System i: Programming Secure Sockets APIs - IBM

v GSK_CERT_VALIDATION_CALLBACK (805) This is the callback that is required to do
additional certificate validation
callBackAreaPtr (Input)
Address of a callback routine or address of a structure containing pointers to callback routines
appropriate to the callBackID. The following indicate what should be pointed to by the
callBackAreaPtr based on the value of the callBackID.
v GSK_ENVIRONMENT_CLOSE_CALLBACK - The callBackAreaPtr should be set to the
address of a function with prototype pGSK_ENVIRONMENT_CLOSE_CALLBACK.
pGSK_ENVIRONMENT_CLOSE_CALLBACK is defined as:
typedef void ( *pGSK_ENVIRONMENT_CLOSE_CALLBACK) (gsk_handle my_env_handle);
v GSK_CERT_VALIDATION_CALLBACK - The callBackAreaPtr must point to a
validationCallBack structure. That structure is defined as:
typedef struct validationCallBack_struct
{
pgsk_cert_validation_callback validation_callback;
VALIDATE_REQUIRED validateRequired;
CERT_NEEDED certificateNeeded;
} validationCallBack;
– validationCallBack.validation_callback should be set to a value of type
pgsk_cert_validation_callback. This is the pgsk_cert_validation_callback typedef:
typedef int (*pgsk_cert_validation_callback)(const unsigned char * my_CertificateChain,
int my_validation_status)
Do not use pgsk_cert_validation_callback as a variable type when you create your prototype
and function though. The following prototype should be used in the code for the function
whose address will be assigned to validationCallBack.validation_callback:
int foo(const unsigned char * my_CertificateChain,
int my_validation_status);
The return value from this function will be one of following:
- GSK_OK (0) - Application accepts the certificate, and SSL will continue the handshake
with this value.
- GSK_ERROR_CERT_VALIDATION (8) - Application does not accept the certificate, and
SSL handshake will terminate immediately with this value. If callback routine return other
than GSK_OK, SSL will consider it as GSK_ERROR_CERT_VALIDATION and terminate
the handshake.
Parameters
my_CertificateChain (Input)
A pointer to a copy of buffer which contains the data of certificate chain.
my_validation_status (Input)
Results from SSL certificate validation:
- GSK_VALIDATION_SUCCESSFUL (0) - Validation is successful.
- GSK_OS400_ERROR_NOT_TRUSTED_ROOT (6000) - The certificate is not signed
by a trusted certificate authority
- GSK_KEYFILE_CERT_EXPIRED (107) - The validity time period of the certificate
has expired.
– validationCallBack.validateRequired - This is the flag to inform SSL when to call the certificate
validation callback. The following values can be used :
- GSK_NO_VALIDATION (900) - User application would like SSL to validate and
authenticate the certificate first before calling the certificate validation callback. However,
Secure Sockets APIs 21