Parsing of X.509 certificates I'm working on a firmware for a platform with limited resources with C as programming language.

There are a set of cryptographic primitives to be implemented, including AES, GCM/GMAC, ECDSA, ECDH. Our hardware allows to handle all these algorithms (it is more or less a crypto controller) and all the mentioned things beside ECDH are already implemented and tested.

For a future firmware release certificate handling (only for ECC with P256/SHA256, including also certificates in the validation chain) is needed as an additional requirement.

What is the best approach to parse certificates into its atomic constituents. E.g. I need access to public key material, like expiration date, issuer, subject , ...

Of course, I know about openSSL, but this is too heavy and would blow up far too much. So I tested mbedSSL (under Apache license). This open source project would do it, but I'm not allowed to use it because of internal reasons. Similar for woolfSSL. Anyway, I would only use a very small part of such library (just parsing of certificates)...

Is there some recommended way to parse a PEM X.509 certificate? Any third party product I can use? Is it complicated to write such parser on my own? Where is the structure described? My biggest concern is about writing a good ANS1 parser together with a base64 decoder on my ow, but maybe it is not that complicated as I expect from now.
Is there some recommended way to parse a PEM X.509 certificate?


Well, this site is not for software recommendations (Software Recommendations is, who would have thought), but if the certificate is well-behaved it is possible to generate code for the ASN.1 constructs. You need a parser/generator for ASN.1.


  Any third party product I can use? Is it complicated to write such parser on my own?


There are various ASN.1 and X.509 libraries online. Is it hard to write on your own? Yes, expect a low minimum of 3 months work to write something pretty OK, if you already understand ASN.1 / DER.


  Where is the structure described?


ASN.1 and DER are described in the ISO/IEC 8824 and 8825-1 specifications respectively. X.509 certificates and CRLs are described in RFC 5280. The appendix of the RFC contains the ASN.1 module.


  My biggest concern is about writing a good ANS1 parser together with a base64 decoder on my ow, but maybe it is not that complicated as I expect from now.


Creating a base 64 decoder is absolutely peanuts compared to the parsing of ASN.1 structures. You may however get away with just DER encoding and looking up paths within the certificates (if you want to live dangerously). You may run into some trouble when converting between implicit and explicit input for the signature algorithm, just to name one issue with the ASN.1 structures.

Note that ASN.1 BER/DER codecs are very vulnerable against stack overflow attacks (especially in non-managed languages like C of course), and that the decoding of the certificate comes before authentication.