GNUTLS_CIPHER_UNKNOWN
     Unknown algorithm.

GNUTLS_CIPHER_NULL
     NULL algorithm.

GNUTLS_CIPHER_ARCFOUR_128
     ARCFOUR stream cipher with 128-bit keys.

GNUTLS_CIPHER_3DES_CBC
     3DES in CBC mode.

GNUTLS_CIPHER_AES_128_CBC
     AES in CBC mode with 128-bit keys.

GNUTLS_CIPHER_AES_256_CBC
     AES in CBC mode with 256-bit keys.

GNUTLS_CIPHER_ARCFOUR_40
     ARCFOUR stream cipher with 40-bit keys.

GNUTLS_CIPHER_CAMELLIA_128_CBC
     Camellia in CBC mode with 128-bit keys.

GNUTLS_CIPHER_CAMELLIA_256_CBC
     Camellia in CBC mode with 256-bit keys.

GNUTLS_CIPHER_RC2_40_CBC
     RC2 in CBC mode with 40-bit keys.

GNUTLS_CIPHER_DES_CBC
     DES in CBC mode (56-bit keys).

GNUTLS_CIPHER_AES_192_CBC
     AES in CBC mode with 192-bit keys.

GNUTLS_CIPHER_AES_128_GCM
     AES in GCM mode with 128-bit keys.

GNUTLS_CIPHER_AES_256_GCM
     AES in GCM mode with 256-bit keys.

GNUTLS_CIPHER_CAMELLIA_192_CBC
     Camellia in CBC mode with 192-bit keys.

GNUTLS_CIPHER_SALSA20_256
     -- undescribed --

GNUTLS_CIPHER_ESTREAM_SALSA20_256
     -- undescribed --

GNUTLS_CIPHER_CAMELLIA_128_GCM
     CAMELLIA in GCM mode with 128-bit keys.

GNUTLS_CIPHER_CAMELLIA_256_GCM
     CAMELLIA in GCM mode with 256-bit keys.

GNUTLS_CIPHER_IDEA_PGP_CFB
     IDEA in CFB mode.

GNUTLS_CIPHER_3DES_PGP_CFB
     3DES in CFB mode.

GNUTLS_CIPHER_CAST5_PGP_CFB
     CAST5 in CFB mode.

GNUTLS_CIPHER_BLOWFISH_PGP_CFB
     Blowfish in CFB mode.

GNUTLS_CIPHER_SAFER_SK128_PGP_CFB
     Safer-SK in CFB mode with 128-bit keys.

GNUTLS_CIPHER_AES128_PGP_CFB
     AES in CFB mode with 128-bit keys.

GNUTLS_CIPHER_AES192_PGP_CFB
     AES in CFB mode with 192-bit keys.

GNUTLS_CIPHER_AES256_PGP_CFB
     AES in CFB mode with 256-bit keys.

GNUTLS_CIPHER_TWOFISH_PGP_CFB
     Twofish in CFB mode.

GNUTLS_KX_UNKNOWN
     Unknown key-exchange algorithm.

GNUTLS_KX_RSA
     RSA key-exchange algorithm.

GNUTLS_KX_DHE_DSS
     DHE-DSS key-exchange algorithm.

GNUTLS_KX_DHE_RSA
     DHE-RSA key-exchange algorithm.

GNUTLS_KX_ANON_DH
     Anon-DH key-exchange algorithm.

GNUTLS_KX_SRP
     SRP key-exchange algorithm.

GNUTLS_KX_RSA_EXPORT
     RSA-EXPORT key-exchange algorithm (defunc).

GNUTLS_KX_SRP_RSA
     SRP-RSA key-exchange algorithm.

GNUTLS_KX_SRP_DSS
     SRP-DSS key-exchange algorithm.

GNUTLS_KX_PSK
     PSK key-exchange algorithm.

GNUTLS_KX_DHE_PSK
     DHE-PSK key-exchange algorithm.

GNUTLS_KX_ANON_ECDH
     Anon-ECDH key-exchange algorithm.

GNUTLS_KX_ECDHE_RSA
     ECDHE-RSA key-exchange algorithm.

GNUTLS_KX_ECDHE_ECDSA
     ECDHE-ECDSA key-exchange algorithm.

GNUTLS_KX_ECDHE_PSK
     ECDHE-PSK key-exchange algorithm.

GNUTLS_KX_RSA_PSK
     RSA-PSK key-exchange algorithm.

GNUTLS_PARAMS_RSA_EXPORT
     Session RSA-EXPORT parameters (defunc).

GNUTLS_PARAMS_DH
     Session Diffie-Hellman parameters.

GNUTLS_PARAMS_ECDH
     Session Elliptic-Curve Diffie-Hellman parameters.

GNUTLS_CRD_CERTIFICATE
     Certificate credential.

GNUTLS_CRD_ANON
     Anonymous credential.

GNUTLS_CRD_SRP
     SRP credential.

GNUTLS_CRD_PSK
     PSK credential.

GNUTLS_CRD_IA
     IA credential.

GNUTLS_MAC_UNKNOWN
     Unknown MAC algorithm.

GNUTLS_MAC_NULL
     NULL MAC algorithm (empty output).

GNUTLS_MAC_MD5
     HMAC-MD5 algorithm.

GNUTLS_MAC_SHA1
     HMAC-SHA-1 algorithm.

GNUTLS_MAC_RMD160
     HMAC-RMD160 algorithm.

GNUTLS_MAC_MD2
     HMAC-MD2 algorithm.

GNUTLS_MAC_SHA256
     HMAC-SHA-256 algorithm.

GNUTLS_MAC_SHA384
     HMAC-SHA-384 algorithm.

GNUTLS_MAC_SHA512
     HMAC-SHA-512 algorithm.

GNUTLS_MAC_SHA224
     HMAC-SHA-224 algorithm.

GNUTLS_MAC_AEAD
     MAC implicit through AEAD cipher.

GNUTLS_MAC_UMAC_96
     The UMAC-96 MAC algorithm.

GNUTLS_MAC_UMAC_128
     The UMAC-128 MAC algorithm.

GNUTLS_DIG_UNKNOWN
     Unknown hash algorithm.

GNUTLS_DIG_NULL
     NULL hash algorithm (empty output).

GNUTLS_DIG_MD5
     MD5 algorithm.

GNUTLS_DIG_SHA1
     SHA-1 algorithm.

GNUTLS_DIG_RMD160
     RMD160 algorithm.

GNUTLS_DIG_MD2
     MD2 algorithm.

GNUTLS_DIG_SHA256
     SHA-256 algorithm.

GNUTLS_DIG_SHA384
     SHA-384 algorithm.

GNUTLS_DIG_SHA512
     SHA-512 algorithm.

GNUTLS_DIG_SHA224
     SHA-224 algorithm.

GNUTLS_COMP_UNKNOWN
     Unknown compression method.

GNUTLS_COMP_NULL
     The NULL compression method (no compression).

GNUTLS_COMP_DEFLATE
     The DEFLATE compression method from zlib.

GNUTLS_COMP_ZLIB
     Same as GNUTLS_COMP_DEFLATE .

GNUTLS_AL_WARNING
     Alert of warning severity.

GNUTLS_AL_FATAL
     Alert of fatal severity.

GNUTLS_A_CLOSE_NOTIFY
     Close notify.

GNUTLS_A_UNEXPECTED_MESSAGE
     Unexpected message.

GNUTLS_A_BAD_RECORD_MAC
     Bad record MAC.

GNUTLS_A_DECRYPTION_FAILED
     Decryption failed.

GNUTLS_A_RECORD_OVERFLOW
     Record overflow.

GNUTLS_A_DECOMPRESSION_FAILURE
     Decompression failed.

GNUTLS_A_HANDSHAKE_FAILURE
     Handshake failed.

GNUTLS_A_SSL3_NO_CERTIFICATE
     No certificate.

GNUTLS_A_BAD_CERTIFICATE
     Certificate is bad.

GNUTLS_A_UNSUPPORTED_CERTIFICATE
     Certificate is not supported.

GNUTLS_A_CERTIFICATE_REVOKED
     Certificate was revoked.

GNUTLS_A_CERTIFICATE_EXPIRED
     Certificate is expired.

GNUTLS_A_CERTIFICATE_UNKNOWN
     Unknown certificate.

GNUTLS_A_ILLEGAL_PARAMETER
     Illegal parameter.

GNUTLS_A_UNKNOWN_CA
     CA is unknown.

GNUTLS_A_ACCESS_DENIED
     Access was denied.

GNUTLS_A_DECODE_ERROR
     Decode error.

GNUTLS_A_DECRYPT_ERROR
     Decrypt error.

GNUTLS_A_EXPORT_RESTRICTION
     Export restriction.

GNUTLS_A_PROTOCOL_VERSION
     Error in protocol version.

GNUTLS_A_INSUFFICIENT_SECURITY
     Insufficient security.

GNUTLS_A_INTERNAL_ERROR
     Internal error.

GNUTLS_A_USER_CANCELED
     User canceled.

GNUTLS_A_NO_RENEGOTIATION
     No renegotiation is allowed.

GNUTLS_A_UNSUPPORTED_EXTENSION
     An unsupported extension was sent.

GNUTLS_A_CERTIFICATE_UNOBTAINABLE
     Could not retrieve the specified certificate.

GNUTLS_A_UNRECOGNIZED_NAME
     The server name sent was not recognized.

GNUTLS_A_UNKNOWN_PSK_IDENTITY
     The SRP/PSK username is missing or not known.

GNUTLS_A_NO_APPLICATION_PROTOCOL
     -- undescribed --

GNUTLS_HANDSHAKE_HELLO_REQUEST
     Hello request.

GNUTLS_HANDSHAKE_CLIENT_HELLO
     Client hello.

GNUTLS_HANDSHAKE_SERVER_HELLO
     Server hello.

GNUTLS_HANDSHAKE_HELLO_VERIFY_REQUEST
     DTLS Hello verify request.

GNUTLS_HANDSHAKE_NEW_SESSION_TICKET
     New session ticket.

GNUTLS_HANDSHAKE_CERTIFICATE_PKT
     Certificate packet.

GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE
     Server key exchange.

GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST
     Certificate request.

GNUTLS_HANDSHAKE_SERVER_HELLO_DONE
     Server hello done.

GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY
     Certificate verify.

GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE
     Client key exchange.

GNUTLS_HANDSHAKE_FINISHED
     Finished.

GNUTLS_HANDSHAKE_CERTIFICATE_STATUS
     Certificate status (OCSP).

GNUTLS_HANDSHAKE_SUPPLEMENTAL
     Supplemental.

GNUTLS_HANDSHAKE_CHANGE_CIPHER_SPEC
     Change Cipher Spec.

GNUTLS_HANDSHAKE_CLIENT_HELLO_V2
     SSLv2 Client Hello.

GNUTLS_CERT_INVALID
     The certificate is not signed by one of the known authorities or the signature is invalid (deprecated by the flags GNUTLS_CERT_SIGNATURE_FAILURE  and GNUTLS_CERT_SIGNER_NOT_FOUND ).

GNUTLS_CERT_REVOKED
     Certificate is revoked by its authority.  In X.509 this will be set only if CRLs are checked.

GNUTLS_CERT_SIGNER_NOT_FOUND
     The certificate's issuer is not known. This is the case if the issuer is not included in the trusted certificate list.

GNUTLS_CERT_SIGNER_NOT_CA
     The certificate's signer was not a CA. This may happen if this was a version 1 certificate, which is common with some CAs, or a version 3 certificate without the basic constrains extension.

GNUTLS_CERT_INSECURE_ALGORITHM
     The certificate was signed using an insecure algorithm such as MD2 or MD5. These algorithms have been broken and should not be trusted.

GNUTLS_CERT_NOT_ACTIVATED
     The certificate is not yet activated.

GNUTLS_CERT_EXPIRED
     The certificate has expired.

GNUTLS_CERT_SIGNATURE_FAILURE
     The signature verification failed.

GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED
     The revocation data are old and have been superseded.

GNUTLS_CERT_UNEXPECTED_OWNER
     The owner is not the expected one.

GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE
     The revocation data have a future issue date.

GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE
     The certificate's signer constraints were violated.

GNUTLS_CERT_MISMATCH
     The certificate presented isn't the expected one (TOFU)

GNUTLS_CERT_IGNORE
     Ignore certificate.

GNUTLS_CERT_REQUEST
     Request certificate.

GNUTLS_CERT_REQUIRE
     Require certificate.

GNUTLS_OPENPGP_CERT
     Send entire certificate.

GNUTLS_OPENPGP_CERT_FINGERPRINT
     Send only certificate fingerprint.

GNUTLS_SHUT_RDWR
     Disallow further receives/sends.

GNUTLS_SHUT_WR
     Disallow further sends.

GNUTLS_SSL3
     SSL version 3.0.

GNUTLS_TLS1_0
     TLS version 1.0.

GNUTLS_TLS1
     Same as GNUTLS_TLS1_0 .

GNUTLS_TLS1_1
     TLS version 1.1.

GNUTLS_TLS1_2
     TLS version 1.2.

GNUTLS_DTLS0_9
     DTLS version 0.9 (Cisco AnyConnect / OpenSSL 0.9.8e).

GNUTLS_DTLS1_0
     DTLS version 1.0.

GNUTLS_DTLS1_2
     DTLS version 1.2.

GNUTLS_DTLS_VERSION_MIN
     -- undescribed --

GNUTLS_DTLS_VERSION_MAX
     -- undescribed --

GNUTLS_TLS_VERSION_MAX
     -- undescribed --

GNUTLS_VERSION_UNKNOWN
     Unknown SSL/TLS version.

GNUTLS_CRT_UNKNOWN
     Unknown certificate type.

GNUTLS_CRT_X509
     X.509 Certificate.

GNUTLS_CRT_OPENPGP
     OpenPGP certificate.

GNUTLS_CRT_RAW
     Raw public key (SubjectPublicKey)

GNUTLS_X509_FMT_DER
     X.509 certificate in DER format (binary).

GNUTLS_X509_FMT_PEM
     X.509 certificate in PEM format (text).

GNUTLS_CRT_PRINT_FULL
     Full information about certificate.

GNUTLS_CRT_PRINT_ONELINE
     Information about certificate in one line.

GNUTLS_CRT_PRINT_UNSIGNED_FULL
     All info for an unsigned certificate.

GNUTLS_CRT_PRINT_COMPACT
     Information about certificate name in one line, plus identification of the public key.

GNUTLS_CRT_PRINT_FULL_NUMBERS
     Full information about certificate and include easy to parse public key parameters.

GNUTLS_PK_UNKNOWN
     Unknown public-key algorithm.

GNUTLS_PK_RSA
     RSA public-key algorithm.

GNUTLS_PK_DSA
     DSA public-key algorithm.

GNUTLS_PK_DH
     Diffie-Hellman algorithm. Used to generate parameters.

GNUTLS_PK_EC
     Elliptic curve algorithm. Used to generate parameters.

GNUTLS_SIGN_UNKNOWN
     Unknown signature algorithm.

GNUTLS_SIGN_RSA_SHA1
     Digital signature algorithm RSA with SHA-1

GNUTLS_SIGN_RSA_SHA
     Same as GNUTLS_SIGN_RSA_SHA1 .

GNUTLS_SIGN_DSA_SHA1
     Digital signature algorithm DSA with SHA-1

GNUTLS_SIGN_DSA_SHA
     Same as GNUTLS_SIGN_DSA_SHA1 .

GNUTLS_SIGN_RSA_MD5
     Digital signature algorithm RSA with MD5.

GNUTLS_SIGN_RSA_MD2
     Digital signature algorithm RSA with MD2.

GNUTLS_SIGN_RSA_RMD160
     Digital signature algorithm RSA with RMD-160.

GNUTLS_SIGN_RSA_SHA256
     Digital signature algorithm RSA with SHA-256.

GNUTLS_SIGN_RSA_SHA384
     Digital signature algorithm RSA with SHA-384.

GNUTLS_SIGN_RSA_SHA512
     Digital signature algorithm RSA with SHA-512.

GNUTLS_SIGN_RSA_SHA224
     Digital signature algorithm RSA with SHA-224.

GNUTLS_SIGN_DSA_SHA224
     Digital signature algorithm DSA with SHA-224

GNUTLS_SIGN_DSA_SHA256
     Digital signature algorithm DSA with SHA-256

GNUTLS_SIGN_ECDSA_SHA1
     ECDSA with SHA1.

GNUTLS_SIGN_ECDSA_SHA224
     Digital signature algorithm ECDSA with SHA-224.

GNUTLS_SIGN_ECDSA_SHA256
     Digital signature algorithm ECDSA with SHA-256.

GNUTLS_SIGN_ECDSA_SHA384
     Digital signature algorithm ECDSA with SHA-384.

GNUTLS_SIGN_ECDSA_SHA512
     Digital signature algorithm ECDSA with SHA-512.

GNUTLS_SIGN_DSA_SHA384
     -- undescribed --

GNUTLS_SIGN_DSA_SHA512
     -- undescribed --

GNUTLS_ECC_CURVE_INVALID
     Cannot be known

GNUTLS_ECC_CURVE_SECP224R1
     the SECP224R1 curve

GNUTLS_ECC_CURVE_SECP256R1
     the SECP256R1 curve

GNUTLS_ECC_CURVE_SECP384R1
     the SECP384R1 curve

GNUTLS_ECC_CURVE_SECP521R1
     the SECP521R1 curve

GNUTLS_ECC_CURVE_SECP192R1
     the SECP192R1 curve

GNUTLS_SEC_PARAM_INSECURE
     Less than 42 bits of security

GNUTLS_SEC_PARAM_EXPORT
     42 bits of security

GNUTLS_SEC_PARAM_VERY_WEAK
     64 bits of security

GNUTLS_SEC_PARAM_WEAK
     72 bits of security

GNUTLS_SEC_PARAM_UNKNOWN
     Cannot be known

GNUTLS_SEC_PARAM_LOW
     80 bits of security

GNUTLS_SEC_PARAM_LEGACY
     96 bits of security

GNUTLS_SEC_PARAM_MEDIUM
     112 bits of security (used to be GNUTLS_SEC_PARAM_NORMAL )

GNUTLS_SEC_PARAM_HIGH
     128 bits of security

GNUTLS_SEC_PARAM_ULTRA
     192 bits of security

GNUTLS_CB_TLS_UNIQUE
     "tls-unique" (RFC 5929) channel binding

GNUTLS_NAME_DNS
     Domain Name System name type.

GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA
     Supplemental user mapping data.

GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80
     128 bit AES with a 80 bit HMAC-SHA1

GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32
     128 bit AES with a 32 bit HMAC-SHA1

GNUTLS_SRTP_NULL_HMAC_SHA1_80
     NULL cipher with a 80 bit HMAC-SHA1

GNUTLS_SRTP_NULL_HMAC_SHA1_32
     NULL cipher with a 32 bit HMAC-SHA1

GNUTLS_PSK_KEY_RAW
     PSK-key in raw format.

GNUTLS_PSK_KEY_HEX
     PSK-key in hex format.

GNUTLS_SAN_DNSNAME
     DNS-name SAN.

GNUTLS_SAN_RFC822NAME
     E-mail address SAN.

GNUTLS_SAN_URI
     URI SAN.

GNUTLS_SAN_IPADDRESS
     IP address SAN.

GNUTLS_SAN_OTHERNAME
     OtherName SAN.

GNUTLS_SAN_DN
     DN SAN.

GNUTLS_SAN_OTHERNAME_XMPP
     Virtual SAN, used by gnutls_x509_crt_get_subject_alt_othername_oid.

GNUTLS_PRIVKEY_X509
     X.509 private key, gnutls_x509_privkey_t .

GNUTLS_PRIVKEY_OPENPGP
     OpenPGP private key, gnutls_openpgp_privkey_t .

GNUTLS_PRIVKEY_PKCS11
     PKCS11 private key, gnutls_pkcs11_privkey_t .

GNUTLS_PRIVKEY_EXT
     External private key, operating using callbacks.

GNUTLS_DT_UNKNOWN
     Unknown data type.

GNUTLS_DT_DNS_HOSTNAME
     The data contain a null-terminated DNS hostname.

GNUTLS_DT_KEY_PURPOSE_OID
     The data contain a null-terminated key purpose OID.

GNUTLS_PIN_USER
     The PIN for the user.

GNUTLS_PIN_SO
     The PIN for the security officer (admin).

GNUTLS_PIN_FINAL_TRY
     This is the final try before blocking.

GNUTLS_PIN_COUNT_LOW
     Few tries remain before token blocks.

GNUTLS_PIN_CONTEXT_SPECIFIC
     The PIN is for a specific action and key like signing.

GNUTLS_PIN_WRONG
     Last given PIN was not correct.

int
---

 -- Function: typedef int (* GNUTLS_PIN_CALLBACK_T)
     GNUTLS_PIN_CALLBACK_T: -- undescribed --

     Callback function type for PKCS11  or TPM PIN entry.  It is set by functions like gnutls_pkcs11_set_pin_function() .

     The callback should provides the PIN code to unlock the token with label  token_label , specified by the URL  token_url .

     The PIN code, as a NUL-terminated ASCII string, should be copied into the  pin buffer (of maximum size  pin_max ), and return 0 to indicate success.  Alternatively, the callback may return a negative gnutls error code to indicate failure and cancel PIN entry (in which case, the contents of the  pin parameter are ignored).

     When a PIN is required, the callback will be invoked repeatedly (and indefinitely) until either the returned PIN code is correct, the callback returns failure, or the token refuses login (e.g. when the token is locked due to too many incorrect PINs!).  For the first such invocation, the  attempt counter will have value zero; it will increase by one for each subsequent attempt.

     Returns: GNUTLS_E_SUCCESS  (0) on success or a negative error code on error.

     Since: 2.12.0

GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED
     Fail if the certificates in the buffer are more than the space allocated for certificates. The error code will be GNUTLS_E_SHORT_MEMORY_BUFFER .

GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED
     Fail if the certificates in the buffer are not ordered starting from subject to issuer. The error code will be GNUTLS_E_CERTIFICATE_LIST_UNSORTED .

GNUTLS_VERIFY_DISABLE_CA_SIGN
     If set a signer does not have to be a certificate authority. This flag should normally be disabled, unless you know what this means.

GNUTLS_VERIFY_DO_NOT_ALLOW_SAME
     If a certificate is not signed by anyone trusted but exists in the trusted CA list do not treat it as trusted.

GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT
     Allow CA certificates that have version 1 (both root and intermediate). This might be dangerous since those haven't the basicConstraints extension.

GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2
     Allow certificates to be signed using the broken MD2 algorithm.

GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5
     Allow certificates to be signed using the broken MD5 algorithm.

GNUTLS_VERIFY_DISABLE_TIME_CHECKS
     Disable checking of activation and expiration validity periods of certificate chains. Don't set this unless you understand the security implications.

GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS
     If set a signer in the trusted list is never checked for expiration or activation.

GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT
     Do not allow trusted CA certificates that have version 1.  This option is to be used to deprecate all certificates of version 1.

GNUTLS_VERIFY_DISABLE_CRL_CHECKS
     Disable checking for validity using certificate revocation lists or the available OCSP data.

GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN
     A certificate chain is tolerated if unsorted (the case with many TLS servers out there). This is the default since GnuTLS 3.1.4.

GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN
     Do not tolerate an unsorted certificate chain.

GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS
     When including a hostname check in the verification, do not consider any wildcards.

GNUTLS_PROFILE_VERY_WEAK
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_VERY_WEAK (64 bits)

GNUTLS_PROFILE_LOW
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_LOW (80 bits)

GNUTLS_PROFILE_LEGACY
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_LEGACY (96 bits)

GNUTLS_PROFILE_MEDIUM
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_MEDIUM (112 bits)

GNUTLS_PROFILE_HIGH
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_HIGH (128 bits)

GNUTLS_PROFILE_ULTRA
     A verification profile that corresponds to  GNUTLS_SEC_PARAM_ULTRA (256 bits)

GNUTLS_PROFILE_SUITEB128
     A verification profile that applies the SUITEB128 rules

GNUTLS_PROFILE_SUITEB192
     A verification profile that applies the SUITEB192 rules

GNUTLS_PKCS_PLAIN
     Unencrypted private key.

GNUTLS_PKCS_USE_PKCS12_3DES
     PKCS-12 3DES.

GNUTLS_PKCS_USE_PKCS12_ARCFOUR
     PKCS-12 ARCFOUR.

GNUTLS_PKCS_USE_PKCS12_RC2_40
     PKCS-12 RC2-40.

GNUTLS_PKCS_USE_PBES2_3DES
     PBES2 3DES.

GNUTLS_PKCS_USE_PBES2_AES_128
     PBES2 AES-128.

GNUTLS_PKCS_USE_PBES2_AES_192
     PBES2 AES-192.

GNUTLS_PKCS_USE_PBES2_AES_256
     PBES2 AES-256.

GNUTLS_PKCS_NULL_PASSWORD
     Some schemas distinguish between an empty and a NULL password.

GNUTLS_OPENPGP_FMT_RAW
     OpenPGP certificate in raw format.

GNUTLS_OPENPGP_FMT_BASE64
     OpenPGP certificate in base64 format.

int
---

 -- Function: typedef int (* GNUTLS_OPENPGP_RECV_KEY_FUNC)
     GNUTLS_OPENPGP_RECV_KEY_FUNC: -- undescribed --

     A callback of this type is used to retrieve OpenPGP keys.  Only useful on the server, and will only be used if the peer send a key fingerprint instead of a full key.  See also gnutls_openpgp_set_recv_key_function() .

     The variable  key must be allocated using gnutls_malloc() .

     Returns: On success, GNUTLS_E_SUCCESS  (zero) is returned, otherwise an error code is returned.

GNUTLS_BAG_EMPTY
     Empty PKCS-12 bag.

GNUTLS_BAG_PKCS8_ENCRYPTED_KEY
     PKCS-12 bag with PKCS-8 encrypted key.

GNUTLS_BAG_PKCS8_KEY
     PKCS-12 bag with PKCS-8 key.

GNUTLS_BAG_CERTIFICATE
     PKCS-12 bag with certificate.

GNUTLS_BAG_CRL
     PKCS-12 bag with CRL.

GNUTLS_BAG_SECRET
     PKCS-12 bag with secret PKCS-9 keys.

GNUTLS_BAG_ENCRYPTED
     Encrypted PKCS-12 bag.

GNUTLS_BAG_UNKNOWN
     Unknown PKCS-12 bag.

int
---

 -- Function: typedef int (* GNUTLS_PKCS11_TOKEN_CALLBACK_T)
     GNUTLS_PKCS11_TOKEN_CALLBACK_T: -- undescribed --

     Token callback function. The callback will be used to ask the user to re-insert the token with given (null terminated) label.  The callback should return zero if token has been inserted by user and a negative error code otherwise.  It might be called multiple times if the token is not detected and the retry counter will be increased.

     Returns: GNUTLS_E_SUCCESS  (0) on success or a negative error code on error.

     Since: 2.12.0

GNUTLS_PKCS11_URL_GENERIC
     A generic-purpose URL.

GNUTLS_PKCS11_URL_LIB
     A URL that specifies the library used as well.

GNUTLS_PKCS11_URL_LIB_VERSION
     A URL that specifies the library and its version.

GNUTLS_PKCS11_OBJ_ID_HEX
     The object ID in hex.

GNUTLS_PKCS11_OBJ_LABEL
     The object label.

GNUTLS_PKCS11_OBJ_TOKEN_LABEL
     The token's label.

GNUTLS_PKCS11_OBJ_TOKEN_SERIAL
     The token's serial number.

GNUTLS_PKCS11_OBJ_TOKEN_MANUFACTURER
     The token's manufacturer.

GNUTLS_PKCS11_OBJ_TOKEN_MODEL
     The token's model.

GNUTLS_PKCS11_OBJ_ID
     The object ID.

GNUTLS_PKCS11_OBJ_LIBRARY_VERSION
     The library's used to access the object version.

GNUTLS_PKCS11_OBJ_LIBRARY_DESCRIPTION
     The library's used to access the object description (name).

GNUTLS_PKCS11_OBJ_LIBRARY_MANUFACTURER
     The library's used to access the object manufacturer name.

GNUTLS_PKCS11_OBJ_ATTR_CRT_ALL
     Specify all certificates.

GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED
     Specify all certificates marked as trusted.

GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY
     Specify all certificates with a corresponding private key.

GNUTLS_PKCS11_OBJ_ATTR_PUBKEY
     Specify all public keys.

GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY
     Specify all private keys.

GNUTLS_PKCS11_OBJ_ATTR_ALL
     Specify all objects.

GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED_CA
     Specify all certificates marked as trusted and are CAs.

GNUTLS_PKCS11_TOKEN_LABEL
     The token's label (string)

GNUTLS_PKCS11_TOKEN_SERIAL
     The token's serial number (string)

GNUTLS_PKCS11_TOKEN_MANUFACTURER
     The token's manufacturer (string)

GNUTLS_PKCS11_TOKEN_MODEL
     The token's model (string)

GNUTLS_PKCS11_OBJ_UNKNOWN
     Unknown PKCS11 object.

GNUTLS_PKCS11_OBJ_X509_CRT
     X.509 certificate.

GNUTLS_PKCS11_OBJ_PUBKEY
     Public key.

GNUTLS_PKCS11_OBJ_PRIVKEY
     Private key.

GNUTLS_PKCS11_OBJ_SECRET_KEY
     Secret key.

GNUTLS_PKCS11_OBJ_DATA
     Data object.

GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA
     This indicates that a (raw) RSA signature is provided as in the TLS 1.0 protocol.

GNUTLS_PUBKEY_DISABLE_CALLBACKS
     The following flag disables call to PIN callbacks. Only relevant to TPM keys.

GNUTLS_PUBKEY_GET_OPENPGP_FINGERPRINT
     request an OPENPGP fingerprint instead of the default.

GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE
     When importing a private key, automatically release it when the structure it was imported is released.

GNUTLS_PRIVKEY_IMPORT_COPY
     Copy required values during import.

GNUTLS_PRIVKEY_DISABLE_CALLBACKS
     The following flag disables call to PIN callbacks etc. Only relevant to TPM keys.

GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA
     Make an RSA signature on the hashed data as in the TLS protocol.

GNUTLS_RND_NONCE
     Non-predictable random number.  Fatal in parts of session if broken, i.e., vulnerable to statistical analysis.

GNUTLS_RND_RANDOM
     Pseudo-random cryptographic random number. Fatal in session if broken.

GNUTLS_RND_KEY
     Fatal in many sessions if broken.

GNUTLS_OCSP_PRINT_FULL
     Full information about OCSP request/response.

GNUTLS_OCSP_PRINT_COMPACT
     More compact information about OCSP request/response.

GNUTLS_OCSP_RESP_SUCCESSFUL
     Response has valid confirmations.

GNUTLS_OCSP_RESP_MALFORMEDREQUEST
     Illegal confirmation request

GNUTLS_OCSP_RESP_INTERNALERROR
     Internal error in issuer

GNUTLS_OCSP_RESP_TRYLATER
     Try again later

GNUTLS_OCSP_RESP_SIGREQUIRED
     Must sign the request

GNUTLS_OCSP_RESP_UNAUTHORIZED
     Request unauthorized

GNUTLS_OCSP_CERT_GOOD
     Positive response to status inquiry.

GNUTLS_OCSP_CERT_REVOKED
     Certificate has been revoked.

GNUTLS_OCSP_CERT_UNKNOWN
     The responder doesn't know about the certificate.

GNUTLS_X509_CRLREASON_UNSPECIFIED
     Unspecified reason.

GNUTLS_X509_CRLREASON_KEYCOMPROMISE
     Private key compromised.

GNUTLS_X509_CRLREASON_CACOMPROMISE
     CA compromised.

GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED
     Affiliation has changed.

GNUTLS_X509_CRLREASON_SUPERSEDED
     Certificate superseded.

GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION
     Operation has ceased.

GNUTLS_X509_CRLREASON_CERTIFICATEHOLD
     Certificate is on hold.

GNUTLS_X509_CRLREASON_REMOVEFROMCRL
     Will be removed from delta CRL.

GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN
     Privilege withdrawn.

GNUTLS_X509_CRLREASON_AACOMPROMISE
     AA compromised.

GNUTLS_OCSP_VERIFY_SIGNER_NOT_FOUND
     Signer cert not found.

GNUTLS_OCSP_VERIFY_SIGNER_KEYUSAGE_ERROR
     Signer keyusage bits incorrect.

GNUTLS_OCSP_VERIFY_UNTRUSTED_SIGNER
     Signer is not trusted.

GNUTLS_OCSP_VERIFY_INSECURE_ALGORITHM
     Signature using insecure algorithm.

GNUTLS_OCSP_VERIFY_SIGNATURE_FAILURE
     Signature mismatch.

GNUTLS_OCSP_VERIFY_CERT_NOT_ACTIVATED
     Signer cert is not yet activated.

GNUTLS_OCSP_VERIFY_CERT_EXPIRED
     Signer cert has expired.

GNUTLS_TPMKEY_FMT_RAW
     The portable data format.

GNUTLS_TPMKEY_FMT_DER
     An alias for the raw format.

GNUTLS_TPMKEY_FMT_CTK_PEM
     A custom data format used by some TPM tools.

DANE_CERT_USAGE_CA
     CA constraint. The certificate/key presented must have signed the verified key.

DANE_CERT_USAGE_EE
     The key or the certificate of the end entity.

DANE_CERT_USAGE_LOCAL_CA
     The remote CA is local and possibly untrusted by the verifier.

DANE_CERT_USAGE_LOCAL_EE
     The remote end-entity key is local and possibly untrusted by the verifier (not signed by a CA).

DANE_CERT_X509
     An X.509 certificate.

DANE_CERT_PK
     A public key.

DANE_MATCH_EXACT
     The full content.

DANE_MATCH_SHA2_256
     A SHA-256 hash of the content.

DANE_MATCH_SHA2_512
     A SHA-512 hash of the content.

DANE_QUERY_UNKNOWN
     There was no query.

DANE_QUERY_DNSSEC_VERIFIED
     The query was verified using DNSSEC.

DANE_QUERY_BOGUS
     The query has wrong DNSSEC signature.

DANE_QUERY_NO_DNSSEC
     The query has no DNSSEC data.

DANE_F_IGNORE_LOCAL_RESOLVER
     Many systems are not DNSSEC-ready. In that case the local resolver is ignored, and a direct recursive resolve occurs.

DANE_F_INSECURE
     Ignore any DNSSEC signature verification errors.

DANE_F_IGNORE_DNSSEC
     Do not try to initialize DNSSEC as we will not use it (will then not try to load the DNSSEC root certificate).  Useful if the TLSA data does not come from DNS.

DANE_VFLAG_FAIL_IF_NOT_CHECKED
     If irrelevant to this certificate DANE entries are received fail instead of succeeding.

DANE_VFLAG_ONLY_CHECK_EE_USAGE
     The provided certificates will be verified only against any EE field. Combine with DANE_VFLAG_FAIL_IF_NOT_CHECKED  to fail if EE entries are not present.

DANE_VFLAG_ONLY_CHECK_CA_USAGE
     The provided certificates will be verified only against any CA field. Combine with DANE_VFLAG_FAIL_IF_NOT_CHECKED  to fail if CA entries are not present.

DANE_VERIFY_CA_CONSTRAINTS_VIOLATED
     The CA constraints were violated.

DANE_VERIFY_CERT_DIFFERS
     The certificate obtained via DNS differs.

DANE_VERIFY_UNKNOWN_DANE_INFO
     No known DANE data was found in the DNS record.