// This file was generated by gir (https://github.com/gtk-rs/gir)
// from gir-files (https://github.com/gtk-rs/gir-files)
// DO NOT EDIT

#[cfg(any(feature = "v2_70", feature = "dox"))]
#[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
use crate::InetAddress;
use crate::{SocketConnectable, TlsCertificateFlags};
#[cfg(any(feature = "v2_70", feature = "dox"))]
#[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
use glib::signal::{connect_raw, SignalHandlerId};
use glib::{prelude::*, translate::*};
#[cfg(any(feature = "v2_70", feature = "dox"))]
#[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
use std::{boxed::Box as Box_, mem::transmute};
use std::{fmt, ptr};

glib::wrapper! {
    /// A certificate used for TLS authentication and encryption.
    /// This can represent either a certificate only (eg, the certificate
    /// received by a client from a server), or the combination of
    /// a certificate and a private key (which is needed when acting as a
    /// [`TlsServerConnection`][crate::TlsServerConnection]).
    ///
    /// This is an Abstract Base Class, you cannot instantiate it.
    ///
    /// ## Properties
    ///
    ///
    /// #### `certificate`
    ///  The DER (binary) encoded representation of the certificate.
    /// This property and the [`certificate-pem`][struct@crate::TlsCertificate#certificate-pem] property
    /// represent the same data, just in different forms.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `certificate-pem`
    ///  The PEM (ASCII) encoded representation of the certificate.
    /// This property and the [`certificate`][struct@crate::TlsCertificate#certificate]
    /// property represent the same data, just in different forms.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `dns-names`
    ///  The DNS names from the certificate's Subject Alternative Names (SANs),
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    ///
    /// #### `ip-addresses`
    ///  The IP addresses from the certificate's Subject Alternative Names (SANs),
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    ///
    /// #### `issuer`
    ///  A [`TlsCertificate`][crate::TlsCertificate] representing the entity that issued this
    /// certificate. If [`None`], this means that the certificate is either
    /// self-signed, or else the certificate of the issuer is not
    /// available.
    ///
    /// Beware the issuer certificate may not be the same as the
    /// certificate that would actually be used to construct a valid
    /// certification path during certificate verification.
    /// [RFC 4158](https://datatracker.ietf.org/doc/html/rfc4158) explains
    /// why an issuer certificate cannot be naively assumed to be part of the
    /// the certification path (though GLib's TLS backends may not follow the
    /// path building strategies outlined in this RFC). Due to the complexity
    /// of certification path building, GLib does not provide any way to know
    /// which certification path will actually be used. Accordingly, this
    /// property cannot be used to make security-related decisions. Only
    /// GLib itself should make security decisions about TLS certificates.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `issuer-name`
    ///  The issuer from the certificate,
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    ///
    /// #### `not-valid-after`
    ///  The time at which this cert is no longer valid,
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    ///
    /// #### `not-valid-before`
    ///  The time at which this cert is considered to be valid,
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    ///
    /// #### `password`
    ///  An optional password used when constructed with GTlsCertificate:pkcs12-data.
    ///
    /// Writeable | Construct Only
    ///
    ///
    /// #### `pkcs11-uri`
    ///  A URI referencing the [PKCS \`11`](https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html)
    /// objects containing an X.509 certificate and optionally a private key.
    ///
    /// If [`None`], the certificate is either not backed by PKCS \`11` or the
    /// [`TlsBackend`][crate::TlsBackend] does not support PKCS \`11`.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `pkcs12-data`
    ///  The PKCS `12` formatted data used to construct the object.
    ///
    /// See also: [`TlsCertificate::from_pkcs12()`][crate::TlsCertificate::from_pkcs12()]
    ///
    /// Writeable | Construct Only
    ///
    ///
    /// #### `private-key`
    ///  The DER (binary) encoded representation of the certificate's
    /// private key, in either [PKCS \`1` format](https://datatracker.ietf.org/doc/html/rfc8017)
    /// or unencrypted [PKCS \`8` format.](https://datatracker.ietf.org/doc/html/rfc5208)
    /// PKCS \`8` format is supported since 2.32; earlier releases only
    /// support PKCS \`1`. You can use the `openssl rsa` tool to convert
    /// PKCS \`8` keys to PKCS \`1`.
    ///
    /// This property (or the [`private-key-pem`][struct@crate::TlsCertificate#private-key-pem] property)
    /// can be set when constructing a key (for example, from a file).
    /// Since GLib 2.70, it is now also readable; however, be aware that if
    /// the private key is backed by a PKCS \`11` URI – for example, if it
    /// is stored on a smartcard – then this property will be [`None`]. If so,
    /// the private key must be referenced via its PKCS \`11` URI,
    /// [`private-key-pkcs11-uri`][struct@crate::TlsCertificate#private-key-pkcs11-uri]. You must check both
    /// properties to see if the certificate really has a private key.
    /// When this property is read, the output format will be unencrypted
    /// PKCS \`8`.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `private-key-pem`
    ///  The PEM (ASCII) encoded representation of the certificate's
    /// private key in either [PKCS \`1` format](https://datatracker.ietf.org/doc/html/rfc8017)
    /// ("`BEGIN RSA PRIVATE KEY`") or unencrypted
    /// [PKCS \`8` format](https://datatracker.ietf.org/doc/html/rfc5208)
    /// ("`BEGIN PRIVATE KEY`"). PKCS \`8` format is supported since 2.32;
    /// earlier releases only support PKCS \`1`. You can use the `openssl rsa`
    /// tool to convert PKCS \`8` keys to PKCS \`1`.
    ///
    /// This property (or the [`private-key`][struct@crate::TlsCertificate#private-key] property)
    /// can be set when constructing a key (for example, from a file).
    /// Since GLib 2.70, it is now also readable; however, be aware that if
    /// the private key is backed by a PKCS \`11` URI - for example, if it
    /// is stored on a smartcard - then this property will be [`None`]. If so,
    /// the private key must be referenced via its PKCS \`11` URI,
    /// [`private-key-pkcs11-uri`][struct@crate::TlsCertificate#private-key-pkcs11-uri]. You must check both
    /// properties to see if the certificate really has a private key.
    /// When this property is read, the output format will be unencrypted
    /// PKCS \`8`.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `private-key-pkcs11-uri`
    ///  A URI referencing a [PKCS \`11`](https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html)
    /// object containing a private key.
    ///
    /// Readable | Writeable | Construct Only
    ///
    ///
    /// #### `subject-name`
    ///  The subject from the cert,
    /// [`None`] if unavailable.
    ///
    /// Readable
    ///
    /// # Implements
    ///
    /// [`TlsCertificateExt`][trait@crate::prelude::TlsCertificateExt], [`trait@glib::ObjectExt`]
    #[doc(alias = "GTlsCertificate")]
    pub struct TlsCertificate(Object<ffi::GTlsCertificate, ffi::GTlsCertificateClass>);

    match fn {
        type_ => || ffi::g_tls_certificate_get_type(),
    }
}

impl TlsCertificate {
    pub const NONE: Option<&'static TlsCertificate> = None;

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from the data in `file`.
    ///
    /// As of 2.72, if the filename ends in `.p12` or `.pfx` the data is loaded by
    /// [`from_pkcs12()`][Self::from_pkcs12()] otherwise it is loaded by
    /// [`from_pem()`][Self::from_pem()]. See those functions for
    /// exact details.
    ///
    /// If `file` cannot be read or parsed, the function will return [`None`] and
    /// set `error`.
    /// ## `file`
    /// file containing a certificate to import
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] on error
    #[doc(alias = "g_tls_certificate_new_from_file")]
    #[doc(alias = "new_from_file")]
    pub fn from_file(file: impl AsRef<std::path::Path>) -> Result<TlsCertificate, glib::Error> {
        unsafe {
            let mut error = ptr::null_mut();
            let ret =
                ffi::g_tls_certificate_new_from_file(file.as_ref().to_glib_none().0, &mut error);
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from the data in `file`.
    ///
    /// If `file` cannot be read or parsed, the function will return [`None`] and
    /// set `error`.
    ///
    /// Any unknown file types will error with [`IOErrorEnum::NotSupported`][crate::IOErrorEnum::NotSupported].
    /// Currently only `.p12` and `.pfx` files are supported.
    /// See [`from_pkcs12()`][Self::from_pkcs12()] for more details.
    /// ## `file`
    /// file containing a certificate to import
    /// ## `password`
    /// password for PKCS `12` files
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] on error
    #[cfg(any(feature = "v2_72", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_72")))]
    #[doc(alias = "g_tls_certificate_new_from_file_with_password")]
    #[doc(alias = "new_from_file_with_password")]
    pub fn from_file_with_password(
        file: impl AsRef<std::path::Path>,
        password: &str,
    ) -> Result<TlsCertificate, glib::Error> {
        unsafe {
            let mut error = ptr::null_mut();
            let ret = ffi::g_tls_certificate_new_from_file_with_password(
                file.as_ref().to_glib_none().0,
                password.to_glib_none().0,
                &mut error,
            );
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from the PEM-encoded data in `cert_file`
    /// and `key_file`. The returned certificate will be the first certificate
    /// found in `cert_file`. As of GLib 2.44, if `cert_file` contains more
    /// certificates it will try to load a certificate chain. All
    /// certificates will be verified in the order found (top-level
    /// certificate should be the last one in the file) and the
    /// [`issuer`][struct@crate::TlsCertificate#issuer] property of each certificate will be set
    /// accordingly if the verification succeeds. If any certificate in the
    /// chain cannot be verified, the first certificate in the file will
    /// still be returned.
    ///
    /// If either file cannot be read or parsed, the function will return
    /// [`None`] and set `error`. Otherwise, this behaves like
    /// [`from_pem()`][Self::from_pem()].
    /// ## `cert_file`
    /// file containing one or more PEM-encoded
    ///  certificates to import
    /// ## `key_file`
    /// file containing a PEM-encoded private key
    ///  to import
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] on error
    #[doc(alias = "g_tls_certificate_new_from_files")]
    #[doc(alias = "new_from_files")]
    pub fn from_files(
        cert_file: impl AsRef<std::path::Path>,
        key_file: impl AsRef<std::path::Path>,
    ) -> Result<TlsCertificate, glib::Error> {
        unsafe {
            let mut error = ptr::null_mut();
            let ret = ffi::g_tls_certificate_new_from_files(
                cert_file.as_ref().to_glib_none().0,
                key_file.as_ref().to_glib_none().0,
                &mut error,
            );
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from the PEM-encoded data in `data`. If
    /// `data` includes both a certificate and a private key, then the
    /// returned certificate will include the private key data as well. (See
    /// the [`private-key-pem`][struct@crate::TlsCertificate#private-key-pem] property for information about
    /// supported formats.)
    ///
    /// The returned certificate will be the first certificate found in
    /// `data`. As of GLib 2.44, if `data` contains more certificates it will
    /// try to load a certificate chain. All certificates will be verified in
    /// the order found (top-level certificate should be the last one in the
    /// file) and the [`issuer`][struct@crate::TlsCertificate#issuer] property of each certificate
    /// will be set accordingly if the verification succeeds. If any
    /// certificate in the chain cannot be verified, the first certificate in
    /// the file will still be returned.
    /// ## `data`
    /// PEM-encoded certificate data
    /// ## `length`
    /// the length of `data`, or -1 if it's 0-terminated.
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] if `data` is invalid
    #[doc(alias = "g_tls_certificate_new_from_pem")]
    #[doc(alias = "new_from_pem")]
    pub fn from_pem(data: &str) -> Result<TlsCertificate, glib::Error> {
        let length = data.len() as _;
        unsafe {
            let mut error = ptr::null_mut();
            let ret =
                ffi::g_tls_certificate_new_from_pem(data.to_glib_none().0, length, &mut error);
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from a
    /// [PKCS \`11`](https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html) URI.
    ///
    /// An example `pkcs11_uri` would be `pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My`20Client``20Certificate`;id=`01``
    ///
    /// Where the token’s layout is:
    ///
    ///
    /// ```text
    /// Object 0:
    ///   URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=private%20key;type=private
    ///   Type: Private key (RSA-2048)
    ///   ID: 01
    ///
    /// Object 1:
    ///   URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=Certificate%20for%20Authentication;type=cert
    ///   Type: X.509 Certificate (RSA-2048)
    ///   ID: 01
    /// ```
    ///
    /// In this case the certificate and private key would both be detected and used as expected.
    /// `pkcs_uri` may also just reference an X.509 certificate object and then optionally
    /// `private_key_pkcs11_uri` allows using a private key exposed under a different URI.
    ///
    /// Note that the private key is not accessed until usage and may fail or require a PIN later.
    /// ## `pkcs11_uri`
    /// A PKCS \`11` URI
    /// ## `private_key_pkcs11_uri`
    /// A PKCS \`11` URI
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] on error
    #[cfg(any(feature = "v2_68", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_68")))]
    #[doc(alias = "g_tls_certificate_new_from_pkcs11_uris")]
    #[doc(alias = "new_from_pkcs11_uris")]
    pub fn from_pkcs11_uris(
        pkcs11_uri: &str,
        private_key_pkcs11_uri: Option<&str>,
    ) -> Result<TlsCertificate, glib::Error> {
        unsafe {
            let mut error = ptr::null_mut();
            let ret = ffi::g_tls_certificate_new_from_pkcs11_uris(
                pkcs11_uri.to_glib_none().0,
                private_key_pkcs11_uri.to_glib_none().0,
                &mut error,
            );
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates a [`TlsCertificate`][crate::TlsCertificate] from the data in `data`. It must contain
    /// a certificate and matching private key.
    ///
    /// If extra certificates are included they will be verified as a chain
    /// and the [`issuer`][struct@crate::TlsCertificate#issuer] property will be set.
    /// All other data will be ignored.
    ///
    /// You can pass as single password for all of the data which will be
    /// used both for the PKCS `12` container as well as encrypted
    /// private keys. If decryption fails it will error with
    /// [`TlsError::BadCertificatePassword`][crate::TlsError::BadCertificatePassword].
    ///
    /// This constructor requires support in the current [`TlsBackend`][crate::TlsBackend].
    /// If support is missing it will error with
    /// [`IOErrorEnum::NotSupported`][crate::IOErrorEnum::NotSupported].
    ///
    /// Other parsing failures will error with [`TlsError::BadCertificate`][crate::TlsError::BadCertificate].
    /// ## `data`
    /// DER-encoded PKCS `12` format certificate data
    /// ## `password`
    /// optional password for encrypted certificate data
    ///
    /// # Returns
    ///
    /// the new certificate, or [`None`] if `data` is invalid
    #[cfg(any(feature = "v2_72", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_72")))]
    #[doc(alias = "g_tls_certificate_new_from_pkcs12")]
    #[doc(alias = "new_from_pkcs12")]
    pub fn from_pkcs12(data: &[u8], password: Option<&str>) -> Result<TlsCertificate, glib::Error> {
        let length = data.len() as _;
        unsafe {
            let mut error = ptr::null_mut();
            let ret = ffi::g_tls_certificate_new_from_pkcs12(
                data.to_glib_none().0,
                length,
                password.to_glib_none().0,
                &mut error,
            );
            if error.is_null() {
                Ok(from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }

    /// Creates one or more `GTlsCertificates` from the PEM-encoded
    /// data in `file`. If `file` cannot be read or parsed, the function will
    /// return [`None`] and set `error`. If `file` does not contain any
    /// PEM-encoded certificates, this will return an empty list and not
    /// set `error`.
    /// ## `file`
    /// file containing PEM-encoded certificates to import
    ///
    /// # Returns
    ///
    /// a
    /// `GList` containing [`TlsCertificate`][crate::TlsCertificate] objects. You must free the list
    /// and its contents when you are done with it.
    #[doc(alias = "g_tls_certificate_list_new_from_file")]
    pub fn list_new_from_file(
        file: impl AsRef<std::path::Path>,
    ) -> Result<Vec<TlsCertificate>, glib::Error> {
        unsafe {
            let mut error = ptr::null_mut();
            let ret = ffi::g_tls_certificate_list_new_from_file(
                file.as_ref().to_glib_none().0,
                &mut error,
            );
            if error.is_null() {
                Ok(FromGlibPtrContainer::from_glib_full(ret))
            } else {
                Err(from_glib_full(error))
            }
        }
    }
}

/// Trait containing all [`struct@TlsCertificate`] methods.
///
/// # Implementors
///
/// [`TlsCertificate`][struct@crate::TlsCertificate]
pub trait TlsCertificateExt: 'static {
    /// Gets the value of [`dns-names`][struct@crate::TlsCertificate#dns-names].
    ///
    /// # Returns
    ///
    /// A `GPtrArray` of
    /// [`glib::Bytes`][crate::glib::Bytes] elements, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_dns_names")]
    #[doc(alias = "get_dns_names")]
    fn dns_names(&self) -> Vec<glib::Bytes>;

    /// Gets the value of [`ip-addresses`][struct@crate::TlsCertificate#ip-addresses].
    ///
    /// # Returns
    ///
    /// A `GPtrArray`
    /// of [`InetAddress`][crate::InetAddress] elements, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_ip_addresses")]
    #[doc(alias = "get_ip_addresses")]
    fn ip_addresses(&self) -> Vec<InetAddress>;

    /// Gets the [`TlsCertificate`][crate::TlsCertificate] representing `self`'s issuer, if known
    ///
    /// # Returns
    ///
    /// The certificate of `self`'s issuer,
    /// or [`None`] if `self` is self-signed or signed with an unknown
    /// certificate.
    #[doc(alias = "g_tls_certificate_get_issuer")]
    #[doc(alias = "get_issuer")]
    #[must_use]
    fn issuer(&self) -> Option<TlsCertificate>;

    /// Returns the issuer name from the certificate.
    ///
    /// # Returns
    ///
    /// The issuer name, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_issuer_name")]
    #[doc(alias = "get_issuer_name")]
    fn issuer_name(&self) -> Option<glib::GString>;

    /// Returns the time at which the certificate became or will become invalid.
    ///
    /// # Returns
    ///
    /// The not-valid-after date, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_not_valid_after")]
    #[doc(alias = "get_not_valid_after")]
    fn not_valid_after(&self) -> Option<glib::DateTime>;

    /// Returns the time at which the certificate became or will become valid.
    ///
    /// # Returns
    ///
    /// The not-valid-before date, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_not_valid_before")]
    #[doc(alias = "get_not_valid_before")]
    fn not_valid_before(&self) -> Option<glib::DateTime>;

    /// Returns the subject name from the certificate.
    ///
    /// # Returns
    ///
    /// The subject name, or [`None`] if it's not available.
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "g_tls_certificate_get_subject_name")]
    #[doc(alias = "get_subject_name")]
    fn subject_name(&self) -> Option<glib::GString>;

    /// Check if two [`TlsCertificate`][crate::TlsCertificate] objects represent the same certificate.
    /// The raw DER byte data of the two certificates are checked for equality.
    /// This has the effect that two certificates may compare equal even if
    /// their [`issuer`][struct@crate::TlsCertificate#issuer], [`private-key`][struct@crate::TlsCertificate#private-key], or
    /// [`private-key-pem`][struct@crate::TlsCertificate#private-key-pem] properties differ.
    /// ## `cert_two`
    /// second certificate to compare
    ///
    /// # Returns
    ///
    /// whether the same or not
    #[doc(alias = "g_tls_certificate_is_same")]
    fn is_same(&self, cert_two: &impl IsA<TlsCertificate>) -> bool;

    /// This verifies `self` and returns a set of [`TlsCertificateFlags`][crate::TlsCertificateFlags]
    /// indicating any problems found with it. This can be used to verify a
    /// certificate outside the context of making a connection, or to
    /// check a certificate against a CA that is not part of the system
    /// CA database.
    ///
    /// If `self` is valid, `G_TLS_CERTIFICATE_NO_FLAGS` is returned.
    ///
    /// If `identity` is not [`None`], `self`'s name(s) will be compared against
    /// it, and [`TlsCertificateFlags::BAD_IDENTITY`][crate::TlsCertificateFlags::BAD_IDENTITY] will be set in the return
    /// value if it does not match. If `identity` is [`None`], that bit will
    /// never be set in the return value.
    ///
    /// If `trusted_ca` is not [`None`], then `self` (or one of the certificates
    /// in its chain) must be signed by it, or else
    /// [`TlsCertificateFlags::UNKNOWN_CA`][crate::TlsCertificateFlags::UNKNOWN_CA] will be set in the return value. If
    /// `trusted_ca` is [`None`], that bit will never be set in the return
    /// value.
    ///
    /// GLib guarantees that if certificate verification fails, at least one
    /// error will be set in the return value, but it does not guarantee
    /// that all possible errors will be set. Accordingly, you may not safely
    /// decide to ignore any particular type of error. For example, it would
    /// be incorrect to mask [`TlsCertificateFlags::EXPIRED`][crate::TlsCertificateFlags::EXPIRED] if you want to allow
    /// expired certificates, because this could potentially be the only
    /// error flag set even if other problems exist with the certificate.
    ///
    /// Because TLS session context is not used, [`TlsCertificate`][crate::TlsCertificate] may not
    /// perform as many checks on the certificates as [`TlsConnection`][crate::TlsConnection] would.
    /// For example, certificate constraints may not be honored, and
    /// revocation checks may not be performed. The best way to verify TLS
    /// certificates used by a TLS connection is to let [`TlsConnection`][crate::TlsConnection]
    /// handle the verification.
    /// ## `identity`
    /// the expected peer identity
    /// ## `trusted_ca`
    /// the certificate of a trusted authority
    ///
    /// # Returns
    ///
    /// the appropriate [`TlsCertificateFlags`][crate::TlsCertificateFlags]
    #[doc(alias = "g_tls_certificate_verify")]
    fn verify(
        &self,
        identity: Option<&impl IsA<SocketConnectable>>,
        trusted_ca: Option<&impl IsA<TlsCertificate>>,
    ) -> TlsCertificateFlags;

    /// The DER (binary) encoded representation of the certificate.
    /// This property and the [`certificate-pem`][struct@crate::TlsCertificate#certificate-pem] property
    /// represent the same data, just in different forms.
    fn certificate(&self) -> Option<glib::ByteArray>;

    /// The PEM (ASCII) encoded representation of the certificate.
    /// This property and the [`certificate`][struct@crate::TlsCertificate#certificate]
    /// property represent the same data, just in different forms.
    #[doc(alias = "certificate-pem")]
    fn certificate_pem(&self) -> Option<glib::GString>;

    /// A URI referencing the [PKCS \`11`](https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html)
    /// objects containing an X.509 certificate and optionally a private key.
    ///
    /// If [`None`], the certificate is either not backed by PKCS \`11` or the
    /// [`TlsBackend`][crate::TlsBackend] does not support PKCS \`11`.
    #[cfg(any(feature = "v2_68", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_68")))]
    #[doc(alias = "pkcs11-uri")]
    fn pkcs11_uri(&self) -> Option<glib::GString>;

    /// The DER (binary) encoded representation of the certificate's
    /// private key, in either [PKCS \`1` format](https://datatracker.ietf.org/doc/html/rfc8017)
    /// or unencrypted [PKCS \`8` format.](https://datatracker.ietf.org/doc/html/rfc5208)
    /// PKCS \`8` format is supported since 2.32; earlier releases only
    /// support PKCS \`1`. You can use the `openssl rsa` tool to convert
    /// PKCS \`8` keys to PKCS \`1`.
    ///
    /// This property (or the [`private-key-pem`][struct@crate::TlsCertificate#private-key-pem] property)
    /// can be set when constructing a key (for example, from a file).
    /// Since GLib 2.70, it is now also readable; however, be aware that if
    /// the private key is backed by a PKCS \`11` URI – for example, if it
    /// is stored on a smartcard – then this property will be [`None`]. If so,
    /// the private key must be referenced via its PKCS \`11` URI,
    /// [`private-key-pkcs11-uri`][struct@crate::TlsCertificate#private-key-pkcs11-uri]. You must check both
    /// properties to see if the certificate really has a private key.
    /// When this property is read, the output format will be unencrypted
    /// PKCS \`8`.
    #[doc(alias = "private-key")]
    fn private_key(&self) -> Option<glib::ByteArray>;

    /// The PEM (ASCII) encoded representation of the certificate's
    /// private key in either [PKCS \`1` format](https://datatracker.ietf.org/doc/html/rfc8017)
    /// ("`BEGIN RSA PRIVATE KEY`") or unencrypted
    /// [PKCS \`8` format](https://datatracker.ietf.org/doc/html/rfc5208)
    /// ("`BEGIN PRIVATE KEY`"). PKCS \`8` format is supported since 2.32;
    /// earlier releases only support PKCS \`1`. You can use the `openssl rsa`
    /// tool to convert PKCS \`8` keys to PKCS \`1`.
    ///
    /// This property (or the [`private-key`][struct@crate::TlsCertificate#private-key] property)
    /// can be set when constructing a key (for example, from a file).
    /// Since GLib 2.70, it is now also readable; however, be aware that if
    /// the private key is backed by a PKCS \`11` URI - for example, if it
    /// is stored on a smartcard - then this property will be [`None`]. If so,
    /// the private key must be referenced via its PKCS \`11` URI,
    /// [`private-key-pkcs11-uri`][struct@crate::TlsCertificate#private-key-pkcs11-uri]. You must check both
    /// properties to see if the certificate really has a private key.
    /// When this property is read, the output format will be unencrypted
    /// PKCS \`8`.
    #[doc(alias = "private-key-pem")]
    fn private_key_pem(&self) -> Option<glib::GString>;

    /// A URI referencing a [PKCS \`11`](https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/os/pkcs11-base-v3.0-os.html)
    /// object containing a private key.
    #[cfg(any(feature = "v2_68", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_68")))]
    #[doc(alias = "private-key-pkcs11-uri")]
    fn private_key_pkcs11_uri(&self) -> Option<glib::GString>;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "dns-names")]
    fn connect_dns_names_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "ip-addresses")]
    fn connect_ip_addresses_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "issuer-name")]
    fn connect_issuer_name_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "not-valid-after")]
    fn connect_not_valid_after_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "not-valid-before")]
    fn connect_not_valid_before_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    #[doc(alias = "subject-name")]
    fn connect_subject_name_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId;
}

impl<O: IsA<TlsCertificate>> TlsCertificateExt for O {
    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn dns_names(&self) -> Vec<glib::Bytes> {
        unsafe {
            FromGlibPtrContainer::from_glib_container(ffi::g_tls_certificate_get_dns_names(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn ip_addresses(&self) -> Vec<InetAddress> {
        unsafe {
            FromGlibPtrContainer::from_glib_container(ffi::g_tls_certificate_get_ip_addresses(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    fn issuer(&self) -> Option<TlsCertificate> {
        unsafe {
            from_glib_none(ffi::g_tls_certificate_get_issuer(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn issuer_name(&self) -> Option<glib::GString> {
        unsafe {
            from_glib_full(ffi::g_tls_certificate_get_issuer_name(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn not_valid_after(&self) -> Option<glib::DateTime> {
        unsafe {
            from_glib_full(ffi::g_tls_certificate_get_not_valid_after(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn not_valid_before(&self) -> Option<glib::DateTime> {
        unsafe {
            from_glib_full(ffi::g_tls_certificate_get_not_valid_before(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn subject_name(&self) -> Option<glib::GString> {
        unsafe {
            from_glib_full(ffi::g_tls_certificate_get_subject_name(
                self.as_ref().to_glib_none().0,
            ))
        }
    }

    fn is_same(&self, cert_two: &impl IsA<TlsCertificate>) -> bool {
        unsafe {
            from_glib(ffi::g_tls_certificate_is_same(
                self.as_ref().to_glib_none().0,
                cert_two.as_ref().to_glib_none().0,
            ))
        }
    }

    fn verify(
        &self,
        identity: Option<&impl IsA<SocketConnectable>>,
        trusted_ca: Option<&impl IsA<TlsCertificate>>,
    ) -> TlsCertificateFlags {
        unsafe {
            from_glib(ffi::g_tls_certificate_verify(
                self.as_ref().to_glib_none().0,
                identity.map(|p| p.as_ref()).to_glib_none().0,
                trusted_ca.map(|p| p.as_ref()).to_glib_none().0,
            ))
        }
    }

    fn certificate(&self) -> Option<glib::ByteArray> {
        glib::ObjectExt::property(self.as_ref(), "certificate")
    }

    fn certificate_pem(&self) -> Option<glib::GString> {
        glib::ObjectExt::property(self.as_ref(), "certificate-pem")
    }

    #[cfg(any(feature = "v2_68", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_68")))]
    fn pkcs11_uri(&self) -> Option<glib::GString> {
        glib::ObjectExt::property(self.as_ref(), "pkcs11-uri")
    }

    fn private_key(&self) -> Option<glib::ByteArray> {
        glib::ObjectExt::property(self.as_ref(), "private-key")
    }

    fn private_key_pem(&self) -> Option<glib::GString> {
        glib::ObjectExt::property(self.as_ref(), "private-key-pem")
    }

    #[cfg(any(feature = "v2_68", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_68")))]
    fn private_key_pkcs11_uri(&self) -> Option<glib::GString> {
        glib::ObjectExt::property(self.as_ref(), "private-key-pkcs11-uri")
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_dns_names_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_dns_names_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::dns-names\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_dns_names_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_ip_addresses_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_ip_addresses_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::ip-addresses\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_ip_addresses_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_issuer_name_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_issuer_name_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::issuer-name\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_issuer_name_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_not_valid_after_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_not_valid_after_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::not-valid-after\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_not_valid_after_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_not_valid_before_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_not_valid_before_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::not-valid-before\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_not_valid_before_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }

    #[cfg(any(feature = "v2_70", feature = "dox"))]
    #[cfg_attr(feature = "dox", doc(cfg(feature = "v2_70")))]
    fn connect_subject_name_notify<F: Fn(&Self) + 'static>(&self, f: F) -> SignalHandlerId {
        unsafe extern "C" fn notify_subject_name_trampoline<
            P: IsA<TlsCertificate>,
            F: Fn(&P) + 'static,
        >(
            this: *mut ffi::GTlsCertificate,
            _param_spec: glib::ffi::gpointer,
            f: glib::ffi::gpointer,
        ) {
            let f: &F = &*(f as *const F);
            f(TlsCertificate::from_glib_borrow(this).unsafe_cast_ref())
        }
        unsafe {
            let f: Box_<F> = Box_::new(f);
            connect_raw(
                self.as_ptr() as *mut _,
                b"notify::subject-name\0".as_ptr() as *const _,
                Some(transmute::<_, unsafe extern "C" fn()>(
                    notify_subject_name_trampoline::<Self, F> as *const (),
                )),
                Box_::into_raw(f),
            )
        }
    }
}

impl fmt::Display for TlsCertificate {
    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
        f.write_str("TlsCertificate")
    }
}