Skip to content
FutureBlitz

    Install

    Import std.crypto.pem

    std.crypto.pem

    Reading keys and X.509 certificates from PEM, and writing keys to it.

    Key and Certificate, which read keys and X.509 certificates from PEM, the text between "-----BEGIN ...-----" and "-----END ...-----" lines that keys and certificates are kept in, over mbedTLS. A Key's Bytes are what its kind's Methods take, so a key read from PEM signs, verifies, or exchanges. RSA keys are of up to 8192 bits.

    std/crypto/pem.fb

    Types

    KeyKind enum 

    Public Enum KeyKind

    What a Key is for, which says what its Bytes are.

    std/crypto/pem.fb, line 27

    • ECDSA_P256 enum member #

      An ECDSA P-256 key, for signing: a private key's 32 bytes, or a public key's 65.

    • RSA enum member #

      An RSA key, for verifying signatures: its PKCS #1 DER.

    • X25519 enum member #

      An X25519 key, for key agreement: its 32 bytes.

    • ED25519 enum member #

      An Ed25519 key, for signing: its 32 bytes.

    Key struct 

    Public Struct Key

    A private or public key, as its kind's Methods take it: an ECDSA P-256 private key's 32 bytes or public key's 65; an RSA key's PKCS #1 DER, whose public one Rsa verifies with; and an X25519 or Ed25519 key's 32 bytes.

    Examples

    Local key = Key(KeyKind.ED25519, True, Ed25519.NewPrivateKey())
Local pem = key.ToPem()
Expect(pem.StartsWith("-----BEGIN PRIVATE KEY-----"))
Local read = Try Key.FromPem(pem)
Expect(read.Kind == KeyKind.ED25519 && read.IsPrivate && read.Bytes == key.Bytes)

    std/crypto/pem.fb, line 52

    • Public ReadOnly Field Kind: KeyKind field #

      What kind of key it is.

    • Public ReadOnly Field IsPrivate: Bool field #

      Whether it's a private key, or a public one.

    • Public ReadOnly Field Bytes: UInt8[] field #

      Its bytes, as its kind's Methods take them.

    • Public New(kind: KeyKind, isPrivate: Bool, bytes: UInt8[]) constructor #

      A key of kind, private or public, of bytes.

    • Public Static Method FromPem(pem: String): Key Throws ParseError static method #

      The first key in pem, whatever comes after it: a private one in PKCS #8 ("PRIVATE KEY"), SEC 1 ("EC PRIVATE KEY"), or PKCS #1 ("RSA PRIVATE KEY"), or a public one ("PUBLIC KEY", or "RSA PUBLIC KEY"). Throws a ParseError of SYNTAX when pem has no key, or one that doesn't read, and of WRONG_TYPE when it's encrypted, or of a kind there's no KeyKind for, like another curve's.

    • @PanicsAtCaller Public Method ToPem(): String method #

      The key as PEM, as OpenSSL writes it: a private one in PKCS #8, but an RSA one in PKCS #1 and a P-256 one in SEC 1, and a public one, RSA's too, in SubjectPublicKeyInfo. Panics when Bytes isn't a key of its Kind.

    Certificate struct 

    Public Struct Certificate

    An X.509 certificate, read from PEM: who it's for and who signed it, as Python's ssl shows them, "C=NL, O=Example, CN=example.com", in the certificate's order, as UTF-8 text with RFC 4514's escapes; its serial number as hex bytes with colons between them; the UTC times it's valid from and to, as "2026-10-23T12:00:00Z"; its public key; and its DER. Checking that one certificate signed another, or that one is trusted, is TLS's.

    Examples

    Local pem = r"""
    -----BEGIN CERTIFICATE-----
    MIIBkjCCATigAwIBAgIBBzAKBggqhkjOPQQDAjAoMRAwDgYDVQQKDAdFeGFtcGxl
    MRQwEgYDVQQDDAtleGFtcGxlLmNvbTAeFw0yNjEwMzAwODA2MzBaFw0zNjEwMjcw
    ODA2MzBaMCgxEDAOBgNVBAoMB0V4YW1wbGUxFDASBgNVBAMMC2V4YW1wbGUuY29t
    MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuoR7/qV4GrMf2sAuOMkR+/vx2oqp
    cyMbBNqdVgnmnhcTFpPNCpRilQhfBbAgQxACoj9Sd4UjZvjxqK/JqHJxJKNTMFEw
    HQYDVR0OBBYEFLEj6Qfik6Vrt/6Kc7QYyvyxtxPiMB8GA1UdIwQYMBaAFLEj6Qfi
    k6Vrt/6Kc7QYyvyxtxPiMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDSAAw
    RQIhANoLqQc7YxRjHvgUjU72HUW3ucpLRmi2LK/tUwiOss1hAiB0VCMesezWW8W0
    gPTHZ/E8f7x3Heu+SKfp/SO5Igym9w==
    -----END CERTIFICATE-----
    """
Local certificate = Try Certificate.FromPem(pem)
Expect(certificate.Subject == "O=Example, CN=example.com")
Expect(certificate.Issuer == certificate.Subject)
Expect(certificate.SerialNumber == "07")
Expect(certificate.NotAfter == "2036-10-27T08:06:30Z")
Expect(certificate.PublicKey?.Kind == KeyKind.ECDSA_P256)
Expect((Try Certificate.AllFromPem(pem)).Count == 1)

    std/crypto/pem.fb, line 126

    • Public ReadOnly Field Subject: String field #

      Who it's for, like "C=NL, O=Example, CN=example.com".

    • Public ReadOnly Field Issuer: String field #

      Who signed it, as Subject says who it's for.

    • Public ReadOnly Field SerialNumber: String field #

      Its serial number, as hex bytes with colons between them.

    • Public ReadOnly Field NotBefore: String field #

      The UTC time it's valid from, like "2026-10-23T12:00:00Z".

    • Public ReadOnly Field NotAfter: String field #

      The UTC time it's valid until, like "2026-10-23T12:00:00Z".

    • Public ReadOnly Field PublicKey: Key? field #

      Its public key, or Null when it's of a kind there's no KeyKind for.

    • Public ReadOnly Field Der: UInt8[] field #

      Its DER bytes.

    • Public Static Method FromPem(pem: String): Certificate Throws ParseError static method #

      The first certificate in pem. Throws a ParseError when pem has none, or one that doesn't read.

    • Public Static Method AllFromPem(pem: String): Certificate[] Throws ParseError static method #

      Each certificate in pem, in order, as a chain or a bundle of trusted ones has them. Throws a ParseError when pem has none, or one that doesn't read.

    Report an issue with this page or with FutureBlitz on GitHub.