1*0Sstevel@tonic-gate /* apps/x509.c */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate #include <assert.h> 60*0Sstevel@tonic-gate #include <stdio.h> 61*0Sstevel@tonic-gate #include <stdlib.h> 62*0Sstevel@tonic-gate #include <string.h> 63*0Sstevel@tonic-gate #ifdef OPENSSL_NO_STDIO 64*0Sstevel@tonic-gate #define APPS_WIN16 65*0Sstevel@tonic-gate #endif 66*0Sstevel@tonic-gate #include "apps.h" 67*0Sstevel@tonic-gate #include <openssl/bio.h> 68*0Sstevel@tonic-gate #include <openssl/asn1.h> 69*0Sstevel@tonic-gate #include <openssl/err.h> 70*0Sstevel@tonic-gate #include <openssl/bn.h> 71*0Sstevel@tonic-gate #include <openssl/evp.h> 72*0Sstevel@tonic-gate #include <openssl/x509.h> 73*0Sstevel@tonic-gate #include <openssl/x509v3.h> 74*0Sstevel@tonic-gate #include <openssl/objects.h> 75*0Sstevel@tonic-gate #include <openssl/pem.h> 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate #undef PROG 78*0Sstevel@tonic-gate #define PROG x509_main 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate #undef POSTFIX 81*0Sstevel@tonic-gate #define POSTFIX ".srl" 82*0Sstevel@tonic-gate #define DEF_DAYS 30 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate static char *x509_usage[]={ 85*0Sstevel@tonic-gate "usage: x509 args\n", 86*0Sstevel@tonic-gate " -inform arg - input format - default PEM (one of DER, NET or PEM)\n", 87*0Sstevel@tonic-gate " -outform arg - output format - default PEM (one of DER, NET or PEM)\n", 88*0Sstevel@tonic-gate " -keyform arg - private key format - default PEM\n", 89*0Sstevel@tonic-gate " -CAform arg - CA format - default PEM\n", 90*0Sstevel@tonic-gate " -CAkeyform arg - CA key format - default PEM\n", 91*0Sstevel@tonic-gate " -in arg - input file - default stdin\n", 92*0Sstevel@tonic-gate " -out arg - output file - default stdout\n", 93*0Sstevel@tonic-gate " -passin arg - private key password source\n", 94*0Sstevel@tonic-gate " -serial - print serial number value\n", 95*0Sstevel@tonic-gate " -hash - print hash value\n", 96*0Sstevel@tonic-gate " -subject - print subject DN\n", 97*0Sstevel@tonic-gate " -issuer - print issuer DN\n", 98*0Sstevel@tonic-gate " -email - print email address(es)\n", 99*0Sstevel@tonic-gate " -startdate - notBefore field\n", 100*0Sstevel@tonic-gate " -enddate - notAfter field\n", 101*0Sstevel@tonic-gate " -purpose - print out certificate purposes\n", 102*0Sstevel@tonic-gate " -dates - both Before and After dates\n", 103*0Sstevel@tonic-gate " -modulus - print the RSA key modulus\n", 104*0Sstevel@tonic-gate " -pubkey - output the public key\n", 105*0Sstevel@tonic-gate " -fingerprint - print the certificate fingerprint\n", 106*0Sstevel@tonic-gate " -alias - output certificate alias\n", 107*0Sstevel@tonic-gate " -noout - no certificate output\n", 108*0Sstevel@tonic-gate " -ocspid - print OCSP hash values for the subject name and public key\n", 109*0Sstevel@tonic-gate " -trustout - output a \"trusted\" certificate\n", 110*0Sstevel@tonic-gate " -clrtrust - clear all trusted purposes\n", 111*0Sstevel@tonic-gate " -clrreject - clear all rejected purposes\n", 112*0Sstevel@tonic-gate " -addtrust arg - trust certificate for a given purpose\n", 113*0Sstevel@tonic-gate " -addreject arg - reject certificate for a given purpose\n", 114*0Sstevel@tonic-gate " -setalias arg - set certificate alias\n", 115*0Sstevel@tonic-gate " -days arg - How long till expiry of a signed certificate - def 30 days\n", 116*0Sstevel@tonic-gate " -checkend arg - check whether the cert expires in the next arg seconds\n", 117*0Sstevel@tonic-gate " exit 1 if so, 0 if not\n", 118*0Sstevel@tonic-gate " -signkey arg - self sign cert with arg\n", 119*0Sstevel@tonic-gate " -x509toreq - output a certification request object\n", 120*0Sstevel@tonic-gate " -req - input is a certificate request, sign and output.\n", 121*0Sstevel@tonic-gate " -CA arg - set the CA certificate, must be PEM format.\n", 122*0Sstevel@tonic-gate " -CAkey arg - set the CA key, must be PEM format\n", 123*0Sstevel@tonic-gate " missing, it is assumed to be in the CA file.\n", 124*0Sstevel@tonic-gate " -CAcreateserial - create serial number file if it does not exist\n", 125*0Sstevel@tonic-gate " -CAserial arg - serial file\n", 126*0Sstevel@tonic-gate " -set_serial - serial number to use\n", 127*0Sstevel@tonic-gate " -text - print the certificate in text form\n", 128*0Sstevel@tonic-gate " -C - print out C code forms\n", 129*0Sstevel@tonic-gate " -md2/-md5/-sha1/-mdc2 - digest to use\n", 130*0Sstevel@tonic-gate " -extfile - configuration file with X509V3 extensions to add\n", 131*0Sstevel@tonic-gate " -extensions - section from config file with X509V3 extensions to add\n", 132*0Sstevel@tonic-gate " -clrext - delete extensions before signing and input certificate\n", 133*0Sstevel@tonic-gate " -nameopt arg - various certificate name options\n", 134*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 135*0Sstevel@tonic-gate " -engine e - use engine e, possibly a hardware device.\n", 136*0Sstevel@tonic-gate #endif 137*0Sstevel@tonic-gate " -certopt arg - various certificate text options\n", 138*0Sstevel@tonic-gate NULL 139*0Sstevel@tonic-gate }; 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx); 142*0Sstevel@tonic-gate static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest, 143*0Sstevel@tonic-gate CONF *conf, char *section); 144*0Sstevel@tonic-gate static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest, 145*0Sstevel@tonic-gate X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial, 146*0Sstevel@tonic-gate int create,int days, int clrext, CONF *conf, char *section, 147*0Sstevel@tonic-gate ASN1_INTEGER *sno); 148*0Sstevel@tonic-gate static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt); 149*0Sstevel@tonic-gate static int reqfile=0; 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate int MAIN(int, char **); 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate int MAIN(int argc, char **argv) 154*0Sstevel@tonic-gate { 155*0Sstevel@tonic-gate ENGINE *e = NULL; 156*0Sstevel@tonic-gate int ret=1; 157*0Sstevel@tonic-gate X509_REQ *req=NULL; 158*0Sstevel@tonic-gate X509 *x=NULL,*xca=NULL; 159*0Sstevel@tonic-gate ASN1_OBJECT *objtmp; 160*0Sstevel@tonic-gate EVP_PKEY *Upkey=NULL,*CApkey=NULL; 161*0Sstevel@tonic-gate ASN1_INTEGER *sno = NULL; 162*0Sstevel@tonic-gate int i,num,badops=0; 163*0Sstevel@tonic-gate BIO *out=NULL; 164*0Sstevel@tonic-gate BIO *STDout=NULL; 165*0Sstevel@tonic-gate STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL; 166*0Sstevel@tonic-gate int informat,outformat,keyformat,CAformat,CAkeyformat; 167*0Sstevel@tonic-gate char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL; 168*0Sstevel@tonic-gate char *CAkeyfile=NULL,*CAserial=NULL; 169*0Sstevel@tonic-gate char *alias=NULL; 170*0Sstevel@tonic-gate int text=0,serial=0,hash=0,subject=0,issuer=0,startdate=0,enddate=0; 171*0Sstevel@tonic-gate int ocspid=0; 172*0Sstevel@tonic-gate int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0; 173*0Sstevel@tonic-gate int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0; 174*0Sstevel@tonic-gate int C=0; 175*0Sstevel@tonic-gate int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0; 176*0Sstevel@tonic-gate int pprint = 0; 177*0Sstevel@tonic-gate char **pp; 178*0Sstevel@tonic-gate X509_STORE *ctx=NULL; 179*0Sstevel@tonic-gate X509_REQ *rq=NULL; 180*0Sstevel@tonic-gate int fingerprint=0; 181*0Sstevel@tonic-gate char buf[256]; 182*0Sstevel@tonic-gate const EVP_MD *md_alg,*digest=EVP_md5(); 183*0Sstevel@tonic-gate CONF *extconf = NULL; 184*0Sstevel@tonic-gate char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL; 185*0Sstevel@tonic-gate int need_rand = 0; 186*0Sstevel@tonic-gate int checkend=0,checkoffset=0; 187*0Sstevel@tonic-gate unsigned long nmflag = 0, certflag = 0; 188*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 189*0Sstevel@tonic-gate char *engine=NULL; 190*0Sstevel@tonic-gate #endif 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate reqfile=0; 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate apps_startup(); 195*0Sstevel@tonic-gate 196*0Sstevel@tonic-gate if (bio_err == NULL) 197*0Sstevel@tonic-gate bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); 198*0Sstevel@tonic-gate 199*0Sstevel@tonic-gate if (!load_config(bio_err, NULL)) 200*0Sstevel@tonic-gate goto end; 201*0Sstevel@tonic-gate STDout=BIO_new_fp(stdout,BIO_NOCLOSE); 202*0Sstevel@tonic-gate #ifdef OPENSSL_SYS_VMS 203*0Sstevel@tonic-gate { 204*0Sstevel@tonic-gate BIO *tmpbio = BIO_new(BIO_f_linebuffer()); 205*0Sstevel@tonic-gate STDout = BIO_push(tmpbio, STDout); 206*0Sstevel@tonic-gate } 207*0Sstevel@tonic-gate #endif 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate informat=FORMAT_PEM; 210*0Sstevel@tonic-gate outformat=FORMAT_PEM; 211*0Sstevel@tonic-gate keyformat=FORMAT_PEM; 212*0Sstevel@tonic-gate CAformat=FORMAT_PEM; 213*0Sstevel@tonic-gate CAkeyformat=FORMAT_PEM; 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate ctx=X509_STORE_new(); 216*0Sstevel@tonic-gate if (ctx == NULL) goto end; 217*0Sstevel@tonic-gate X509_STORE_set_verify_cb_func(ctx,callb); 218*0Sstevel@tonic-gate 219*0Sstevel@tonic-gate argc--; 220*0Sstevel@tonic-gate argv++; 221*0Sstevel@tonic-gate num=0; 222*0Sstevel@tonic-gate while (argc >= 1) 223*0Sstevel@tonic-gate { 224*0Sstevel@tonic-gate if (strcmp(*argv,"-inform") == 0) 225*0Sstevel@tonic-gate { 226*0Sstevel@tonic-gate if (--argc < 1) goto bad; 227*0Sstevel@tonic-gate informat=str2fmt(*(++argv)); 228*0Sstevel@tonic-gate } 229*0Sstevel@tonic-gate else if (strcmp(*argv,"-outform") == 0) 230*0Sstevel@tonic-gate { 231*0Sstevel@tonic-gate if (--argc < 1) goto bad; 232*0Sstevel@tonic-gate outformat=str2fmt(*(++argv)); 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate else if (strcmp(*argv,"-keyform") == 0) 235*0Sstevel@tonic-gate { 236*0Sstevel@tonic-gate if (--argc < 1) goto bad; 237*0Sstevel@tonic-gate keyformat=str2fmt(*(++argv)); 238*0Sstevel@tonic-gate } 239*0Sstevel@tonic-gate else if (strcmp(*argv,"-req") == 0) 240*0Sstevel@tonic-gate { 241*0Sstevel@tonic-gate reqfile=1; 242*0Sstevel@tonic-gate need_rand = 1; 243*0Sstevel@tonic-gate } 244*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAform") == 0) 245*0Sstevel@tonic-gate { 246*0Sstevel@tonic-gate if (--argc < 1) goto bad; 247*0Sstevel@tonic-gate CAformat=str2fmt(*(++argv)); 248*0Sstevel@tonic-gate } 249*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAkeyform") == 0) 250*0Sstevel@tonic-gate { 251*0Sstevel@tonic-gate if (--argc < 1) goto bad; 252*0Sstevel@tonic-gate CAkeyformat=str2fmt(*(++argv)); 253*0Sstevel@tonic-gate } 254*0Sstevel@tonic-gate else if (strcmp(*argv,"-days") == 0) 255*0Sstevel@tonic-gate { 256*0Sstevel@tonic-gate if (--argc < 1) goto bad; 257*0Sstevel@tonic-gate days=atoi(*(++argv)); 258*0Sstevel@tonic-gate if (days == 0) 259*0Sstevel@tonic-gate { 260*0Sstevel@tonic-gate BIO_printf(STDout,"bad number of days\n"); 261*0Sstevel@tonic-gate goto bad; 262*0Sstevel@tonic-gate } 263*0Sstevel@tonic-gate } 264*0Sstevel@tonic-gate else if (strcmp(*argv,"-passin") == 0) 265*0Sstevel@tonic-gate { 266*0Sstevel@tonic-gate if (--argc < 1) goto bad; 267*0Sstevel@tonic-gate passargin= *(++argv); 268*0Sstevel@tonic-gate } 269*0Sstevel@tonic-gate else if (strcmp(*argv,"-extfile") == 0) 270*0Sstevel@tonic-gate { 271*0Sstevel@tonic-gate if (--argc < 1) goto bad; 272*0Sstevel@tonic-gate extfile= *(++argv); 273*0Sstevel@tonic-gate } 274*0Sstevel@tonic-gate else if (strcmp(*argv,"-extensions") == 0) 275*0Sstevel@tonic-gate { 276*0Sstevel@tonic-gate if (--argc < 1) goto bad; 277*0Sstevel@tonic-gate extsect= *(++argv); 278*0Sstevel@tonic-gate } 279*0Sstevel@tonic-gate else if (strcmp(*argv,"-in") == 0) 280*0Sstevel@tonic-gate { 281*0Sstevel@tonic-gate if (--argc < 1) goto bad; 282*0Sstevel@tonic-gate infile= *(++argv); 283*0Sstevel@tonic-gate } 284*0Sstevel@tonic-gate else if (strcmp(*argv,"-out") == 0) 285*0Sstevel@tonic-gate { 286*0Sstevel@tonic-gate if (--argc < 1) goto bad; 287*0Sstevel@tonic-gate outfile= *(++argv); 288*0Sstevel@tonic-gate } 289*0Sstevel@tonic-gate else if (strcmp(*argv,"-signkey") == 0) 290*0Sstevel@tonic-gate { 291*0Sstevel@tonic-gate if (--argc < 1) goto bad; 292*0Sstevel@tonic-gate keyfile= *(++argv); 293*0Sstevel@tonic-gate sign_flag= ++num; 294*0Sstevel@tonic-gate need_rand = 1; 295*0Sstevel@tonic-gate } 296*0Sstevel@tonic-gate else if (strcmp(*argv,"-CA") == 0) 297*0Sstevel@tonic-gate { 298*0Sstevel@tonic-gate if (--argc < 1) goto bad; 299*0Sstevel@tonic-gate CAfile= *(++argv); 300*0Sstevel@tonic-gate CA_flag= ++num; 301*0Sstevel@tonic-gate need_rand = 1; 302*0Sstevel@tonic-gate } 303*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAkey") == 0) 304*0Sstevel@tonic-gate { 305*0Sstevel@tonic-gate if (--argc < 1) goto bad; 306*0Sstevel@tonic-gate CAkeyfile= *(++argv); 307*0Sstevel@tonic-gate } 308*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAserial") == 0) 309*0Sstevel@tonic-gate { 310*0Sstevel@tonic-gate if (--argc < 1) goto bad; 311*0Sstevel@tonic-gate CAserial= *(++argv); 312*0Sstevel@tonic-gate } 313*0Sstevel@tonic-gate else if (strcmp(*argv,"-set_serial") == 0) 314*0Sstevel@tonic-gate { 315*0Sstevel@tonic-gate if (--argc < 1) goto bad; 316*0Sstevel@tonic-gate if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv)))) 317*0Sstevel@tonic-gate goto bad; 318*0Sstevel@tonic-gate } 319*0Sstevel@tonic-gate else if (strcmp(*argv,"-addtrust") == 0) 320*0Sstevel@tonic-gate { 321*0Sstevel@tonic-gate if (--argc < 1) goto bad; 322*0Sstevel@tonic-gate if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) 323*0Sstevel@tonic-gate { 324*0Sstevel@tonic-gate BIO_printf(bio_err, 325*0Sstevel@tonic-gate "Invalid trust object value %s\n", *argv); 326*0Sstevel@tonic-gate goto bad; 327*0Sstevel@tonic-gate } 328*0Sstevel@tonic-gate if (!trust) trust = sk_ASN1_OBJECT_new_null(); 329*0Sstevel@tonic-gate sk_ASN1_OBJECT_push(trust, objtmp); 330*0Sstevel@tonic-gate trustout = 1; 331*0Sstevel@tonic-gate } 332*0Sstevel@tonic-gate else if (strcmp(*argv,"-addreject") == 0) 333*0Sstevel@tonic-gate { 334*0Sstevel@tonic-gate if (--argc < 1) goto bad; 335*0Sstevel@tonic-gate if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) 336*0Sstevel@tonic-gate { 337*0Sstevel@tonic-gate BIO_printf(bio_err, 338*0Sstevel@tonic-gate "Invalid reject object value %s\n", *argv); 339*0Sstevel@tonic-gate goto bad; 340*0Sstevel@tonic-gate } 341*0Sstevel@tonic-gate if (!reject) reject = sk_ASN1_OBJECT_new_null(); 342*0Sstevel@tonic-gate sk_ASN1_OBJECT_push(reject, objtmp); 343*0Sstevel@tonic-gate trustout = 1; 344*0Sstevel@tonic-gate } 345*0Sstevel@tonic-gate else if (strcmp(*argv,"-setalias") == 0) 346*0Sstevel@tonic-gate { 347*0Sstevel@tonic-gate if (--argc < 1) goto bad; 348*0Sstevel@tonic-gate alias= *(++argv); 349*0Sstevel@tonic-gate trustout = 1; 350*0Sstevel@tonic-gate } 351*0Sstevel@tonic-gate else if (strcmp(*argv,"-certopt") == 0) 352*0Sstevel@tonic-gate { 353*0Sstevel@tonic-gate if (--argc < 1) goto bad; 354*0Sstevel@tonic-gate if (!set_cert_ex(&certflag, *(++argv))) goto bad; 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate else if (strcmp(*argv,"-nameopt") == 0) 357*0Sstevel@tonic-gate { 358*0Sstevel@tonic-gate if (--argc < 1) goto bad; 359*0Sstevel@tonic-gate if (!set_name_ex(&nmflag, *(++argv))) goto bad; 360*0Sstevel@tonic-gate } 361*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 362*0Sstevel@tonic-gate else if (strcmp(*argv,"-engine") == 0) 363*0Sstevel@tonic-gate { 364*0Sstevel@tonic-gate if (--argc < 1) goto bad; 365*0Sstevel@tonic-gate engine= *(++argv); 366*0Sstevel@tonic-gate } 367*0Sstevel@tonic-gate #endif 368*0Sstevel@tonic-gate else if (strcmp(*argv,"-C") == 0) 369*0Sstevel@tonic-gate C= ++num; 370*0Sstevel@tonic-gate else if (strcmp(*argv,"-email") == 0) 371*0Sstevel@tonic-gate email= ++num; 372*0Sstevel@tonic-gate else if (strcmp(*argv,"-serial") == 0) 373*0Sstevel@tonic-gate serial= ++num; 374*0Sstevel@tonic-gate else if (strcmp(*argv,"-modulus") == 0) 375*0Sstevel@tonic-gate modulus= ++num; 376*0Sstevel@tonic-gate else if (strcmp(*argv,"-pubkey") == 0) 377*0Sstevel@tonic-gate pubkey= ++num; 378*0Sstevel@tonic-gate else if (strcmp(*argv,"-x509toreq") == 0) 379*0Sstevel@tonic-gate x509req= ++num; 380*0Sstevel@tonic-gate else if (strcmp(*argv,"-text") == 0) 381*0Sstevel@tonic-gate text= ++num; 382*0Sstevel@tonic-gate else if (strcmp(*argv,"-hash") == 0) 383*0Sstevel@tonic-gate hash= ++num; 384*0Sstevel@tonic-gate else if (strcmp(*argv,"-subject") == 0) 385*0Sstevel@tonic-gate subject= ++num; 386*0Sstevel@tonic-gate else if (strcmp(*argv,"-issuer") == 0) 387*0Sstevel@tonic-gate issuer= ++num; 388*0Sstevel@tonic-gate else if (strcmp(*argv,"-fingerprint") == 0) 389*0Sstevel@tonic-gate fingerprint= ++num; 390*0Sstevel@tonic-gate else if (strcmp(*argv,"-dates") == 0) 391*0Sstevel@tonic-gate { 392*0Sstevel@tonic-gate startdate= ++num; 393*0Sstevel@tonic-gate enddate= ++num; 394*0Sstevel@tonic-gate } 395*0Sstevel@tonic-gate else if (strcmp(*argv,"-purpose") == 0) 396*0Sstevel@tonic-gate pprint= ++num; 397*0Sstevel@tonic-gate else if (strcmp(*argv,"-startdate") == 0) 398*0Sstevel@tonic-gate startdate= ++num; 399*0Sstevel@tonic-gate else if (strcmp(*argv,"-enddate") == 0) 400*0Sstevel@tonic-gate enddate= ++num; 401*0Sstevel@tonic-gate else if (strcmp(*argv,"-checkend") == 0) 402*0Sstevel@tonic-gate { 403*0Sstevel@tonic-gate if (--argc < 1) goto bad; 404*0Sstevel@tonic-gate checkoffset=atoi(*(++argv)); 405*0Sstevel@tonic-gate checkend=1; 406*0Sstevel@tonic-gate } 407*0Sstevel@tonic-gate else if (strcmp(*argv,"-noout") == 0) 408*0Sstevel@tonic-gate noout= ++num; 409*0Sstevel@tonic-gate else if (strcmp(*argv,"-trustout") == 0) 410*0Sstevel@tonic-gate trustout= 1; 411*0Sstevel@tonic-gate else if (strcmp(*argv,"-clrtrust") == 0) 412*0Sstevel@tonic-gate clrtrust= ++num; 413*0Sstevel@tonic-gate else if (strcmp(*argv,"-clrreject") == 0) 414*0Sstevel@tonic-gate clrreject= ++num; 415*0Sstevel@tonic-gate else if (strcmp(*argv,"-alias") == 0) 416*0Sstevel@tonic-gate aliasout= ++num; 417*0Sstevel@tonic-gate else if (strcmp(*argv,"-CAcreateserial") == 0) 418*0Sstevel@tonic-gate CA_createserial= ++num; 419*0Sstevel@tonic-gate else if (strcmp(*argv,"-clrext") == 0) 420*0Sstevel@tonic-gate clrext = 1; 421*0Sstevel@tonic-gate #if 1 /* stay backwards-compatible with 0.9.5; this should go away soon */ 422*0Sstevel@tonic-gate else if (strcmp(*argv,"-crlext") == 0) 423*0Sstevel@tonic-gate { 424*0Sstevel@tonic-gate BIO_printf(bio_err,"use -clrext instead of -crlext\n"); 425*0Sstevel@tonic-gate clrext = 1; 426*0Sstevel@tonic-gate } 427*0Sstevel@tonic-gate #endif 428*0Sstevel@tonic-gate else if (strcmp(*argv,"-ocspid") == 0) 429*0Sstevel@tonic-gate ocspid= ++num; 430*0Sstevel@tonic-gate else if ((md_alg=EVP_get_digestbyname(*argv + 1))) 431*0Sstevel@tonic-gate { 432*0Sstevel@tonic-gate /* ok */ 433*0Sstevel@tonic-gate digest=md_alg; 434*0Sstevel@tonic-gate } 435*0Sstevel@tonic-gate else 436*0Sstevel@tonic-gate { 437*0Sstevel@tonic-gate BIO_printf(bio_err,"unknown option %s\n",*argv); 438*0Sstevel@tonic-gate badops=1; 439*0Sstevel@tonic-gate break; 440*0Sstevel@tonic-gate } 441*0Sstevel@tonic-gate argc--; 442*0Sstevel@tonic-gate argv++; 443*0Sstevel@tonic-gate } 444*0Sstevel@tonic-gate 445*0Sstevel@tonic-gate if (badops) 446*0Sstevel@tonic-gate { 447*0Sstevel@tonic-gate bad: 448*0Sstevel@tonic-gate for (pp=x509_usage; (*pp != NULL); pp++) 449*0Sstevel@tonic-gate BIO_printf(bio_err,"%s",*pp); 450*0Sstevel@tonic-gate goto end; 451*0Sstevel@tonic-gate } 452*0Sstevel@tonic-gate 453*0Sstevel@tonic-gate #ifndef OPENSSL_NO_ENGINE 454*0Sstevel@tonic-gate e = setup_engine(bio_err, engine, 0); 455*0Sstevel@tonic-gate #endif 456*0Sstevel@tonic-gate 457*0Sstevel@tonic-gate if (need_rand) 458*0Sstevel@tonic-gate app_RAND_load_file(NULL, bio_err, 0); 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate ERR_load_crypto_strings(); 461*0Sstevel@tonic-gate 462*0Sstevel@tonic-gate if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) 463*0Sstevel@tonic-gate { 464*0Sstevel@tonic-gate BIO_printf(bio_err, "Error getting password\n"); 465*0Sstevel@tonic-gate goto end; 466*0Sstevel@tonic-gate } 467*0Sstevel@tonic-gate 468*0Sstevel@tonic-gate if (!X509_STORE_set_default_paths(ctx)) 469*0Sstevel@tonic-gate { 470*0Sstevel@tonic-gate ERR_print_errors(bio_err); 471*0Sstevel@tonic-gate goto end; 472*0Sstevel@tonic-gate } 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM)) 475*0Sstevel@tonic-gate { CAkeyfile=CAfile; } 476*0Sstevel@tonic-gate else if ((CA_flag) && (CAkeyfile == NULL)) 477*0Sstevel@tonic-gate { 478*0Sstevel@tonic-gate BIO_printf(bio_err,"need to specify a CAkey if using the CA command\n"); 479*0Sstevel@tonic-gate goto end; 480*0Sstevel@tonic-gate } 481*0Sstevel@tonic-gate 482*0Sstevel@tonic-gate if (extfile) 483*0Sstevel@tonic-gate { 484*0Sstevel@tonic-gate long errorline = -1; 485*0Sstevel@tonic-gate X509V3_CTX ctx2; 486*0Sstevel@tonic-gate extconf = NCONF_new(NULL); 487*0Sstevel@tonic-gate if (!NCONF_load(extconf, extfile,&errorline)) 488*0Sstevel@tonic-gate { 489*0Sstevel@tonic-gate if (errorline <= 0) 490*0Sstevel@tonic-gate BIO_printf(bio_err, 491*0Sstevel@tonic-gate "error loading the config file '%s'\n", 492*0Sstevel@tonic-gate extfile); 493*0Sstevel@tonic-gate else 494*0Sstevel@tonic-gate BIO_printf(bio_err, 495*0Sstevel@tonic-gate "error on line %ld of config file '%s'\n" 496*0Sstevel@tonic-gate ,errorline,extfile); 497*0Sstevel@tonic-gate goto end; 498*0Sstevel@tonic-gate } 499*0Sstevel@tonic-gate if (!extsect) 500*0Sstevel@tonic-gate { 501*0Sstevel@tonic-gate extsect = NCONF_get_string(extconf, "default", "extensions"); 502*0Sstevel@tonic-gate if (!extsect) 503*0Sstevel@tonic-gate { 504*0Sstevel@tonic-gate ERR_clear_error(); 505*0Sstevel@tonic-gate extsect = "default"; 506*0Sstevel@tonic-gate } 507*0Sstevel@tonic-gate } 508*0Sstevel@tonic-gate X509V3_set_ctx_test(&ctx2); 509*0Sstevel@tonic-gate X509V3_set_nconf(&ctx2, extconf); 510*0Sstevel@tonic-gate if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL)) 511*0Sstevel@tonic-gate { 512*0Sstevel@tonic-gate BIO_printf(bio_err, 513*0Sstevel@tonic-gate "Error Loading extension section %s\n", 514*0Sstevel@tonic-gate extsect); 515*0Sstevel@tonic-gate ERR_print_errors(bio_err); 516*0Sstevel@tonic-gate goto end; 517*0Sstevel@tonic-gate } 518*0Sstevel@tonic-gate } 519*0Sstevel@tonic-gate 520*0Sstevel@tonic-gate 521*0Sstevel@tonic-gate if (reqfile) 522*0Sstevel@tonic-gate { 523*0Sstevel@tonic-gate EVP_PKEY *pkey; 524*0Sstevel@tonic-gate X509_CINF *ci; 525*0Sstevel@tonic-gate BIO *in; 526*0Sstevel@tonic-gate 527*0Sstevel@tonic-gate if (!sign_flag && !CA_flag) 528*0Sstevel@tonic-gate { 529*0Sstevel@tonic-gate BIO_printf(bio_err,"We need a private key to sign with\n"); 530*0Sstevel@tonic-gate goto end; 531*0Sstevel@tonic-gate } 532*0Sstevel@tonic-gate in=BIO_new(BIO_s_file()); 533*0Sstevel@tonic-gate if (in == NULL) 534*0Sstevel@tonic-gate { 535*0Sstevel@tonic-gate ERR_print_errors(bio_err); 536*0Sstevel@tonic-gate goto end; 537*0Sstevel@tonic-gate } 538*0Sstevel@tonic-gate 539*0Sstevel@tonic-gate if (infile == NULL) 540*0Sstevel@tonic-gate BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT); 541*0Sstevel@tonic-gate else 542*0Sstevel@tonic-gate { 543*0Sstevel@tonic-gate if (BIO_read_filename(in,infile) <= 0) 544*0Sstevel@tonic-gate { 545*0Sstevel@tonic-gate perror(infile); 546*0Sstevel@tonic-gate BIO_free(in); 547*0Sstevel@tonic-gate goto end; 548*0Sstevel@tonic-gate } 549*0Sstevel@tonic-gate } 550*0Sstevel@tonic-gate req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL); 551*0Sstevel@tonic-gate BIO_free(in); 552*0Sstevel@tonic-gate 553*0Sstevel@tonic-gate if (req == NULL) 554*0Sstevel@tonic-gate { 555*0Sstevel@tonic-gate ERR_print_errors(bio_err); 556*0Sstevel@tonic-gate goto end; 557*0Sstevel@tonic-gate } 558*0Sstevel@tonic-gate 559*0Sstevel@tonic-gate if ( (req->req_info == NULL) || 560*0Sstevel@tonic-gate (req->req_info->pubkey == NULL) || 561*0Sstevel@tonic-gate (req->req_info->pubkey->public_key == NULL) || 562*0Sstevel@tonic-gate (req->req_info->pubkey->public_key->data == NULL)) 563*0Sstevel@tonic-gate { 564*0Sstevel@tonic-gate BIO_printf(bio_err,"The certificate request appears to corrupted\n"); 565*0Sstevel@tonic-gate BIO_printf(bio_err,"It does not contain a public key\n"); 566*0Sstevel@tonic-gate goto end; 567*0Sstevel@tonic-gate } 568*0Sstevel@tonic-gate if ((pkey=X509_REQ_get_pubkey(req)) == NULL) 569*0Sstevel@tonic-gate { 570*0Sstevel@tonic-gate BIO_printf(bio_err,"error unpacking public key\n"); 571*0Sstevel@tonic-gate goto end; 572*0Sstevel@tonic-gate } 573*0Sstevel@tonic-gate i=X509_REQ_verify(req,pkey); 574*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 575*0Sstevel@tonic-gate if (i < 0) 576*0Sstevel@tonic-gate { 577*0Sstevel@tonic-gate BIO_printf(bio_err,"Signature verification error\n"); 578*0Sstevel@tonic-gate ERR_print_errors(bio_err); 579*0Sstevel@tonic-gate goto end; 580*0Sstevel@tonic-gate } 581*0Sstevel@tonic-gate if (i == 0) 582*0Sstevel@tonic-gate { 583*0Sstevel@tonic-gate BIO_printf(bio_err,"Signature did not match the certificate request\n"); 584*0Sstevel@tonic-gate goto end; 585*0Sstevel@tonic-gate } 586*0Sstevel@tonic-gate else 587*0Sstevel@tonic-gate BIO_printf(bio_err,"Signature ok\n"); 588*0Sstevel@tonic-gate 589*0Sstevel@tonic-gate print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag); 590*0Sstevel@tonic-gate 591*0Sstevel@tonic-gate if ((x=X509_new()) == NULL) goto end; 592*0Sstevel@tonic-gate ci=x->cert_info; 593*0Sstevel@tonic-gate 594*0Sstevel@tonic-gate if (sno) 595*0Sstevel@tonic-gate { 596*0Sstevel@tonic-gate if (!X509_set_serialNumber(x, sno)) 597*0Sstevel@tonic-gate goto end; 598*0Sstevel@tonic-gate } 599*0Sstevel@tonic-gate else if (!ASN1_INTEGER_set(X509_get_serialNumber(x),0)) goto end; 600*0Sstevel@tonic-gate if (!X509_set_issuer_name(x,req->req_info->subject)) goto end; 601*0Sstevel@tonic-gate if (!X509_set_subject_name(x,req->req_info->subject)) goto end; 602*0Sstevel@tonic-gate 603*0Sstevel@tonic-gate X509_gmtime_adj(X509_get_notBefore(x),0); 604*0Sstevel@tonic-gate X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days); 605*0Sstevel@tonic-gate 606*0Sstevel@tonic-gate pkey = X509_REQ_get_pubkey(req); 607*0Sstevel@tonic-gate X509_set_pubkey(x,pkey); 608*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 609*0Sstevel@tonic-gate } 610*0Sstevel@tonic-gate else 611*0Sstevel@tonic-gate x=load_cert(bio_err,infile,informat,NULL,e,"Certificate"); 612*0Sstevel@tonic-gate 613*0Sstevel@tonic-gate if (x == NULL) goto end; 614*0Sstevel@tonic-gate if (CA_flag) 615*0Sstevel@tonic-gate { 616*0Sstevel@tonic-gate xca=load_cert(bio_err,CAfile,CAformat,NULL,e,"CA Certificate"); 617*0Sstevel@tonic-gate if (xca == NULL) goto end; 618*0Sstevel@tonic-gate } 619*0Sstevel@tonic-gate 620*0Sstevel@tonic-gate if (!noout || text) 621*0Sstevel@tonic-gate { 622*0Sstevel@tonic-gate OBJ_create("2.99999.3", 623*0Sstevel@tonic-gate "SET.ex3","SET x509v3 extension 3"); 624*0Sstevel@tonic-gate 625*0Sstevel@tonic-gate out=BIO_new(BIO_s_file()); 626*0Sstevel@tonic-gate if (out == NULL) 627*0Sstevel@tonic-gate { 628*0Sstevel@tonic-gate ERR_print_errors(bio_err); 629*0Sstevel@tonic-gate goto end; 630*0Sstevel@tonic-gate } 631*0Sstevel@tonic-gate if (outfile == NULL) 632*0Sstevel@tonic-gate { 633*0Sstevel@tonic-gate BIO_set_fp(out,stdout,BIO_NOCLOSE); 634*0Sstevel@tonic-gate #ifdef OPENSSL_SYS_VMS 635*0Sstevel@tonic-gate { 636*0Sstevel@tonic-gate BIO *tmpbio = BIO_new(BIO_f_linebuffer()); 637*0Sstevel@tonic-gate out = BIO_push(tmpbio, out); 638*0Sstevel@tonic-gate } 639*0Sstevel@tonic-gate #endif 640*0Sstevel@tonic-gate } 641*0Sstevel@tonic-gate else 642*0Sstevel@tonic-gate { 643*0Sstevel@tonic-gate if (BIO_write_filename(out,outfile) <= 0) 644*0Sstevel@tonic-gate { 645*0Sstevel@tonic-gate perror(outfile); 646*0Sstevel@tonic-gate goto end; 647*0Sstevel@tonic-gate } 648*0Sstevel@tonic-gate } 649*0Sstevel@tonic-gate } 650*0Sstevel@tonic-gate 651*0Sstevel@tonic-gate if (alias) X509_alias_set1(x, (unsigned char *)alias, -1); 652*0Sstevel@tonic-gate 653*0Sstevel@tonic-gate if (clrtrust) X509_trust_clear(x); 654*0Sstevel@tonic-gate if (clrreject) X509_reject_clear(x); 655*0Sstevel@tonic-gate 656*0Sstevel@tonic-gate if (trust) 657*0Sstevel@tonic-gate { 658*0Sstevel@tonic-gate for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) 659*0Sstevel@tonic-gate { 660*0Sstevel@tonic-gate objtmp = sk_ASN1_OBJECT_value(trust, i); 661*0Sstevel@tonic-gate X509_add1_trust_object(x, objtmp); 662*0Sstevel@tonic-gate } 663*0Sstevel@tonic-gate } 664*0Sstevel@tonic-gate 665*0Sstevel@tonic-gate if (reject) 666*0Sstevel@tonic-gate { 667*0Sstevel@tonic-gate for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) 668*0Sstevel@tonic-gate { 669*0Sstevel@tonic-gate objtmp = sk_ASN1_OBJECT_value(reject, i); 670*0Sstevel@tonic-gate X509_add1_reject_object(x, objtmp); 671*0Sstevel@tonic-gate } 672*0Sstevel@tonic-gate } 673*0Sstevel@tonic-gate 674*0Sstevel@tonic-gate if (num) 675*0Sstevel@tonic-gate { 676*0Sstevel@tonic-gate for (i=1; i<=num; i++) 677*0Sstevel@tonic-gate { 678*0Sstevel@tonic-gate if (issuer == i) 679*0Sstevel@tonic-gate { 680*0Sstevel@tonic-gate print_name(STDout, "issuer= ", 681*0Sstevel@tonic-gate X509_get_issuer_name(x), nmflag); 682*0Sstevel@tonic-gate } 683*0Sstevel@tonic-gate else if (subject == i) 684*0Sstevel@tonic-gate { 685*0Sstevel@tonic-gate print_name(STDout, "subject= ", 686*0Sstevel@tonic-gate X509_get_subject_name(x), nmflag); 687*0Sstevel@tonic-gate } 688*0Sstevel@tonic-gate else if (serial == i) 689*0Sstevel@tonic-gate { 690*0Sstevel@tonic-gate BIO_printf(STDout,"serial="); 691*0Sstevel@tonic-gate i2a_ASN1_INTEGER(STDout,x->cert_info->serialNumber); 692*0Sstevel@tonic-gate BIO_printf(STDout,"\n"); 693*0Sstevel@tonic-gate } 694*0Sstevel@tonic-gate else if (email == i) 695*0Sstevel@tonic-gate { 696*0Sstevel@tonic-gate int j; 697*0Sstevel@tonic-gate STACK *emlst; 698*0Sstevel@tonic-gate emlst = X509_get1_email(x); 699*0Sstevel@tonic-gate for (j = 0; j < sk_num(emlst); j++) 700*0Sstevel@tonic-gate BIO_printf(STDout, "%s\n", sk_value(emlst, j)); 701*0Sstevel@tonic-gate X509_email_free(emlst); 702*0Sstevel@tonic-gate } 703*0Sstevel@tonic-gate else if (aliasout == i) 704*0Sstevel@tonic-gate { 705*0Sstevel@tonic-gate unsigned char *alstr; 706*0Sstevel@tonic-gate alstr = X509_alias_get0(x, NULL); 707*0Sstevel@tonic-gate if (alstr) BIO_printf(STDout,"%s\n", alstr); 708*0Sstevel@tonic-gate else BIO_puts(STDout,"<No Alias>\n"); 709*0Sstevel@tonic-gate } 710*0Sstevel@tonic-gate else if (hash == i) 711*0Sstevel@tonic-gate { 712*0Sstevel@tonic-gate BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x)); 713*0Sstevel@tonic-gate } 714*0Sstevel@tonic-gate else if (pprint == i) 715*0Sstevel@tonic-gate { 716*0Sstevel@tonic-gate X509_PURPOSE *ptmp; 717*0Sstevel@tonic-gate int j; 718*0Sstevel@tonic-gate BIO_printf(STDout, "Certificate purposes:\n"); 719*0Sstevel@tonic-gate for (j = 0; j < X509_PURPOSE_get_count(); j++) 720*0Sstevel@tonic-gate { 721*0Sstevel@tonic-gate ptmp = X509_PURPOSE_get0(j); 722*0Sstevel@tonic-gate purpose_print(STDout, x, ptmp); 723*0Sstevel@tonic-gate } 724*0Sstevel@tonic-gate } 725*0Sstevel@tonic-gate else 726*0Sstevel@tonic-gate if (modulus == i) 727*0Sstevel@tonic-gate { 728*0Sstevel@tonic-gate EVP_PKEY *pkey; 729*0Sstevel@tonic-gate 730*0Sstevel@tonic-gate pkey=X509_get_pubkey(x); 731*0Sstevel@tonic-gate if (pkey == NULL) 732*0Sstevel@tonic-gate { 733*0Sstevel@tonic-gate BIO_printf(bio_err,"Modulus=unavailable\n"); 734*0Sstevel@tonic-gate ERR_print_errors(bio_err); 735*0Sstevel@tonic-gate goto end; 736*0Sstevel@tonic-gate } 737*0Sstevel@tonic-gate BIO_printf(STDout,"Modulus="); 738*0Sstevel@tonic-gate #ifndef OPENSSL_NO_RSA 739*0Sstevel@tonic-gate if (pkey->type == EVP_PKEY_RSA) 740*0Sstevel@tonic-gate BN_print(STDout,pkey->pkey.rsa->n); 741*0Sstevel@tonic-gate else 742*0Sstevel@tonic-gate #endif 743*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 744*0Sstevel@tonic-gate if (pkey->type == EVP_PKEY_DSA) 745*0Sstevel@tonic-gate BN_print(STDout,pkey->pkey.dsa->pub_key); 746*0Sstevel@tonic-gate else 747*0Sstevel@tonic-gate #endif 748*0Sstevel@tonic-gate BIO_printf(STDout,"Wrong Algorithm type"); 749*0Sstevel@tonic-gate BIO_printf(STDout,"\n"); 750*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 751*0Sstevel@tonic-gate } 752*0Sstevel@tonic-gate else 753*0Sstevel@tonic-gate if (pubkey == i) 754*0Sstevel@tonic-gate { 755*0Sstevel@tonic-gate EVP_PKEY *pkey; 756*0Sstevel@tonic-gate 757*0Sstevel@tonic-gate pkey=X509_get_pubkey(x); 758*0Sstevel@tonic-gate if (pkey == NULL) 759*0Sstevel@tonic-gate { 760*0Sstevel@tonic-gate BIO_printf(bio_err,"Error getting public key\n"); 761*0Sstevel@tonic-gate ERR_print_errors(bio_err); 762*0Sstevel@tonic-gate goto end; 763*0Sstevel@tonic-gate } 764*0Sstevel@tonic-gate PEM_write_bio_PUBKEY(STDout, pkey); 765*0Sstevel@tonic-gate EVP_PKEY_free(pkey); 766*0Sstevel@tonic-gate } 767*0Sstevel@tonic-gate else 768*0Sstevel@tonic-gate if (C == i) 769*0Sstevel@tonic-gate { 770*0Sstevel@tonic-gate unsigned char *d; 771*0Sstevel@tonic-gate char *m; 772*0Sstevel@tonic-gate int y,z; 773*0Sstevel@tonic-gate 774*0Sstevel@tonic-gate X509_NAME_oneline(X509_get_subject_name(x), 775*0Sstevel@tonic-gate buf,sizeof buf); 776*0Sstevel@tonic-gate BIO_printf(STDout,"/* subject:%s */\n",buf); 777*0Sstevel@tonic-gate m=X509_NAME_oneline( 778*0Sstevel@tonic-gate X509_get_issuer_name(x),buf, 779*0Sstevel@tonic-gate sizeof buf); 780*0Sstevel@tonic-gate BIO_printf(STDout,"/* issuer :%s */\n",buf); 781*0Sstevel@tonic-gate 782*0Sstevel@tonic-gate z=i2d_X509(x,NULL); 783*0Sstevel@tonic-gate m=OPENSSL_malloc(z); 784*0Sstevel@tonic-gate 785*0Sstevel@tonic-gate d=(unsigned char *)m; 786*0Sstevel@tonic-gate z=i2d_X509_NAME(X509_get_subject_name(x),&d); 787*0Sstevel@tonic-gate BIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\n",z); 788*0Sstevel@tonic-gate d=(unsigned char *)m; 789*0Sstevel@tonic-gate for (y=0; y<z; y++) 790*0Sstevel@tonic-gate { 791*0Sstevel@tonic-gate BIO_printf(STDout,"0x%02X,",d[y]); 792*0Sstevel@tonic-gate if ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\n"); 793*0Sstevel@tonic-gate } 794*0Sstevel@tonic-gate if (y%16 != 0) BIO_printf(STDout,"\n"); 795*0Sstevel@tonic-gate BIO_printf(STDout,"};\n"); 796*0Sstevel@tonic-gate 797*0Sstevel@tonic-gate z=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d); 798*0Sstevel@tonic-gate BIO_printf(STDout,"unsigned char XXX_public_key[%d]={\n",z); 799*0Sstevel@tonic-gate d=(unsigned char *)m; 800*0Sstevel@tonic-gate for (y=0; y<z; y++) 801*0Sstevel@tonic-gate { 802*0Sstevel@tonic-gate BIO_printf(STDout,"0x%02X,",d[y]); 803*0Sstevel@tonic-gate if ((y & 0x0f) == 0x0f) 804*0Sstevel@tonic-gate BIO_printf(STDout,"\n"); 805*0Sstevel@tonic-gate } 806*0Sstevel@tonic-gate if (y%16 != 0) BIO_printf(STDout,"\n"); 807*0Sstevel@tonic-gate BIO_printf(STDout,"};\n"); 808*0Sstevel@tonic-gate 809*0Sstevel@tonic-gate z=i2d_X509(x,&d); 810*0Sstevel@tonic-gate BIO_printf(STDout,"unsigned char XXX_certificate[%d]={\n",z); 811*0Sstevel@tonic-gate d=(unsigned char *)m; 812*0Sstevel@tonic-gate for (y=0; y<z; y++) 813*0Sstevel@tonic-gate { 814*0Sstevel@tonic-gate BIO_printf(STDout,"0x%02X,",d[y]); 815*0Sstevel@tonic-gate if ((y & 0x0f) == 0x0f) 816*0Sstevel@tonic-gate BIO_printf(STDout,"\n"); 817*0Sstevel@tonic-gate } 818*0Sstevel@tonic-gate if (y%16 != 0) BIO_printf(STDout,"\n"); 819*0Sstevel@tonic-gate BIO_printf(STDout,"};\n"); 820*0Sstevel@tonic-gate 821*0Sstevel@tonic-gate OPENSSL_free(m); 822*0Sstevel@tonic-gate } 823*0Sstevel@tonic-gate else if (text == i) 824*0Sstevel@tonic-gate { 825*0Sstevel@tonic-gate X509_print_ex(out,x,nmflag, certflag); 826*0Sstevel@tonic-gate } 827*0Sstevel@tonic-gate else if (startdate == i) 828*0Sstevel@tonic-gate { 829*0Sstevel@tonic-gate BIO_puts(STDout,"notBefore="); 830*0Sstevel@tonic-gate ASN1_TIME_print(STDout,X509_get_notBefore(x)); 831*0Sstevel@tonic-gate BIO_puts(STDout,"\n"); 832*0Sstevel@tonic-gate } 833*0Sstevel@tonic-gate else if (enddate == i) 834*0Sstevel@tonic-gate { 835*0Sstevel@tonic-gate BIO_puts(STDout,"notAfter="); 836*0Sstevel@tonic-gate ASN1_TIME_print(STDout,X509_get_notAfter(x)); 837*0Sstevel@tonic-gate BIO_puts(STDout,"\n"); 838*0Sstevel@tonic-gate } 839*0Sstevel@tonic-gate else if (fingerprint == i) 840*0Sstevel@tonic-gate { 841*0Sstevel@tonic-gate int j; 842*0Sstevel@tonic-gate unsigned int n; 843*0Sstevel@tonic-gate unsigned char md[EVP_MAX_MD_SIZE]; 844*0Sstevel@tonic-gate 845*0Sstevel@tonic-gate if (!X509_digest(x,digest,md,&n)) 846*0Sstevel@tonic-gate { 847*0Sstevel@tonic-gate BIO_printf(bio_err,"out of memory\n"); 848*0Sstevel@tonic-gate goto end; 849*0Sstevel@tonic-gate } 850*0Sstevel@tonic-gate BIO_printf(STDout,"%s Fingerprint=", 851*0Sstevel@tonic-gate OBJ_nid2sn(EVP_MD_type(digest))); 852*0Sstevel@tonic-gate for (j=0; j<(int)n; j++) 853*0Sstevel@tonic-gate { 854*0Sstevel@tonic-gate BIO_printf(STDout,"%02X%c",md[j], 855*0Sstevel@tonic-gate (j+1 == (int)n) 856*0Sstevel@tonic-gate ?'\n':':'); 857*0Sstevel@tonic-gate } 858*0Sstevel@tonic-gate } 859*0Sstevel@tonic-gate 860*0Sstevel@tonic-gate /* should be in the library */ 861*0Sstevel@tonic-gate else if ((sign_flag == i) && (x509req == 0)) 862*0Sstevel@tonic-gate { 863*0Sstevel@tonic-gate BIO_printf(bio_err,"Getting Private key\n"); 864*0Sstevel@tonic-gate if (Upkey == NULL) 865*0Sstevel@tonic-gate { 866*0Sstevel@tonic-gate Upkey=load_key(bio_err, 867*0Sstevel@tonic-gate keyfile, keyformat, 0, 868*0Sstevel@tonic-gate passin, e, "Private key"); 869*0Sstevel@tonic-gate if (Upkey == NULL) goto end; 870*0Sstevel@tonic-gate } 871*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 872*0Sstevel@tonic-gate if (Upkey->type == EVP_PKEY_DSA) 873*0Sstevel@tonic-gate digest=EVP_dss1(); 874*0Sstevel@tonic-gate #endif 875*0Sstevel@tonic-gate 876*0Sstevel@tonic-gate assert(need_rand); 877*0Sstevel@tonic-gate if (!sign(x,Upkey,days,clrext,digest, 878*0Sstevel@tonic-gate extconf, extsect)) goto end; 879*0Sstevel@tonic-gate } 880*0Sstevel@tonic-gate else if (CA_flag == i) 881*0Sstevel@tonic-gate { 882*0Sstevel@tonic-gate BIO_printf(bio_err,"Getting CA Private Key\n"); 883*0Sstevel@tonic-gate if (CAkeyfile != NULL) 884*0Sstevel@tonic-gate { 885*0Sstevel@tonic-gate CApkey=load_key(bio_err, 886*0Sstevel@tonic-gate CAkeyfile, CAkeyformat, 887*0Sstevel@tonic-gate 0, passin, e, 888*0Sstevel@tonic-gate "CA Private Key"); 889*0Sstevel@tonic-gate if (CApkey == NULL) goto end; 890*0Sstevel@tonic-gate } 891*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 892*0Sstevel@tonic-gate if (CApkey->type == EVP_PKEY_DSA) 893*0Sstevel@tonic-gate digest=EVP_dss1(); 894*0Sstevel@tonic-gate #endif 895*0Sstevel@tonic-gate 896*0Sstevel@tonic-gate assert(need_rand); 897*0Sstevel@tonic-gate if (!x509_certify(ctx,CAfile,digest,x,xca, 898*0Sstevel@tonic-gate CApkey, CAserial,CA_createserial,days, clrext, 899*0Sstevel@tonic-gate extconf, extsect, sno)) 900*0Sstevel@tonic-gate goto end; 901*0Sstevel@tonic-gate } 902*0Sstevel@tonic-gate else if (x509req == i) 903*0Sstevel@tonic-gate { 904*0Sstevel@tonic-gate EVP_PKEY *pk; 905*0Sstevel@tonic-gate 906*0Sstevel@tonic-gate BIO_printf(bio_err,"Getting request Private Key\n"); 907*0Sstevel@tonic-gate if (keyfile == NULL) 908*0Sstevel@tonic-gate { 909*0Sstevel@tonic-gate BIO_printf(bio_err,"no request key file specified\n"); 910*0Sstevel@tonic-gate goto end; 911*0Sstevel@tonic-gate } 912*0Sstevel@tonic-gate else 913*0Sstevel@tonic-gate { 914*0Sstevel@tonic-gate pk=load_key(bio_err, 915*0Sstevel@tonic-gate keyfile, FORMAT_PEM, 0, 916*0Sstevel@tonic-gate passin, e, "request key"); 917*0Sstevel@tonic-gate if (pk == NULL) goto end; 918*0Sstevel@tonic-gate } 919*0Sstevel@tonic-gate 920*0Sstevel@tonic-gate BIO_printf(bio_err,"Generating certificate request\n"); 921*0Sstevel@tonic-gate 922*0Sstevel@tonic-gate #ifndef OPENSSL_NO_DSA 923*0Sstevel@tonic-gate if (pk->type == EVP_PKEY_DSA) 924*0Sstevel@tonic-gate digest=EVP_dss1(); 925*0Sstevel@tonic-gate #endif 926*0Sstevel@tonic-gate 927*0Sstevel@tonic-gate rq=X509_to_X509_REQ(x,pk,digest); 928*0Sstevel@tonic-gate EVP_PKEY_free(pk); 929*0Sstevel@tonic-gate if (rq == NULL) 930*0Sstevel@tonic-gate { 931*0Sstevel@tonic-gate ERR_print_errors(bio_err); 932*0Sstevel@tonic-gate goto end; 933*0Sstevel@tonic-gate } 934*0Sstevel@tonic-gate if (!noout) 935*0Sstevel@tonic-gate { 936*0Sstevel@tonic-gate X509_REQ_print(out,rq); 937*0Sstevel@tonic-gate PEM_write_bio_X509_REQ(out,rq); 938*0Sstevel@tonic-gate } 939*0Sstevel@tonic-gate noout=1; 940*0Sstevel@tonic-gate } 941*0Sstevel@tonic-gate else if (ocspid == i) 942*0Sstevel@tonic-gate { 943*0Sstevel@tonic-gate X509_ocspid_print(out, x); 944*0Sstevel@tonic-gate } 945*0Sstevel@tonic-gate } 946*0Sstevel@tonic-gate } 947*0Sstevel@tonic-gate 948*0Sstevel@tonic-gate if (checkend) 949*0Sstevel@tonic-gate { 950*0Sstevel@tonic-gate time_t tnow=time(NULL); 951*0Sstevel@tonic-gate 952*0Sstevel@tonic-gate if (ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(x), tnow+checkoffset) == -1) 953*0Sstevel@tonic-gate { 954*0Sstevel@tonic-gate BIO_printf(out,"Certificate will expire\n"); 955*0Sstevel@tonic-gate ret=1; 956*0Sstevel@tonic-gate } 957*0Sstevel@tonic-gate else 958*0Sstevel@tonic-gate { 959*0Sstevel@tonic-gate BIO_printf(out,"Certificate will not expire\n"); 960*0Sstevel@tonic-gate ret=0; 961*0Sstevel@tonic-gate } 962*0Sstevel@tonic-gate goto end; 963*0Sstevel@tonic-gate } 964*0Sstevel@tonic-gate 965*0Sstevel@tonic-gate if (noout) 966*0Sstevel@tonic-gate { 967*0Sstevel@tonic-gate ret=0; 968*0Sstevel@tonic-gate goto end; 969*0Sstevel@tonic-gate } 970*0Sstevel@tonic-gate 971*0Sstevel@tonic-gate if (outformat == FORMAT_ASN1) 972*0Sstevel@tonic-gate i=i2d_X509_bio(out,x); 973*0Sstevel@tonic-gate else if (outformat == FORMAT_PEM) 974*0Sstevel@tonic-gate { 975*0Sstevel@tonic-gate if (trustout) i=PEM_write_bio_X509_AUX(out,x); 976*0Sstevel@tonic-gate else i=PEM_write_bio_X509(out,x); 977*0Sstevel@tonic-gate } 978*0Sstevel@tonic-gate else if (outformat == FORMAT_NETSCAPE) 979*0Sstevel@tonic-gate { 980*0Sstevel@tonic-gate ASN1_HEADER ah; 981*0Sstevel@tonic-gate ASN1_OCTET_STRING os; 982*0Sstevel@tonic-gate 983*0Sstevel@tonic-gate os.data=(unsigned char *)NETSCAPE_CERT_HDR; 984*0Sstevel@tonic-gate os.length=strlen(NETSCAPE_CERT_HDR); 985*0Sstevel@tonic-gate ah.header= &os; 986*0Sstevel@tonic-gate ah.data=(char *)x; 987*0Sstevel@tonic-gate ah.meth=X509_asn1_meth(); 988*0Sstevel@tonic-gate 989*0Sstevel@tonic-gate /* no macro for this one yet */ 990*0Sstevel@tonic-gate i=ASN1_i2d_bio(i2d_ASN1_HEADER,out,(unsigned char *)&ah); 991*0Sstevel@tonic-gate } 992*0Sstevel@tonic-gate else { 993*0Sstevel@tonic-gate BIO_printf(bio_err,"bad output format specified for outfile\n"); 994*0Sstevel@tonic-gate goto end; 995*0Sstevel@tonic-gate } 996*0Sstevel@tonic-gate if (!i) 997*0Sstevel@tonic-gate { 998*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to write certificate\n"); 999*0Sstevel@tonic-gate ERR_print_errors(bio_err); 1000*0Sstevel@tonic-gate goto end; 1001*0Sstevel@tonic-gate } 1002*0Sstevel@tonic-gate ret=0; 1003*0Sstevel@tonic-gate end: 1004*0Sstevel@tonic-gate if (need_rand) 1005*0Sstevel@tonic-gate app_RAND_write_file(NULL, bio_err); 1006*0Sstevel@tonic-gate OBJ_cleanup(); 1007*0Sstevel@tonic-gate NCONF_free(extconf); 1008*0Sstevel@tonic-gate BIO_free_all(out); 1009*0Sstevel@tonic-gate BIO_free_all(STDout); 1010*0Sstevel@tonic-gate X509_STORE_free(ctx); 1011*0Sstevel@tonic-gate X509_REQ_free(req); 1012*0Sstevel@tonic-gate X509_free(x); 1013*0Sstevel@tonic-gate X509_free(xca); 1014*0Sstevel@tonic-gate EVP_PKEY_free(Upkey); 1015*0Sstevel@tonic-gate EVP_PKEY_free(CApkey); 1016*0Sstevel@tonic-gate X509_REQ_free(rq); 1017*0Sstevel@tonic-gate ASN1_INTEGER_free(sno); 1018*0Sstevel@tonic-gate sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free); 1019*0Sstevel@tonic-gate sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free); 1020*0Sstevel@tonic-gate if (passin) OPENSSL_free(passin); 1021*0Sstevel@tonic-gate apps_shutdown(); 1022*0Sstevel@tonic-gate OPENSSL_EXIT(ret); 1023*0Sstevel@tonic-gate } 1024*0Sstevel@tonic-gate 1025*0Sstevel@tonic-gate static ASN1_INTEGER *x509_load_serial(char *CAfile, char *serialfile, int create) 1026*0Sstevel@tonic-gate { 1027*0Sstevel@tonic-gate char *buf = NULL, *p; 1028*0Sstevel@tonic-gate ASN1_INTEGER *bs = NULL; 1029*0Sstevel@tonic-gate BIGNUM *serial = NULL; 1030*0Sstevel@tonic-gate size_t len; 1031*0Sstevel@tonic-gate 1032*0Sstevel@tonic-gate len = ((serialfile == NULL) 1033*0Sstevel@tonic-gate ?(strlen(CAfile)+strlen(POSTFIX)+1) 1034*0Sstevel@tonic-gate :(strlen(serialfile)))+1; 1035*0Sstevel@tonic-gate buf=OPENSSL_malloc(len); 1036*0Sstevel@tonic-gate if (buf == NULL) { BIO_printf(bio_err,"out of mem\n"); goto end; } 1037*0Sstevel@tonic-gate if (serialfile == NULL) 1038*0Sstevel@tonic-gate { 1039*0Sstevel@tonic-gate BUF_strlcpy(buf,CAfile,len); 1040*0Sstevel@tonic-gate for (p=buf; *p; p++) 1041*0Sstevel@tonic-gate if (*p == '.') 1042*0Sstevel@tonic-gate { 1043*0Sstevel@tonic-gate *p='\0'; 1044*0Sstevel@tonic-gate break; 1045*0Sstevel@tonic-gate } 1046*0Sstevel@tonic-gate BUF_strlcat(buf,POSTFIX,len); 1047*0Sstevel@tonic-gate } 1048*0Sstevel@tonic-gate else 1049*0Sstevel@tonic-gate BUF_strlcpy(buf,serialfile,len); 1050*0Sstevel@tonic-gate serial=BN_new(); 1051*0Sstevel@tonic-gate bs=ASN1_INTEGER_new(); 1052*0Sstevel@tonic-gate if ((serial == NULL) || (bs == NULL)) 1053*0Sstevel@tonic-gate { 1054*0Sstevel@tonic-gate ERR_print_errors(bio_err); 1055*0Sstevel@tonic-gate goto end; 1056*0Sstevel@tonic-gate } 1057*0Sstevel@tonic-gate 1058*0Sstevel@tonic-gate serial = load_serial(buf, create, NULL); 1059*0Sstevel@tonic-gate if (serial == NULL) goto end; 1060*0Sstevel@tonic-gate 1061*0Sstevel@tonic-gate if (!BN_add_word(serial,1)) 1062*0Sstevel@tonic-gate { BIO_printf(bio_err,"add_word failure\n"); goto end; } 1063*0Sstevel@tonic-gate 1064*0Sstevel@tonic-gate if (!save_serial(buf, NULL, serial, &bs)) goto end; 1065*0Sstevel@tonic-gate 1066*0Sstevel@tonic-gate end: 1067*0Sstevel@tonic-gate if (buf) OPENSSL_free(buf); 1068*0Sstevel@tonic-gate BN_free(serial); 1069*0Sstevel@tonic-gate return bs; 1070*0Sstevel@tonic-gate } 1071*0Sstevel@tonic-gate 1072*0Sstevel@tonic-gate static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, 1073*0Sstevel@tonic-gate X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create, 1074*0Sstevel@tonic-gate int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno) 1075*0Sstevel@tonic-gate { 1076*0Sstevel@tonic-gate int ret=0; 1077*0Sstevel@tonic-gate ASN1_INTEGER *bs=NULL; 1078*0Sstevel@tonic-gate X509_STORE_CTX xsc; 1079*0Sstevel@tonic-gate EVP_PKEY *upkey; 1080*0Sstevel@tonic-gate 1081*0Sstevel@tonic-gate upkey = X509_get_pubkey(xca); 1082*0Sstevel@tonic-gate EVP_PKEY_copy_parameters(upkey,pkey); 1083*0Sstevel@tonic-gate EVP_PKEY_free(upkey); 1084*0Sstevel@tonic-gate 1085*0Sstevel@tonic-gate if(!X509_STORE_CTX_init(&xsc,ctx,x,NULL)) 1086*0Sstevel@tonic-gate { 1087*0Sstevel@tonic-gate BIO_printf(bio_err,"Error initialising X509 store\n"); 1088*0Sstevel@tonic-gate goto end; 1089*0Sstevel@tonic-gate } 1090*0Sstevel@tonic-gate if (sno) bs = sno; 1091*0Sstevel@tonic-gate else if (!(bs = x509_load_serial(CAfile, serialfile, create))) 1092*0Sstevel@tonic-gate goto end; 1093*0Sstevel@tonic-gate 1094*0Sstevel@tonic-gate /* if (!X509_STORE_add_cert(ctx,x)) goto end;*/ 1095*0Sstevel@tonic-gate 1096*0Sstevel@tonic-gate /* NOTE: this certificate can/should be self signed, unless it was 1097*0Sstevel@tonic-gate * a certificate request in which case it is not. */ 1098*0Sstevel@tonic-gate X509_STORE_CTX_set_cert(&xsc,x); 1099*0Sstevel@tonic-gate if (!reqfile && !X509_verify_cert(&xsc)) 1100*0Sstevel@tonic-gate goto end; 1101*0Sstevel@tonic-gate 1102*0Sstevel@tonic-gate if (!X509_check_private_key(xca,pkey)) 1103*0Sstevel@tonic-gate { 1104*0Sstevel@tonic-gate BIO_printf(bio_err,"CA certificate and CA private key do not match\n"); 1105*0Sstevel@tonic-gate goto end; 1106*0Sstevel@tonic-gate } 1107*0Sstevel@tonic-gate 1108*0Sstevel@tonic-gate if (!X509_set_issuer_name(x,X509_get_subject_name(xca))) goto end; 1109*0Sstevel@tonic-gate if (!X509_set_serialNumber(x,bs)) goto end; 1110*0Sstevel@tonic-gate 1111*0Sstevel@tonic-gate if (X509_gmtime_adj(X509_get_notBefore(x),0L) == NULL) 1112*0Sstevel@tonic-gate goto end; 1113*0Sstevel@tonic-gate 1114*0Sstevel@tonic-gate /* hardwired expired */ 1115*0Sstevel@tonic-gate if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL) 1116*0Sstevel@tonic-gate goto end; 1117*0Sstevel@tonic-gate 1118*0Sstevel@tonic-gate if (clrext) 1119*0Sstevel@tonic-gate { 1120*0Sstevel@tonic-gate while (X509_get_ext_count(x) > 0) X509_delete_ext(x, 0); 1121*0Sstevel@tonic-gate } 1122*0Sstevel@tonic-gate 1123*0Sstevel@tonic-gate if (conf) 1124*0Sstevel@tonic-gate { 1125*0Sstevel@tonic-gate X509V3_CTX ctx2; 1126*0Sstevel@tonic-gate X509_set_version(x,2); /* version 3 certificate */ 1127*0Sstevel@tonic-gate X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0); 1128*0Sstevel@tonic-gate X509V3_set_nconf(&ctx2, conf); 1129*0Sstevel@tonic-gate if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) goto end; 1130*0Sstevel@tonic-gate } 1131*0Sstevel@tonic-gate 1132*0Sstevel@tonic-gate if (!X509_sign(x,pkey,digest)) goto end; 1133*0Sstevel@tonic-gate ret=1; 1134*0Sstevel@tonic-gate end: 1135*0Sstevel@tonic-gate X509_STORE_CTX_cleanup(&xsc); 1136*0Sstevel@tonic-gate if (!ret) 1137*0Sstevel@tonic-gate ERR_print_errors(bio_err); 1138*0Sstevel@tonic-gate if (!sno) ASN1_INTEGER_free(bs); 1139*0Sstevel@tonic-gate return ret; 1140*0Sstevel@tonic-gate } 1141*0Sstevel@tonic-gate 1142*0Sstevel@tonic-gate static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx) 1143*0Sstevel@tonic-gate { 1144*0Sstevel@tonic-gate int err; 1145*0Sstevel@tonic-gate X509 *err_cert; 1146*0Sstevel@tonic-gate 1147*0Sstevel@tonic-gate /* it is ok to use a self signed certificate 1148*0Sstevel@tonic-gate * This case will catch both the initial ok == 0 and the 1149*0Sstevel@tonic-gate * final ok == 1 calls to this function */ 1150*0Sstevel@tonic-gate err=X509_STORE_CTX_get_error(ctx); 1151*0Sstevel@tonic-gate if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) 1152*0Sstevel@tonic-gate return 1; 1153*0Sstevel@tonic-gate 1154*0Sstevel@tonic-gate /* BAD we should have gotten an error. Normally if everything 1155*0Sstevel@tonic-gate * worked X509_STORE_CTX_get_error(ctx) will still be set to 1156*0Sstevel@tonic-gate * DEPTH_ZERO_SELF_.... */ 1157*0Sstevel@tonic-gate if (ok) 1158*0Sstevel@tonic-gate { 1159*0Sstevel@tonic-gate BIO_printf(bio_err,"error with certificate to be certified - should be self signed\n"); 1160*0Sstevel@tonic-gate return 0; 1161*0Sstevel@tonic-gate } 1162*0Sstevel@tonic-gate else 1163*0Sstevel@tonic-gate { 1164*0Sstevel@tonic-gate err_cert=X509_STORE_CTX_get_current_cert(ctx); 1165*0Sstevel@tonic-gate print_name(bio_err, NULL, X509_get_subject_name(err_cert),0); 1166*0Sstevel@tonic-gate BIO_printf(bio_err,"error with certificate - error %d at depth %d\n%s\n", 1167*0Sstevel@tonic-gate err,X509_STORE_CTX_get_error_depth(ctx), 1168*0Sstevel@tonic-gate X509_verify_cert_error_string(err)); 1169*0Sstevel@tonic-gate return 1; 1170*0Sstevel@tonic-gate } 1171*0Sstevel@tonic-gate } 1172*0Sstevel@tonic-gate 1173*0Sstevel@tonic-gate /* self sign */ 1174*0Sstevel@tonic-gate static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest, 1175*0Sstevel@tonic-gate CONF *conf, char *section) 1176*0Sstevel@tonic-gate { 1177*0Sstevel@tonic-gate 1178*0Sstevel@tonic-gate EVP_PKEY *pktmp; 1179*0Sstevel@tonic-gate 1180*0Sstevel@tonic-gate pktmp = X509_get_pubkey(x); 1181*0Sstevel@tonic-gate EVP_PKEY_copy_parameters(pktmp,pkey); 1182*0Sstevel@tonic-gate EVP_PKEY_save_parameters(pktmp,1); 1183*0Sstevel@tonic-gate EVP_PKEY_free(pktmp); 1184*0Sstevel@tonic-gate 1185*0Sstevel@tonic-gate if (!X509_set_issuer_name(x,X509_get_subject_name(x))) goto err; 1186*0Sstevel@tonic-gate if (X509_gmtime_adj(X509_get_notBefore(x),0) == NULL) goto err; 1187*0Sstevel@tonic-gate 1188*0Sstevel@tonic-gate /* Lets just make it 12:00am GMT, Jan 1 1970 */ 1189*0Sstevel@tonic-gate /* memcpy(x->cert_info->validity->notBefore,"700101120000Z",13); */ 1190*0Sstevel@tonic-gate /* 28 days to be certified */ 1191*0Sstevel@tonic-gate 1192*0Sstevel@tonic-gate if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL) 1193*0Sstevel@tonic-gate goto err; 1194*0Sstevel@tonic-gate 1195*0Sstevel@tonic-gate if (!X509_set_pubkey(x,pkey)) goto err; 1196*0Sstevel@tonic-gate if (clrext) 1197*0Sstevel@tonic-gate { 1198*0Sstevel@tonic-gate while (X509_get_ext_count(x) > 0) X509_delete_ext(x, 0); 1199*0Sstevel@tonic-gate } 1200*0Sstevel@tonic-gate if (conf) 1201*0Sstevel@tonic-gate { 1202*0Sstevel@tonic-gate X509V3_CTX ctx; 1203*0Sstevel@tonic-gate X509_set_version(x,2); /* version 3 certificate */ 1204*0Sstevel@tonic-gate X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0); 1205*0Sstevel@tonic-gate X509V3_set_nconf(&ctx, conf); 1206*0Sstevel@tonic-gate if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) goto err; 1207*0Sstevel@tonic-gate } 1208*0Sstevel@tonic-gate if (!X509_sign(x,pkey,digest)) goto err; 1209*0Sstevel@tonic-gate return 1; 1210*0Sstevel@tonic-gate err: 1211*0Sstevel@tonic-gate ERR_print_errors(bio_err); 1212*0Sstevel@tonic-gate return 0; 1213*0Sstevel@tonic-gate } 1214*0Sstevel@tonic-gate 1215*0Sstevel@tonic-gate static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt) 1216*0Sstevel@tonic-gate { 1217*0Sstevel@tonic-gate int id, i, idret; 1218*0Sstevel@tonic-gate char *pname; 1219*0Sstevel@tonic-gate id = X509_PURPOSE_get_id(pt); 1220*0Sstevel@tonic-gate pname = X509_PURPOSE_get0_name(pt); 1221*0Sstevel@tonic-gate for (i = 0; i < 2; i++) 1222*0Sstevel@tonic-gate { 1223*0Sstevel@tonic-gate idret = X509_check_purpose(cert, id, i); 1224*0Sstevel@tonic-gate BIO_printf(bio, "%s%s : ", pname, i ? " CA" : ""); 1225*0Sstevel@tonic-gate if (idret == 1) BIO_printf(bio, "Yes\n"); 1226*0Sstevel@tonic-gate else if (idret == 0) BIO_printf(bio, "No\n"); 1227*0Sstevel@tonic-gate else BIO_printf(bio, "Yes (WARNING code=%d)\n", idret); 1228*0Sstevel@tonic-gate } 1229*0Sstevel@tonic-gate return 1; 1230*0Sstevel@tonic-gate } 1231