path: root/nss/lib/certdb/polcyxtn.c

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*
 * Support for various policy related extensions
 */

#include "seccomon.h"
#include "secport.h"
#include "secder.h"
#include "cert.h"
#include "secoid.h"
#include "secasn1.h"
#include "secerr.h"
#include "nspr.h"

SEC_ASN1_MKSUB(SEC_IntegerTemplate)
SEC_ASN1_MKSUB(SEC_ObjectIDTemplate)

const SEC_ASN1Template CERT_DisplayTextTypeTemplate[] = {
    { SEC_ASN1_CHOICE, offsetof(SECItem, type), 0, sizeof(SECItem) },
    { SEC_ASN1_IA5_STRING, 0, 0, siAsciiString },
    { SEC_ASN1_VISIBLE_STRING, 0, 0, siVisibleString },
    { SEC_ASN1_BMP_STRING, 0, 0, siBMPString },
    { SEC_ASN1_UTF8_STRING, 0, 0, siUTF8String },
    { 0 }
};

const SEC_ASN1Template CERT_NoticeReferenceTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTNoticeReference) },
    { SEC_ASN1_INLINE, offsetof(CERTNoticeReference, organization),
      CERT_DisplayTextTypeTemplate, 0 },
    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN,
      offsetof(CERTNoticeReference, noticeNumbers),
      SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { 0 }
};

const SEC_ASN1Template CERT_UserNoticeTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTUserNotice) },
    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL,
      offsetof(CERTUserNotice, noticeReference), CERT_NoticeReferenceTemplate,
      0 },
    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL,
      offsetof(CERTUserNotice, displayText), CERT_DisplayTextTypeTemplate, 0 },
    { 0 }
};

const SEC_ASN1Template CERT_PolicyQualifierTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTPolicyQualifier) },
    { SEC_ASN1_OBJECT_ID, offsetof(CERTPolicyQualifier, qualifierID) },
    { SEC_ASN1_ANY, offsetof(CERTPolicyQualifier, qualifierValue) },
    { 0 }
};

const SEC_ASN1Template CERT_PolicyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTPolicyInfo) },
    { SEC_ASN1_OBJECT_ID, offsetof(CERTPolicyInfo, policyID) },
    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_OPTIONAL,
      offsetof(CERTPolicyInfo, policyQualifiers),
      CERT_PolicyQualifierTemplate },
    { 0 }
};

const SEC_ASN1Template CERT_CertificatePoliciesTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, offsetof(CERTCertificatePolicies, policyInfos),
      CERT_PolicyInfoTemplate, sizeof(CERTCertificatePolicies) }
};

const SEC_ASN1Template CERT_PolicyMapTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTPolicyMap) },
    { SEC_ASN1_OBJECT_ID, offsetof(CERTPolicyMap, issuerDomainPolicy) },
    { SEC_ASN1_OBJECT_ID, offsetof(CERTPolicyMap, subjectDomainPolicy) },
    { 0 }
};

const SEC_ASN1Template CERT_PolicyMappingsTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, offsetof(CERTCertificatePolicyMappings, policyMaps),
      CERT_PolicyMapTemplate, sizeof(CERTPolicyMap) }
};

const SEC_ASN1Template CERT_PolicyConstraintsTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTCertificatePolicyConstraints) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
      offsetof(CERTCertificatePolicyConstraints, explicitPolicySkipCerts),
      SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
      offsetof(CERTCertificatePolicyConstraints, inhibitMappingSkipCerts),
      SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { 0 }
};

const SEC_ASN1Template CERT_InhibitAnyTemplate[] = {
    { SEC_ASN1_INTEGER,
      offsetof(CERTCertificateInhibitAny, inhibitAnySkipCerts), NULL,
      sizeof(CERTCertificateInhibitAny) }
};

static void
breakLines(char *string)
{
    char *tmpstr;
    char *lastspace = NULL;
    int curlen = 0;
    int c;

    tmpstr = string;

    while ((c = *tmpstr) != '\0') {
        switch (c) {
            case ' ':
                lastspace = tmpstr;
                break;
            case '\n':
                lastspace = NULL;
                curlen = 0;
                break;
        }

        if ((curlen >= 55) && (lastspace != NULL)) {
            *lastspace = '\n';
            curlen = (tmpstr - lastspace);
            lastspace = NULL;
        }

        curlen++;
        tmpstr++;
    }

    return;
}

CERTCertificatePolicies *
CERT_DecodeCertificatePoliciesExtension(const SECItem *extnValue)
{
    PLArenaPool *arena = NULL;
    SECStatus rv;
    CERTCertificatePolicies *policies;
    CERTPolicyInfo **policyInfos, *policyInfo;
    CERTPolicyQualifier **policyQualifiers, *policyQualifier;
    SECItem newExtnValue;

    /* make a new arena */
    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);

    if (!arena) {
        goto loser;
    }

    /* allocate the certificate policies structure */
    policies = (CERTCertificatePolicies *)PORT_ArenaZAlloc(
        arena, sizeof(CERTCertificatePolicies));

    if (policies == NULL) {
        goto loser;
    }

    policies->arena = arena;

    /* copy the DER into the arena, since Quick DER returns data that points
       into the DER input, which may get freed by the caller */
    rv = SECITEM_CopyItem(arena, &newExtnValue, extnValue);
    if (rv != SECSuccess) {
        goto loser;
    }

    /* decode the policy info */
    rv = SEC_QuickDERDecodeItem(
        arena, policies, CERT_CertificatePoliciesTemplate, &newExtnValue);

    if (rv != SECSuccess) {
        goto loser;
    }

    /* initialize the oid tags */
    policyInfos = policies->policyInfos;
    while (*policyInfos != NULL) {
        policyInfo = *policyInfos;
        policyInfo->oid = SECOID_FindOIDTag(&policyInfo->policyID);
        policyQualifiers = policyInfo->policyQualifiers;
        while (policyQualifiers != NULL && *policyQualifiers != NULL) {
            policyQualifier = *policyQualifiers;
            policyQualifier->oid =
                SECOID_FindOIDTag(&policyQualifier->qualifierID);
            policyQualifiers++;
        }
        policyInfos++;
    }

    return (policies);

loser:
    if (arena != NULL) {
        PORT_FreeArena(arena, PR_FALSE);
    }

    return (NULL);
}

void
CERT_DestroyCertificatePoliciesExtension(CERTCertificatePolicies *policies)
{
    if (policies != NULL) {
        PORT_FreeArena(policies->arena, PR_FALSE);
    }
    return;
}

CERTCertificatePolicyMappings *
CERT_DecodePolicyMappingsExtension(SECItem *extnValue)
{
    PLArenaPool *arena = NULL;
    SECStatus rv;
    CERTCertificatePolicyMappings *mappings;
    SECItem newExtnValue;

    /* make a new arena */
    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
    if (!arena) {
        goto loser;
    }

    /* allocate the policy mappings structure */
    mappings = (CERTCertificatePolicyMappings *)PORT_ArenaZAlloc(
        arena, sizeof(CERTCertificatePolicyMappings));
    if (mappings == NULL) {
        goto loser;
    }
    mappings->arena = arena;

    /* copy the DER into the arena, since Quick DER returns data that points
       into the DER input, which may get freed by the caller */
    rv = SECITEM_CopyItem(arena, &newExtnValue, extnValue);
    if (rv != SECSuccess) {
        goto loser;
    }

    /* decode the policy mappings */
    rv = SEC_QuickDERDecodeItem(arena, mappings, CERT_PolicyMappingsTemplate,
                                &newExtnValue);
    if (rv != SECSuccess) {
        goto loser;
    }

    return (mappings);

loser:
    if (arena != NULL) {
        PORT_FreeArena(arena, PR_FALSE);
    }

    return (NULL);
}

SECStatus
CERT_DestroyPolicyMappingsExtension(CERTCertificatePolicyMappings *mappings)
{
    if (mappings != NULL) {
        PORT_FreeArena(mappings->arena, PR_FALSE);
    }
    return SECSuccess;
}

SECStatus
CERT_DecodePolicyConstraintsExtension(
    CERTCertificatePolicyConstraints *decodedValue, const SECItem *encodedValue)
{
    CERTCertificatePolicyConstraints decodeContext;
    PLArenaPool *arena = NULL;
    SECStatus rv = SECSuccess;

    /* initialize so we can tell when an optional component is omitted */
    PORT_Memset(&decodeContext, 0, sizeof(decodeContext));

    /* make a new arena */
    arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
    if (!arena) {
        return SECFailure;
    }

    do {
        /* decode the policy constraints */
        rv = SEC_QuickDERDecodeItem(arena, &decodeContext,
                                    CERT_PolicyConstraintsTemplate,
                                    encodedValue);

        if (rv != SECSuccess) {
            break;
        }

        if (decodeContext.explicitPolicySkipCerts.len == 0) {
            *(PRInt32 *)decodedValue->explicitPolicySkipCerts.data = -1;
        } else {
            *(PRInt32 *)decodedValue->explicitPolicySkipCerts.data =
                DER_GetInteger(&decodeContext.explicitPolicySkipCerts);
        }

        if (decodeContext.inhibitMappingSkipCerts.len == 0) {
            *(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data = -1;
        } else {
            *(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data =
                DER_GetInteger(&decodeContext.inhibitMappingSkipCerts);
        }

        if ((*(PRInt32 *)decodedValue->explicitPolicySkipCerts.data ==
             PR_INT32_MIN) ||
            (*(PRInt32 *)decodedValue->explicitPolicySkipCerts.data ==
             PR_INT32_MAX) ||
            (*(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data ==
             PR_INT32_MIN) ||
            (*(PRInt32 *)decodedValue->inhibitMappingSkipCerts.data ==
             PR_INT32_MAX)) {
            rv = SECFailure;
        }

    } while (0);

    PORT_FreeArena(arena, PR_FALSE);
    return (rv);
}

SECStatus
CERT_DecodeInhibitAnyExtension(CERTCertificateInhibitAny *decodedValue,
                               SECItem *encodedValue)
{
    CERTCertificateInhibitAny decodeContext;
    PLArenaPool *arena = NULL;
    SECStatus rv = SECSuccess;

    /* make a new arena */
    arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
    if (!arena) {
        return SECFailure;
    }

    do {

        /* decode the policy mappings */
        decodeContext.inhibitAnySkipCerts.type = siUnsignedInteger;
        rv = SEC_QuickDERDecodeItem(arena, &decodeContext,
                                    CERT_InhibitAnyTemplate, encodedValue);

        if (rv != SECSuccess) {
            break;
        }

        *(PRInt32 *)decodedValue->inhibitAnySkipCerts.data =
            DER_GetInteger(&decodeContext.inhibitAnySkipCerts);

    } while (0);

    PORT_FreeArena(arena, PR_FALSE);
    return (rv);
}

CERTUserNotice *
CERT_DecodeUserNotice(SECItem *noticeItem)
{
    PLArenaPool *arena = NULL;
    SECStatus rv;
    CERTUserNotice *userNotice;
    SECItem newNoticeItem;

    /* make a new arena */
    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);

    if (!arena) {
        goto loser;
    }

    /* allocate the userNotice structure */
    userNotice =
        (CERTUserNotice *)PORT_ArenaZAlloc(arena, sizeof(CERTUserNotice));

    if (userNotice == NULL) {
        goto loser;
    }

    userNotice->arena = arena;

    /* copy the DER into the arena, since Quick DER returns data that points
       into the DER input, which may get freed by the caller */
    rv = SECITEM_CopyItem(arena, &newNoticeItem, noticeItem);
    if (rv != SECSuccess) {
        goto loser;
    }

    /* decode the user notice */
    rv = SEC_QuickDERDecodeItem(arena, userNotice, CERT_UserNoticeTemplate,
                                &newNoticeItem);

    if (rv != SECSuccess) {
        goto loser;
    }

    if (userNotice->derNoticeReference.data != NULL) {

        rv = SEC_QuickDERDecodeItem(arena, &userNotice->noticeReference,
                                    CERT_NoticeReferenceTemplate,
                                    &userNotice->derNoticeReference);
        if (rv == SECFailure) {
            goto loser;
        }
    }

    return (userNotice);

loser:
    if (arena != NULL) {
        PORT_FreeArena(arena, PR_FALSE);
    }

    return (NULL);
}

void
CERT_DestroyUserNotice(CERTUserNotice *userNotice)
{
    if (userNotice != NULL) {
        PORT_FreeArena(userNotice->arena, PR_FALSE);
    }
    return;
}

static CERTPolicyStringCallback policyStringCB = NULL;
static void *policyStringCBArg = NULL;

void
CERT_SetCAPolicyStringCallback(CERTPolicyStringCallback cb, void *cbarg)
{
    policyStringCB = cb;
    policyStringCBArg = cbarg;
    return;
}

char *
stringFromUserNotice(SECItem *noticeItem)
{
    SECItem *org;
    unsigned int len, headerlen;
    char *stringbuf;
    CERTUserNotice *userNotice;
    char *policystr;
    char *retstr = NULL;
    SECItem *displayText;
    SECItem **noticeNumbers;
    unsigned int strnum;

    /* decode the user notice */
    userNotice = CERT_DecodeUserNotice(noticeItem);
    if (userNotice == NULL) {
        return (NULL);
    }

    org = &userNotice->noticeReference.organization;
    if ((org->len != 0) && (policyStringCB != NULL)) {
        /* has a noticeReference */

        /* extract the org string */
        len = org->len;
        stringbuf = (char *)PORT_Alloc(len + 1);
        if (stringbuf != NULL) {
            PORT_Memcpy(stringbuf, org->data, len);
            stringbuf[len] = '\0';

            noticeNumbers = userNotice->noticeReference.noticeNumbers;
            while (*noticeNumbers != NULL) {
                /* XXX - only one byte integers right now*/
                strnum = (*noticeNumbers)->data[0];
                policystr =
                    (*policyStringCB)(stringbuf, strnum, policyStringCBArg);
                if (policystr != NULL) {
                    if (retstr != NULL) {
                        retstr = PR_sprintf_append(retstr, "\n%s", policystr);
                    } else {
                        retstr = PR_sprintf_append(retstr, "%s", policystr);
                    }

                    PORT_Free(policystr);
                }

                noticeNumbers++;
            }

            PORT_Free(stringbuf);
        }
    }

    if (retstr == NULL) {
        if (userNotice->displayText.len != 0) {
            displayText = &userNotice->displayText;

            if (displayText->len > 2) {
                if (displayText->data[0] == SEC_ASN1_VISIBLE_STRING) {
                    headerlen = 2;
                    if (displayText->data[1] & 0x80) {
                        /* multibyte length */
                        headerlen += (displayText->data[1] & 0x7f);
                    }

                    len = displayText->len - headerlen;
                    retstr = (char *)PORT_Alloc(len + 1);
                    if (retstr != NULL) {
                        PORT_Memcpy(retstr, &displayText->data[headerlen], len);
                        retstr[len] = '\0';
                    }
                }
            }
        }
    }

    CERT_DestroyUserNotice(userNotice);

    return (retstr);
}

char *
CERT_GetCertCommentString(CERTCertificate *cert)
{
    char *retstring = NULL;
    SECStatus rv;
    SECItem policyItem;
    CERTCertificatePolicies *policies = NULL;
    CERTPolicyInfo **policyInfos;
    CERTPolicyQualifier **policyQualifiers, *qualifier;

    policyItem.data = NULL;

    rv = CERT_FindCertExtension(cert, SEC_OID_X509_CERTIFICATE_POLICIES,
                                &policyItem);
    if (rv != SECSuccess) {
        goto nopolicy;
    }

    policies = CERT_DecodeCertificatePoliciesExtension(&policyItem);
    if (policies == NULL) {
        goto nopolicy;
    }

    policyInfos = policies->policyInfos;
    /* search through policyInfos looking for the verisign policy */
    while (*policyInfos != NULL) {
        if ((*policyInfos)->oid == SEC_OID_VERISIGN_USER_NOTICES) {
            policyQualifiers = (*policyInfos)->policyQualifiers;
            /* search through the policy qualifiers looking for user notice */
            while (policyQualifiers != NULL && *policyQualifiers != NULL) {
                qualifier = *policyQualifiers;
                if (qualifier->oid == SEC_OID_PKIX_USER_NOTICE_QUALIFIER) {
                    retstring =
                        stringFromUserNotice(&qualifier->qualifierValue);
                    break;
                }

                policyQualifiers++;
            }
            break;
        }
        policyInfos++;
    }

nopolicy:
    if (policyItem.data != NULL) {
        PORT_Free(policyItem.data);
    }

    if (policies != NULL) {
        CERT_DestroyCertificatePoliciesExtension(policies);
    }

    if (retstring == NULL) {
        retstring =
            CERT_FindNSStringExtension(cert, SEC_OID_NS_CERT_EXT_COMMENT);
    }

    if (retstring != NULL) {
        breakLines(retstring);
    }

    return (retstring);
}

const SEC_ASN1Template CERT_OidSeqTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN, offsetof(CERTOidSequence, oids),
      SEC_ASN1_SUB(SEC_ObjectIDTemplate) }
};

CERTOidSequence *
CERT_DecodeOidSequence(const SECItem *seqItem)
{
    PLArenaPool *arena = NULL;
    SECStatus rv;
    CERTOidSequence *oidSeq;
    SECItem newSeqItem;

    /* make a new arena */
    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);

    if (!arena) {
        goto loser;
    }

    /* allocate the userNotice structure */
    oidSeq =
        (CERTOidSequence *)PORT_ArenaZAlloc(arena, sizeof(CERTOidSequence));

    if (oidSeq == NULL) {
        goto loser;
    }

    oidSeq->arena = arena;

    /* copy the DER into the arena, since Quick DER returns data that points
       into the DER input, which may get freed by the caller */
    rv = SECITEM_CopyItem(arena, &newSeqItem, seqItem);
    if (rv != SECSuccess) {
        goto loser;
    }

    /* decode the user notice */
    rv =
        SEC_QuickDERDecodeItem(arena, oidSeq, CERT_OidSeqTemplate, &newSeqItem);

    if (rv != SECSuccess) {
        goto loser;
    }

    return (oidSeq);

loser:
    if (arena) {
        PORT_FreeArena(arena, PR_FALSE);
    }
    return (NULL);
}

void
CERT_DestroyOidSequence(CERTOidSequence *oidSeq)
{
    if (oidSeq != NULL) {
        PORT_FreeArena(oidSeq->arena, PR_FALSE);
    }
    return;
}

PRBool
CERT_GovtApprovedBitSet(CERTCertificate *cert)
{
    SECStatus rv;
    SECItem extItem;
    CERTOidSequence *oidSeq = NULL;
    PRBool ret;
    SECItem **oids;
    SECItem *oid;
    SECOidTag oidTag;

    extItem.data = NULL;
    rv = CERT_FindCertExtension(cert, SEC_OID_X509_EXT_KEY_USAGE, &extItem);
    if (rv != SECSuccess) {
        goto loser;
    }

    oidSeq = CERT_DecodeOidSequence(&extItem);
    if (oidSeq == NULL) {
        goto loser;
    }

    oids = oidSeq->oids;
    while (oids != NULL && *oids != NULL) {
        oid = *oids;

        oidTag = SECOID_FindOIDTag(oid);

        if (oidTag == SEC_OID_NS_KEY_USAGE_GOVT_APPROVED) {
            goto success;
        }

        oids++;
    }

loser:
    ret = PR_FALSE;
    goto done;
success:
    ret = PR_TRUE;
done:
    if (oidSeq != NULL) {
        CERT_DestroyOidSequence(oidSeq);
    }
    if (extItem.data != NULL) {
        PORT_Free(extItem.data);
    }
    return (ret);
}

SECStatus
CERT_EncodePolicyConstraintsExtension(PLArenaPool *arena,
                                      CERTCertificatePolicyConstraints *constr,
                                      SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(constr != NULL && dest != NULL);
    if (constr == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, constr,
                           CERT_PolicyConstraintsTemplate) == NULL) {
        rv = SECFailure;
    }
    return (rv);
}

SECStatus
CERT_EncodePolicyMappingExtension(PLArenaPool *arena,
                                  CERTCertificatePolicyMappings *mapping,
                                  SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(mapping != NULL && dest != NULL);
    if (mapping == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, mapping, CERT_PolicyMappingsTemplate) ==
        NULL) {
        rv = SECFailure;
    }
    return (rv);
}

SECStatus
CERT_EncodeCertPoliciesExtension(PLArenaPool *arena, CERTPolicyInfo **info,
                                 SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(info != NULL && dest != NULL);
    if (info == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, info,
                           CERT_CertificatePoliciesTemplate) == NULL) {
        rv = SECFailure;
    }
    return (rv);
}

SECStatus
CERT_EncodeUserNotice(PLArenaPool *arena, CERTUserNotice *notice, SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(notice != NULL && dest != NULL);
    if (notice == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, notice, CERT_UserNoticeTemplate) ==
        NULL) {
        rv = SECFailure;
    }

    return (rv);
}

SECStatus
CERT_EncodeNoticeReference(PLArenaPool *arena, CERTNoticeReference *reference,
                           SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(reference != NULL && dest != NULL);
    if (reference == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, reference,
                           CERT_NoticeReferenceTemplate) == NULL) {
        rv = SECFailure;
    }

    return (rv);
}

SECStatus
CERT_EncodeInhibitAnyExtension(PLArenaPool *arena,
                               CERTCertificateInhibitAny *certInhibitAny,
                               SECItem *dest)
{
    SECStatus rv = SECSuccess;

    PORT_Assert(certInhibitAny != NULL && dest != NULL);
    if (certInhibitAny == NULL || dest == NULL) {
        return SECFailure;
    }

    if (SEC_ASN1EncodeItem(arena, dest, certInhibitAny,
                           CERT_InhibitAnyTemplate) == NULL) {
        rv = SECFailure;
    }
    return (rv);
}