Add wc_SignCert_cb API for external signing callbacks #9632

jackctj117 · 2026-01-08T22:22:09Z

This pull request adds support for signing certificates and CSRs using a user-provided callback function, enabling integration with external signing devices (such as TPMs or HSMs) without relying on the crypto callback infrastructure. This is particularly useful for FIPS-compliant applications and scenarios where offloading cryptographic operations is required. The changes include new API definitions, documentation, internal implementation, and tests for the callback-based signing mechanism.

New Callback-Based Certificate Signing API

Introduced the wc_SignCert_cb function and the wc_SignCertCb callback type, allowing certificates and CSRs to be signed via an external callback for flexible integration with devices like TPMs/HSMs. [1] [2] [3]

Internal Implementation

Added the internal MakeSignatureCb function to handle hashing, digest encoding, and invoking the user-provided signing callback, supporting both RSA and ECC key types.

Testing
Setup:
TPM simulator: swtpm running on port 2321
Built wolfSSL with: --enable-certgen --enable-certreq --enable-certext --enable-cryptocb
Built wolfTPM with: --enable-swtpm --enable-certgen --enable-debug
Tests Run:
Generated RSA and ECC test keys in TPM
Created CSRs using ./examples/csr/csr
Validated CSRs with openssl req -text -noout
Results:
wc_SignCert_cb compiled into wolfSSL
wolfTPM2_SignCertCb and CSR_MakeAndSign_Cb compiled into wolfTPM
Generated valid RSA (1228 bytes) and ECC (696 bytes) CSRs
CSRs verified successfully with OpenSSL

dgarske · 2026-01-14T17:54:51Z

Jenkins retest this please. History lost.

wolfcrypt/src/asn.c

Copilot

Pull request overview

This pull request adds support for signing certificates and CSRs using a user-provided callback function, enabling integration with external signing devices (TPMs/HSMs) without relying on the crypto callback infrastructure. This is particularly useful for FIPS-compliant applications where offloading cryptographic operations is not acceptable.

Changes:

Introduced new wc_SignCert_cb API and wc_SignCertCb callback type for external certificate/CSR signing
Refactored internal MakeSignature function to use new MakeSignatureCb internally for RSA and ECC, eliminating code duplication
Added configure option --enable-certsigncb to enable the feature

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
wolfssl/wolfcrypt/asn_public.h	Added public API declarations for the callback-based certificate signing, including typedef for wc_SignCertCb and function declaration for wc_SignCert_cb
wolfcrypt/src/asn.c	Implemented internal MakeSignatureCb function and refactored MakeSignature to use callback path for RSA/ECC; added wc_SignCert_cb implementation
tests/api.c	Added test case test_wc_SignCert_cb with mock callback to verify the new API functionality
configure.ac	Added configuration option --enable-certsigncb to control compilation of the new feature

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfcrypt/src/asn.c

tests/api.c

wolfcrypt/src/asn.c

tests/api.c

wolfssl/wolfcrypt/asn_public.h

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfcrypt/src/asn.c

tests/api.c

wolfcrypt/src/asn.c

jackctj117 · 2026-01-21T16:18:51Z

Jenkins retest this

jackctj117 · 2026-01-21T16:27:26Z

Jenkins retest this please.

dgarske

[check-source-text] [2 of 7] [wolfssl]
    autogen.sh wolfssl...   real 0m17.507s  user 0m15.557s  sys 0m0.446s
    configure...   real 0m12.829s  user 0m10.049s  sys 0m2.680s
trailing whitespace:
./wolfcrypt/src/asn.c:32089:/* Make signature from buffer (sz), write to sig (sigSz)·
./wolfcrypt/src/asn.c:32100:····
./wolfcrypt/src/asn.c:32119:········
./wolfcrypt/src/asn.c:32125:········
./wolfcrypt/src/asn.c:32137:········
C++-style comments:
./wolfssl/wolfcrypt/asn_public.h:269:        // Perform signing using external device/HSM
./wolfssl/wolfcrypt/asn_public.h:601:    // Initialize cert and set subject, etc.
./wolfssl/wolfcrypt/asn_public.h:603:    // ... set cert fields ...
./wolfssl/wolfcrypt/asn_public.h:605:    // Make certificate body
./wolfssl/wolfcrypt/asn_public.h:608:    // Sign using callback
unescaped error code operands (missing WC_NO_ERR_TRACE()):
wolfcrypt/src/asn.c:32016:    int ret = ALGO_ID_E;

lealem47 · 2026-01-27T20:15:19Z

Jenkins retest this please.

wolfcrypt/src/asn.c

lealem47

Thanks Jack!

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-03T21:57:34Z

tests/api.c

+static int test_wc_SignCert_cb(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC) && !defined(NO_ASN_TIME)
+    Cert cert;
+    byte der[FOURK_BUF];
+    int derSize = 0;
+    WC_RNG rng;
+    ecc_key key;
+    MockSignCtx signCtx;
+    int ret;
+
+    XMEMSET(&rng, 0, sizeof(WC_RNG));
+    XMEMSET(&key, 0, sizeof(ecc_key));
+    XMEMSET(&cert, 0, sizeof(Cert));
+    XMEMSET(&signCtx, 0, sizeof(MockSignCtx));
+
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    ExpectIntEQ(wc_ecc_init(&key), 0);
+    ExpectIntEQ(wc_ecc_make_key(&rng, 32, &key), 0);
+    ExpectIntEQ(wc_InitCert(&cert), 0);
+
+    (void)XSTRNCPY(cert.subject.country, "US", CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.state, "state", CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.locality, "locality", CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.org, "org", CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.unit, "unit", CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.commonName, "www.example.com",
+        CTC_NAME_SIZE);
+    (void)XSTRNCPY(cert.subject.email, "test@example.com", CTC_NAME_SIZE);
+
+    cert.selfSigned = 1;
+    cert.isCA       = 0;
+    cert.sigType    = CTC_SHA256wECDSA;
+
+    /* Make cert body */
+    ExpectIntGT(wc_MakeCert(&cert, der, FOURK_BUF, NULL, &key, &rng), 0);
+
+    /* Setup signing context with key and RNG */
+    signCtx.key = &key;
+    signCtx.rng = &rng;
+
+    /* Sign using callback API */
+    ExpectIntGT(derSize = wc_SignCert_cb(cert.bodySz, cert.sigType, der,
+        FOURK_BUF, ECC_TYPE, mockSignCb, &signCtx, &rng), 0);
+
+    /* Verify the certificate was created properly */
+    ExpectIntGT(derSize, 0);
+
+    /* Test error cases */
+    ExpectIntEQ(wc_SignCert_cb(cert.bodySz, cert.sigType, der,
+        FOURK_BUF, ECC_TYPE, NULL, &signCtx, &rng), BAD_FUNC_ARG);
+
+    ret = wc_ecc_free(&key);
+    ExpectIntEQ(ret, 0);
+    ret = wc_FreeRng(&rng);
+    ExpectIntEQ(ret, 0);
+#endif
+    return EXPECT_RESULT();
+}
+#endif /* WOLFSSL_CERT_SIGN_CB */


The test function test_wc_SignCert_cb only tests with ECC keys (CTC_SHA256wECDSA). Since the new API explicitly supports both RSA and ECC key types, and the mockSignCb callback implementation includes RSA support (lines 20011-20023), there should be test coverage for RSA as well to ensure the RSA code path works correctly. Consider adding an RSA test case to verify that RSA signing through the callback works properly.

Copilot · 2026-02-03T21:57:34Z

tests/api.c

+    /* Test error cases */
+    ExpectIntEQ(wc_SignCert_cb(cert.bodySz, cert.sigType, der,
+        FOURK_BUF, ECC_TYPE, NULL, &signCtx, &rng), BAD_FUNC_ARG);


The test only checks one error case (NULL callback). Additional error cases should be tested to ensure robust error handling:

NULL buf parameter (should return BAD_FUNC_ARG per line 34426)

requestSz < 0 (should return requestSz per line 34432-34434)

Invalid keyType (to ensure proper error handling)

Buffer too small (buffSz too small for signature)

These additional test cases would improve confidence in the error handling paths of the new API.

Copilot · 2026-02-03T21:57:34Z

wolfssl/wolfcrypt/asn_public.h

+typedef int (*wc_SignCertCb)(const byte* in, word32 inLen,
+                             byte* out, word32* outLen,
+                             int sigAlgo, int keyType, void* ctx);


The wc_SignCertCb typedef is not guarded by WOLFSSL_CERT_SIGN_CB, but it's only used in the wc_SignCert_cb function declaration which is guarded (lines 609-614). This creates an inconsistency where the typedef is always defined but the function using it may not be. While this doesn't cause compilation errors (the typedef can exist without the function), it's inconsistent with the pattern used elsewhere in the codebase.

For example, looking at other callback typedefs in the same header file (asn.h), wc_CallbackEccVerify and wc_CallbackRsaVerify are conditionally compiled. The typedef should either be:

Moved inside the WOLFSSL_CERT_SIGN_CB guard along with the function declaration, or

Left unguarded if it's intended to be part of the public API regardless of the feature flag (which seems unlikely for a feature-specific callback)

Recommend moving the typedef definition (lines 272-274) inside the WOLFSSL_CERT_SIGN_CB guard block starting at line 609.

jackctj117 self-assigned this Jan 8, 2026

jackctj117 marked this pull request as draft January 8, 2026 22:22

jackctj117 mentioned this pull request Jan 8, 2026

Add TPM support for wc_SignCert_cb callback API wolfSSL/wolfTPM#450

Open

jackctj117 marked this pull request as ready for review January 9, 2026 21:59

wolfSSL deleted a comment from devin-ai-integration bot Jan 9, 2026

jackctj117 requested a review from wolfSSL-Bot January 9, 2026 23:30

dgarske assigned dgarske, wolfSSL-Bot and lealem47 Jan 14, 2026

dgarske requested review from dgarske and lealem47 and removed request for wolfSSL-Bot January 14, 2026 16:59

dgarske requested changes Jan 14, 2026

View reviewed changes

wolfcrypt/src/asn.c Show resolved Hide resolved

dgarske unassigned dgarske and lealem47 Jan 14, 2026

lealem47 requested a review from Copilot January 14, 2026 23:45

Copilot started reviewing on behalf of lealem47 January 15, 2026 00:00 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

jackctj117 requested a review from Copilot January 15, 2026 20:12

Copilot started reviewing on behalf of jackctj117 January 15, 2026 20:13 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

wolfcrypt/src/asn.c Show resolved Hide resolved

tests/api.c Show resolved Hide resolved

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

dgarske self-requested a review January 19, 2026 20:06

jackctj117 force-pushed the CSR-signing branch 2 times, most recently from 4dd06e1 to 8e28ab2 Compare January 20, 2026 20:26

dgarske requested changes Jan 21, 2026

View reviewed changes

lealem47 requested changes Jan 27, 2026

View reviewed changes

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

wolfcrypt/src/asn.c Show resolved Hide resolved

dgarske requested changes Jan 27, 2026

View reviewed changes

wolfcrypt/src/asn.c Show resolved Hide resolved

dgarske assigned jackctj117 and unassigned jackctj117 Jan 27, 2026

jackctj117 requested a review from dgarske January 28, 2026 18:16

dgarske requested changes Jan 28, 2026

View reviewed changes

wolfcrypt/src/asn.c Outdated Show resolved Hide resolved

jackctj117 force-pushed the CSR-signing branch from 91d51bd to 1898d4c Compare January 29, 2026 21:08

jackctj117 requested a review from dgarske January 30, 2026 16:01

jackctj117 force-pushed the CSR-signing branch from 1898d4c to 2cf03da Compare January 30, 2026 21:02

lealem47 previously approved these changes Feb 3, 2026

View reviewed changes

jackctj117 dismissed lealem47’s stale review via 6483a4b February 3, 2026 19:19

jackctj117 force-pushed the CSR-signing branch from 2cf03da to 6483a4b Compare February 3, 2026 19:19

Add wc_SignCert_cb API for external signing callbacks

8b5bd3b

jackctj117 force-pushed the CSR-signing branch from 6483a4b to 8b5bd3b Compare February 3, 2026 19:58

lealem47 approved these changes Feb 3, 2026

View reviewed changes

dgarske requested a review from Copilot February 3, 2026 21:51

Copilot started reviewing on behalf of dgarske February 3, 2026 21:52 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

Add wc_SignCert_cb API for external signing callbacks #9632

Are you sure you want to change the base?

Add wc_SignCert_cb API for external signing callbacks #9632

Conversation

jackctj117 commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dgarske commented Jan 14, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jackctj117 commented Jan 21, 2026

Uh oh!

jackctj117 commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Uh oh!

lealem47 commented Jan 27, 2026 • edited by jackctj117 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lealem47 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jackctj117 commented Jan 8, 2026 •

edited

Loading

jackctj117 commented Jan 21, 2026 •

edited

Loading

lealem47 commented Jan 27, 2026 •

edited by jackctj117

Loading