfter() const;
+    virtual chrono::system_clock::time_point getNotBefore() const;
+#  else
+    virtual IceUtil::Time getNotAfter() const;
+    virtual IceUtil::Time getNotBefore() const;
+#  endif
+    virtual string getSerialNumber() const;
+    virtual IceSSL::DistinguishedName getIssuerDN() const;
+    virtual vector<pair<int, string> > getIssuerAlternativeNames() const;
+    virtual IceSSL::DistinguishedName getSubjectDN() const;
+    virtual vector<pair<int, string> > getSubjectAlternativeNames() const;
+    virtual int getVersion() const;
+    virtual x509_st* getCert() const;
+
+protected:
+
+    virtual void loadX509Extensions() const;
+
+private:
+
+    x509_st* _cert;
+};
+
+} // end anonymous namespace
+
+OpenSSLX509ExtensionI::OpenSSLX509ExtensionI(struct X509_extension_st* extension, const string& oid, x509_st* cert):
+    _extension(extension),
+    _oid(oid),
+    _cert(cert)
+{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+    CRYPTO_add(&_cert->references, 1, CRYPTO_LOCK_X509);
+#else
+    X509_up_ref(_cert);
+#endif
+}
+
+OpenSSLX509ExtensionI::~OpenSSLX509ExtensionI()
+{
+    X509_free(_cert);
+}
+
+bool
+OpenSSLX509ExtensionI::isCritical() const
+{
+    return X509_EXTENSION_get_critical(_extension) == 1;
+}
+
+string
+OpenSSLX509ExtensionI::getOID() const
+{
+    return _oid;
+}
+
+vector<Ice::Byte>
+OpenSSLX509ExtensionI::getData() const
+{
+    vector<Ice::Byte> data;
+    ASN1_OCTET_STRING* buffer = X509_EXTENSION_get_data(_extension);
+    assert(buffer);
+    data.resize(buffer->length);
+    memcpy(&data[0], buffer->data, buffer->length);
+    return data;
+}
+
+//
+// The caller is responsible for incrementing the reference count.
+//
+OpenSSLCertificateI::OpenSSLCertificateI(x509_st* cert) : _cert(cert)
+{
+    if(!_cert)
+    {
+#ifdef ICE_CPP11_MAPPING
+        throw invalid_argument("Invalid certificate reference");
+#else
+        throw IceUtil::IllegalArgumentException(__FILE__, __LINE__, "Invalid certificate reference");
+#endif
+    }
+}
+
+OpenSSLCertificateI::~OpenSSLCertificateI()
+{
+    if(_cert)
+    {
+        X509_free(_cert);
+    }
+}
+
+bool
+OpenSSLCertificateI::operator==(const IceSSL::Certificate& r) const
+{
+    const OpenSSLCertificateI* p = dynamic_cast<const OpenSSLCertificateI*>(&r);
+    if(!p)
+    {
+        return false;
+    }
+
+    return X509_cmp(_cert, p->_cert) == 0;
+}
+
+vector<Ice::Byte>
+OpenSSLCertificateI::getAuthorityKeyIdentifier() const
+{
+    vector<Ice::Byte> keyid;
+    int index = X509_get_ext_by_NID(_cert, NID_authority_key_identifier, -1);
+    if(index >= 0)
+    {
+        X509_EXTENSION* ext = X509_get_ext(_cert, index);
+        if(ext)
+        {
+            AUTHORITY_KEYID* decoded = (AUTHORITY_KEYID*)X509V3_EXT_d2i(ext);
+            if(!decoded)
+            {
+                throw IceSSL::CertificateEncodingException(__FILE__, __LINE__, "the extension could not be decoded");
+            }
+            keyid.resize(decoded->keyid->length);
+            memcpy(&keyid[0], decoded->keyid->data, decoded->keyid->length);
+            AUTHORITY_KEYID_free(decoded);
+        }
+    }
+    return keyid;
+}
+
+vector<Ice::Byte>
+OpenSSLCertificateI::getSubjectKeyIdentifier() const
+{
+    vector<Ice::Byte> keyid;
+    int index = X509_get_ext_by_NID(_cert, NID_subject_key_identifier, -1);
+    if(index >= 0)
+    {
+        X509_EXTENSION* ext = X509_get_ext(_cert, index);
+        if(ext)
+        {
+            ASN1_OCTET_STRING* decoded = static_cast<ASN1_OCTET_STRING*>(X509V3_EXT_d2i(ext));
+            if(!decoded)
+            {
+                throw IceSSL::CertificateEncodingException(__FILE__, __LINE__, "the extension could not be decoded");
+            }
+            keyid.resize(decoded->length);
+            memcpy(&keyid[0], decoded->data, decoded->length);
+            ASN1_OCTET_STRING_free(decoded);
+        }
+    }
+    return keyid;
+}
+
+bool
+OpenSSLCertificateI::verify(const IceSSL::CertificatePtr& cert) const
+{
+    OpenSSLCertificateI* c = dynamic_cast<OpenSSLCertificateI*>(cert.get());
+    if(c)
+    {
+        EVP_PKEY* key = X509_get_pubkey(c->_cert);
+        bool verified = X509_verify(_cert, key) > 0;
+        EVP_PKEY_free(key);
+        return verified;
+    }
+    return false;
+}
+
+string
+OpenSSLCertificateI::encode() const
+{
+    BIO* out = BIO_new(BIO_s_mem());
+    int i = PEM_write_bio_X509(out, _cert);
+    if(i <= 0)
+    {
+        BIO_free(out);
+        throw IceSSL::CertificateEncodingException(__FILE__, __LINE__, IceSSL::OpenSSL::getSslErrors(false));
+    }
+    BUF_MEM* p;
+    BIO_get_mem_ptr(out, &p);
+    string result = string(p->data, p->length);
+    BIO_free(out);
+    return result;
+}
+
+#  ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#  else
+IceUtil::Time
+#  endif
+OpenSSLCertificateI::getNotAfter() const
+{
+    return ASMUtcTimeToTime(X509_get_notAfter(_cert));
+}
+
+#  ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#  else
+IceUtil::Time
+#  endif
+OpenSSLCertificateI::getNotBefore() const
+{
+    return ASMUtcTimeToTime(X509_get_notBefore(_cert));
+}
+
+string
+OpenSSLCertificateI::getSerialNumber() const
+{
+    BIGNUM* bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(_cert), 0);
+    char* dec = BN_bn2dec(bn);
+    string result = dec;
+    OPENSSL_free(dec);
+    BN_free(bn);
+    return result;
+}
+
+IceSSL::DistinguishedName
+OpenSSLCertificateI::getIssuerDN() const
+{
+    return IceSSL::DistinguishedName(IceSSL::RFC2253::parseStrict(convertX509NameToString(X509_get_issuer_name(_cert))));
+}
+
+vector<pair<int, string> >
+OpenSSLCertificateI::getIssuerAlternativeNames() const
+{
+    return convertGeneralNames(reinterpret_cast<GENERAL_NAMES*>(X509_get_ext_d2i(_cert, NID_issuer_alt_name, 0, 0)));
+}
+
+IceSSL::DistinguishedName
+OpenSSLCertificateI::getSubjectDN() const
+{
+    return IceSSL::DistinguishedName(IceSSL::RFC2253::parseStrict(convertX509NameToString(X509_get_subject_name(_cert))));
+}
+
+vector<pair<int, string> >
+OpenSSLCertificateI::getSubjectAlternativeNames() const
+{
+    return convertGeneralNames(reinterpret_cast<GENERAL_NAMES*>(X509_get_ext_d2i(_cert, NID_subject_alt_name, 0, 0)));
+}
+
+int
+OpenSSLCertificateI::getVersion() const
+{
+    return static_cast<int>(X509_get_version(_cert));
+}
+
+x509_st*
+OpenSSLCertificateI::getCert() const
+{
+    return _cert;
+}
+
+void
+OpenSSLCertificateI::loadX509Extensions() const
+{
+    IceUtil::Mutex::Lock sync(*this);
+    if(_extensions.empty())
+    {
+        int sz = X509_get_ext_count(_cert);
+        for(int i = 0; i < sz; i++)
+        {
+            X509_EXTENSION* ext = X509_get_ext(_cert, i);
+            ASN1_OBJECT* obj = X509_EXTENSION_get_object(ext);
+            string oid;
+            //
+            // According to OBJ_obj2txt doc a buffer of length 80 should be more than enough to
+            // handle any OID encountered in practice.
+            //
+            int len = 80;
+            oid.resize(len);
+            len = OBJ_obj2txt(&oid[0], len, obj, 1);
+            oid.resize(len);
+            _extensions.push_back(ICE_DYNAMIC_CAST(IceSSL::X509Extension,
+                ICE_MAKE_SHARED(OpenSSLX509ExtensionI, ext, oid, _cert)));
+        }
+    }
+}
+
+IceSSL::OpenSSL::CertificatePtr
+IceSSL::OpenSSL::Certificate::create(x509_st* cert)
+{
+    return ICE_MAKE_SHARED(OpenSSLCertificateI, cert);
+}
+
+IceSSL::OpenSSL::CertificatePtr
+IceSSL::OpenSSL::Certificate::load(const std::string& file)
+{
+    BIO* cert = BIO_new(BIO_s_file());
+    if(BIO_read_filename(cert, file.c_str()) <= 0)
+    {
+        BIO_free(cert);
+        throw CertificateReadException(__FILE__, __LINE__, "error opening file");
+    }
+
+    x509_st* x = PEM_read_bio_X509(cert, ICE_NULLPTR, ICE_NULLPTR, ICE_NULLPTR);
+    if(x == ICE_NULLPTR)
+    {
+        BIO_free(cert);
+        throw CertificateReadException(__FILE__, __LINE__, "error reading file:\n" + getSslErrors(false));
+    }
+    BIO_free(cert);
+    return ICE_MAKE_SHARED(OpenSSLCertificateI, x);
+}
+
+IceSSL::OpenSSL::CertificatePtr
+IceSSL::OpenSSL::Certificate::decode(const std::string& encoding)
+{
+    BIO *cert = BIO_new_mem_buf(static_cast<void*>(const_cast<char*>(&encoding[0])), static_cast<int>(encoding.size()));
+    x509_st* x = PEM_read_bio_X509(cert, ICE_NULLPTR, ICE_NULLPTR, ICE_NULLPTR);
+    if(x == ICE_NULLPTR)
+    {
+        BIO_free(cert);
+        throw CertificateEncodingException(__FILE__, __LINE__, getSslErrors(false));
+    }
+    BIO_free(cert);
+    return ICE_MAKE_SHARED(OpenSSLCertificateI, x);
+}