Annotation of src/usr.bin/openssl/x509.c, Revision 1.5
1.5 ! jsing 1: /* $OpenBSD: x509.c,v 1.4 2015/07/19 03:18:10 doug Exp $ */
1.1 jsing 2: /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3: * All rights reserved.
4: *
5: * This package is an SSL implementation written
6: * by Eric Young (eay@cryptsoft.com).
7: * The implementation was written so as to conform with Netscapes SSL.
8: *
9: * This library is free for commercial and non-commercial use as long as
10: * the following conditions are aheared to. The following conditions
11: * apply to all code found in this distribution, be it the RC4, RSA,
12: * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13: * included with this distribution is covered by the same copyright terms
14: * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15: *
16: * Copyright remains Eric Young's, and as such any Copyright notices in
17: * the code are not to be removed.
18: * If this package is used in a product, Eric Young should be given attribution
19: * as the author of the parts of the library used.
20: * This can be in the form of a textual message at program startup or
21: * in documentation (online or textual) provided with the package.
22: *
23: * Redistribution and use in source and binary forms, with or without
24: * modification, are permitted provided that the following conditions
25: * are met:
26: * 1. Redistributions of source code must retain the copyright
27: * notice, this list of conditions and the following disclaimer.
28: * 2. Redistributions in binary form must reproduce the above copyright
29: * notice, this list of conditions and the following disclaimer in the
30: * documentation and/or other materials provided with the distribution.
31: * 3. All advertising materials mentioning features or use of this software
32: * must display the following acknowledgement:
33: * "This product includes cryptographic software written by
34: * Eric Young (eay@cryptsoft.com)"
35: * The word 'cryptographic' can be left out if the rouines from the library
36: * being used are not cryptographic related :-).
37: * 4. If you include any Windows specific code (or a derivative thereof) from
38: * the apps directory (application code) you must include an acknowledgement:
39: * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40: *
41: * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44: * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51: * SUCH DAMAGE.
52: *
53: * The licence and distribution terms for any publically available version or
54: * derivative of this code cannot be changed. i.e. this code cannot simply be
55: * copied and put under another distribution licence
56: * [including the GNU Public Licence.]
57: */
58:
59: #include <assert.h>
60: #include <stdio.h>
61: #include <stdlib.h>
62: #include <limits.h>
63: #include <string.h>
64:
65: #include "apps.h"
66:
67: #include <openssl/asn1.h>
68: #include <openssl/bio.h>
69: #include <openssl/bn.h>
70: #include <openssl/err.h>
71: #include <openssl/evp.h>
72: #include <openssl/objects.h>
73: #include <openssl/pem.h>
74: #include <openssl/x509.h>
75: #include <openssl/x509v3.h>
76:
77: #include <openssl/dsa.h>
78:
79: #include <openssl/rsa.h>
80:
81: #define POSTFIX ".srl"
82: #define DEF_DAYS 30
83:
84: static const char *x509_usage[] = {
85: "usage: x509 args\n",
86: " -inform arg - input format - default PEM (one of DER, NET or PEM)\n",
87: " -outform arg - output format - default PEM (one of DER, NET or PEM)\n",
88: " -keyform arg - private key format - default PEM\n",
89: " -CAform arg - CA format - default PEM\n",
90: " -CAkeyform arg - CA key format - default PEM\n",
91: " -in arg - input file - default stdin\n",
92: " -out arg - output file - default stdout\n",
93: " -passin arg - private key password source\n",
94: " -serial - print serial number value\n",
95: " -subject_hash - print subject hash value\n",
96: #ifndef OPENSSL_NO_MD5
97: " -subject_hash_old - print old-style (MD5) subject hash value\n",
98: #endif
99: " -issuer_hash - print issuer hash value\n",
100: #ifndef OPENSSL_NO_MD5
101: " -issuer_hash_old - print old-style (MD5) issuer hash value\n",
102: #endif
103: " -hash - synonym for -subject_hash\n",
104: " -subject - print subject DN\n",
105: " -issuer - print issuer DN\n",
106: " -email - print email address(es)\n",
107: " -startdate - notBefore field\n",
108: " -enddate - notAfter field\n",
109: " -purpose - print out certificate purposes\n",
110: " -dates - both Before and After dates\n",
111: " -modulus - print the RSA key modulus\n",
112: " -pubkey - output the public key\n",
113: " -fingerprint - print the certificate fingerprint\n",
114: " -alias - output certificate alias\n",
115: " -noout - no certificate output\n",
116: " -ocspid - print OCSP hash values for the subject name and public key\n",
117: " -ocsp_uri - print OCSP Responder URL(s)\n",
118: " -trustout - output a \"trusted\" certificate\n",
119: " -clrtrust - clear all trusted purposes\n",
120: " -clrreject - clear all rejected purposes\n",
121: " -addtrust arg - trust certificate for a given purpose\n",
122: " -addreject arg - reject certificate for a given purpose\n",
123: " -setalias arg - set certificate alias\n",
124: " -days arg - How long till expiry of a signed certificate - def 30 days\n",
125: " -checkend arg - check whether the cert expires in the next arg seconds\n",
126: " exit 1 if so, 0 if not\n",
127: " -signkey arg - self sign cert with arg\n",
128: " -x509toreq - output a certification request object\n",
129: " -req - input is a certificate request, sign and output.\n",
130: " -CA arg - set the CA certificate, must be PEM format.\n",
131: " -CAkey arg - set the CA key, must be PEM format\n",
132: " missing, it is assumed to be in the CA file.\n",
133: " -CAcreateserial - create serial number file if it does not exist\n",
134: " -CAserial arg - serial file\n",
135: " -set_serial - serial number to use\n",
136: " -text - print the certificate in text form\n",
137: " -C - print out C code forms\n",
1.3 doug 138: " -md2/-md5/-sha1 - digest to use\n",
1.1 jsing 139: " -extfile - configuration file with X509V3 extensions to add\n",
140: " -extensions - section from config file with X509V3 extensions to add\n",
141: " -clrext - delete extensions before signing and input certificate\n",
142: " -nameopt arg - various certificate name options\n",
143: #ifndef OPENSSL_NO_ENGINE
144: " -engine e - use engine e, possibly a hardware device.\n",
145: #endif
146: " -certopt arg - various certificate text options\n",
147: NULL
148: };
149:
150: static int callb(int ok, X509_STORE_CTX *ctx);
151: static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext,
152: const EVP_MD *digest, CONF *conf, char *section);
153: static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
154: X509 *x, X509 *xca, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *sigopts,
155: char *serial, int create, int days, int clrext, CONF *conf, char *section,
156: ASN1_INTEGER *sno);
157: static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
158: static int reqfile = 0;
159:
160: int
161: x509_main(int argc, char **argv)
162: {
163: ENGINE *e = NULL;
164: int ret = 1;
165: X509_REQ *req = NULL;
166: X509 *x = NULL, *xca = NULL;
167: ASN1_OBJECT *objtmp;
168: STACK_OF(OPENSSL_STRING) *sigopts = NULL;
169: EVP_PKEY *Upkey = NULL, *CApkey = NULL;
170: ASN1_INTEGER *sno = NULL;
171: int i, num, badops = 0;
172: BIO *out = NULL;
173: BIO *STDout = NULL;
174: STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
175: int informat, outformat, keyformat, CAformat, CAkeyformat;
176: char *infile = NULL, *outfile = NULL, *keyfile = NULL, *CAfile = NULL;
177: char *CAkeyfile = NULL, *CAserial = NULL;
178: char *alias = NULL;
179: int text = 0, serial = 0, subject = 0, issuer = 0, startdate = 0,
180: enddate = 0;
181: int next_serial = 0;
182: int subject_hash = 0, issuer_hash = 0, ocspid = 0;
183: #ifndef OPENSSL_NO_MD5
184: int subject_hash_old = 0, issuer_hash_old = 0;
185: #endif
186: int noout = 0, sign_flag = 0, CA_flag = 0, CA_createserial = 0,
187: email = 0;
188: int ocsp_uri = 0;
189: int trustout = 0, clrtrust = 0, clrreject = 0, aliasout = 0, clrext = 0;
190: int C = 0;
191: int x509req = 0, days = DEF_DAYS, modulus = 0, pubkey = 0;
192: int pprint = 0;
193: const char **pp;
194: X509_STORE *ctx = NULL;
195: X509_REQ *rq = NULL;
196: int fingerprint = 0;
197: char buf[256];
198: const EVP_MD *md_alg, *digest = NULL;
199: CONF *extconf = NULL;
200: char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
201: int checkend = 0, checkoffset = 0;
202: unsigned long nmflag = 0, certflag = 0;
203: #ifndef OPENSSL_NO_ENGINE
204: char *engine = NULL;
205: #endif
206: const char *errstr = NULL;
207:
208: reqfile = 0;
209:
210: STDout = BIO_new_fp(stdout, BIO_NOCLOSE);
211:
212: informat = FORMAT_PEM;
213: outformat = FORMAT_PEM;
214: keyformat = FORMAT_PEM;
215: CAformat = FORMAT_PEM;
216: CAkeyformat = FORMAT_PEM;
217:
218: ctx = X509_STORE_new();
219: if (ctx == NULL)
220: goto end;
221: X509_STORE_set_verify_cb(ctx, callb);
222:
223: argc--;
224: argv++;
225: num = 0;
226: while (argc >= 1) {
227: if (strcmp(*argv, "-inform") == 0) {
228: if (--argc < 1)
229: goto bad;
230: informat = str2fmt(*(++argv));
231: } else if (strcmp(*argv, "-outform") == 0) {
232: if (--argc < 1)
233: goto bad;
234: outformat = str2fmt(*(++argv));
235: } else if (strcmp(*argv, "-keyform") == 0) {
236: if (--argc < 1)
237: goto bad;
238: keyformat = str2fmt(*(++argv));
239: } else if (strcmp(*argv, "-req") == 0) {
240: reqfile = 1;
241: } else if (strcmp(*argv, "-CAform") == 0) {
242: if (--argc < 1)
243: goto bad;
244: CAformat = str2fmt(*(++argv));
245: } else if (strcmp(*argv, "-CAkeyform") == 0) {
246: if (--argc < 1)
247: goto bad;
248: CAkeyformat = str2fmt(*(++argv));
249: } else if (strcmp(*argv, "-sigopt") == 0) {
250: if (--argc < 1)
251: goto bad;
252: if (!sigopts)
253: sigopts = sk_OPENSSL_STRING_new_null();
254: if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
255: goto bad;
256: } else if (strcmp(*argv, "-days") == 0) {
257: if (--argc < 1)
258: goto bad;
259: days = strtonum(*(++argv), 1, INT_MAX, &errstr);
260: if (errstr) {
261: BIO_printf(bio_err, "bad number of days: %s\n", errstr);
262: goto bad;
263: }
264: } else if (strcmp(*argv, "-passin") == 0) {
265: if (--argc < 1)
266: goto bad;
267: passargin = *(++argv);
268: } else if (strcmp(*argv, "-extfile") == 0) {
269: if (--argc < 1)
270: goto bad;
271: extfile = *(++argv);
272: } else if (strcmp(*argv, "-extensions") == 0) {
273: if (--argc < 1)
274: goto bad;
275: extsect = *(++argv);
276: } else if (strcmp(*argv, "-in") == 0) {
277: if (--argc < 1)
278: goto bad;
279: infile = *(++argv);
280: } else if (strcmp(*argv, "-out") == 0) {
281: if (--argc < 1)
282: goto bad;
283: outfile = *(++argv);
284: } else if (strcmp(*argv, "-signkey") == 0) {
285: if (--argc < 1)
286: goto bad;
287: keyfile = *(++argv);
288: sign_flag = ++num;
289: } else if (strcmp(*argv, "-CA") == 0) {
290: if (--argc < 1)
291: goto bad;
292: CAfile = *(++argv);
293: CA_flag = ++num;
294: } else if (strcmp(*argv, "-CAkey") == 0) {
295: if (--argc < 1)
296: goto bad;
297: CAkeyfile = *(++argv);
298: } else if (strcmp(*argv, "-CAserial") == 0) {
299: if (--argc < 1)
300: goto bad;
301: CAserial = *(++argv);
302: } else if (strcmp(*argv, "-set_serial") == 0) {
303: if (--argc < 1)
304: goto bad;
1.4 doug 305: M_ASN1_INTEGER_free(sno);
1.1 jsing 306: if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv))))
307: goto bad;
308: } else if (strcmp(*argv, "-addtrust") == 0) {
309: if (--argc < 1)
310: goto bad;
311: if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
312: BIO_printf(bio_err,
313: "Invalid trust object value %s\n", *argv);
314: goto bad;
315: }
316: if (!trust)
317: trust = sk_ASN1_OBJECT_new_null();
318: sk_ASN1_OBJECT_push(trust, objtmp);
319: trustout = 1;
320: } else if (strcmp(*argv, "-addreject") == 0) {
321: if (--argc < 1)
322: goto bad;
323: if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) {
324: BIO_printf(bio_err,
325: "Invalid reject object value %s\n", *argv);
326: goto bad;
327: }
328: if (!reject)
329: reject = sk_ASN1_OBJECT_new_null();
330: sk_ASN1_OBJECT_push(reject, objtmp);
331: trustout = 1;
332: } else if (strcmp(*argv, "-setalias") == 0) {
333: if (--argc < 1)
334: goto bad;
335: alias = *(++argv);
336: trustout = 1;
337: } else if (strcmp(*argv, "-certopt") == 0) {
338: if (--argc < 1)
339: goto bad;
340: if (!set_cert_ex(&certflag, *(++argv)))
341: goto bad;
342: } else if (strcmp(*argv, "-nameopt") == 0) {
343: if (--argc < 1)
344: goto bad;
345: if (!set_name_ex(&nmflag, *(++argv)))
346: goto bad;
347: }
348: #ifndef OPENSSL_NO_ENGINE
349: else if (strcmp(*argv, "-engine") == 0) {
350: if (--argc < 1)
351: goto bad;
352: engine = *(++argv);
353: }
354: #endif
355: else if (strcmp(*argv, "-C") == 0)
356: C = ++num;
357: else if (strcmp(*argv, "-email") == 0)
358: email = ++num;
359: else if (strcmp(*argv, "-ocsp_uri") == 0)
360: ocsp_uri = ++num;
361: else if (strcmp(*argv, "-serial") == 0)
362: serial = ++num;
363: else if (strcmp(*argv, "-next_serial") == 0)
364: next_serial = ++num;
365: else if (strcmp(*argv, "-modulus") == 0)
366: modulus = ++num;
367: else if (strcmp(*argv, "-pubkey") == 0)
368: pubkey = ++num;
369: else if (strcmp(*argv, "-x509toreq") == 0)
370: x509req = ++num;
371: else if (strcmp(*argv, "-text") == 0)
372: text = ++num;
373: else if (strcmp(*argv, "-hash") == 0 ||
374: strcmp(*argv, "-subject_hash") == 0)
375: subject_hash = ++num;
376: #ifndef OPENSSL_NO_MD5
377: else if (strcmp(*argv, "-subject_hash_old") == 0)
378: subject_hash_old = ++num;
379: #endif
380: else if (strcmp(*argv, "-issuer_hash") == 0)
381: issuer_hash = ++num;
382: #ifndef OPENSSL_NO_MD5
383: else if (strcmp(*argv, "-issuer_hash_old") == 0)
384: issuer_hash_old = ++num;
385: #endif
386: else if (strcmp(*argv, "-subject") == 0)
387: subject = ++num;
388: else if (strcmp(*argv, "-issuer") == 0)
389: issuer = ++num;
390: else if (strcmp(*argv, "-fingerprint") == 0)
391: fingerprint = ++num;
392: else if (strcmp(*argv, "-dates") == 0) {
393: startdate = ++num;
394: enddate = ++num;
395: } else if (strcmp(*argv, "-purpose") == 0)
396: pprint = ++num;
397: else if (strcmp(*argv, "-startdate") == 0)
398: startdate = ++num;
399: else if (strcmp(*argv, "-enddate") == 0)
400: enddate = ++num;
401: else if (strcmp(*argv, "-checkend") == 0) {
402: if (--argc < 1)
403: goto bad;
404: checkoffset = strtonum(*(++argv), 0, INT_MAX, &errstr);
405: if (errstr) {
406: BIO_printf(bio_err, "checkend unusable: %s\n", errstr);
407: goto bad;
408: }
409: checkend = 1;
410: } else if (strcmp(*argv, "-noout") == 0)
411: noout = ++num;
412: else if (strcmp(*argv, "-trustout") == 0)
413: trustout = 1;
414: else if (strcmp(*argv, "-clrtrust") == 0)
415: clrtrust = ++num;
416: else if (strcmp(*argv, "-clrreject") == 0)
417: clrreject = ++num;
418: else if (strcmp(*argv, "-alias") == 0)
419: aliasout = ++num;
420: else if (strcmp(*argv, "-CAcreateserial") == 0)
421: CA_createserial = ++num;
422: else if (strcmp(*argv, "-clrext") == 0)
423: clrext = 1;
424: else if (strcmp(*argv, "-ocspid") == 0)
425: ocspid = ++num;
426: else if ((md_alg = EVP_get_digestbyname(*argv + 1))) {
427: /* ok */
428: digest = md_alg;
429: } else {
430: BIO_printf(bio_err, "unknown option %s\n", *argv);
431: badops = 1;
432: break;
433: }
434: argc--;
435: argv++;
436: }
437:
438: if (badops) {
439: bad:
440: for (pp = x509_usage; (*pp != NULL); pp++)
441: BIO_printf(bio_err, "%s", *pp);
442: goto end;
443: }
444: #ifndef OPENSSL_NO_ENGINE
445: e = setup_engine(bio_err, engine, 0);
446: #endif
447:
448: if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) {
449: BIO_printf(bio_err, "Error getting password\n");
450: goto end;
451: }
452: if (!X509_STORE_set_default_paths(ctx)) {
453: ERR_print_errors(bio_err);
454: goto end;
455: }
456: if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM)) {
457: CAkeyfile = CAfile;
458: } else if ((CA_flag) && (CAkeyfile == NULL)) {
459: BIO_printf(bio_err,
460: "need to specify a CAkey if using the CA command\n");
461: goto end;
462: }
463: if (extfile) {
464: long errorline = -1;
465: X509V3_CTX ctx2;
466: extconf = NCONF_new(NULL);
467: if (!NCONF_load(extconf, extfile, &errorline)) {
468: if (errorline <= 0)
469: BIO_printf(bio_err,
470: "error loading the config file '%s'\n",
471: extfile);
472: else
473: BIO_printf(bio_err,
474: "error on line %ld of config file '%s'\n",
475: errorline, extfile);
476: goto end;
477: }
478: if (!extsect) {
479: extsect = NCONF_get_string(extconf, "default",
480: "extensions");
481: if (!extsect) {
482: ERR_clear_error();
483: extsect = "default";
484: }
485: }
486: X509V3_set_ctx_test(&ctx2);
487: X509V3_set_nconf(&ctx2, extconf);
488: if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL)) {
489: BIO_printf(bio_err,
490: "Error Loading extension section %s\n",
491: extsect);
492: ERR_print_errors(bio_err);
493: goto end;
494: }
495: }
496: if (reqfile) {
497: EVP_PKEY *pkey;
498: BIO *in;
499:
500: if (!sign_flag && !CA_flag) {
501: BIO_printf(bio_err, "We need a private key to sign with\n");
502: goto end;
503: }
504: in = BIO_new(BIO_s_file());
505: if (in == NULL) {
506: ERR_print_errors(bio_err);
507: goto end;
508: }
509: if (infile == NULL)
510: BIO_set_fp(in, stdin, BIO_NOCLOSE | BIO_FP_TEXT);
511: else {
512: if (BIO_read_filename(in, infile) <= 0) {
513: perror(infile);
514: BIO_free(in);
515: goto end;
516: }
517: }
518: req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
519: BIO_free(in);
520:
521: if (req == NULL) {
522: ERR_print_errors(bio_err);
523: goto end;
524: }
525: if ((req->req_info == NULL) ||
526: (req->req_info->pubkey == NULL) ||
527: (req->req_info->pubkey->public_key == NULL) ||
528: (req->req_info->pubkey->public_key->data == NULL)) {
529: BIO_printf(bio_err, "The certificate request appears to corrupted\n");
530: BIO_printf(bio_err, "It does not contain a public key\n");
531: goto end;
532: }
533: if ((pkey = X509_REQ_get_pubkey(req)) == NULL) {
534: BIO_printf(bio_err, "error unpacking public key\n");
535: goto end;
536: }
537: i = X509_REQ_verify(req, pkey);
538: EVP_PKEY_free(pkey);
539: if (i < 0) {
540: BIO_printf(bio_err, "Signature verification error\n");
541: ERR_print_errors(bio_err);
542: goto end;
543: }
544: if (i == 0) {
545: BIO_printf(bio_err, "Signature did not match the certificate request\n");
546: goto end;
547: } else
548: BIO_printf(bio_err, "Signature ok\n");
549:
550: print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag);
551:
552: if ((x = X509_new()) == NULL)
553: goto end;
554:
555: if (sno == NULL) {
556: sno = ASN1_INTEGER_new();
557: if (!sno || !rand_serial(NULL, sno))
558: goto end;
559: if (!X509_set_serialNumber(x, sno))
560: goto end;
561: ASN1_INTEGER_free(sno);
562: sno = NULL;
563: } else if (!X509_set_serialNumber(x, sno))
564: goto end;
565:
566: if (!X509_set_issuer_name(x, req->req_info->subject))
567: goto end;
568: if (!X509_set_subject_name(x, req->req_info->subject))
569: goto end;
570:
571: X509_gmtime_adj(X509_get_notBefore(x), 0);
572: X509_time_adj_ex(X509_get_notAfter(x), days, 0, NULL);
573:
574: pkey = X509_REQ_get_pubkey(req);
575: X509_set_pubkey(x, pkey);
576: EVP_PKEY_free(pkey);
577: } else
578: x = load_cert(bio_err, infile, informat, NULL, e, "Certificate");
579:
580: if (x == NULL)
581: goto end;
582: if (CA_flag) {
583: xca = load_cert(bio_err, CAfile, CAformat, NULL, e, "CA Certificate");
584: if (xca == NULL)
585: goto end;
586: }
587: if (!noout || text || next_serial) {
588: OBJ_create("2.99999.3",
589: "SET.ex3", "SET x509v3 extension 3");
590:
591: out = BIO_new(BIO_s_file());
592: if (out == NULL) {
593: ERR_print_errors(bio_err);
594: goto end;
595: }
596: if (outfile == NULL) {
597: BIO_set_fp(out, stdout, BIO_NOCLOSE);
598: } else {
599: if (BIO_write_filename(out, outfile) <= 0) {
600: perror(outfile);
601: goto end;
602: }
603: }
604: }
605: if (alias)
606: X509_alias_set1(x, (unsigned char *) alias, -1);
607:
608: if (clrtrust)
609: X509_trust_clear(x);
610: if (clrreject)
611: X509_reject_clear(x);
612:
613: if (trust) {
614: for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) {
615: objtmp = sk_ASN1_OBJECT_value(trust, i);
616: X509_add1_trust_object(x, objtmp);
617: }
618: }
619: if (reject) {
620: for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) {
621: objtmp = sk_ASN1_OBJECT_value(reject, i);
622: X509_add1_reject_object(x, objtmp);
623: }
624: }
625: if (num) {
626: for (i = 1; i <= num; i++) {
627: if (issuer == i) {
628: print_name(STDout, "issuer= ",
629: X509_get_issuer_name(x), nmflag);
630: } else if (subject == i) {
631: print_name(STDout, "subject= ",
632: X509_get_subject_name(x), nmflag);
633: } else if (serial == i) {
634: BIO_printf(STDout, "serial=");
635: i2a_ASN1_INTEGER(STDout,
636: X509_get_serialNumber(x));
637: BIO_printf(STDout, "\n");
638: } else if (next_serial == i) {
639: BIGNUM *bnser;
640: ASN1_INTEGER *ser;
641: ser = X509_get_serialNumber(x);
642: bnser = ASN1_INTEGER_to_BN(ser, NULL);
643: if (!bnser)
644: goto end;
645: if (!BN_add_word(bnser, 1))
646: goto end;
647: ser = BN_to_ASN1_INTEGER(bnser, NULL);
648: if (!ser)
649: goto end;
650: BN_free(bnser);
651: i2a_ASN1_INTEGER(out, ser);
652: ASN1_INTEGER_free(ser);
653: BIO_puts(out, "\n");
654: } else if ((email == i) || (ocsp_uri == i)) {
655: int j;
656: STACK_OF(OPENSSL_STRING) *emlst;
657: if (email == i)
658: emlst = X509_get1_email(x);
659: else
660: emlst = X509_get1_ocsp(x);
661: for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
662: BIO_printf(STDout, "%s\n",
663: sk_OPENSSL_STRING_value(emlst, j));
664: X509_email_free(emlst);
665: } else if (aliasout == i) {
666: unsigned char *alstr;
667: alstr = X509_alias_get0(x, NULL);
668: if (alstr)
669: BIO_printf(STDout, "%s\n", alstr);
670: else
671: BIO_puts(STDout, "<No Alias>\n");
672: } else if (subject_hash == i) {
673: BIO_printf(STDout, "%08lx\n", X509_subject_name_hash(x));
674: }
675: #ifndef OPENSSL_NO_MD5
676: else if (subject_hash_old == i) {
677: BIO_printf(STDout, "%08lx\n", X509_subject_name_hash_old(x));
678: }
679: #endif
680: else if (issuer_hash == i) {
681: BIO_printf(STDout, "%08lx\n", X509_issuer_name_hash(x));
682: }
683: #ifndef OPENSSL_NO_MD5
684: else if (issuer_hash_old == i) {
685: BIO_printf(STDout, "%08lx\n", X509_issuer_name_hash_old(x));
686: }
687: #endif
688: else if (pprint == i) {
689: X509_PURPOSE *ptmp;
690: int j;
691: BIO_printf(STDout, "Certificate purposes:\n");
692: for (j = 0; j < X509_PURPOSE_get_count(); j++) {
693: ptmp = X509_PURPOSE_get0(j);
694: purpose_print(STDout, x, ptmp);
695: }
696: } else if (modulus == i) {
697: EVP_PKEY *pkey;
698:
699: pkey = X509_get_pubkey(x);
700: if (pkey == NULL) {
701: BIO_printf(bio_err, "Modulus=unavailable\n");
702: ERR_print_errors(bio_err);
703: goto end;
704: }
705: BIO_printf(STDout, "Modulus=");
706: if (pkey->type == EVP_PKEY_RSA)
707: BN_print(STDout, pkey->pkey.rsa->n);
708: else
709: if (pkey->type == EVP_PKEY_DSA)
710: BN_print(STDout, pkey->pkey.dsa->pub_key);
711: else
712: BIO_printf(STDout, "Wrong Algorithm type");
713: BIO_printf(STDout, "\n");
714: EVP_PKEY_free(pkey);
715: } else if (pubkey == i) {
716: EVP_PKEY *pkey;
717:
718: pkey = X509_get_pubkey(x);
719: if (pkey == NULL) {
720: BIO_printf(bio_err, "Error getting public key\n");
721: ERR_print_errors(bio_err);
722: goto end;
723: }
724: PEM_write_bio_PUBKEY(STDout, pkey);
725: EVP_PKEY_free(pkey);
726: } else if (C == i) {
727: unsigned char *d;
728: char *m;
729: int y, z;
730:
731: X509_NAME_oneline(X509_get_subject_name(x),
732: buf, sizeof buf);
733: BIO_printf(STDout, "/* subject:%s */\n", buf);
734: m = X509_NAME_oneline(
735: X509_get_issuer_name(x), buf,
736: sizeof buf);
737: BIO_printf(STDout, "/* issuer :%s */\n", buf);
738:
739: z = i2d_X509(x, NULL);
740: m = malloc(z);
741:
742: d = (unsigned char *) m;
743: z = i2d_X509_NAME(X509_get_subject_name(x), &d);
744: BIO_printf(STDout, "unsigned char XXX_subject_name[%d]={\n", z);
745: d = (unsigned char *) m;
746: for (y = 0; y < z; y++) {
747: BIO_printf(STDout, "0x%02X,", d[y]);
748: if ((y & 0x0f) == 0x0f)
749: BIO_printf(STDout, "\n");
750: }
751: if (y % 16 != 0)
752: BIO_printf(STDout, "\n");
753: BIO_printf(STDout, "};\n");
754:
755: z = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), &d);
756: BIO_printf(STDout, "unsigned char XXX_public_key[%d]={\n", z);
757: d = (unsigned char *) m;
758: for (y = 0; y < z; y++) {
759: BIO_printf(STDout, "0x%02X,", d[y]);
760: if ((y & 0x0f) == 0x0f)
761: BIO_printf(STDout, "\n");
762: }
763: if (y % 16 != 0)
764: BIO_printf(STDout, "\n");
765: BIO_printf(STDout, "};\n");
766:
767: z = i2d_X509(x, &d);
768: BIO_printf(STDout, "unsigned char XXX_certificate[%d]={\n", z);
769: d = (unsigned char *) m;
770: for (y = 0; y < z; y++) {
771: BIO_printf(STDout, "0x%02X,", d[y]);
772: if ((y & 0x0f) == 0x0f)
773: BIO_printf(STDout, "\n");
774: }
775: if (y % 16 != 0)
776: BIO_printf(STDout, "\n");
777: BIO_printf(STDout, "};\n");
778:
779: free(m);
780: } else if (text == i) {
781: X509_print_ex(STDout, x, nmflag, certflag);
782: } else if (startdate == i) {
783: BIO_puts(STDout, "notBefore=");
784: ASN1_TIME_print(STDout, X509_get_notBefore(x));
785: BIO_puts(STDout, "\n");
786: } else if (enddate == i) {
787: BIO_puts(STDout, "notAfter=");
788: ASN1_TIME_print(STDout, X509_get_notAfter(x));
789: BIO_puts(STDout, "\n");
790: } else if (fingerprint == i) {
791: int j;
792: unsigned int n;
793: unsigned char md[EVP_MAX_MD_SIZE];
794: const EVP_MD *fdig = digest;
795:
796: if (!fdig)
797: fdig = EVP_sha1();
798:
799: if (!X509_digest(x, fdig, md, &n)) {
800: BIO_printf(bio_err, "out of memory\n");
801: goto end;
802: }
803: BIO_printf(STDout, "%s Fingerprint=",
804: OBJ_nid2sn(EVP_MD_type(fdig)));
805: for (j = 0; j < (int) n; j++) {
806: BIO_printf(STDout, "%02X%c", md[j],
807: (j + 1 == (int)n) ? '\n' : ':');
808: }
809: }
810: /* should be in the library */
811: else if ((sign_flag == i) && (x509req == 0)) {
812: BIO_printf(bio_err, "Getting Private key\n");
813: if (Upkey == NULL) {
814: Upkey = load_key(bio_err,
815: keyfile, keyformat, 0,
816: passin, e, "Private key");
817: if (Upkey == NULL)
818: goto end;
819: }
820: if (!sign(x, Upkey, days, clrext, digest,
821: extconf, extsect))
822: goto end;
823: } else if (CA_flag == i) {
824: BIO_printf(bio_err, "Getting CA Private Key\n");
825: if (CAkeyfile != NULL) {
826: CApkey = load_key(bio_err,
827: CAkeyfile, CAkeyformat,
828: 0, passin, e,
829: "CA Private Key");
830: if (CApkey == NULL)
831: goto end;
832: }
833: if (!x509_certify(ctx, CAfile, digest, x, xca,
834: CApkey, sigopts,
835: CAserial, CA_createserial, days, clrext,
836: extconf, extsect, sno))
837: goto end;
838: } else if (x509req == i) {
839: EVP_PKEY *pk;
840:
841: BIO_printf(bio_err, "Getting request Private Key\n");
842: if (keyfile == NULL) {
843: BIO_printf(bio_err, "no request key file specified\n");
844: goto end;
845: } else {
846: pk = load_key(bio_err,
847: keyfile, keyformat, 0,
848: passin, e, "request key");
849: if (pk == NULL)
850: goto end;
851: }
852:
853: BIO_printf(bio_err, "Generating certificate request\n");
854:
855: rq = X509_to_X509_REQ(x, pk, digest);
856: EVP_PKEY_free(pk);
857: if (rq == NULL) {
858: ERR_print_errors(bio_err);
859: goto end;
860: }
861: if (!noout) {
862: X509_REQ_print(out, rq);
863: PEM_write_bio_X509_REQ(out, rq);
864: }
865: noout = 1;
866: } else if (ocspid == i) {
867: X509_ocspid_print(out, x);
868: }
869: }
870: }
871: if (checkend) {
872: time_t tcheck = time(NULL) + checkoffset;
873:
874: if (X509_cmp_time(X509_get_notAfter(x), &tcheck) < 0) {
875: BIO_printf(out, "Certificate will expire\n");
876: ret = 1;
877: } else {
878: BIO_printf(out, "Certificate will not expire\n");
879: ret = 0;
880: }
881: goto end;
882: }
883: if (noout) {
884: ret = 0;
885: goto end;
886: }
887: if (outformat == FORMAT_ASN1)
888: i = i2d_X509_bio(out, x);
889: else if (outformat == FORMAT_PEM) {
890: if (trustout)
891: i = PEM_write_bio_X509_AUX(out, x);
892: else
893: i = PEM_write_bio_X509(out, x);
894: } else if (outformat == FORMAT_NETSCAPE) {
895: NETSCAPE_X509 nx;
896: ASN1_OCTET_STRING hdr;
897:
898: hdr.data = (unsigned char *) NETSCAPE_CERT_HDR;
899: hdr.length = strlen(NETSCAPE_CERT_HDR);
900: nx.header = &hdr;
901: nx.cert = x;
902:
903: i = ASN1_item_i2d_bio(ASN1_ITEM_rptr(NETSCAPE_X509), out, &nx);
904: } else {
905: BIO_printf(bio_err, "bad output format specified for outfile\n");
906: goto end;
907: }
908: if (!i) {
909: BIO_printf(bio_err, "unable to write certificate\n");
910: ERR_print_errors(bio_err);
911: goto end;
912: }
913: ret = 0;
914:
915: end:
916: OBJ_cleanup();
917: NCONF_free(extconf);
918: BIO_free_all(out);
919: BIO_free_all(STDout);
920: X509_STORE_free(ctx);
921: X509_REQ_free(req);
922: X509_free(x);
923: X509_free(xca);
924: EVP_PKEY_free(Upkey);
925: EVP_PKEY_free(CApkey);
926: if (sigopts)
927: sk_OPENSSL_STRING_free(sigopts);
928: X509_REQ_free(rq);
929: ASN1_INTEGER_free(sno);
930: sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
931: sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
932: free(passin);
933:
934: return (ret);
935: }
936:
937: static ASN1_INTEGER *
938: x509_load_serial(char *CAfile, char *serialfile, int create)
939: {
940: char *buf = NULL, *p;
941: ASN1_INTEGER *bs = NULL;
942: BIGNUM *serial = NULL;
943: size_t len;
944:
945: len = ((serialfile == NULL) ? (strlen(CAfile) + strlen(POSTFIX) + 1) :
946: (strlen(serialfile))) + 1;
947: buf = malloc(len);
948: if (buf == NULL) {
949: BIO_printf(bio_err, "out of mem\n");
950: goto end;
951: }
952: if (serialfile == NULL) {
953: strlcpy(buf, CAfile, len);
954: for (p = buf; *p; p++)
955: if (*p == '.') {
956: *p = '\0';
957: break;
958: }
959: strlcat(buf, POSTFIX, len);
960: } else
961: strlcpy(buf, serialfile, len);
962:
963: serial = load_serial(buf, create, NULL);
964: if (serial == NULL)
965: goto end;
966:
967: if (!BN_add_word(serial, 1)) {
968: BIO_printf(bio_err, "add_word failure\n");
969: goto end;
970: }
971: if (!save_serial(buf, NULL, serial, &bs))
972: goto end;
973:
974: end:
975: free(buf);
976: BN_free(serial);
977:
978: return bs;
979: }
980:
981: static int
982: x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, X509 *x,
983: X509 *xca, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *sigopts,
984: char *serialfile, int create, int days, int clrext, CONF *conf,
985: char *section, ASN1_INTEGER *sno)
986: {
987: int ret = 0;
988: ASN1_INTEGER *bs = NULL;
989: X509_STORE_CTX xsc;
990: EVP_PKEY *upkey;
991:
992: upkey = X509_get_pubkey(xca);
993: EVP_PKEY_copy_parameters(upkey, pkey);
994: EVP_PKEY_free(upkey);
995:
996: if (!X509_STORE_CTX_init(&xsc, ctx, x, NULL)) {
997: BIO_printf(bio_err, "Error initialising X509 store\n");
998: goto end;
999: }
1000: if (sno)
1001: bs = sno;
1002: else if (!(bs = x509_load_serial(CAfile, serialfile, create)))
1003: goto end;
1004:
1005: /* if (!X509_STORE_add_cert(ctx,x)) goto end;*/
1006:
1007: /*
1008: * NOTE: this certificate can/should be self signed, unless it was a
1009: * certificate request in which case it is not.
1010: */
1011: X509_STORE_CTX_set_cert(&xsc, x);
1012: X509_STORE_CTX_set_flags(&xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);
1013: if (!reqfile && X509_verify_cert(&xsc) <= 0)
1014: goto end;
1015:
1016: if (!X509_check_private_key(xca, pkey)) {
1017: BIO_printf(bio_err, "CA certificate and CA private key do not match\n");
1018: goto end;
1019: }
1020: if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
1021: goto end;
1022: if (!X509_set_serialNumber(x, bs))
1023: goto end;
1024:
1025: if (X509_gmtime_adj(X509_get_notBefore(x), 0L) == NULL)
1026: goto end;
1027:
1028: /* hardwired expired */
1029: if (X509_time_adj_ex(X509_get_notAfter(x), days, 0, NULL) == NULL)
1030: goto end;
1031:
1032: if (clrext) {
1033: while (X509_get_ext_count(x) > 0)
1034: X509_delete_ext(x, 0);
1035: }
1036: if (conf) {
1037: X509V3_CTX ctx2;
1038: X509_set_version(x, 2); /* version 3 certificate */
1039: X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
1040: X509V3_set_nconf(&ctx2, conf);
1041: if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x))
1042: goto end;
1043: }
1044: if (!do_X509_sign(bio_err, x, pkey, digest, sigopts))
1045: goto end;
1046: ret = 1;
1047: end:
1048: X509_STORE_CTX_cleanup(&xsc);
1049: if (!ret)
1050: ERR_print_errors(bio_err);
1051: if (!sno)
1052: ASN1_INTEGER_free(bs);
1053: return ret;
1054: }
1055:
1056: static int
1057: callb(int ok, X509_STORE_CTX *ctx)
1058: {
1059: int err;
1060: X509 *err_cert;
1061:
1062: /*
1063: * it is ok to use a self signed certificate This case will catch
1064: * both the initial ok == 0 and the final ok == 1 calls to this
1065: * function
1066: */
1067: err = X509_STORE_CTX_get_error(ctx);
1068: if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
1069: return 1;
1070:
1071: /*
1072: * BAD we should have gotten an error. Normally if everything worked
1073: * X509_STORE_CTX_get_error(ctx) will still be set to
1074: * DEPTH_ZERO_SELF_....
1075: */
1076: if (ok) {
1077: BIO_printf(bio_err, "error with certificate to be certified - should be self signed\n");
1078: return 0;
1079: } else {
1080: err_cert = X509_STORE_CTX_get_current_cert(ctx);
1081: print_name(bio_err, NULL, X509_get_subject_name(err_cert), 0);
1082: BIO_printf(bio_err, "error with certificate - error %d at depth %d\n%s\n",
1083: err, X509_STORE_CTX_get_error_depth(ctx),
1084: X509_verify_cert_error_string(err));
1085: return 1;
1086: }
1087: }
1088:
1089: /* self sign */
1090: static int
1091: sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest,
1092: CONF *conf, char *section)
1093: {
1094:
1095: EVP_PKEY *pktmp;
1096:
1097: pktmp = X509_get_pubkey(x);
1098: EVP_PKEY_copy_parameters(pktmp, pkey);
1099: EVP_PKEY_save_parameters(pktmp, 1);
1100: EVP_PKEY_free(pktmp);
1101:
1102: if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
1103: goto err;
1104: if (X509_gmtime_adj(X509_get_notBefore(x), 0) == NULL)
1105: goto err;
1106:
1107: /* Lets just make it 12:00am GMT, Jan 1 1970 */
1108: /* memcpy(x->cert_info->validity->notBefore,"700101120000Z",13); */
1109: /* 28 days to be certified */
1110:
1111: if (X509_gmtime_adj(X509_get_notAfter(x),
1112: (long) 60 * 60 * 24 * days) == NULL)
1113: goto err;
1114:
1115: if (!X509_set_pubkey(x, pkey))
1116: goto err;
1117: if (clrext) {
1118: while (X509_get_ext_count(x) > 0)
1119: X509_delete_ext(x, 0);
1120: }
1121: if (conf) {
1122: X509V3_CTX ctx;
1123: X509_set_version(x, 2); /* version 3 certificate */
1124: X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);
1125: X509V3_set_nconf(&ctx, conf);
1126: if (!X509V3_EXT_add_nconf(conf, &ctx, section, x))
1127: goto err;
1128: }
1129: if (!X509_sign(x, pkey, digest))
1130: goto err;
1131: return 1;
1132:
1133: err:
1134: ERR_print_errors(bio_err);
1135: return 0;
1136: }
1137:
1138: static int
1139: purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
1140: {
1141: int id, i, idret;
1142: char *pname;
1143:
1144: id = X509_PURPOSE_get_id(pt);
1145: pname = X509_PURPOSE_get0_name(pt);
1146: for (i = 0; i < 2; i++) {
1147: idret = X509_check_purpose(cert, id, i);
1148: BIO_printf(bio, "%s%s : ", pname, i ? " CA" : "");
1149: if (idret == 1)
1150: BIO_printf(bio, "Yes\n");
1151: else if (idret == 0)
1152: BIO_printf(bio, "No\n");
1153: else
1154: BIO_printf(bio, "Yes (WARNING code=%d)\n", idret);
1155: }
1156: return 1;
1157: }