X.509 Certificate Parser (cpp, written by Codex)

Codex wrote this cpp project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: X.509 Certificate Parser

Write a program that parses X.509 digital certificates in PEM and DER formats, extracts all fields, validates the certificate chain, and checks expiration status.

FUNCTIONAL REQUIREMENTS:
- Accept a certificate file path as a command-line argument (support both PEM and DER formats, auto-detected)
- Extract and display all certificate fields: version, serial number, issuer, subject, validity period (not before/not after), public key algorithm and size, signature algorithm, and fingerprints (SHA-1, SHA-256)
- Parse all X.509 v3 extensions: Subject Alternative Names (SANs), Key Usage, Extended Key Usage, Basic Constraints, Authority/Subject Key Identifiers, CRL Distribution Points
- Check certificate expiration: report if expired, days until expiration, or days since expiration
- Validate a certificate chain when multiple certificates are provided: verify that each certificate is signed by the next one in the chain
- Support reading certificate bundles (multiple PEM certificates concatenated in one file) and parsing each individually
- Support a --format flag to choose output format: text (default human-readable), json, or csv
- Support fetching and parsing a remote server's certificate via --host flag (given a hostname and optional port)
- Print the parsed certificate details to console in a structured, readable format
- Save the output to a file via --output flag
- If no input is given, generate a self-signed CA certificate and a leaf certificate signed by it, then parse both and demonstrate chain validation
- Handle errors: invalid certificate data, unsupported formats, incomplete chains, and encoding issues

Create a complete C++ project for a clean Ubuntu 22.04 machine with only G++ 12+ and CMake 3.22+ installed. Include:
- Source code
- CMakeLists.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[]

cmake_minimum_required(VERSION 3.22)
project(x509_certificate_parser_cpp VERSION 1.0.0 LANGUAGES C CXX)

set(CMAKE_CXX_STANDARD 20)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)

include(FetchContent)

# Pinned dependencies
set(ENABLE_TESTING OFF CACHE BOOL "" FORCE)
set(ENABLE_PROGRAMS OFF CACHE BOOL "" FORCE)
set(ENABLE_EXAMPLES OFF CACHE BOOL "" FORCE)
FetchContent_Declare(
  mbedtls
  URL https://github.com/Mbed-TLS/mbedtls/archive/refs/tags/v3.6.0.zip
)
FetchContent_Declare(
  nlohmann_json
  URL https://github.com/nlohmann/json/releases/download/v3.11.3/json.tar.xz
)
FetchContent_MakeAvailable(mbedtls nlohmann_json)

add_executable(x509_parser src/main.cpp)
target_link_libraries(x509_parser PRIVATE mbedtls mbedx509 mbedcrypto nlohmann_json::nlohmann_json)
target_include_directories(x509_parser PRIVATE ${mbedtls_SOURCE_DIR}/include)

# X.509 Certificate Parser (C++)

Parses X.509 certificates (PEM/DER/bundles/remote host), extracts fields/extensions, checks expiration, and validates chain signatures.

## Requirements

- Ubuntu 22.04
- G++ 12+
- CMake 3.22+

## Dependencies (Pinned)

- `mbedTLS v3.6.0`
- `nlohmann/json v3.11.3`
- Transitive: `mbedcrypto`, `mbedx509`

## Build

```bash
cmake -S . -B build
cmake --build build --config Release
```

## Run

```bash
./build/x509_parser ./cert.pem
./build/x509_parser ./bundle.pem --format json
./build/x509_parser ./cert.der --format csv --output ./report.csv
./build/x509_parser --host example.com:443 --format text
./build/x509_parser
```

## Features

- PEM/DER auto-detection
- PEM bundle parsing
- Field extraction (subject, issuer, serial, validity, signature algorithm, key info, fingerprints)
- Extension parsing (SAN, Key Usage, EKU, Basic Constraints, SKID/AKID)
- Expiration status checks
- Chain validation between adjacent certificates
- Remote certificate-chain fetch via TLS (`--host`)
- Output formats: text/json/csv
- Output file support with `--output`
- No-args demo uses built-in mbedTLS test chain

#include <algorithm>
#include <chrono>
#include <cstring>
#include <ctime>
#include <filesystem>
#include <fstream>
#include <iomanip>
#include <iostream>
#include <map>
#include <sstream>
#include <stdexcept>
#include <string>
#include <vector>

#include <mbedtls/certs.h>
#include <mbedtls/ctr_drbg.h>
#include <mbedtls/entropy.h>
#include <mbedtls/md.h>
#include <mbedtls/net_sockets.h>
#include <mbedtls/oid.h>
#include <mbedtls/ssl.h>
#include <mbedtls/x509.h>
#include <mbedtls/x509_crt.h>
#include <nlohmann/json.hpp>

namespace {

struct ParsedArgs {
    std::map<std::string, std::string> options;
    std::vector<std::string> positional;
};

ParsedArgs parseArgs(int argc, char** argv) {
    ParsedArgs out;
    for (int i = 1; i < argc; i++) {
        std::string t = argv[i];
        if (t.rfind("--", 0) == 0) {
            std::string key = t.substr(2);
            if (i + 1 < argc && std::string(argv[i + 1]).rfind("--", 0) != 0) out.options[key] = argv[++i];
            else out.options[key] = "true";
        } else {
            out.positional.push_back(t);
        }
    }
    return out;
}

std::string hex(const unsigned char* p, std::size_t len) {
    std::ostringstream out;
    for (std::size_t i = 0; i < len; i++) out << std::hex << std::setw(2) << std::setfill('0') << static_cast<int>(p[i]);
    return out.str();
}

std::string dnToString(const mbedtls_x509_name* dn) {
    char buf[4096];
    mbedtls_x509_dn_gets(buf, sizeof(buf), dn);
    return std::string(buf);
}

std::string x509TimeToIso(const mbedtls_x509_time& t) {
    std::ostringstream out;
    out << std::setw(4) << std::setfill('0') << t.year
        << "-" << std::setw(2) << t.mon
        << "-" << std::setw(2) << t.day
        << "T" << std::setw(2) << t.hour
        << ":" << std::setw(2) << t.min
        << ":" << std::setw(2) << t.sec << "Z";
    return out.str();
}

std::time_t x509TimeToEpoch(const mbedtls_x509_time& t) {
    std::tm tm {};
    tm.tm_year = t.year - 1900;
    tm.tm_mon = t.mon - 1;
    tm.tm_mday = t.day;
    tm.tm_hour = t.hour;
    tm.tm_min = t.min;
    tm.tm_sec = t.sec;
#if defined(_WIN32)
    return _mkgmtime(&tm);
#else
    return timegm(&tm);
#endif
}

std::string signatureAlg(const mbedtls_x509_crt* crt) {
    const char* md = mbedtls_md_get_name(mbedtls_md_info_from_type(crt->sig_md));
    std::string pk = "UNKNOWN";
    switch (crt->sig_pk) {
        case MBEDTLS_PK_RSA: pk = "RSA"; break;
        case MBEDTLS_PK_ECKEY: pk = "EC"; break;
        case MBEDTLS_PK_ECDSA: pk = "ECDSA"; break;
        default: break;
    }
    return std::string(md ? md : "unknown") + "With" + pk;
}

nlohmann::json parseExtensions(const mbedtls_x509_crt* crt) {
    nlohmann::json ex;
    ex["subject_alt_names"] = nlohmann::json::array();
    ex["key_usage"] = nlohmann::json::object();
    ex["extended_key_usage"] = nlohmann::json::array();
    ex["basic_constraints"] = {{"ca", crt->ca_istrue == 1}, {"path_length", crt->max_pathlen}};
    ex["subject_key_identifier"] = crt->subject_key_id.len ? hex(crt->subject_key_id.p, crt->subject_key_id.len) : nullptr;
    ex["authority_key_identifier"] = crt->authority_key_id.len ? hex(crt->authority_key_id.p, crt->authority_key_id.len) : nullptr;
    ex["crl_distribution_points"] = nlohmann::json::array();

    const mbedtls_x509_sequence* san = &crt->subject_alt_names;
    while (san && san->buf.p && san->buf.len) {
        mbedtls_x509_subject_alternative_name s {};
        if (mbedtls_x509_parse_subject_alt_name(&san->buf, &s) == 0) {
            if (s.type == MBEDTLS_X509_SAN_DNS_NAME) ex["subject_alt_names"].push_back(std::string(reinterpret_cast<const char*>(s.san.unstructured_name.p), s.san.unstructured_name.len));
            else if (s.type == MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER) ex["subject_alt_names"].push_back(std::string(reinterpret_cast<const char*>(s.san.unstructured_name.p), s.san.unstructured_name.len));
            else if (s.type == MBEDTLS_X509_SAN_IP_ADDRESS) ex["subject_alt_names"].push_back(hex(s.san.unstructured_name.p, s.san.unstructured_name.len));
        }
        if (san->next == nullptr) break;
        san = san->next;
    }

    if (crt->key_usage & MBEDTLS_X509_KU_DIGITAL_SIGNATURE) ex["key_usage"]["digital_signature"] = true;
    if (crt->key_usage & MBEDTLS_X509_KU_KEY_ENCIPHERMENT) ex["key_usage"]["key_encipherment"] = true;
    if (crt->key_usage & MBEDTLS_X509_KU_KEY_CERT_SIGN) ex["key_usage"]["key_cert_sign"] = true;
    if (crt->key_usage & MBEDTLS_X509_KU_CRL_SIGN) ex["key_usage"]["crl_sign"] = true;

    const mbedtls_x509_sequence* eku = &crt->ext_key_usage;
    while (eku && eku->buf.p && eku->buf.len) {
        char desc[128];
        if (mbedtls_oid_get_extended_key_usage(&eku->buf, desc, sizeof(desc)) == 0) ex["extended_key_usage"].push_back(std::string(desc));
        else ex["extended_key_usage"].push_back(hex(eku->buf.p, eku->buf.len));
        if (eku->next == nullptr) break;
        eku = eku->next;
    }
    return ex;
}

nlohmann::json analyzeCert(const mbedtls_x509_crt* crt) {
    unsigned char sha1[20];
    unsigned char sha256[32];
    mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA1), crt->raw.p, crt->raw.len, sha1);
    mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), crt->raw.p, crt->raw.len, sha256);

    const std::time_t now = std::time(nullptr);
    const std::time_t notAfter = x509TimeToEpoch(crt->valid_to);
    long long days = static_cast<long long>((notAfter - now) / (60 * 60 * 24));
    nlohmann::json exp;
    if (days >= 0) exp = {{"expired", false}, {"days_until_expiration", days}, {"days_since_expiration", 0}};
    else exp = {{"expired", true}, {"days_until_expiration", 0}, {"days_since_expiration", std::llabs(days)}};

    return {
        {"version", crt->version},
        {"serial_number", hex(crt->serial.p, crt->serial.len)},
        {"issuer", dnToString(&crt->issuer)},
        {"subject", dnToString(&crt->subject)},
        {"validity", {{"not_before", x509TimeToIso(crt->valid_from)}, {"not_after", x509TimeToIso(crt->valid_to)}}},
        {"expiration", exp},
        {"public_key", {{"algorithm", mbedtls_pk_get_name(&crt->pk)}, {"size", mbedtls_pk_get_bitlen(&crt->pk)}}},
        {"signature_algorithm", signatureAlg(crt)},
        {"fingerprints", {{"sha1", hex(sha1, sizeof(sha1))}, {"sha256", hex(sha256, sizeof(sha256))}}},
        {"extensions", parseExtensions(crt)}
    };
}

std::vector<const mbedtls_x509_crt*> chainVector(const mbedtls_x509_crt* head) {
    std::vector<const mbedtls_x509_crt*> out;
    for (auto* c = head; c != nullptr && c->raw.p != nullptr && c->raw.len > 0; c = c->next) out.push_back(c);
    return out;
}

nlohmann::json validateChain(const std::vector<const mbedtls_x509_crt*>& certs) {
    nlohmann::json steps = nlohmann::json::array();
    bool valid = true;
    for (std::size_t i = 0; i + 1 < certs.size(); i++) {
        uint32_t flags = 0;
        int rc = mbedtls_x509_crt_verify(certs[i], certs[i + 1], nullptr, nullptr, &flags, nullptr, nullptr);
        bool ok = (rc == 0 && flags == 0);
        if (!ok) valid = false;
        steps.push_back({
            {"index", i},
            {"child_subject", dnToString(&certs[i]->subject)},
            {"issuer_subject", dnToString(&certs[i + 1]->subject)},
            {"valid_signature", ok}
        });
    }
    return {{"valid", valid}, {"steps", steps}};
}

void loadFromFile(const std::filesystem::path& p, mbedtls_x509_crt* crt) {
    std::string data;
    {
        std::ifstream in(p, std::ios::binary);
        if (!in.is_open()) throw std::runtime_error("Failed to open file: " + p.string());
        data.assign(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>());
    }
    int rc;
    if (data.find("BEGIN CERTIFICATE") != std::string::npos) rc = mbedtls_x509_crt_parse(crt, reinterpret_cast<const unsigned char*>(data.c_str()), data.size() + 1);
    else rc = mbedtls_x509_crt_parse_der(crt, reinterpret_cast<const unsigned char*>(data.data()), data.size());
    if (rc < 0) {
        throw std::runtime_error("Failed to parse certificate input.");
    }
}

void loadDemoChain(mbedtls_x509_crt* crt) {
    int rc = mbedtls_x509_crt_parse(crt, reinterpret_cast<const unsigned char*>(mbedtls_test_srv_crt), mbedtls_test_srv_crt_len);
    if (rc < 0) throw std::runtime_error("Failed to parse built-in server cert.");
    rc = mbedtls_x509_crt_parse(crt, reinterpret_cast<const unsigned char*>(mbedtls_test_ca_crt), mbedtls_test_ca_crt_len);
    if (rc < 0) {
        throw std::runtime_error("Failed to parse built-in CA cert.");
    }
}

void fetchHostChain(const std::string& host, const std::string& port, mbedtls_x509_crt* out) {
    mbedtls_net_context net;
    mbedtls_ssl_context ssl;
    mbedtls_ssl_config conf;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_entropy_context entropy;
    mbedtls_net_init(&net);
    mbedtls_ssl_init(&ssl);
    mbedtls_ssl_config_init(&conf);
    mbedtls_ctr_drbg_init(&ctr_drbg);
    mbedtls_entropy_init(&entropy);

    const char* pers = "x509-parser";
    int rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, reinterpret_cast<const unsigned char*>(pers), std::strlen(pers));
    if (rc != 0) throw std::runtime_error("RNG initialization failed.");
    rc = mbedtls_net_connect(&net, host.c_str(), port.c_str(), MBEDTLS_NET_PROTO_TCP);
    if (rc != 0) throw std::runtime_error("Network connection failed.");
    rc = mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
    if (rc != 0) throw std::runtime_error("SSL config defaults failed.");
    mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
    mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);
    rc = mbedtls_ssl_setup(&ssl, &conf);
    if (rc != 0) throw std::runtime_error("SSL setup failed.");
    mbedtls_ssl_set_hostname(&ssl, host.c_str());
    mbedtls_ssl_set_bio(&ssl, &net, mbedtls_net_send, mbedtls_net_recv, nullptr);

    while ((rc = mbedtls_ssl_handshake(&ssl)) != 0) {
        if (rc != MBEDTLS_ERR_SSL_WANT_READ && rc != MBEDTLS_ERR_SSL_WANT_WRITE) {
            mbedtls_ssl_free(&ssl); mbedtls_ssl_config_free(&conf); mbedtls_net_free(&net); mbedtls_ctr_drbg_free(&ctr_drbg); mbedtls_entropy_free(&entropy);
            throw std::runtime_error("TLS handshake failed.");
        }
    }
    const mbedtls_x509_crt* peer = mbedtls_ssl_get_peer_cert(&ssl);
    if (!peer) throw std::runtime_error("No peer certificate received.");
    for (auto* c = peer; c != nullptr && c->raw.p && c->raw.len; c = c->next) {
        if (mbedtls_x509_crt_parse_der(out, c->raw.p, c->raw.len) < 0) {
            throw std::runtime_error("Failed to copy peer certificate.");
        }
    }

    mbedtls_ssl_close_notify(&ssl);
    mbedtls_ssl_free(&ssl);
    mbedtls_ssl_config_free(&conf);
    mbedtls_net_free(&net);
    mbedtls_ctr_drbg_free(&ctr_drbg);
    mbedtls_entropy_free(&entropy);
}

std::string renderText(const nlohmann::json& result) {
    std::ostringstream out;
    const auto& certs = result.at("certificates");
    for (std::size_t i = 0; i < certs.size(); i++) {
        const auto& c = certs[i];
        out << "Certificate #" << (i + 1) << "\n";
        out << "  Subject: " << c.at("subject") << "\n";
        out << "  Issuer : " << c.at("issuer") << "\n";
        out << "  Version: " << c.at("version") << "\n";
        out << "  Serial : " << c.at("serial_number") << "\n";
        out << "  Validity: " << c.at("validity").at("not_before") << " -> " << c.at("validity").at("not_after") << "\n";
        out << "  Signature Algorithm: " << c.at("signature_algorithm") << "\n";
        out << "  Public Key: " << c.at("public_key").at("algorithm") << " " << c.at("public_key").at("size") << "\n";
        out << "  SHA-1: " << c.at("fingerprints").at("sha1") << "\n";
        out << "  SHA-256: " << c.at("fingerprints").at("sha256") << "\n\n";
    }
    out << "Chain validation: " << result.at("chain_validation").at("valid") << "\n";
    for (const auto& s : result.at("chain_validation").at("steps")) {
        out << "  [" << s.at("index") << "] " << (s.at("valid_signature").get<bool>() ? "OK" : "FAIL")
            << " :: " << s.at("child_subject") << " <- " << s.at("issuer_subject") << "\n";
    }
    return out.str();
}

std::string renderCsv(const nlohmann::json& result) {
    std::ostringstream out;
    out << "index,subject,issuer,serial_number,not_before,not_after,expired,days_until_expiration,days_since_expiration,public_key_algorithm,public_key_size,signature_algorithm,fingerprint_sha1,fingerprint_sha256\n";
    const auto& certs = result.at("certificates");
    for (std::size_t i = 0; i < certs.size(); i++) {
        const auto& c = certs[i];
        out << (i + 1) << ","
            << "\"" << c.at("subject").get<std::string>() << "\","
            << "\"" << c.at("issuer").get<std::string>() << "\","
            << c.at("serial_number") << ","
            << c.at("validity").at("not_before") << ","
            << c.at("validity").at("not_after") << ","
            << c.at("expiration").at("expired") << ","
            << c.at("expiration").at("days_until_expiration") << ","
            << c.at("expiration").at("days_since_expiration") << ","
            << c.at("public_key").at("algorithm") << ","
            << c.at("public_key").at("size") << ","
            << c.at("signature_algorithm") << ","
            << c.at("fingerprints").at("sha1") << ","
            << c.at("fingerprints").at("sha256") << "\n";
    }
    return out.str();
}

} // namespace

int main(int argc, char** argv) {
    ParsedArgs args = parseArgs(argc, argv);
    try {
        mbedtls_x509_crt chain;
        mbedtls_x509_crt_init(&chain);
        std::string source;
        if (args.options.count("host")) {
            const std::string hostPort = args.options.at("host");
            std::string host = hostPort;
            std::string port = args.options.count("port") ? args.options.at("port") : "443";
            auto pos = hostPort.find(':');
            if (pos != std::string::npos) {
                host = hostPort.substr(0, pos);
                if (!args.options.count("port")) port = hostPort.substr(pos + 1);
            }
            fetchHostChain(host, port, &chain);
            source = "host:" + host + ":" + port;
        } else if (!args.positional.empty()) {
            loadFromFile(std::filesystem::absolute(args.positional[0]), &chain);
            source = std::filesystem::absolute(args.positional[0]).string();
        } else {
            loadDemoChain(&chain);
            source = "demo-generated";
        }

        auto vec = chainVector(&chain);
        nlohmann::json result;
        result["source"] = source;
        result["certificate_count"] = vec.size();
        result["certificates"] = nlohmann::json::array();
        for (const auto* c : vec) result["certificates"].push_back(analyzeCert(c));
        result["chain_validation"] = validateChain(vec);

        std::string format = args.options.count("format") ? args.options.at("format") : "text";
        std::string rendered;
        if (format == "json") rendered = result.dump(2) + "\n";
        else if (format == "csv") rendered = renderCsv(result);
        else rendered = renderText(result);

        if (args.options.count("output")) {
            auto outPath = std::filesystem::absolute(args.options.at("output"));
            if (!outPath.parent_path().empty()) std::filesystem::create_directories(outPath.parent_path());
            std::ofstream out(outPath);
            out << rendered;
        }
        std::cout << rendered;
        mbedtls_x509_crt_free(&chain);
        return 0;
    } catch (const std::exception& e) {
        std::cerr << "Error: " << e.what() << "\n";
        return 1;
    }
}