x509.c (1.1.1.10) | x509.c (1.1.1.11) |
---|---|
1/* apps/x509.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. | 1/* 2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. |
4 * | 3 * |
5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] | 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html |
57 */ 58 | 8 */ 9 |
59#include <assert.h> | |
60#include <stdio.h> 61#include <stdlib.h> 62#include <string.h> | 10#include <stdio.h> 11#include <stdlib.h> 12#include <string.h> |
63#ifdef OPENSSL_NO_STDIO 64# define APPS_WIN16 65#endif | |
66#include "apps.h" 67#include <openssl/bio.h> 68#include <openssl/asn1.h> 69#include <openssl/err.h> 70#include <openssl/bn.h> 71#include <openssl/evp.h> 72#include <openssl/x509.h> 73#include <openssl/x509v3.h> 74#include <openssl/objects.h> 75#include <openssl/pem.h> 76#ifndef OPENSSL_NO_RSA 77# include <openssl/rsa.h> 78#endif 79#ifndef OPENSSL_NO_DSA 80# include <openssl/dsa.h> 81#endif 82 | 13#include "apps.h" 14#include <openssl/bio.h> 15#include <openssl/asn1.h> 16#include <openssl/err.h> 17#include <openssl/bn.h> 18#include <openssl/evp.h> 19#include <openssl/x509.h> 20#include <openssl/x509v3.h> 21#include <openssl/objects.h> 22#include <openssl/pem.h> 23#ifndef OPENSSL_NO_RSA 24# include <openssl/rsa.h> 25#endif 26#ifndef OPENSSL_NO_DSA 27# include <openssl/dsa.h> 28#endif 29 |
83#undef PROG 84#define PROG x509_main 85 | |
86#undef POSTFIX 87#define POSTFIX ".srl" 88#define DEF_DAYS 30 89 | 30#undef POSTFIX 31#define POSTFIX ".srl" 32#define DEF_DAYS 30 33 |
90static const char *x509_usage[] = { 91 "usage: x509 args\n", 92 " -inform arg - input format - default PEM (one of DER, NET or PEM)\n", 93 " -outform arg - output format - default PEM (one of DER, NET or PEM)\n", 94 " -keyform arg - private key format - default PEM\n", 95 " -CAform arg - CA format - default PEM\n", 96 " -CAkeyform arg - CA key format - default PEM\n", 97 " -in arg - input file - default stdin\n", 98 " -out arg - output file - default stdout\n", 99 " -passin arg - private key password source\n", 100 " -serial - print serial number value\n", 101 " -subject_hash - print subject hash value\n", 102#ifndef OPENSSL_NO_MD5 103 " -subject_hash_old - print old-style (MD5) subject hash value\n", 104#endif 105 " -issuer_hash - print issuer hash value\n", 106#ifndef OPENSSL_NO_MD5 107 " -issuer_hash_old - print old-style (MD5) issuer hash value\n", 108#endif 109 " -hash - synonym for -subject_hash\n", 110 " -subject - print subject DN\n", 111 " -issuer - print issuer DN\n", 112 " -email - print email address(es)\n", 113 " -startdate - notBefore field\n", 114 " -enddate - notAfter field\n", 115 " -purpose - print out certificate purposes\n", 116 " -dates - both Before and After dates\n", 117 " -modulus - print the RSA key modulus\n", 118 " -pubkey - output the public key\n", 119 " -fingerprint - print the certificate fingerprint\n", 120 " -alias - output certificate alias\n", 121 " -noout - no certificate output\n", 122 " -ocspid - print OCSP hash values for the subject name and public key\n", 123 " -ocsp_uri - print OCSP Responder URL(s)\n", 124 " -trustout - output a \"trusted\" certificate\n", 125 " -clrtrust - clear all trusted purposes\n", 126 " -clrreject - clear all rejected purposes\n", 127 " -addtrust arg - trust certificate for a given purpose\n", 128 " -addreject arg - reject certificate for a given purpose\n", 129 " -setalias arg - set certificate alias\n", 130 " -days arg - How long till expiry of a signed certificate - def 30 days\n", 131 " -checkend arg - check whether the cert expires in the next arg seconds\n", 132 " exit 1 if so, 0 if not\n", 133 " -signkey arg - self sign cert with arg\n", 134 " -x509toreq - output a certification request object\n", 135 " -req - input is a certificate request, sign and output.\n", 136 " -CA arg - set the CA certificate, must be PEM format.\n", 137 " -CAkey arg - set the CA key, must be PEM format\n", 138 " missing, it is assumed to be in the CA file.\n", 139 " -CAcreateserial - create serial number file if it does not exist\n", 140 " -CAserial arg - serial file\n", 141 " -set_serial - serial number to use\n", 142 " -text - print the certificate in text form\n", 143 " -C - print out C code forms\n", 144 " -md2/-md5/-sha1/-mdc2 - digest to use\n", 145 " -extfile - configuration file with X509V3 extensions to add\n", 146 " -extensions - section from config file with X509V3 extensions to add\n", 147 " -clrext - delete extensions before signing and input certificate\n", 148 " -nameopt arg - various certificate name options\n", 149#ifndef OPENSSL_NO_ENGINE 150 " -engine e - use engine e, possibly a hardware device.\n", 151#endif 152 " -certopt arg - various certificate text options\n", 153 " -checkhost host - check certificate matches \"host\"\n", 154 " -checkemail email - check certificate matches \"email\"\n", 155 " -checkip ipaddr - check certificate matches \"ipaddr\"\n", 156 NULL 157}; 158 159static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx); | 34static int callb(int ok, X509_STORE_CTX *ctx); |
160static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, | 35static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, |
161 const EVP_MD *digest, CONF *conf, char *section); 162static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, | 36 const EVP_MD *digest, CONF *conf, const char *section); 37static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *digest, |
163 X509 *x, X509 *xca, EVP_PKEY *pkey, | 38 X509 *x, X509 *xca, EVP_PKEY *pkey, |
164 STACK_OF(OPENSSL_STRING) *sigopts, char *serial, | 39 STACK_OF(OPENSSL_STRING) *sigopts, const char *serialfile, |
165 int create, int days, int clrext, CONF *conf, | 40 int create, int days, int clrext, CONF *conf, |
166 char *section, ASN1_INTEGER *sno); | 41 const char *section, ASN1_INTEGER *sno, int reqfile); |
167static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt); | 42static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt); |
168static int reqfile = 0; 169#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL 170static int force_version = 2; 171#endif | |
172 | 43 |
173int MAIN(int, char **); | 44typedef enum OPTION_choice { 45 OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, 46 OPT_INFORM, OPT_OUTFORM, OPT_KEYFORM, OPT_REQ, OPT_CAFORM, 47 OPT_CAKEYFORM, OPT_SIGOPT, OPT_DAYS, OPT_PASSIN, OPT_EXTFILE, 48 OPT_EXTENSIONS, OPT_IN, OPT_OUT, OPT_SIGNKEY, OPT_CA, 49 OPT_CAKEY, OPT_CASERIAL, OPT_SET_SERIAL, OPT_FORCE_PUBKEY, 50 OPT_ADDTRUST, OPT_ADDREJECT, OPT_SETALIAS, OPT_CERTOPT, OPT_NAMEOPT, 51 OPT_C, OPT_EMAIL, OPT_OCSP_URI, OPT_SERIAL, OPT_NEXT_SERIAL, 52 OPT_MODULUS, OPT_PUBKEY, OPT_X509TOREQ, OPT_TEXT, OPT_HASH, 53 OPT_ISSUER_HASH, OPT_SUBJECT, OPT_ISSUER, OPT_FINGERPRINT, OPT_DATES, 54 OPT_PURPOSE, OPT_STARTDATE, OPT_ENDDATE, OPT_CHECKEND, OPT_CHECKHOST, 55 OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST, 56 OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID, 57 OPT_SUBJECT_HASH_OLD, 58 OPT_ISSUER_HASH_OLD, 59 OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT 60} OPTION_CHOICE; |
174 | 61 |
175int MAIN(int argc, char **argv) | 62OPTIONS x509_options[] = { 63 {"help", OPT_HELP, '-', "Display this summary"}, 64 {"inform", OPT_INFORM, 'f', 65 "Input format - default PEM (one of DER, NET or PEM)"}, 66 {"in", OPT_IN, '<', "Input file - default stdin"}, 67 {"outform", OPT_OUTFORM, 'f', 68 "Output format - default PEM (one of DER, NET or PEM)"}, 69 {"out", OPT_OUT, '>', "Output file - default stdout"}, 70 {"keyform", OPT_KEYFORM, 'F', "Private key format - default PEM"}, 71 {"passin", OPT_PASSIN, 's', "Private key password/pass-phrase source"}, 72 {"serial", OPT_SERIAL, '-', "Print serial number value"}, 73 {"subject_hash", OPT_HASH, '-', "Print subject hash value"}, 74 {"issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value"}, 75 {"hash", OPT_HASH, '-', "Synonym for -subject_hash"}, 76 {"subject", OPT_SUBJECT, '-', "Print subject DN"}, 77 {"issuer", OPT_ISSUER, '-', "Print issuer DN"}, 78 {"email", OPT_EMAIL, '-', "Print email address(es)"}, 79 {"startdate", OPT_STARTDATE, '-', "Set notBefore field"}, 80 {"enddate", OPT_ENDDATE, '-', "Set notAfter field"}, 81 {"purpose", OPT_PURPOSE, '-', "Print out certificate purposes"}, 82 {"dates", OPT_DATES, '-', "Both Before and After dates"}, 83 {"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"}, 84 {"pubkey", OPT_PUBKEY, '-', "Output the public key"}, 85 {"fingerprint", OPT_FINGERPRINT, '-', 86 "Print the certificate fingerprint"}, 87 {"alias", OPT_ALIAS, '-', "Output certificate alias"}, 88 {"noout", OPT_NOOUT, '-', "No output, just status"}, 89 {"nocert", OPT_NOCERT, '-', "No certificate output"}, 90 {"ocspid", OPT_OCSPID, '-', 91 "Print OCSP hash values for the subject name and public key"}, 92 {"ocsp_uri", OPT_OCSP_URI, '-', "Print OCSP Responder URL(s)"}, 93 {"trustout", OPT_TRUSTOUT, '-', "Output a trusted certificate"}, 94 {"clrtrust", OPT_CLRTRUST, '-', "Clear all trusted purposes"}, 95 {"clrext", OPT_CLREXT, '-', "Clear all certificate extensions"}, 96 {"addtrust", OPT_ADDTRUST, 's', "Trust certificate for a given purpose"}, 97 {"addreject", OPT_ADDREJECT, 's', 98 "Reject certificate for a given purpose"}, 99 {"setalias", OPT_SETALIAS, 's', "Set certificate alias"}, 100 {"days", OPT_DAYS, 'n', 101 "How long till expiry of a signed certificate - def 30 days"}, 102 {"checkend", OPT_CHECKEND, 'M', 103 "Check whether the cert expires in the next arg seconds"}, 104 {OPT_MORE_STR, 1, 1, "Exit 1 if so, 0 if not"}, 105 {"signkey", OPT_SIGNKEY, '<', "Self sign cert with arg"}, 106 {"x509toreq", OPT_X509TOREQ, '-', 107 "Output a certification request object"}, 108 {"req", OPT_REQ, '-', "Input is a certificate request, sign and output"}, 109 {"CA", OPT_CA, '<', "Set the CA certificate, must be PEM format"}, 110 {"CAkey", OPT_CAKEY, 's', 111 "The CA key, must be PEM format; if not in CAfile"}, 112 {"CAcreateserial", OPT_CACREATESERIAL, '-', 113 "Create serial number file if it does not exist"}, 114 {"CAserial", OPT_CASERIAL, 's', "Serial file"}, 115 {"set_serial", OPT_SET_SERIAL, 's', "Serial number to use"}, 116 {"text", OPT_TEXT, '-', "Print the certificate in text form"}, 117 {"C", OPT_C, '-', "Print out C code forms"}, 118 {"extfile", OPT_EXTFILE, '<', "File with X509V3 extensions to add"}, 119 {"extensions", OPT_EXTENSIONS, 's', "Section from config file to use"}, 120 {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"}, 121 {"certopt", OPT_CERTOPT, 's', "Various certificate text options"}, 122 {"checkhost", OPT_CHECKHOST, 's', "Check certificate matches host"}, 123 {"checkemail", OPT_CHECKEMAIL, 's', "Check certificate matches email"}, 124 {"checkip", OPT_CHECKIP, 's', "Check certificate matches ipaddr"}, 125 {"CAform", OPT_CAFORM, 'F', "CA format - default PEM"}, 126 {"CAkeyform", OPT_CAKEYFORM, 'f', "CA key format - default PEM"}, 127 {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"}, 128 {"force_pubkey", OPT_FORCE_PUBKEY, '<', "Force the Key to put inside certificate"}, 129 {"next_serial", OPT_NEXT_SERIAL, '-', "Increment current certificate serial number"}, 130 {"clrreject", OPT_CLRREJECT, '-', 131 "Clears all the prohibited or rejected uses of the certificate"}, 132 {"badsig", OPT_BADSIG, '-', "Corrupt last byte of certificate signature (for test)"}, 133 {"", OPT_MD, '-', "Any supported digest"}, 134#ifndef OPENSSL_NO_MD5 135 {"subject_hash_old", OPT_SUBJECT_HASH_OLD, '-', 136 "Print old-style (MD5) issuer hash value"}, 137 {"issuer_hash_old", OPT_ISSUER_HASH_OLD, '-', 138 "Print old-style (MD5) subject hash value"}, 139#endif 140#ifndef OPENSSL_NO_ENGINE 141 {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, 142#endif 143 {NULL} 144}; 145 146int x509_main(int argc, char **argv) |
176{ | 147{ |
177 ENGINE *e = NULL; 178 int ret = 1; 179 X509_REQ *req = NULL; 180 X509 *x = NULL, *xca = NULL; 181 ASN1_OBJECT *objtmp; 182 STACK_OF(OPENSSL_STRING) *sigopts = NULL; 183 EVP_PKEY *Upkey = NULL, *CApkey = NULL, *fkey = NULL; | |
184 ASN1_INTEGER *sno = NULL; | 148 ASN1_INTEGER *sno = NULL; |
185 int i, num, badops = 0, badsig = 0; | 149 ASN1_OBJECT *objtmp = NULL; |
186 BIO *out = NULL; | 150 BIO *out = NULL; |
187 BIO *STDout = NULL; | 151 CONF *extconf = NULL; 152 EVP_PKEY *Upkey = NULL, *CApkey = NULL, *fkey = NULL; |
188 STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL; | 153 STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL; |
189 int informat, outformat, keyformat, CAformat, CAkeyformat; | 154 STACK_OF(OPENSSL_STRING) *sigopts = NULL; 155 X509 *x = NULL, *xca = NULL; 156 X509_REQ *req = NULL, *rq = NULL; 157 X509_STORE *ctx = NULL; 158 const EVP_MD *digest = NULL; 159 char *CAkeyfile = NULL, *CAserial = NULL, *fkeyfile = NULL, *alias = NULL; 160 char *checkhost = NULL, *checkemail = NULL, *checkip = NULL; 161 char *extsect = NULL, *extfile = NULL, *passin = NULL, *passinarg = NULL; |
190 char *infile = NULL, *outfile = NULL, *keyfile = NULL, *CAfile = NULL; | 162 char *infile = NULL, *outfile = NULL, *keyfile = NULL, *CAfile = NULL; |
191 char *CAkeyfile = NULL, *CAserial = NULL; 192 char *fkeyfile = NULL; 193 char *alias = NULL; 194 int text = 0, serial = 0, subject = 0, issuer = 0, startdate = 195 0, enddate = 0; 196 int next_serial = 0; 197 int subject_hash = 0, issuer_hash = 0, ocspid = 0; | 163 char buf[256], *prog; 164 int x509req = 0, days = DEF_DAYS, modulus = 0, pubkey = 0, pprint = 0; 165 int C = 0, CAformat = FORMAT_PEM, CAkeyformat = FORMAT_PEM; 166 int fingerprint = 0, reqfile = 0, need_rand = 0, checkend = 0; 167 int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM; 168 int next_serial = 0, subject_hash = 0, issuer_hash = 0, ocspid = 0; 169 int noout = 0, sign_flag = 0, CA_flag = 0, CA_createserial = 0, email = 0; 170 int ocsp_uri = 0, trustout = 0, clrtrust = 0, clrreject = 0, aliasout = 0; 171 int ret = 1, i, num = 0, badsig = 0, clrext = 0, nocert = 0; 172 int text = 0, serial = 0, subject = 0, issuer = 0, startdate = 0; 173 int enddate = 0; 174 time_t checkoffset = 0; 175 unsigned long nmflag = 0, certflag = 0; 176 char nmflag_set = 0; 177 OPTION_CHOICE o; 178 ENGINE *e = NULL; |
198#ifndef OPENSSL_NO_MD5 199 int subject_hash_old = 0, issuer_hash_old = 0; 200#endif | 179#ifndef OPENSSL_NO_MD5 180 int subject_hash_old = 0, issuer_hash_old = 0; 181#endif |
201 int noout = 0, sign_flag = 0, CA_flag = 0, CA_createserial = 0, email = 0; 202 int ocsp_uri = 0; 203 int trustout = 0, clrtrust = 0, clrreject = 0, aliasout = 0, clrext = 0; 204 int C = 0; 205 int x509req = 0, days = DEF_DAYS, modulus = 0, pubkey = 0; 206 int pprint = 0; 207 const char **pp; 208 X509_STORE *ctx = NULL; 209 X509_REQ *rq = NULL; 210 int fingerprint = 0; 211 char buf[256]; 212 const EVP_MD *md_alg, *digest = NULL; 213 CONF *extconf = NULL; 214 char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL; 215 int need_rand = 0; 216 int checkend = 0, checkoffset = 0; 217 unsigned long nmflag = 0, certflag = 0; 218 char *checkhost = NULL; 219 char *checkemail = NULL; 220 char *checkip = NULL; 221 char *engine = NULL; | |
222 | 182 |
223 reqfile = 0; 224 225 apps_startup(); 226 227 if (bio_err == NULL) 228 bio_err = BIO_new_fp(stderr, BIO_NOCLOSE); 229 230 if (!load_config(bio_err, NULL)) 231 goto end; 232 STDout = BIO_new_fp(stdout, BIO_NOCLOSE); 233#ifdef OPENSSL_SYS_VMS 234 { 235 BIO *tmpbio = BIO_new(BIO_f_linebuffer()); 236 STDout = BIO_push(tmpbio, STDout); 237 } 238#endif 239 240 informat = FORMAT_PEM; 241 outformat = FORMAT_PEM; 242 keyformat = FORMAT_PEM; 243 CAformat = FORMAT_PEM; 244 CAkeyformat = FORMAT_PEM; 245 | |
246 ctx = X509_STORE_new(); 247 if (ctx == NULL) 248 goto end; 249 X509_STORE_set_verify_cb(ctx, callb); 250 | 183 ctx = X509_STORE_new(); 184 if (ctx == NULL) 185 goto end; 186 X509_STORE_set_verify_cb(ctx, callb); 187 |
251 argc--; 252 argv++; 253 num = 0; 254 while (argc >= 1) { 255 if (strcmp(*argv, "-inform") == 0) { 256 if (--argc < 1) 257 goto bad; 258 informat = str2fmt(*(++argv)); 259 } else if (strcmp(*argv, "-outform") == 0) { 260 if (--argc < 1) 261 goto bad; 262 outformat = str2fmt(*(++argv)); 263 } else if (strcmp(*argv, "-keyform") == 0) { 264 if (--argc < 1) 265 goto bad; 266 keyformat = str2fmt(*(++argv)); 267 } else if (strcmp(*argv, "-req") == 0) { 268 reqfile = 1; 269 need_rand = 1; 270 } else if (strcmp(*argv, "-CAform") == 0) { 271 if (--argc < 1) 272 goto bad; 273 CAformat = str2fmt(*(++argv)); 274 } else if (strcmp(*argv, "-CAkeyform") == 0) { 275 if (--argc < 1) 276 goto bad; 277 CAkeyformat = str2fmt(*(++argv)); 278 } else if (strcmp(*argv, "-sigopt") == 0) { 279 if (--argc < 1) 280 goto bad; | 188 prog = opt_init(argc, argv, x509_options); 189 while ((o = opt_next()) != OPT_EOF) { 190 switch (o) { 191 case OPT_EOF: 192 case OPT_ERR: 193 opthelp: 194 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog); 195 goto end; 196 case OPT_HELP: 197 opt_help(x509_options); 198 ret = 0; 199 goto end; 200 case OPT_INFORM: 201 if (!opt_format(opt_arg(), OPT_FMT_ANY, &informat)) 202 goto opthelp; 203 break; 204 case OPT_IN: 205 infile = opt_arg(); 206 break; 207 case OPT_OUTFORM: 208 if (!opt_format(opt_arg(), OPT_FMT_ANY, &outformat)) 209 goto opthelp; 210 break; 211 case OPT_KEYFORM: 212 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat)) 213 goto opthelp; 214 break; 215 case OPT_CAFORM: 216 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &CAformat)) 217 goto opthelp; 218 break; 219 case OPT_CAKEYFORM: 220 if (!opt_format(opt_arg(), OPT_FMT_ANY, &CAkeyformat)) 221 goto opthelp; 222 break; 223 case OPT_OUT: 224 outfile = opt_arg(); 225 break; 226 case OPT_REQ: 227 reqfile = need_rand = 1; 228 break; 229 230 case OPT_SIGOPT: |
281 if (!sigopts) 282 sigopts = sk_OPENSSL_STRING_new_null(); | 231 if (!sigopts) 232 sigopts = sk_OPENSSL_STRING_new_null(); |
283 if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv))) 284 goto bad; 285 } 286#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL 287 else if (strcmp(*argv, "-force_version") == 0) { 288 if (--argc < 1) 289 goto bad; 290 force_version = atoi(*(++argv)) - 1; 291 } 292#endif 293 else if (strcmp(*argv, "-days") == 0) { 294 if (--argc < 1) 295 goto bad; 296 days = atoi(*(++argv)); 297 if (days == 0) { 298 BIO_printf(bio_err, "bad number of days\n"); 299 goto bad; 300 } 301 } else if (strcmp(*argv, "-passin") == 0) { 302 if (--argc < 1) 303 goto bad; 304 passargin = *(++argv); 305 } else if (strcmp(*argv, "-extfile") == 0) { 306 if (--argc < 1) 307 goto bad; 308 extfile = *(++argv); 309 } else if (strcmp(*argv, "-extensions") == 0) { 310 if (--argc < 1) 311 goto bad; 312 extsect = *(++argv); 313 } else if (strcmp(*argv, "-in") == 0) { 314 if (--argc < 1) 315 goto bad; 316 infile = *(++argv); 317 } else if (strcmp(*argv, "-out") == 0) { 318 if (--argc < 1) 319 goto bad; 320 outfile = *(++argv); 321 } else if (strcmp(*argv, "-signkey") == 0) { 322 if (--argc < 1) 323 goto bad; 324 keyfile = *(++argv); | 233 if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg())) 234 goto opthelp; 235 break; 236 case OPT_DAYS: 237 days = atoi(opt_arg()); 238 break; 239 case OPT_PASSIN: 240 passinarg = opt_arg(); 241 break; 242 case OPT_EXTFILE: 243 extfile = opt_arg(); 244 break; 245 case OPT_EXTENSIONS: 246 extsect = opt_arg(); 247 break; 248 case OPT_SIGNKEY: 249 keyfile = opt_arg(); |
325 sign_flag = ++num; 326 need_rand = 1; | 250 sign_flag = ++num; 251 need_rand = 1; |
327 } else if (strcmp(*argv, "-CA") == 0) { 328 if (--argc < 1) 329 goto bad; 330 CAfile = *(++argv); | 252 break; 253 case OPT_CA: 254 CAfile = opt_arg(); |
331 CA_flag = ++num; 332 need_rand = 1; | 255 CA_flag = ++num; 256 need_rand = 1; |
333 } else if (strcmp(*argv, "-CAkey") == 0) { 334 if (--argc < 1) 335 goto bad; 336 CAkeyfile = *(++argv); 337 } else if (strcmp(*argv, "-CAserial") == 0) { 338 if (--argc < 1) 339 goto bad; 340 CAserial = *(++argv); 341 } else if (strcmp(*argv, "-set_serial") == 0) { 342 if (--argc < 1) 343 goto bad; 344 if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv)))) 345 goto bad; 346 } else if (strcmp(*argv, "-force_pubkey") == 0) { 347 if (--argc < 1) 348 goto bad; 349 fkeyfile = *(++argv); 350 } else if (strcmp(*argv, "-addtrust") == 0) { 351 if (--argc < 1) 352 goto bad; 353 if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) { 354 BIO_printf(bio_err, "Invalid trust object value %s\n", *argv); 355 goto bad; | 257 break; 258 case OPT_CAKEY: 259 CAkeyfile = opt_arg(); 260 break; 261 case OPT_CASERIAL: 262 CAserial = opt_arg(); 263 break; 264 case OPT_SET_SERIAL: 265 if (sno != NULL) { 266 BIO_printf(bio_err, "Serial number supplied twice\n"); 267 goto opthelp; |
356 } | 268 } |
357 if (!trust) 358 trust = sk_ASN1_OBJECT_new_null(); | 269 if ((sno = s2i_ASN1_INTEGER(NULL, opt_arg())) == NULL) 270 goto opthelp; 271 break; 272 case OPT_FORCE_PUBKEY: 273 fkeyfile = opt_arg(); 274 break; 275 case OPT_ADDTRUST: 276 if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) { 277 BIO_printf(bio_err, 278 "%s: Invalid trust object value %s\n", 279 prog, opt_arg()); 280 goto opthelp; 281 } 282 if (trust == NULL && (trust = sk_ASN1_OBJECT_new_null()) == NULL) 283 goto end; |
359 sk_ASN1_OBJECT_push(trust, objtmp); | 284 sk_ASN1_OBJECT_push(trust, objtmp); |
285 objtmp = NULL; |
|
360 trustout = 1; | 286 trustout = 1; |
361 } else if (strcmp(*argv, "-addreject") == 0) { 362 if (--argc < 1) 363 goto bad; 364 if (!(objtmp = OBJ_txt2obj(*(++argv), 0))) { | 287 break; 288 case OPT_ADDREJECT: 289 if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) { |
365 BIO_printf(bio_err, | 290 BIO_printf(bio_err, |
366 "Invalid reject object value %s\n", *argv); 367 goto bad; | 291 "%s: Invalid reject object value %s\n", 292 prog, opt_arg()); 293 goto opthelp; |
368 } | 294 } |
369 if (!reject) 370 reject = sk_ASN1_OBJECT_new_null(); | 295 if (reject == NULL 296 && (reject = sk_ASN1_OBJECT_new_null()) == NULL) 297 goto end; |
371 sk_ASN1_OBJECT_push(reject, objtmp); | 298 sk_ASN1_OBJECT_push(reject, objtmp); |
299 objtmp = NULL; |
|
372 trustout = 1; | 300 trustout = 1; |
373 } else if (strcmp(*argv, "-setalias") == 0) { 374 if (--argc < 1) 375 goto bad; 376 alias = *(++argv); | 301 break; 302 case OPT_SETALIAS: 303 alias = opt_arg(); |
377 trustout = 1; | 304 trustout = 1; |
378 } else if (strcmp(*argv, "-certopt") == 0) { 379 if (--argc < 1) 380 goto bad; 381 if (!set_cert_ex(&certflag, *(++argv))) 382 goto bad; 383 } else if (strcmp(*argv, "-nameopt") == 0) { 384 if (--argc < 1) 385 goto bad; 386 if (!set_name_ex(&nmflag, *(++argv))) 387 goto bad; 388 } 389#ifndef OPENSSL_NO_ENGINE 390 else if (strcmp(*argv, "-engine") == 0) { 391 if (--argc < 1) 392 goto bad; 393 engine = *(++argv); 394 } 395#endif 396 else if (strcmp(*argv, "-C") == 0) | 305 break; 306 case OPT_CERTOPT: 307 if (!set_cert_ex(&certflag, opt_arg())) 308 goto opthelp; 309 break; 310 case OPT_NAMEOPT: 311 nmflag_set = 1; 312 if (!set_name_ex(&nmflag, opt_arg())) 313 goto opthelp; 314 break; 315 case OPT_ENGINE: 316 e = setup_engine(opt_arg(), 0); 317 break; 318 case OPT_C: |
397 C = ++num; | 319 C = ++num; |
398 else if (strcmp(*argv, "-email") == 0) | 320 break; 321 case OPT_EMAIL: |
399 email = ++num; | 322 email = ++num; |
400 else if (strcmp(*argv, "-ocsp_uri") == 0) | 323 break; 324 case OPT_OCSP_URI: |
401 ocsp_uri = ++num; | 325 ocsp_uri = ++num; |
402 else if (strcmp(*argv, "-serial") == 0) | 326 break; 327 case OPT_SERIAL: |
403 serial = ++num; | 328 serial = ++num; |
404 else if (strcmp(*argv, "-next_serial") == 0) | 329 break; 330 case OPT_NEXT_SERIAL: |
405 next_serial = ++num; | 331 next_serial = ++num; |
406 else if (strcmp(*argv, "-modulus") == 0) | 332 break; 333 case OPT_MODULUS: |
407 modulus = ++num; | 334 modulus = ++num; |
408 else if (strcmp(*argv, "-pubkey") == 0) | 335 break; 336 case OPT_PUBKEY: |
409 pubkey = ++num; | 337 pubkey = ++num; |
410 else if (strcmp(*argv, "-x509toreq") == 0) | 338 break; 339 case OPT_X509TOREQ: |
411 x509req = ++num; | 340 x509req = ++num; |
412 else if (strcmp(*argv, "-text") == 0) | 341 break; 342 case OPT_TEXT: |
413 text = ++num; | 343 text = ++num; |
414 else if (strcmp(*argv, "-hash") == 0 415 || strcmp(*argv, "-subject_hash") == 0) 416 subject_hash = ++num; 417#ifndef OPENSSL_NO_MD5 418 else if (strcmp(*argv, "-subject_hash_old") == 0) 419 subject_hash_old = ++num; 420#endif 421 else if (strcmp(*argv, "-issuer_hash") == 0) 422 issuer_hash = ++num; 423#ifndef OPENSSL_NO_MD5 424 else if (strcmp(*argv, "-issuer_hash_old") == 0) 425 issuer_hash_old = ++num; 426#endif 427 else if (strcmp(*argv, "-subject") == 0) | 344 break; 345 case OPT_SUBJECT: |
428 subject = ++num; | 346 subject = ++num; |
429 else if (strcmp(*argv, "-issuer") == 0) | 347 break; 348 case OPT_ISSUER: |
430 issuer = ++num; | 349 issuer = ++num; |
431 else if (strcmp(*argv, "-fingerprint") == 0) | 350 break; 351 case OPT_FINGERPRINT: |
432 fingerprint = ++num; | 352 fingerprint = ++num; |
433 else if (strcmp(*argv, "-dates") == 0) { 434 startdate = ++num; 435 enddate = ++num; 436 } else if (strcmp(*argv, "-purpose") == 0) | 353 break; 354 case OPT_HASH: 355 subject_hash = ++num; 356 break; 357 case OPT_ISSUER_HASH: 358 issuer_hash = ++num; 359 break; 360 case OPT_PURPOSE: |
437 pprint = ++num; | 361 pprint = ++num; |
438 else if (strcmp(*argv, "-startdate") == 0) | 362 break; 363 case OPT_STARTDATE: |
439 startdate = ++num; | 364 startdate = ++num; |
440 else if (strcmp(*argv, "-enddate") == 0) | 365 break; 366 case OPT_ENDDATE: |
441 enddate = ++num; | 367 enddate = ++num; |
442 else if (strcmp(*argv, "-checkend") == 0) { 443 if (--argc < 1) 444 goto bad; 445 checkoffset = atoi(*(++argv)); 446 checkend = 1; 447 } else if (strcmp(*argv, "-checkhost") == 0) { 448 if (--argc < 1) 449 goto bad; 450 checkhost = *(++argv); 451 } else if (strcmp(*argv, "-checkemail") == 0) { 452 if (--argc < 1) 453 goto bad; 454 checkemail = *(++argv); 455 } else if (strcmp(*argv, "-checkip") == 0) { 456 if (--argc < 1) 457 goto bad; 458 checkip = *(++argv); 459 } else if (strcmp(*argv, "-noout") == 0) | 368 break; 369 case OPT_NOOUT: |
460 noout = ++num; | 370 noout = ++num; |
461 else if (strcmp(*argv, "-trustout") == 0) | 371 break; 372 case OPT_NOCERT: 373 nocert = 1; 374 break; 375 case OPT_TRUSTOUT: |
462 trustout = 1; | 376 trustout = 1; |
463 else if (strcmp(*argv, "-clrtrust") == 0) | 377 break; 378 case OPT_CLRTRUST: |
464 clrtrust = ++num; | 379 clrtrust = ++num; |
465 else if (strcmp(*argv, "-clrreject") == 0) | 380 break; 381 case OPT_CLRREJECT: |
466 clrreject = ++num; | 382 clrreject = ++num; |
467 else if (strcmp(*argv, "-alias") == 0) | 383 break; 384 case OPT_ALIAS: |
468 aliasout = ++num; | 385 aliasout = ++num; |
469 else if (strcmp(*argv, "-CAcreateserial") == 0) | 386 break; 387 case OPT_CACREATESERIAL: |
470 CA_createserial = ++num; | 388 CA_createserial = ++num; |
471 else if (strcmp(*argv, "-clrext") == 0) | 389 break; 390 case OPT_CLREXT: |
472 clrext = 1; | 391 clrext = 1; |
473#if 1 /* stay backwards-compatible with 0.9.5; this 474 * should go away soon */ 475 else if (strcmp(*argv, "-crlext") == 0) { 476 BIO_printf(bio_err, "use -clrext instead of -crlext\n"); 477 clrext = 1; 478 } 479#endif 480 else if (strcmp(*argv, "-ocspid") == 0) | 392 break; 393 case OPT_OCSPID: |
481 ocspid = ++num; | 394 ocspid = ++num; |
482 else if (strcmp(*argv, "-badsig") == 0) | 395 break; 396 case OPT_BADSIG: |
483 badsig = 1; | 397 badsig = 1; |
484 else if ((md_alg = EVP_get_digestbyname(*argv + 1))) { 485 /* ok */ 486 digest = md_alg; 487 } else { 488 BIO_printf(bio_err, "unknown option %s\n", *argv); 489 badops = 1; | |
490 break; | 398 break; |
399#ifndef OPENSSL_NO_MD5 400 case OPT_SUBJECT_HASH_OLD: 401 subject_hash_old = ++num; 402 break; 403 case OPT_ISSUER_HASH_OLD: 404 issuer_hash_old = ++num; 405 break; 406#else 407 case OPT_SUBJECT_HASH_OLD: 408 case OPT_ISSUER_HASH_OLD: 409 break; 410#endif 411 case OPT_DATES: 412 startdate = ++num; 413 enddate = ++num; 414 break; 415 case OPT_CHECKEND: 416 checkend = 1; 417 { 418 intmax_t temp = 0; 419 if (!opt_imax(opt_arg(), &temp)) 420 goto opthelp; 421 checkoffset = (time_t)temp; 422 if ((intmax_t)checkoffset != temp) { 423 BIO_printf(bio_err, "%s: checkend time out of range %s\n", 424 prog, opt_arg()); 425 goto opthelp; 426 } 427 } 428 break; 429 case OPT_CHECKHOST: 430 checkhost = opt_arg(); 431 break; 432 case OPT_CHECKEMAIL: 433 checkemail = opt_arg(); 434 break; 435 case OPT_CHECKIP: 436 checkip = opt_arg(); 437 break; 438 case OPT_MD: 439 if (!opt_md(opt_unknown(), &digest)) 440 goto opthelp; |
|
491 } | 441 } |
492 argc--; 493 argv++; | |
494 } | 442 } |
443 argc = opt_num_rest(); 444 argv = opt_rest(); 445 if (argc != 0) { 446 BIO_printf(bio_err, "%s: Unknown parameter %s\n", prog, argv[0]); 447 goto opthelp; 448 } |
|
495 | 449 |
496 if (badops) { 497 bad: 498 for (pp = x509_usage; (*pp != NULL); pp++) 499 BIO_printf(bio_err, "%s", *pp); | 450 if (!nmflag_set) 451 nmflag = XN_FLAG_ONELINE; 452 453 out = bio_open_default(outfile, 'w', outformat); 454 if (out == NULL) |
500 goto end; | 455 goto end; |
501 } 502 e = setup_engine(bio_err, engine, 0); | |
503 504 if (need_rand) | 456 457 if (need_rand) |
505 app_RAND_load_file(NULL, bio_err, 0); | 458 app_RAND_load_file(NULL, 0); |
506 | 459 |
507 ERR_load_crypto_strings(); 508 509 if (!app_passwd(bio_err, passargin, NULL, &passin, NULL)) { | 460 if (!app_passwd(passinarg, NULL, &passin, NULL)) { |
510 BIO_printf(bio_err, "Error getting password\n"); 511 goto end; 512 } 513 514 if (!X509_STORE_set_default_paths(ctx)) { 515 ERR_print_errors(bio_err); 516 goto end; 517 } 518 519 if (fkeyfile) { | 461 BIO_printf(bio_err, "Error getting password\n"); 462 goto end; 463 } 464 465 if (!X509_STORE_set_default_paths(ctx)) { 466 ERR_print_errors(bio_err); 467 goto end; 468 } 469 470 if (fkeyfile) { |
520 fkey = load_pubkey(bio_err, fkeyfile, keyformat, 0, 521 NULL, e, "Forced key"); | 471 fkey = load_pubkey(fkeyfile, keyformat, 0, NULL, e, "Forced key"); |
522 if (fkey == NULL) 523 goto end; 524 } 525 526 if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM)) { 527 CAkeyfile = CAfile; 528 } else if ((CA_flag) && (CAkeyfile == NULL)) { 529 BIO_printf(bio_err, 530 "need to specify a CAkey if using the CA command\n"); 531 goto end; 532 } 533 534 if (extfile) { | 472 if (fkey == NULL) 473 goto end; 474 } 475 476 if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM)) { 477 CAkeyfile = CAfile; 478 } else if ((CA_flag) && (CAkeyfile == NULL)) { 479 BIO_printf(bio_err, 480 "need to specify a CAkey if using the CA command\n"); 481 goto end; 482 } 483 484 if (extfile) { |
535 long errorline = -1; | |
536 X509V3_CTX ctx2; | 485 X509V3_CTX ctx2; |
537 extconf = NCONF_new(NULL); 538 if (!NCONF_load(extconf, extfile, &errorline)) { 539 if (errorline <= 0) 540 BIO_printf(bio_err, 541 "error loading the config file '%s'\n", extfile); 542 else 543 BIO_printf(bio_err, 544 "error on line %ld of config file '%s'\n", 545 errorline, extfile); | 486 if ((extconf = app_load_config(extfile)) == NULL) |
546 goto end; | 487 goto end; |
547 } | |
548 if (!extsect) { 549 extsect = NCONF_get_string(extconf, "default", "extensions"); 550 if (!extsect) { 551 ERR_clear_error(); 552 extsect = "default"; 553 } 554 } 555 X509V3_set_ctx_test(&ctx2); --- 9 unchanged lines hidden (view full) --- 565 if (reqfile) { 566 EVP_PKEY *pkey; 567 BIO *in; 568 569 if (!sign_flag && !CA_flag) { 570 BIO_printf(bio_err, "We need a private key to sign with\n"); 571 goto end; 572 } | 488 if (!extsect) { 489 extsect = NCONF_get_string(extconf, "default", "extensions"); 490 if (!extsect) { 491 ERR_clear_error(); 492 extsect = "default"; 493 } 494 } 495 X509V3_set_ctx_test(&ctx2); --- 9 unchanged lines hidden (view full) --- 505 if (reqfile) { 506 EVP_PKEY *pkey; 507 BIO *in; 508 509 if (!sign_flag && !CA_flag) { 510 BIO_printf(bio_err, "We need a private key to sign with\n"); 511 goto end; 512 } |
573 in = BIO_new(BIO_s_file()); 574 if (in == NULL) { 575 ERR_print_errors(bio_err); | 513 in = bio_open_default(infile, 'r', informat); 514 if (in == NULL) |
576 goto end; | 515 goto end; |
577 } 578 579 if (infile == NULL) 580 BIO_set_fp(in, stdin, BIO_NOCLOSE | BIO_FP_TEXT); 581 else { 582 if (BIO_read_filename(in, infile) <= 0) { 583 perror(infile); 584 BIO_free(in); 585 goto end; 586 } 587 } | |
588 req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL); 589 BIO_free(in); 590 591 if (req == NULL) { 592 ERR_print_errors(bio_err); 593 goto end; 594 } 595 | 516 req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL); 517 BIO_free(in); 518 519 if (req == NULL) { 520 ERR_print_errors(bio_err); 521 goto end; 522 } 523 |
596 if ((req->req_info == NULL) || 597 (req->req_info->pubkey == NULL) || 598 (req->req_info->pubkey->public_key == NULL) || 599 (req->req_info->pubkey->public_key->data == NULL)) { 600 BIO_printf(bio_err, 601 "The certificate request appears to corrupted\n"); 602 BIO_printf(bio_err, "It does not contain a public key\n"); 603 goto end; 604 } 605 if ((pkey = X509_REQ_get_pubkey(req)) == NULL) { | 524 if ((pkey = X509_REQ_get0_pubkey(req)) == NULL) { |
606 BIO_printf(bio_err, "error unpacking public key\n"); 607 goto end; 608 } 609 i = X509_REQ_verify(req, pkey); | 525 BIO_printf(bio_err, "error unpacking public key\n"); 526 goto end; 527 } 528 i = X509_REQ_verify(req, pkey); |
610 EVP_PKEY_free(pkey); | |
611 if (i < 0) { 612 BIO_printf(bio_err, "Signature verification error\n"); 613 ERR_print_errors(bio_err); 614 goto end; 615 } 616 if (i == 0) { 617 BIO_printf(bio_err, 618 "Signature did not match the certificate request\n"); --- 4 unchanged lines hidden (view full) --- 623 print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), 624 nmflag); 625 626 if ((x = X509_new()) == NULL) 627 goto end; 628 629 if (sno == NULL) { 630 sno = ASN1_INTEGER_new(); | 529 if (i < 0) { 530 BIO_printf(bio_err, "Signature verification error\n"); 531 ERR_print_errors(bio_err); 532 goto end; 533 } 534 if (i == 0) { 535 BIO_printf(bio_err, 536 "Signature did not match the certificate request\n"); --- 4 unchanged lines hidden (view full) --- 541 print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), 542 nmflag); 543 544 if ((x = X509_new()) == NULL) 545 goto end; 546 547 if (sno == NULL) { 548 sno = ASN1_INTEGER_new(); |
631 if (!sno || !rand_serial(NULL, sno)) | 549 if (sno == NULL || !rand_serial(NULL, sno)) |
632 goto end; 633 if (!X509_set_serialNumber(x, sno)) 634 goto end; 635 ASN1_INTEGER_free(sno); 636 sno = NULL; 637 } else if (!X509_set_serialNumber(x, sno)) 638 goto end; 639 | 550 goto end; 551 if (!X509_set_serialNumber(x, sno)) 552 goto end; 553 ASN1_INTEGER_free(sno); 554 sno = NULL; 555 } else if (!X509_set_serialNumber(x, sno)) 556 goto end; 557 |
640 if (!X509_set_issuer_name(x, req->req_info->subject)) | 558 if (!X509_set_issuer_name(x, X509_REQ_get_subject_name(req))) |
641 goto end; | 559 goto end; |
642 if (!X509_set_subject_name(x, req->req_info->subject)) | 560 if (!X509_set_subject_name(x, X509_REQ_get_subject_name(req))) |
643 goto end; | 561 goto end; |
562 if (!set_cert_times(x, NULL, NULL, days)) 563 goto end; |
|
644 | 564 |
645 X509_gmtime_adj(X509_get_notBefore(x), 0); 646 X509_time_adj_ex(X509_get_notAfter(x), days, 0, NULL); | |
647 if (fkey) 648 X509_set_pubkey(x, fkey); 649 else { | 565 if (fkey) 566 X509_set_pubkey(x, fkey); 567 else { |
650 pkey = X509_REQ_get_pubkey(req); | 568 pkey = X509_REQ_get0_pubkey(req); |
651 X509_set_pubkey(x, pkey); | 569 X509_set_pubkey(x, pkey); |
652 EVP_PKEY_free(pkey); | |
653 } 654 } else | 570 } 571 } else |
655 x = load_cert(bio_err, infile, informat, NULL, e, "Certificate"); | 572 x = load_cert(infile, informat, "Certificate"); |
656 657 if (x == NULL) 658 goto end; 659 if (CA_flag) { | 573 574 if (x == NULL) 575 goto end; 576 if (CA_flag) { |
660 xca = load_cert(bio_err, CAfile, CAformat, NULL, e, "CA Certificate"); | 577 xca = load_cert(CAfile, CAformat, "CA Certificate"); |
661 if (xca == NULL) 662 goto end; 663 } 664 665 if (!noout || text || next_serial) { 666 OBJ_create("2.99999.3", "SET.ex3", "SET x509v3 extension 3"); 667 | 578 if (xca == NULL) 579 goto end; 580 } 581 582 if (!noout || text || next_serial) { 583 OBJ_create("2.99999.3", "SET.ex3", "SET x509v3 extension 3"); 584 |
668 out = BIO_new(BIO_s_file()); 669 if (out == NULL) { 670 ERR_print_errors(bio_err); 671 goto end; 672 } 673 if (outfile == NULL) { 674 BIO_set_fp(out, stdout, BIO_NOCLOSE); 675#ifdef OPENSSL_SYS_VMS 676 { 677 BIO *tmpbio = BIO_new(BIO_f_linebuffer()); 678 out = BIO_push(tmpbio, out); 679 } 680#endif 681 } else { 682 if (BIO_write_filename(out, outfile) <= 0) { 683 perror(outfile); 684 goto end; 685 } 686 } | |
687 } 688 689 if (alias) 690 X509_alias_set1(x, (unsigned char *)alias, -1); 691 692 if (clrtrust) 693 X509_trust_clear(x); 694 if (clrreject) 695 X509_reject_clear(x); 696 697 if (trust) { 698 for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { 699 objtmp = sk_ASN1_OBJECT_value(trust, i); 700 X509_add1_trust_object(x, objtmp); 701 } | 585 } 586 587 if (alias) 588 X509_alias_set1(x, (unsigned char *)alias, -1); 589 590 if (clrtrust) 591 X509_trust_clear(x); 592 if (clrreject) 593 X509_reject_clear(x); 594 595 if (trust) { 596 for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { 597 objtmp = sk_ASN1_OBJECT_value(trust, i); 598 X509_add1_trust_object(x, objtmp); 599 } |
600 objtmp = NULL; |
|
702 } 703 704 if (reject) { 705 for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { 706 objtmp = sk_ASN1_OBJECT_value(reject, i); 707 X509_add1_reject_object(x, objtmp); 708 } | 601 } 602 603 if (reject) { 604 for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { 605 objtmp = sk_ASN1_OBJECT_value(reject, i); 606 X509_add1_reject_object(x, objtmp); 607 } |
608 objtmp = NULL; |
|
709 } 710 | 609 } 610 |
611 if (badsig) { 612 const ASN1_BIT_STRING *signature; 613 614 X509_get0_signature(&signature, NULL, x); 615 corrupt_signature(signature); 616 } 617 |
|
711 if (num) { 712 for (i = 1; i <= num; i++) { 713 if (issuer == i) { | 618 if (num) { 619 for (i = 1; i <= num; i++) { 620 if (issuer == i) { |
714 print_name(STDout, "issuer= ", 715 X509_get_issuer_name(x), nmflag); | 621 print_name(out, "issuer=", X509_get_issuer_name(x), nmflag); |
716 } else if (subject == i) { | 622 } else if (subject == i) { |
717 print_name(STDout, "subject= ", | 623 print_name(out, "subject=", |
718 X509_get_subject_name(x), nmflag); 719 } else if (serial == i) { | 624 X509_get_subject_name(x), nmflag); 625 } else if (serial == i) { |
720 BIO_printf(STDout, "serial="); 721 i2a_ASN1_INTEGER(STDout, X509_get_serialNumber(x)); 722 BIO_printf(STDout, "\n"); | 626 BIO_printf(out, "serial="); 627 i2a_ASN1_INTEGER(out, X509_get_serialNumber(x)); 628 BIO_printf(out, "\n"); |
723 } else if (next_serial == i) { | 629 } else if (next_serial == i) { |
724 BIGNUM *bnser; 725 ASN1_INTEGER *ser; 726 ser = X509_get_serialNumber(x); 727 bnser = ASN1_INTEGER_to_BN(ser, NULL); | 630 ASN1_INTEGER *ser = X509_get_serialNumber(x); 631 BIGNUM *bnser = ASN1_INTEGER_to_BN(ser, NULL); 632 |
728 if (!bnser) 729 goto end; 730 if (!BN_add_word(bnser, 1)) 731 goto end; 732 ser = BN_to_ASN1_INTEGER(bnser, NULL); 733 if (!ser) 734 goto end; 735 BN_free(bnser); 736 i2a_ASN1_INTEGER(out, ser); 737 ASN1_INTEGER_free(ser); 738 BIO_puts(out, "\n"); 739 } else if ((email == i) || (ocsp_uri == i)) { 740 int j; 741 STACK_OF(OPENSSL_STRING) *emlst; 742 if (email == i) 743 emlst = X509_get1_email(x); 744 else 745 emlst = X509_get1_ocsp(x); 746 for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++) | 633 if (!bnser) 634 goto end; 635 if (!BN_add_word(bnser, 1)) 636 goto end; 637 ser = BN_to_ASN1_INTEGER(bnser, NULL); 638 if (!ser) 639 goto end; 640 BN_free(bnser); 641 i2a_ASN1_INTEGER(out, ser); 642 ASN1_INTEGER_free(ser); 643 BIO_puts(out, "\n"); 644 } else if ((email == i) || (ocsp_uri == i)) { 645 int j; 646 STACK_OF(OPENSSL_STRING) *emlst; 647 if (email == i) 648 emlst = X509_get1_email(x); 649 else 650 emlst = X509_get1_ocsp(x); 651 for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++) |
747 BIO_printf(STDout, "%s\n", | 652 BIO_printf(out, "%s\n", |
748 sk_OPENSSL_STRING_value(emlst, j)); 749 X509_email_free(emlst); 750 } else if (aliasout == i) { 751 unsigned char *alstr; 752 alstr = X509_alias_get0(x, NULL); 753 if (alstr) | 653 sk_OPENSSL_STRING_value(emlst, j)); 654 X509_email_free(emlst); 655 } else if (aliasout == i) { 656 unsigned char *alstr; 657 alstr = X509_alias_get0(x, NULL); 658 if (alstr) |
754 BIO_printf(STDout, "%s\n", alstr); | 659 BIO_printf(out, "%s\n", alstr); |
755 else | 660 else |
756 BIO_puts(STDout, "<No Alias>\n"); | 661 BIO_puts(out, " |
757 } else if (subject_hash == i) { | 662 } else if (subject_hash == i) { |
758 BIO_printf(STDout, "%08lx\n", X509_subject_name_hash(x)); | 663 BIO_printf(out, "%08lx\n", X509_subject_name_hash(x)); |
759 } 760#ifndef OPENSSL_NO_MD5 761 else if (subject_hash_old == i) { | 664 } 665#ifndef OPENSSL_NO_MD5 666 else if (subject_hash_old == i) { |
762 BIO_printf(STDout, "%08lx\n", X509_subject_name_hash_old(x)); | 667 BIO_printf(out, "%08lx\n", X509_subject_name_hash_old(x)); |
763 } 764#endif 765 else if (issuer_hash == i) { | 668 } 669#endif 670 else if (issuer_hash == i) { |
766 BIO_printf(STDout, "%08lx\n", X509_issuer_name_hash(x)); | 671 BIO_printf(out, "%08lx\n", X509_issuer_name_hash(x)); |
767 } 768#ifndef OPENSSL_NO_MD5 769 else if (issuer_hash_old == i) { | 672 } 673#ifndef OPENSSL_NO_MD5 674 else if (issuer_hash_old == i) { |
770 BIO_printf(STDout, "%08lx\n", X509_issuer_name_hash_old(x)); | 675 BIO_printf(out, "%08lx\n", X509_issuer_name_hash_old(x)); |
771 } 772#endif 773 else if (pprint == i) { 774 X509_PURPOSE *ptmp; 775 int j; | 676 } 677#endif 678 else if (pprint == i) { 679 X509_PURPOSE *ptmp; 680 int j; |
776 BIO_printf(STDout, "Certificate purposes:\n"); | 681 BIO_printf(out, "Certificate purposes:\n"); |
777 for (j = 0; j < X509_PURPOSE_get_count(); j++) { 778 ptmp = X509_PURPOSE_get0(j); | 682 for (j = 0; j < X509_PURPOSE_get_count(); j++) { 683 ptmp = X509_PURPOSE_get0(j); |
779 purpose_print(STDout, x, ptmp); | 684 purpose_print(out, x, ptmp); |
780 } 781 } else if (modulus == i) { 782 EVP_PKEY *pkey; 783 | 685 } 686 } else if (modulus == i) { 687 EVP_PKEY *pkey; 688 |
784 pkey = X509_get_pubkey(x); | 689 pkey = X509_get0_pubkey(x); |
785 if (pkey == NULL) { 786 BIO_printf(bio_err, "Modulus=unavailable\n"); 787 ERR_print_errors(bio_err); 788 goto end; 789 } | 690 if (pkey == NULL) { 691 BIO_printf(bio_err, "Modulus=unavailable\n"); 692 ERR_print_errors(bio_err); 693 goto end; 694 } |
790 BIO_printf(STDout, "Modulus="); | 695 BIO_printf(out, "Modulus="); |
791#ifndef OPENSSL_NO_RSA | 696#ifndef OPENSSL_NO_RSA |
792 if (pkey->type == EVP_PKEY_RSA) 793 BN_print(STDout, pkey->pkey.rsa->n); 794 else | 697 if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) { 698 const BIGNUM *n; 699 RSA_get0_key(EVP_PKEY_get0_RSA(pkey), &n, NULL, NULL); 700 BN_print(out, n); 701 } else |
795#endif 796#ifndef OPENSSL_NO_DSA | 702#endif 703#ifndef OPENSSL_NO_DSA |
797 if (pkey->type == EVP_PKEY_DSA) 798 BN_print(STDout, pkey->pkey.dsa->pub_key); 799 else | 704 if (EVP_PKEY_id(pkey) == EVP_PKEY_DSA) { 705 const BIGNUM *dsapub = NULL; 706 DSA_get0_key(EVP_PKEY_get0_DSA(pkey), &dsapub, NULL); 707 BN_print(out, dsapub); 708 } else |
800#endif | 709#endif |
801 BIO_printf(STDout, "Wrong Algorithm type"); 802 BIO_printf(STDout, "\n"); 803 EVP_PKEY_free(pkey); | 710 { 711 BIO_printf(out, "Wrong Algorithm type"); 712 } 713 BIO_printf(out, "\n"); |
804 } else if (pubkey == i) { 805 EVP_PKEY *pkey; 806 | 714 } else if (pubkey == i) { 715 EVP_PKEY *pkey; 716 |
807 pkey = X509_get_pubkey(x); | 717 pkey = X509_get0_pubkey(x); |
808 if (pkey == NULL) { 809 BIO_printf(bio_err, "Error getting public key\n"); 810 ERR_print_errors(bio_err); 811 goto end; 812 } | 718 if (pkey == NULL) { 719 BIO_printf(bio_err, "Error getting public key\n"); 720 ERR_print_errors(bio_err); 721 goto end; 722 } |
813 PEM_write_bio_PUBKEY(STDout, pkey); 814 EVP_PKEY_free(pkey); | 723 PEM_write_bio_PUBKEY(out, pkey); |
815 } else if (C == i) { 816 unsigned char *d; 817 char *m; | 724 } else if (C == i) { 725 unsigned char *d; 726 char *m; |
818 int y, z; | 727 int len; |
819 820 X509_NAME_oneline(X509_get_subject_name(x), buf, sizeof buf); | 728 729 X509_NAME_oneline(X509_get_subject_name(x), buf, sizeof buf); |
821 BIO_printf(STDout, "/* subject:%s */\n", buf); 822 m = X509_NAME_oneline(X509_get_issuer_name(x), buf, 823 sizeof buf); 824 BIO_printf(STDout, "/* issuer :%s */\n", buf); | 730 BIO_printf(out, "/*\n" 731 " * Subject: %s\n", buf); |
825 | 732 |
826 z = i2d_X509(x, NULL); 827 m = OPENSSL_malloc(z); 828 if (!m) { 829 BIO_printf(bio_err, "Out of memory\n"); 830 ERR_print_errors(bio_err); 831 goto end; 832 } | 733 X509_NAME_oneline(X509_get_issuer_name(x), buf, sizeof buf); 734 BIO_printf(out, " * Issuer: %s\n" 735 " */\n", buf); |
833 | 736 |
737 len = i2d_X509(x, NULL); 738 m = app_malloc(len, "x509 name buffer"); |
|
834 d = (unsigned char *)m; | 739 d = (unsigned char *)m; |
835 z = i2d_X509_NAME(X509_get_subject_name(x), &d); 836 BIO_printf(STDout, "unsigned char XXX_subject_name[%d]={\n", 837 z); | 740 len = i2d_X509_NAME(X509_get_subject_name(x), &d); 741 print_array(out, "the_subject_name", len, (unsigned char *)m); |
838 d = (unsigned char *)m; | 742 d = (unsigned char *)m; |
839 for (y = 0; y < z; y++) { 840 BIO_printf(STDout, "0x%02X,", d[y]); 841 if ((y & 0x0f) == 0x0f) 842 BIO_printf(STDout, "\n"); 843 } 844 if (y % 16 != 0) 845 BIO_printf(STDout, "\n"); 846 BIO_printf(STDout, "};\n"); 847 848 z = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), &d); 849 BIO_printf(STDout, "unsigned char XXX_public_key[%d]={\n", z); | 743 len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), &d); 744 print_array(out, "the_public_key", len, (unsigned char *)m); |
850 d = (unsigned char *)m; | 745 d = (unsigned char *)m; |
851 for (y = 0; y < z; y++) { 852 BIO_printf(STDout, "0x%02X,", d[y]); 853 if ((y & 0x0f) == 0x0f) 854 BIO_printf(STDout, "\n"); 855 } 856 if (y % 16 != 0) 857 BIO_printf(STDout, "\n"); 858 BIO_printf(STDout, "};\n"); 859 860 z = i2d_X509(x, &d); 861 BIO_printf(STDout, "unsigned char XXX_certificate[%d]={\n", 862 z); 863 d = (unsigned char *)m; 864 for (y = 0; y < z; y++) { 865 BIO_printf(STDout, "0x%02X,", d[y]); 866 if ((y & 0x0f) == 0x0f) 867 BIO_printf(STDout, "\n"); 868 } 869 if (y % 16 != 0) 870 BIO_printf(STDout, "\n"); 871 BIO_printf(STDout, "};\n"); 872 | 746 len = i2d_X509(x, &d); 747 print_array(out, "the_certificate", len, (unsigned char *)m); |
873 OPENSSL_free(m); 874 } else if (text == i) { | 748 OPENSSL_free(m); 749 } else if (text == i) { |
875 X509_print_ex(STDout, x, nmflag, certflag); | 750 X509_print_ex(out, x, nmflag, certflag); |
876 } else if (startdate == i) { | 751 } else if (startdate == i) { |
877 BIO_puts(STDout, "notBefore="); 878 ASN1_TIME_print(STDout, X509_get_notBefore(x)); 879 BIO_puts(STDout, "\n"); | 752 BIO_puts(out, "notBefore="); 753 ASN1_TIME_print(out, X509_get0_notBefore(x)); 754 BIO_puts(out, "\n"); |
880 } else if (enddate == i) { | 755 } else if (enddate == i) { |
881 BIO_puts(STDout, "notAfter="); 882 ASN1_TIME_print(STDout, X509_get_notAfter(x)); 883 BIO_puts(STDout, "\n"); | 756 BIO_puts(out, "notAfter="); 757 ASN1_TIME_print(out, X509_get0_notAfter(x)); 758 BIO_puts(out, "\n"); |
884 } else if (fingerprint == i) { 885 int j; 886 unsigned int n; 887 unsigned char md[EVP_MAX_MD_SIZE]; 888 const EVP_MD *fdig = digest; 889 890 if (!fdig) 891 fdig = EVP_sha1(); 892 893 if (!X509_digest(x, fdig, md, &n)) { 894 BIO_printf(bio_err, "out of memory\n"); 895 goto end; 896 } | 759 } else if (fingerprint == i) { 760 int j; 761 unsigned int n; 762 unsigned char md[EVP_MAX_MD_SIZE]; 763 const EVP_MD *fdig = digest; 764 765 if (!fdig) 766 fdig = EVP_sha1(); 767 768 if (!X509_digest(x, fdig, md, &n)) { 769 BIO_printf(bio_err, "out of memory\n"); 770 goto end; 771 } |
897 BIO_printf(STDout, "%s Fingerprint=", | 772 BIO_printf(out, "%s Fingerprint=", |
898 OBJ_nid2sn(EVP_MD_type(fdig))); 899 for (j = 0; j < (int)n; j++) { | 773 OBJ_nid2sn(EVP_MD_type(fdig))); 774 for (j = 0; j < (int)n; j++) { |
900 BIO_printf(STDout, "%02X%c", md[j], (j + 1 == (int)n) | 775 BIO_printf(out, "%02X%c", md[j], (j + 1 == (int)n) |
901 ? '\n' : ':'); 902 } 903 } 904 905 /* should be in the library */ 906 else if ((sign_flag == i) && (x509req == 0)) { 907 BIO_printf(bio_err, "Getting Private key\n"); 908 if (Upkey == NULL) { | 776 ? '\n' : ':'); 777 } 778 } 779 780 /* should be in the library */ 781 else if ((sign_flag == i) && (x509req == 0)) { 782 BIO_printf(bio_err, "Getting Private key\n"); 783 if (Upkey == NULL) { |
909 Upkey = load_key(bio_err, 910 keyfile, keyformat, 0, | 784 Upkey = load_key(keyfile, keyformat, 0, |
911 passin, e, "Private key"); 912 if (Upkey == NULL) 913 goto end; 914 } 915 916 assert(need_rand); 917 if (!sign(x, Upkey, days, clrext, digest, extconf, extsect)) 918 goto end; 919 } else if (CA_flag == i) { 920 BIO_printf(bio_err, "Getting CA Private Key\n"); 921 if (CAkeyfile != NULL) { | 785 passin, e, "Private key"); 786 if (Upkey == NULL) 787 goto end; 788 } 789 790 assert(need_rand); 791 if (!sign(x, Upkey, days, clrext, digest, extconf, extsect)) 792 goto end; 793 } else if (CA_flag == i) { 794 BIO_printf(bio_err, "Getting CA Private Key\n"); 795 if (CAkeyfile != NULL) { |
922 CApkey = load_key(bio_err, 923 CAkeyfile, CAkeyformat, | 796 CApkey = load_key(CAkeyfile, CAkeyformat, |
924 0, passin, e, "CA Private Key"); 925 if (CApkey == NULL) 926 goto end; 927 } 928 929 assert(need_rand); 930 if (!x509_certify(ctx, CAfile, digest, x, xca, 931 CApkey, sigopts, 932 CAserial, CA_createserial, days, clrext, | 797 0, passin, e, "CA Private Key"); 798 if (CApkey == NULL) 799 goto end; 800 } 801 802 assert(need_rand); 803 if (!x509_certify(ctx, CAfile, digest, x, xca, 804 CApkey, sigopts, 805 CAserial, CA_createserial, days, clrext, |
933 extconf, extsect, sno)) | 806 extconf, extsect, sno, reqfile)) |
934 goto end; 935 } else if (x509req == i) { 936 EVP_PKEY *pk; 937 938 BIO_printf(bio_err, "Getting request Private Key\n"); 939 if (keyfile == NULL) { 940 BIO_printf(bio_err, "no request key file specified\n"); 941 goto end; 942 } else { | 807 goto end; 808 } else if (x509req == i) { 809 EVP_PKEY *pk; 810 811 BIO_printf(bio_err, "Getting request Private Key\n"); 812 if (keyfile == NULL) { 813 BIO_printf(bio_err, "no request key file specified\n"); 814 goto end; 815 } else { |
943 pk = load_key(bio_err, 944 keyfile, keyformat, 0, | 816 pk = load_key(keyfile, keyformat, 0, |
945 passin, e, "request key"); 946 if (pk == NULL) 947 goto end; 948 } 949 950 BIO_printf(bio_err, "Generating certificate request\n"); 951 952 rq = X509_to_X509_REQ(x, pk, digest); --- 11 unchanged lines hidden (view full) --- 964 X509_ocspid_print(out, x); 965 } 966 } 967 } 968 969 if (checkend) { 970 time_t tcheck = time(NULL) + checkoffset; 971 | 817 passin, e, "request key"); 818 if (pk == NULL) 819 goto end; 820 } 821 822 BIO_printf(bio_err, "Generating certificate request\n"); 823 824 rq = X509_to_X509_REQ(x, pk, digest); --- 11 unchanged lines hidden (view full) --- 836 X509_ocspid_print(out, x); 837 } 838 } 839 } 840 841 if (checkend) { 842 time_t tcheck = time(NULL) + checkoffset; 843 |
972 if (X509_cmp_time(X509_get_notAfter(x), &tcheck) < 0) { | 844 if (X509_cmp_time(X509_get0_notAfter(x), &tcheck) < 0) { |
973 BIO_printf(out, "Certificate will expire\n"); 974 ret = 1; 975 } else { 976 BIO_printf(out, "Certificate will not expire\n"); 977 ret = 0; 978 } 979 goto end; 980 } 981 | 845 BIO_printf(out, "Certificate will expire\n"); 846 ret = 1; 847 } else { 848 BIO_printf(out, "Certificate will not expire\n"); 849 ret = 0; 850 } 851 goto end; 852 } 853 |
982 print_cert_checks(STDout, x, checkhost, checkemail, checkip); | 854 print_cert_checks(out, x, checkhost, checkemail, checkip); |
983 | 855 |
984 if (noout) { | 856 if (noout || nocert) { |
985 ret = 0; 986 goto end; 987 } 988 | 857 ret = 0; 858 goto end; 859 } 860 |
989 if (badsig) 990 x->signature->data[x->signature->length - 1] ^= 0x1; 991 | |
992 if (outformat == FORMAT_ASN1) 993 i = i2d_X509_bio(out, x); 994 else if (outformat == FORMAT_PEM) { 995 if (trustout) 996 i = PEM_write_bio_X509_AUX(out, x); 997 else 998 i = PEM_write_bio_X509(out, x); | 861 if (outformat == FORMAT_ASN1) 862 i = i2d_X509_bio(out, x); 863 else if (outformat == FORMAT_PEM) { 864 if (trustout) 865 i = PEM_write_bio_X509_AUX(out, x); 866 else 867 i = PEM_write_bio_X509(out, x); |
999 } else if (outformat == FORMAT_NETSCAPE) { 1000 NETSCAPE_X509 nx; 1001 ASN1_OCTET_STRING hdr; 1002 1003 hdr.data = (unsigned char *)NETSCAPE_CERT_HDR; 1004 hdr.length = strlen(NETSCAPE_CERT_HDR); 1005 nx.header = &hdr; 1006 nx.cert = x; 1007 1008 i = ASN1_item_i2d_bio(ASN1_ITEM_rptr(NETSCAPE_X509), out, &nx); | |
1009 } else { 1010 BIO_printf(bio_err, "bad output format specified for outfile\n"); 1011 goto end; 1012 } 1013 if (!i) { 1014 BIO_printf(bio_err, "unable to write certificate\n"); 1015 ERR_print_errors(bio_err); 1016 goto end; 1017 } 1018 ret = 0; 1019 end: 1020 if (need_rand) | 868 } else { 869 BIO_printf(bio_err, "bad output format specified for outfile\n"); 870 goto end; 871 } 872 if (!i) { 873 BIO_printf(bio_err, "unable to write certificate\n"); 874 ERR_print_errors(bio_err); 875 goto end; 876 } 877 ret = 0; 878 end: 879 if (need_rand) |
1021 app_RAND_write_file(NULL, bio_err); 1022 OBJ_cleanup(); | 880 app_RAND_write_file(NULL); |
1023 NCONF_free(extconf); 1024 BIO_free_all(out); | 881 NCONF_free(extconf); 882 BIO_free_all(out); |
1025 BIO_free_all(STDout); | |
1026 X509_STORE_free(ctx); 1027 X509_REQ_free(req); 1028 X509_free(x); 1029 X509_free(xca); 1030 EVP_PKEY_free(Upkey); 1031 EVP_PKEY_free(CApkey); 1032 EVP_PKEY_free(fkey); | 883 X509_STORE_free(ctx); 884 X509_REQ_free(req); 885 X509_free(x); 886 X509_free(xca); 887 EVP_PKEY_free(Upkey); 888 EVP_PKEY_free(CApkey); 889 EVP_PKEY_free(fkey); |
1033 if (sigopts) 1034 sk_OPENSSL_STRING_free(sigopts); | 890 sk_OPENSSL_STRING_free(sigopts); |
1035 X509_REQ_free(rq); 1036 ASN1_INTEGER_free(sno); 1037 sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free); 1038 sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free); | 891 X509_REQ_free(rq); 892 ASN1_INTEGER_free(sno); 893 sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free); 894 sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free); |
895 ASN1_OBJECT_free(objtmp); |
|
1039 release_engine(e); | 896 release_engine(e); |
1040 if (passin) 1041 OPENSSL_free(passin); 1042 apps_shutdown(); 1043 OPENSSL_EXIT(ret); | 897 OPENSSL_free(passin); 898 return (ret); |
1044} 1045 | 899} 900 |
1046static ASN1_INTEGER *x509_load_serial(char *CAfile, char *serialfile, | 901static ASN1_INTEGER *x509_load_serial(const char *CAfile, const char *serialfile, |
1047 int create) 1048{ 1049 char *buf = NULL, *p; 1050 ASN1_INTEGER *bs = NULL; 1051 BIGNUM *serial = NULL; 1052 size_t len; 1053 1054 len = ((serialfile == NULL) 1055 ? (strlen(CAfile) + strlen(POSTFIX) + 1) 1056 : (strlen(serialfile))) + 1; | 902 int create) 903{ 904 char *buf = NULL, *p; 905 ASN1_INTEGER *bs = NULL; 906 BIGNUM *serial = NULL; 907 size_t len; 908 909 len = ((serialfile == NULL) 910 ? (strlen(CAfile) + strlen(POSTFIX) + 1) 911 : (strlen(serialfile))) + 1; |
1057 buf = OPENSSL_malloc(len); 1058 if (buf == NULL) { 1059 BIO_printf(bio_err, "out of mem\n"); 1060 goto end; 1061 } | 912 buf = app_malloc(len, "serial# buffer"); |
1062 if (serialfile == NULL) { | 913 if (serialfile == NULL) { |
1063 BUF_strlcpy(buf, CAfile, len); | 914 OPENSSL_strlcpy(buf, CAfile, len); |
1064 for (p = buf; *p; p++) 1065 if (*p == '.') { 1066 *p = '\0'; 1067 break; 1068 } | 915 for (p = buf; *p; p++) 916 if (*p == '.') { 917 *p = '\0'; 918 break; 919 } |
1069 BUF_strlcat(buf, POSTFIX, len); | 920 OPENSSL_strlcat(buf, POSTFIX, len); |
1070 } else | 921 } else |
1071 BUF_strlcpy(buf, serialfile, len); | 922 OPENSSL_strlcpy(buf, serialfile, len); |
1072 1073 serial = load_serial(buf, create, NULL); 1074 if (serial == NULL) 1075 goto end; 1076 1077 if (!BN_add_word(serial, 1)) { 1078 BIO_printf(bio_err, "add_word failure\n"); 1079 goto end; 1080 } 1081 1082 if (!save_serial(buf, NULL, serial, &bs)) 1083 goto end; 1084 1085 end: | 923 924 serial = load_serial(buf, create, NULL); 925 if (serial == NULL) 926 goto end; 927 928 if (!BN_add_word(serial, 1)) { 929 BIO_printf(bio_err, "add_word failure\n"); 930 goto end; 931 } 932 933 if (!save_serial(buf, NULL, serial, &bs)) 934 goto end; 935 936 end: |
1086 if (buf) 1087 OPENSSL_free(buf); | 937 OPENSSL_free(buf); |
1088 BN_free(serial); 1089 return bs; 1090} 1091 | 938 BN_free(serial); 939 return bs; 940} 941 |
1092static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, | 942static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *digest, |
1093 X509 *x, X509 *xca, EVP_PKEY *pkey, 1094 STACK_OF(OPENSSL_STRING) *sigopts, | 943 X509 *x, X509 *xca, EVP_PKEY *pkey, 944 STACK_OF(OPENSSL_STRING) *sigopts, |
1095 char *serialfile, int create, 1096 int days, int clrext, CONF *conf, char *section, 1097 ASN1_INTEGER *sno) | 945 const char *serialfile, int create, 946 int days, int clrext, CONF *conf, const char *section, 947 ASN1_INTEGER *sno, int reqfile) |
1098{ 1099 int ret = 0; 1100 ASN1_INTEGER *bs = NULL; | 948{ 949 int ret = 0; 950 ASN1_INTEGER *bs = NULL; |
1101 X509_STORE_CTX xsc; | 951 X509_STORE_CTX *xsc = NULL; |
1102 EVP_PKEY *upkey; 1103 | 952 EVP_PKEY *upkey; 953 |
1104 upkey = X509_get_pubkey(xca); 1105 if (upkey == NULL) { | 954 upkey = X509_get0_pubkey(xca); 955 if (upkey == NULL) { |
1106 BIO_printf(bio_err, "Error obtaining CA X509 public key\n"); 1107 goto end; 1108 } 1109 EVP_PKEY_copy_parameters(upkey, pkey); | 956 BIO_printf(bio_err, "Error obtaining CA X509 public key\n"); 957 goto end; 958 } 959 EVP_PKEY_copy_parameters(upkey, pkey); |
1110 EVP_PKEY_free(upkey); | |
1111 | 960 |
1112 if (!X509_STORE_CTX_init(&xsc, ctx, x, NULL)) { | 961 xsc = X509_STORE_CTX_new(); 962 if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, x, NULL)) { |
1113 BIO_printf(bio_err, "Error initialising X509 store\n"); 1114 goto end; 1115 } 1116 if (sno) 1117 bs = sno; | 963 BIO_printf(bio_err, "Error initialising X509 store\n"); 964 goto end; 965 } 966 if (sno) 967 bs = sno; |
1118 else if (!(bs = x509_load_serial(CAfile, serialfile, create))) | 968 else if ((bs = x509_load_serial(CAfile, serialfile, create)) == NULL) |
1119 goto end; 1120 | 969 goto end; 970 |
1121/* if (!X509_STORE_add_cert(ctx,x)) goto end;*/ 1122 | |
1123 /* 1124 * NOTE: this certificate can/should be self signed, unless it was a 1125 * certificate request in which case it is not. 1126 */ | 971 /* 972 * NOTE: this certificate can/should be self signed, unless it was a 973 * certificate request in which case it is not. 974 */ |
1127 X509_STORE_CTX_set_cert(&xsc, x); 1128 X509_STORE_CTX_set_flags(&xsc, X509_V_FLAG_CHECK_SS_SIGNATURE); 1129 if (!reqfile && X509_verify_cert(&xsc) <= 0) | 975 X509_STORE_CTX_set_cert(xsc, x); 976 X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE); 977 if (!reqfile && X509_verify_cert(xsc) <= 0) |
1130 goto end; 1131 1132 if (!X509_check_private_key(xca, pkey)) { 1133 BIO_printf(bio_err, 1134 "CA certificate and CA private key do not match\n"); 1135 goto end; 1136 } 1137 1138 if (!X509_set_issuer_name(x, X509_get_subject_name(xca))) 1139 goto end; 1140 if (!X509_set_serialNumber(x, bs)) 1141 goto end; 1142 | 978 goto end; 979 980 if (!X509_check_private_key(xca, pkey)) { 981 BIO_printf(bio_err, 982 "CA certificate and CA private key do not match\n"); 983 goto end; 984 } 985 986 if (!X509_set_issuer_name(x, X509_get_subject_name(xca))) 987 goto end; 988 if (!X509_set_serialNumber(x, bs)) 989 goto end; 990 |
1143 if (X509_gmtime_adj(X509_get_notBefore(x), 0L) == NULL) | 991 if (!set_cert_times(x, NULL, NULL, days)) |
1144 goto end; 1145 | 992 goto end; 993 |
1146 /* hardwired expired */ 1147 if (X509_time_adj_ex(X509_get_notAfter(x), days, 0, NULL) == NULL) 1148 goto end; 1149 | |
1150 if (clrext) { 1151 while (X509_get_ext_count(x) > 0) 1152 X509_delete_ext(x, 0); 1153 } 1154 1155 if (conf) { 1156 X509V3_CTX ctx2; | 994 if (clrext) { 995 while (X509_get_ext_count(x) > 0) 996 X509_delete_ext(x, 0); 997 } 998 999 if (conf) { 1000 X509V3_CTX ctx2; |
1157#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL 1158 X509_set_version(x, force_version); 1159#else | |
1160 X509_set_version(x, 2); /* version 3 certificate */ | 1001 X509_set_version(x, 2); /* version 3 certificate */ |
1161#endif | |
1162 X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0); 1163 X509V3_set_nconf(&ctx2, conf); 1164 if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) 1165 goto end; 1166 } 1167 | 1002 X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0); 1003 X509V3_set_nconf(&ctx2, conf); 1004 if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) 1005 goto end; 1006 } 1007 |
1168 if (!do_X509_sign(bio_err, x, pkey, digest, sigopts)) | 1008 if (!do_X509_sign(x, pkey, digest, sigopts)) |
1169 goto end; 1170 ret = 1; 1171 end: | 1009 goto end; 1010 ret = 1; 1011 end: |
1172 X509_STORE_CTX_cleanup(&xsc); | 1012 X509_STORE_CTX_free(xsc); |
1173 if (!ret) 1174 ERR_print_errors(bio_err); 1175 if (!sno) 1176 ASN1_INTEGER_free(bs); 1177 return ret; 1178} 1179 | 1013 if (!ret) 1014 ERR_print_errors(bio_err); 1015 if (!sno) 1016 ASN1_INTEGER_free(bs); 1017 return ret; 1018} 1019 |
1180static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx) | 1020static int callb(int ok, X509_STORE_CTX *ctx) |
1181{ 1182 int err; 1183 X509 *err_cert; 1184 1185 /* 1186 * it is ok to use a self signed certificate This case will catch both 1187 * the initial ok == 0 and the final ok == 1 calls to this function 1188 */ --- 18 unchanged lines hidden (view full) --- 1207 X509_STORE_CTX_get_error_depth(ctx), 1208 X509_verify_cert_error_string(err)); 1209 return 1; 1210 } 1211} 1212 1213/* self sign */ 1214static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, | 1021{ 1022 int err; 1023 X509 *err_cert; 1024 1025 /* 1026 * it is ok to use a self signed certificate This case will catch both 1027 * the initial ok == 0 and the final ok == 1 calls to this function 1028 */ --- 18 unchanged lines hidden (view full) --- 1047 X509_STORE_CTX_get_error_depth(ctx), 1048 X509_verify_cert_error_string(err)); 1049 return 1; 1050 } 1051} 1052 1053/* self sign */ 1054static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, |
1215 const EVP_MD *digest, CONF *conf, char *section) | 1055 const EVP_MD *digest, CONF *conf, const char *section) |
1216{ 1217 | 1056{ 1057 |
1218 EVP_PKEY *pktmp; 1219 1220 pktmp = X509_get_pubkey(x); 1221 if (pktmp == NULL) 1222 goto err; 1223 EVP_PKEY_copy_parameters(pktmp, pkey); 1224 EVP_PKEY_save_parameters(pktmp, 1); 1225 EVP_PKEY_free(pktmp); 1226 | |
1227 if (!X509_set_issuer_name(x, X509_get_subject_name(x))) 1228 goto err; | 1058 if (!X509_set_issuer_name(x, X509_get_subject_name(x))) 1059 goto err; |
1229 if (X509_gmtime_adj(X509_get_notBefore(x), 0) == NULL) | 1060 if (!set_cert_times(x, NULL, NULL, days)) |
1230 goto err; | 1061 goto err; |
1231 1232 if (X509_time_adj_ex(X509_get_notAfter(x), days, 0, NULL) == NULL) 1233 goto err; 1234 | |
1235 if (!X509_set_pubkey(x, pkey)) 1236 goto err; 1237 if (clrext) { 1238 while (X509_get_ext_count(x) > 0) 1239 X509_delete_ext(x, 0); 1240 } 1241 if (conf) { 1242 X509V3_CTX ctx; | 1062 if (!X509_set_pubkey(x, pkey)) 1063 goto err; 1064 if (clrext) { 1065 while (X509_get_ext_count(x) > 0) 1066 X509_delete_ext(x, 0); 1067 } 1068 if (conf) { 1069 X509V3_CTX ctx; |
1243#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL 1244 X509_set_version(x, force_version); 1245#else | |
1246 X509_set_version(x, 2); /* version 3 certificate */ | 1070 X509_set_version(x, 2); /* version 3 certificate */ |
1247#endif | |
1248 X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0); 1249 X509V3_set_nconf(&ctx, conf); 1250 if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) 1251 goto err; 1252 } 1253 if (!X509_sign(x, pkey, digest)) 1254 goto err; 1255 return 1; 1256 err: 1257 ERR_print_errors(bio_err); 1258 return 0; 1259} 1260 1261static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt) 1262{ 1263 int id, i, idret; | 1071 X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0); 1072 X509V3_set_nconf(&ctx, conf); 1073 if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) 1074 goto err; 1075 } 1076 if (!X509_sign(x, pkey, digest)) 1077 goto err; 1078 return 1; 1079 err: 1080 ERR_print_errors(bio_err); 1081 return 0; 1082} 1083 1084static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt) 1085{ 1086 int id, i, idret; |
1264 char *pname; | 1087 const char *pname; |
1265 id = X509_PURPOSE_get_id(pt); 1266 pname = X509_PURPOSE_get0_name(pt); 1267 for (i = 0; i < 2; i++) { 1268 idret = X509_check_purpose(cert, id, i); 1269 BIO_printf(bio, "%s%s : ", pname, i ? " CA" : ""); 1270 if (idret == 1) 1271 BIO_printf(bio, "Yes\n"); 1272 else if (idret == 0) 1273 BIO_printf(bio, "No\n"); 1274 else 1275 BIO_printf(bio, "Yes (WARNING code=%d)\n", idret); 1276 } 1277 return 1; 1278} | 1088 id = X509_PURPOSE_get_id(pt); 1089 pname = X509_PURPOSE_get0_name(pt); 1090 for (i = 0; i < 2; i++) { 1091 idret = X509_check_purpose(cert, id, i); 1092 BIO_printf(bio, "%s%s : ", pname, i ? " CA" : ""); 1093 if (idret == 1) 1094 BIO_printf(bio, "Yes\n"); 1095 else if (idret == 0) 1096 BIO_printf(bio, "No\n"); 1097 else 1098 BIO_printf(bio, "Yes (WARNING code=%d)\n", idret); 1099 } 1100 return 1; 1101} |