Subject: 26.2; gnutls: accessing raw server certificate data

From: Julian Scheid <[email-masked]>
Date: Sat, 18 May 2019 13:48:47 +1200

Hello, I would like to request a feature: accessing the raw certificate
of a server connected to via `gnutls-negotiate' (or such).

Currently, `gnutls-peer-status' only allows accessing high-level
information extracted from the certificate, such as the issuer, but not
the certificate data itself.

Access to the raw certificate data would allow implementing the
`tls-server-endpoint' channel binding type as per
https://tools.ietf.org/html/rfc5929#section-4.1 , which requires
> [t]he hash of the TLS server's certificate [RFC5280] as it
> appears, octet for octet, in the server's Certificate message.  Note
> that the Certificate message contains a certificate_list, in which
> the first element is the server's certificate.