# `ADS.Certificate`
[🔗](https://github.com/tallakt/yaads/blob/v0.1.0/lib/ads/certificate.ex#L1)

X.509 certificates for Secure ADS, as DER binaries.

With self-signed certificates, each side makes its own, and knows the other's by its
fingerprint. The client's is made once and kept, since the PLC remembers it when the route is
added:

    {cert, key} = ADS.Certificate.self_signed("scada")
    :ok = ADS.Certificate.write("scada.pem", cert)
    :ok = ADS.Certificate.write_key("scada.key", key)
    ADS.Certificate.fingerprint(cert)

With a CA, the certificates come from it, and these functions read them.

# `private_key`

```elixir
@type private_key() :: tuple()
```

# `t`

```elixir
@type t() :: binary()
```

# `fingerprint`

```elixir
@spec fingerprint(t()) :: String.t()
```

A certificate's fingerprint: the SHA-256 of its DER, as 64 hexadecimal digits, as TwinCAT shows
its own in the About TwinCAT dialog.

# `read`

```elixir
@spec read(Path.t()) :: t()
```

Reads a certificate from a DER or PEM file.

# `read_key`

```elixir
@spec read_key(Path.t()) :: private_key()
```

Reads a private key from a PEM file.

# `self_signed`

```elixir
@spec self_signed(String.t(), keyword()) :: {t(), private_key()}
```

Makes a self-signed certificate and its private key, with a common name: the name of the client,
as the PLC compares it with the route unless told to ignore it.

  * `:hostnames` - DNS names and IP addresses for its subject alternative name (default the
    common name)
  * `:days` - how long it's valid (default 3650)
  * `:key_size` - RSA key bits (default 2048)

# `write`

```elixir
@spec write(Path.t(), t()) :: :ok | {:error, File.posix()}
```

Writes a certificate as DER, or PEM if the path ends in `.pem`.

# `write_key`

```elixir
@spec write_key(Path.t(), private_key()) :: :ok | {:error, File.posix()}
```

Writes an RSA private key as PEM.

---

*Consult [api-reference.md](api-reference.md) for complete listing*