1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 #ifndef NET_CERT_CERT_POLICY_ENFORCER_H
5 #define NET_CERT_CERT_POLICY_ENFORCER_H
9 #include "net/base/net_export.h"
10 #include "net/log/net_log.h"
16 struct CTVerifyResult
;
17 class EVCertsWhitelist
;
21 class X509Certificate
;
23 // Class for checking that a given certificate conforms to security-related
25 class NET_EXPORT CertPolicyEnforcer
{
27 // Set the parameters for this policy enforcer:
28 // |require_ct_for_ev| indicates whether Certificate Transparency presence
29 // is required for EV certificates.
30 explicit CertPolicyEnforcer(bool require_ct_for_ev
);
31 virtual ~CertPolicyEnforcer();
33 // Returns true if the collection of SCTs for the given certificate
34 // conforms with the CT/EV policy. Conformance details are logged to
36 // |cert| is the certificate for which the SCTs apply.
37 // |ct_result| must contain the result of verifying any SCTs associated with
38 // |cert| prior to invoking this method.
39 bool DoesConformToCTEVPolicy(X509Certificate
* cert
,
40 const ct::EVCertsWhitelist
* ev_whitelist
,
41 const ct::CTVerifyResult
& ct_result
,
42 const BoundNetLog
& net_log
);
45 bool require_ct_for_ev_
;
50 #endif // NET_CERT_CERT_POLICY_ENFORCER_H