crypto.x509

parse_pem(text)! skips other PEM blocks and reads the first CERTIFICATE block. parse_der(bytes)! reads one complete DER certificate and returns its version, serial, issuer and subject attribute maps, validity times, DNS subject alternative names, and original bytes. Attribute map keys are dotted OIDs; common_name() and organization() retrieve common subject values. Repeated attributes use the last value. Unknown extensions and unsupported directory string types are skipped. Common UTF-8, ASCII, and BMP directory strings are decoded; TeletexString is skipped.

The parser checks certificate structure, bounded DER lengths, duplicate extensions, and calendar/time encodings. Both version 2 unique identifiers and version 3 extensions are handled. Parsing does not validate a certificate's signature, trust chain, validity period, key usage, or critical extensions.

certificate.check_host(name)! checks an ASCII DNS hostname, ignoring case and accepting a final dot. A wildcard matches exactly one leftmost label. SAN identities take precedence; if a SAN extension is present without DNS names, matching fails. When SAN is absent, the subject common name is accepted for legacy compatibility. This CN fallback is not the modern SAN-only TLS policy. IP reference identities are rejected; IP SAN support and full certificate verification are not provided. Use IDNA ASCII names for international domains.

fn parse_der(der []u8) !Certificate

parse_der parses one complete DER-encoded certificate without verifying its signature.

fn parse_pem(pem_text string) !Certificate

parse_pem parses the first CERTIFICATE block of PEM text.

struct Certificate {
pub:
	version    int
	serial     []u8
	issuer     map[string]string // OID string -> value, e.g. '2.5.4.3'
	subject    map[string]string
	not_before time.Time
	not_after  time.Time
	dns_names  []string
	raw        []u8
	has_san    bool
}

Certificate is a parsed X.509 certificate: identity (issuer/subject), validity window, and DNS names from the subject alternative names. It is the V-idiomatic equivalent of the parsing half of Go's crypto/x509. Chain building and full verification are follow-ups (they need the trust store design of #28405); check_host covers the hostname step.

fn (c &Certificate) common_name() string

common_name returns the subject CN, or '' if absent.

fn (c &Certificate) organization() string

organization returns the subject O, or '' if absent.

fn (c &Certificate) check_host(name string) !

check_host checks a DNS hostname against SAN identities, with legacy CN fallback only when the SAN extension is absent. Wildcards match one leftmost label. It does not verify signatures, trust, validity periods, or IP address identities.