Skip to content
FutureBlitz

    Install

    Import std.crypto.pem

    std.crypto.pem

    Key and Certificate, which read keys and X.509 certificates from PEM, the text between "-----BEGIN ...-----" and "-----END ...-----" lines that keys and certificates are kept in, over mbedTLS. A Key's Bytes are what its kind's Methods take, so a key read from PEM signs, verifies, or exchanges. RSA keys are of up to 8192 bits.

    std/crypto/pem.fb

    Types

    KeyKind enum 

    Public Enum KeyKind

    What a Key is for, which says what its Bytes are.

    std/crypto/pem.fb, line 25

    • ECDSA_P256 enum member #

      An ECDSA P-256 key, for signing: a private key's 32 bytes, or a public key's 65.

    • RSA enum member #

      An RSA key, for verifying signatures: its PKCS #1 DER.

    • X25519 enum member #

      An X25519 key, for key agreement: its 32 bytes.

    • ED25519 enum member #

      An Ed25519 key, for signing: its 32 bytes.

    Key struct 

    Public Struct Key

    A private or public key, as its kind's Methods take it: an ECDSA P-256 private key's 32 bytes or public key's 65; an RSA key's PKCS #1 DER, whose public one Rsa verifies with; and an X25519 or Ed25519 key's 32 bytes.

    std/crypto/pem.fb, line 39

    • Public ReadOnly Field Kind: KeyKind field #

      What kind of key it is.

    • Public ReadOnly Field IsPrivate: Bool field #

      Whether it's a private key, or a public one.

    • Public ReadOnly Field Bytes: UInt8[] field #

      Its bytes, as its kind's Methods take them.

    • Public New(kind: KeyKind, isPrivate: Bool, bytes: UInt8[]) constructor #

      A key of kind, private or public, of bytes.

    • Public Static Method FromPem(pem: String): Key Throws ParseError static method #

      The first key in pem, whatever comes after it: a private one in PKCS #8 ("PRIVATE KEY"), SEC 1 ("EC PRIVATE KEY"), or PKCS #1 ("RSA PRIVATE KEY"), or a public one ("PUBLIC KEY", or "RSA PUBLIC KEY"). Throws a ParseError of SYNTAX when pem has no key, or one that doesn't read, and of WRONG_TYPE when it's encrypted, or of a kind there's no KeyKind for, like another curve's.

    • @PanicsAtCaller Public Method ToPem(): String method #

      The key as PEM, as OpenSSL writes it: a private one in PKCS #8, but an RSA one in PKCS #1 and a P-256 one in SEC 1, and a public one, RSA's too, in SubjectPublicKeyInfo. Panics when Bytes isn't a key of its Kind.

    Certificate struct 

    Public Struct Certificate

    An X.509 certificate, read from PEM: who it's for and who signed it, as Python's ssl shows them, "C=NL, O=Example, CN=example.com", in the certificate's order, as UTF-8 text with RFC 4514's escapes; its serial number as hex bytes with colons between them; the UTC times it's valid from and to, as "2026-10-23T12:00:00Z"; its public key; and its DER. Checking that one certificate signed another, or that one is trusted, is TLS's.

    std/crypto/pem.fb, line 88

    • Public ReadOnly Field Subject: String field #

      Who it's for, like "C=NL, O=Example, CN=example.com".

    • Public ReadOnly Field Issuer: String field #

      Who signed it, as Subject says who it's for.

    • Public ReadOnly Field SerialNumber: String field #

      Its serial number, as hex bytes with colons between them.

    • Public ReadOnly Field NotBefore: String field #

      The UTC time it's valid from, like "2026-10-23T12:00:00Z".

    • Public ReadOnly Field NotAfter: String field #

      The UTC time it's valid until, like "2026-10-23T12:00:00Z".

    • Public ReadOnly Field PublicKey: Key? field #

      Its public key, or Null when it's of a kind there's no KeyKind for.

    • Public ReadOnly Field Der: UInt8[] field #

      Its DER bytes.

    • Public Static Method FromPem(pem: String): Certificate Throws ParseError static method #

      The first certificate in pem. Throws a ParseError when pem has none, or one that doesn't read.

    • Public Static Method AllFromPem(pem: String): Certificate[] Throws ParseError static method #

      Each certificate in pem, in order, as a chain or a bundle of trusted ones has them. Throws a ParseError when pem has none, or one that doesn't read.

    Report an issue with this page or with FutureBlitz on GitHub.