235 	return impl->cert;  in sshkey_type_is_cert()
261 		    (!impl->cert && strcasecmp(impl->shortname, name) == 0))  in sshkey_type_from_name()
331 		if ((certs_only && !impl->cert) || (plain_only && impl->cert))  in sshkey_alg_list()
410 	return !impl->cert;  in sshkey_type_is_valid_ca()
570 cert_free(struct sshkey_cert *cert)  in cert_free()  argument
574 	if (cert == NULL)  in cert_free()
576 	sshbuf_free(cert->certblob);  in cert_free()
577 	sshbuf_free(cert->critical);  in cert_free()
578 	sshbuf_free(cert->extensions);  in cert_free()
579 	free(cert->key_id);  in cert_free()
580 	for (i = 0; i < cert->nprincipals; i++)  in cert_free()
581 		free(cert->principals[i]);  in cert_free()
582 	free(cert->principals);  in cert_free()
583 	sshkey_free(cert->signature_key);  in cert_free()
584 	free(cert->signature_type);  in cert_free()
585 	freezero(cert, sizeof(*cert));  in cert_free()
591 	struct sshkey_cert *cert;  in cert_new()  local
593 	if ((cert = calloc(1, sizeof(*cert))) == NULL)  in cert_new()
595 	if ((cert->certblob = sshbuf_new()) == NULL ||  in cert_new()
596 	    (cert->critical = sshbuf_new()) == NULL ||  in cert_new()
597 	    (cert->extensions = sshbuf_new()) == NULL) {  in cert_new()
598 		cert_free(cert);  in cert_new()
601 	cert->key_id = NULL;  in cert_new()
602 	cert->principals = NULL;  in cert_new()
603 	cert->signature_key = NULL;  in cert_new()
604 	cert->signature_type = NULL;  in cert_new()
605 	return cert;  in cert_new()
630 		if ((k->cert = cert_new()) == NULL) {  in sshkey_new()
661 		cert_free(k->cert);  in sshkey_free_contents()
722 		if (!cert_compare(a->cert, b->cert))  in sshkey_equal()
755 		if (key->cert == NULL)  in to_blob_buf()
757 		if (sshbuf_len(key->cert->certblob) == 0)  in to_blob_buf()
760 		if ((ret = sshbuf_putb(b, key->cert->certblob)) != 0)  in to_blob_buf()
1320 	switch (k->cert->type) {  in sshkey_cert_type()
1431 	if (to_key == NULL || (from = from_key->cert) == NULL)  in sshkey_cert_copy()
1484 	cert_free(to_key->cert);  in sshkey_cert_copy()
1485 	to_key->cert = to;  in sshkey_cert_copy()
1771 	if ((ret = sshbuf_putb(key->cert->certblob, certbuf)) != 0)  in cert_parse()
1775 	if ((ret = sshbuf_get_u64(b, &key->cert->serial)) != 0 ||  in cert_parse()
1776 	    (ret = sshbuf_get_u32(b, &key->cert->type)) != 0 ||  in cert_parse()
1777 	    (ret = sshbuf_get_cstring(b, &key->cert->key_id, &kidlen)) != 0 ||  in cert_parse()
1779 	    (ret = sshbuf_get_u64(b, &key->cert->valid_after)) != 0 ||  in cert_parse()
1780 	    (ret = sshbuf_get_u64(b, &key->cert->valid_before)) != 0 ||  in cert_parse()
1791 	signed_len = sshbuf_len(key->cert->certblob) - sshbuf_len(b);  in cert_parse()
1798 	if (key->cert->type != SSH2_CERT_TYPE_USER &&  in cert_parse()
1799 	    key->cert->type != SSH2_CERT_TYPE_HOST) {  in cert_parse()
1809 		if (key->cert->nprincipals >= SSHKEY_CERT_MAX_PRINCIPALS) {  in cert_parse()
1818 		oprincipals = key->cert->principals;  in cert_parse()
1819 		key->cert->principals = recallocarray(key->cert->principals,  in cert_parse()
1820 		    key->cert->nprincipals, key->cert->nprincipals + 1,  in cert_parse()
1821 		    sizeof(*key->cert->principals));  in cert_parse()
1822 		if (key->cert->principals == NULL) {  in cert_parse()
1824 			key->cert->principals = oprincipals;  in cert_parse()
1828 		key->cert->principals[key->cert->nprincipals++] = principal;  in cert_parse()
1835 	if ((ret = sshbuf_putb(key->cert->critical, crit)) != 0 ||  in cert_parse()
1837 	    (ret = sshbuf_putb(key->cert->extensions, exts)) != 0))  in cert_parse()
1846 			sshbuf_reset(key->cert->critical);  in cert_parse()
1854 			sshbuf_reset(key->cert->extensions);  in cert_parse()
1861 	if (sshkey_from_blob_internal(ca, &key->cert->signature_key, 0) != 0) {  in cert_parse()
1865 	if (!sshkey_type_is_valid_ca(key->cert->signature_key->type)) {  in cert_parse()
1869 	if ((ret = sshkey_verify(key->cert->signature_key, sig, slen,  in cert_parse()
1870 	    sshbuf_ptr(key->cert->certblob), signed_len, NULL, 0, NULL)) != 0)  in cert_parse()
1873 	    &key->cert->signature_type)) != 0)  in cert_parse()
2034 	if (key->cert == NULL || key->cert->signature_type == NULL)  in sshkey_check_cert_sigtype()
2036 	if (match_pattern_list(key->cert->signature_type, allowed, 0) != 1)  in sshkey_check_cert_sigtype()
2056 		if (!impl->cert)  in sshkey_sigalg_by_name()
2153 	if ((k->cert = cert_new()) == NULL)  in sshkey_to_certified()
2165 	cert_free(k->cert);  in sshkey_drop_cert()
2166 	k->cert = NULL;  in sshkey_drop_cert()
2182 	struct sshbuf *cert = NULL;  in sshkey_certify_custom()  local
2185 	if (k == NULL || k->cert == NULL ||  in sshkey_certify_custom()
2186 	    k->cert->certblob == NULL || ca == NULL)  in sshkey_certify_custom()
2200 		alg = k->cert->signature_type;  in sshkey_certify_custom()
2201 	else if (k->cert->signature_type != NULL &&  in sshkey_certify_custom()
2202 	    strcmp(alg, k->cert->signature_type) != 0)  in sshkey_certify_custom()
2215 	cert = k->cert->certblob; /* for readability */  in sshkey_certify_custom()
2216 	sshbuf_reset(cert);  in sshkey_certify_custom()
2217 	if ((ret = sshbuf_put_cstring(cert, sshkey_ssh_name(k))) != 0)  in sshkey_certify_custom()
2222 	if ((ret = sshbuf_put_string(cert, nonce, sizeof(nonce))) != 0)  in sshkey_certify_custom()
2226 	if ((ret = impl->funcs->serialize_public(k, cert,  in sshkey_certify_custom()
2231 	if ((ret = sshbuf_put_u64(cert, k->cert->serial)) != 0 ||  in sshkey_certify_custom()
2232 	    (ret = sshbuf_put_u32(cert, k->cert->type)) != 0 ||  in sshkey_certify_custom()
2233 	    (ret = sshbuf_put_cstring(cert, k->cert->key_id)) != 0)  in sshkey_certify_custom()
2240 	for (i = 0; i < k->cert->nprincipals; i++) {  in sshkey_certify_custom()
2242 		    k->cert->principals[i])) != 0)  in sshkey_certify_custom()
2245 	if ((ret = sshbuf_put_stringb(cert, principals)) != 0 ||  in sshkey_certify_custom()
2246 	    (ret = sshbuf_put_u64(cert, k->cert->valid_after)) != 0 ||  in sshkey_certify_custom()
2247 	    (ret = sshbuf_put_u64(cert, k->cert->valid_before)) != 0 ||  in sshkey_certify_custom()
2248 	    (ret = sshbuf_put_stringb(cert, k->cert->critical)) != 0 ||  in sshkey_certify_custom()
2249 	    (ret = sshbuf_put_stringb(cert, k->cert->extensions)) != 0 ||  in sshkey_certify_custom()
2250 	    (ret = sshbuf_put_string(cert, NULL, 0)) != 0 || /* Reserved */  in sshkey_certify_custom()
2251 	    (ret = sshbuf_put_string(cert, ca_blob, ca_len)) != 0)  in sshkey_certify_custom()
2255 	if ((ret = signer(ca, &sig_blob, &sig_len, sshbuf_ptr(cert),  in sshkey_certify_custom()
2256 	    sshbuf_len(cert), alg, sk_provider, sk_pin, 0, signer_ctx)) != 0)  in sshkey_certify_custom()
2265 	if (k->cert->signature_type == NULL) {  in sshkey_certify_custom()
2266 		k->cert->signature_type = sigtype;  in sshkey_certify_custom()
2270 	if ((ret = sshbuf_put_string(cert, sig_blob, sig_len)) != 0)  in sshkey_certify_custom()
2275 		sshbuf_reset(cert);  in sshkey_certify_custom()
2317 		if (k->cert->type != SSH2_CERT_TYPE_HOST) {  in sshkey_cert_check_authority()
2322 		if (k->cert->type != SSH2_CERT_TYPE_USER) {  in sshkey_cert_check_authority()
2327 	if (verify_time < k->cert->valid_after) {  in sshkey_cert_check_authority()
2331 	if (verify_time >= k->cert->valid_before) {  in sshkey_cert_check_authority()
2335 	if (k->cert->nprincipals == 0) {  in sshkey_cert_check_authority()
2342 		for (i = 0; i < k->cert->nprincipals; i++) {  in sshkey_cert_check_authority()
2344 				if (match_pattern(k->cert->principals[i],  in sshkey_cert_check_authority()
2349 			} else if (strcmp(name, k->cert->principals[i]) == 0) {  in sshkey_cert_check_authority()
2389 	if (sshbuf_len(key->cert->critical) != 0) {  in sshkey_cert_check_host()
2402 sshkey_format_cert_validity(const struct sshkey_cert *cert, char *s, size_t l)  in sshkey_format_cert_validity()  argument
2407 	if (cert->valid_after == 0 &&  in sshkey_format_cert_validity()
2408 	    cert->valid_before == 0xffffffffffffffffULL)  in sshkey_format_cert_validity()
2411 	if (cert->valid_after != 0)  in sshkey_format_cert_validity()
2412 		format_absolute_time(cert->valid_after, from, sizeof(from));  in sshkey_format_cert_validity()
2413 	if (cert->valid_before != 0xffffffffffffffffULL)  in sshkey_format_cert_validity()
2414 		format_absolute_time(cert->valid_before, to, sizeof(to));  in sshkey_format_cert_validity()
2416 	if (cert->valid_after == 0)  in sshkey_format_cert_validity()
2418 	else if (cert->valid_before == 0xffffffffffffffffULL)  in sshkey_format_cert_validity()
2459 		if (key->cert == NULL ||  in sshkey_private_serialize_opt()
2460 		    sshbuf_len(key->cert->certblob) == 0) {  in sshkey_private_serialize_opt()
2464 		if ((r = sshbuf_put_stringb(b, key->cert->certblob)) != 0)  in sshkey_private_serialize_opt()