user_settings.h.example

/*
 * Copyright (C) 2026 wolfSSL Inc.
 *
 * This file is part of wolfCert.
 *
 * wolfCert is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * wolfCert is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with wolfCert.  If not, see <http://www.gnu.org/licenses/>.
 */

/*
 * examples/user_settings.h.example - TEMPLATE.
 *
 * Copy this file to "user_settings.h" somewhere on your include path, edit it,
 * and build wolfCert (and your application) with -DWOLFCERT_USER_SETTINGS.
 * wolfcert/types.h then takes wolfCert's feature configuration from here
 * instead of the build-generated wolfcert/options.h - the header-only analogue
 * of running CMake/autoconf, intended for embedded/MCU toolchains that drive
 * their own build. wolfcert/check_config.h validates the result at compile
 * time, so a contradictory or incomplete config fails with a clear #error.
 *
 * This template carries wolfCert's half of the config only. The
 * "user_settings.h" name is shared with wolfSSL's own WOLFSSL_USER_SETTINGS
 * header on purpose, and the macro namespaces are disjoint (wolfCert reads only
 * WOLFCERT_HAVE_*; wolfSSL reads HAVE_* / NO_* / WOLFSSL_*), so one file can
 * carry both. Building wolfSSL that way means adding its macros here too - the
 * flag list at the end of this comment names them. Keep only one file by this
 * name on your include path: both wolfSSL and wolfCert include it unqualified,
 * so the first one found serves both. See docs/EMBEDDED.md.
 *
 * RULES
 *   - To ENABLE a feature, leave its #define uncommented.
 *   - To DISABLE a feature, COMMENT THE LINE OUT. Do NOT write
 *     "#define WOLFCERT_HAVE_X 0" - the code tests presence with #ifdef, so a
 *     value of 0 still counts as enabled.
 *   - At least one key algorithm must be enabled.
 *   - SCEP is RSA-only (RFC 8894): enabling WOLFCERT_HAVE_SCEP requires
 *     WOLFCERT_HAVE_RSA, and a wolfSSL with AES-128-CBC encrypt and decrypt
 *     (no NO_AES_128, NO_AES_CBC or NO_AES_DECRYPT).
 *
 * The enabled set must also be backed by the wolfSSL you link against. wolfCert
 * requires a wolfSSL (>= 5.9.4) built with at least:
 *   --enable-pkcs7 --enable-certgen --enable-certreq --enable-certext
 *   --enable-keygen --enable-cryptocb --enable-base64encode
 *   CPPFLAGS="-DWOLFSSL_ALT_NAMES -DWOLFSSL_CERT_NAME_ALL -DWOLFSSL_PUBLIC_ASN"
 * plus AES + SHA-256 (default on) and TLS 1.2 and/or TLS 1.3, and the matching
 * algorithm flags for the key types you enable below (--enable-ecc,
 * --enable-ed25519, --enable-ed448, --enable-mldsa; RSA is default on).
 */

#ifndef WOLFCERT_USER_SETTINGS_H
#define WOLFCERT_USER_SETTINGS_H

/* ---- Protocols ---- */
#define WOLFCERT_HAVE_EST    1   /* EST  (RFC 7030) */
#define WOLFCERT_HAVE_SCEP   1   /* SCEP (RFC 8894) - requires WOLFCERT_HAVE_RSA */
#define WOLFCERT_HAVE_SERVER 1   /* built-in EST/SCEP test server */

/* ---- Platform ---- */
/* One of each HAVE/NO pair is mandatory: define the WOLFCERT_NO_* form to
 * compile the backend out and supply your own transport / store ops. */
#define WOLFCERT_HAVE_POSIX_STORE 1
#define WOLFCERT_HAVE_BUILTIN_TRANSPORT 1

/* ---- Key algorithms (enable at least one) ---- */
#define WOLFCERT_HAVE_RSA     1
#define WOLFCERT_HAVE_ECC     1
#define WOLFCERT_HAVE_ED25519 1
#define WOLFCERT_HAVE_ED448   1
#define WOLFCERT_HAVE_MLDSA   1

#endif /* WOLFCERT_USER_SETTINGS_H */