1'*************************************************************************** 2'* _ _ ____ _ 3'* Project ___| | | | _ \| | 4'* / __| | | | |_) | | 5'* | (__| |_| | _ <| |___ 6'* \___|\___/|_| \_\_____| 7'* 8'* Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al. 9'* 10'* This software is licensed as described in the file COPYING, which 11'* you should have received as part of this distribution. The terms 12'* are also available at http://curl.haxx.se/docs/copyright.html. 13'* 14'* You may opt to use, copy, modify, merge, publish, distribute and/or sell 15'* copies of the Software, and permit persons to whom the Software is 16'* furnished to do so, under the terms of the COPYING file. 17'* 18'* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY 19'* KIND, either express or implied. 20'* 21'*************************************************************************** 22'* Script to fetch certdata.txt from Mozilla.org site and create a 23'* ca-bundle.crt for use with OpenSSL / libcurl / libcurl bindings 24'* Requires WinHttp.WinHttpRequest.5.1 and ADODB.Stream which are part of 25'* W2000 SP3 or later, WXP SP1 or later, W2003 Server SP1 or later. 26'* Hacked by Guenter Knauf 27'*************************************************************************** 28Option Explicit 29Const myVersion = "0.3.7" 30 31Const myUrl = "http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1" 32 33Const myOpenssl = "openssl.exe" 34 35Const myCdSavF = FALSE ' Flag: save downloaded data to file certdata.txt 36Const myCaBakF = TRUE ' Flag: backup existing ca-bundle certificate 37Const myAskLiF = TRUE ' Flag: display certdata.txt license agreement 38Const myAskTiF = TRUE ' Flag: ask to include certificate text info 39Const myWrapLe = 76 ' Default length of base64 output lines 40 41'******************* Nothing to configure below! ******************* 42Dim objShell, objNetwork, objFSO, objHttp 43Dim myBase, mySelf, myFh, myTmpFh, myCdData, myCdFile, myCaFile, myTmpName, myBakNum, myOptTxt, i 44Set objNetwork = WScript.CreateObject("WScript.Network") 45Set objShell = WScript.CreateObject("WScript.Shell") 46Set objFSO = WScript.CreateObject("Scripting.FileSystemObject") 47Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest.5.1") 48If objHttp Is Nothing Then Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest") 49myBase = Left(WScript.ScriptFullName, InstrRev(WScript.ScriptFullName, "\")) 50mySelf = Left(WScript.ScriptName, InstrRev(WScript.ScriptName, ".") - 1) & " " & myVersion 51myCdFile = Mid(myUrl, InstrRev(myUrl, "/") + 1, InstrRev(myUrl, "?") - InstrRev(myUrl, "/") - 1) 52myCaFile = "ca-bundle.crt" 53myTmpName = InputBox("Enter output filename:", mySelf, myCaFile) 54If Not (myTmpName = "") Then 55 myCaFile = myTmpName 56End If 57' Lets ignore SSL invalid cert errors 58objHttp.Option(4) = 256 + 512 + 4096 + 8192 59objHttp.SetTimeouts 0, 5000, 10000, 10000 60objHttp.Open "GET", myUrl, FALSE 61objHttp.setRequestHeader "User-Agent", WScript.ScriptName & "/" & myVersion 62objHttp.Send "" 63If Not (objHttp.statusText = "OK") Then 64 MsgBox("Failed to download '" & myCdFile & "': " & objHttp.statusText), vbCritical, mySelf 65 WScript.Quit 1 66End If 67' Convert data from ResponseBody instead of using ResponseText because of UTF-8 68myCdData = ConvertBinaryData(objHttp.ResponseBody) 69Set objHttp = Nothing 70' Write received data to file if enabled 71If (myCdSavF = TRUE) Then 72 Set myFh = objFSO.OpenTextFile(myCdFile, 2, TRUE) 73 myFh.Write myCdData 74 myFh.Close 75End If 76' Backup exitsing ca-bundle certificate file 77If (myCaBakF = TRUE) Then 78 If objFSO.FileExists(myCaFile) Then 79 Dim myBakFile, b 80 b = 1 81 myBakFile = myCaFile & ".~" & b & "~" 82 While objFSO.FileExists(myBakFile) 83 b = b + 1 84 myBakFile = myCaFile & ".~" & b & "~" 85 Wend 86 Set myTmpFh = objFSO.GetFile(myCaFile) 87 myTmpFh.Move myBakFile 88 End If 89End If 90If (myAskTiF = TRUE) Then 91 If (6 = objShell.PopUp("Do you want to include text information about each certificate?" & vbLf & _ 92 "(requires OpenSSL commandline in current directory or in search path)",, _ 93 mySelf, vbQuestion + vbYesNo + vbDefaultButton2)) Then 94 myOptTxt = TRUE 95 Else 96 myOptTxt = FALSE 97 End If 98End If 99' Process the received data 100Dim myLines, myPattern, myInsideCert, myInsideLicense, myLicenseText, myNumCerts, myNumSkipped 101Dim myLabel, myOctets, myData, myPem, myRev, myUntrusted, j 102myNumSkipped = 0 103myNumCerts = 0 104myData = "" 105myLines = Split(myCdData, vbLf, -1) 106Set myFh = objFSO.OpenTextFile(myCaFile, 2, TRUE) 107myFh.Write "##" & vbLf 108myFh.Write "## " & myCaFile & " -- Bundle of CA Root Certificates" & vbLf 109myFh.Write "##" & vbLf 110myFh.Write "## Converted at: " & Now & vbLf 111myFh.Write "##" & vbLf 112myFh.Write "## This is a bundle of X.509 certificates of public Certificate Authorities" & vbLf 113myFh.Write "## (CA). These were automatically extracted from Mozilla's root certificates" & vbLf 114myFh.Write "## file (certdata.txt). This file can be found in the mozilla source tree:" & vbLf 115myFh.Write "## '/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt'" & vbLf 116myFh.Write "##" & vbLf 117myFh.Write "## It contains the certificates in PEM format and therefore" & vbLf 118myFh.Write "## can be directly used with curl / libcurl / php_curl, or with" & vbLf 119myFh.Write "## an Apache+mod_ssl webserver for SSL client authentication." & vbLf 120myFh.Write "## Just configure this file as the SSLCACertificateFile." & vbLf 121myFh.Write "##" & vbLf 122myFh.Write vbLf 123For i = 0 To UBound(myLines) 124 If InstrRev(myLines(i), "CKA_LABEL ") Then 125 myPattern = "^CKA_LABEL\s+[A-Z0-9]+\s+""(.+?)""" 126 myLabel = RegExprFirst(myPattern, myLines(i)) 127 End If 128 If (myInsideCert = TRUE) Then 129 If InstrRev(myLines(i), "END") Then 130 myInsideCert = FALSE 131 While (i < UBound(myLines)) And Not (myLines(i) = "#") 132 i = i + 1 133 If (InstrRev(myLines(i), "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED") Or _ 134 InstrRev(myLines(i), "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUST_UNKNOWN")) Then 135 myUntrusted = TRUE 136 End If 137 Wend 138 If (myUntrusted = TRUE) Then 139 myNumSkipped = myNumSkipped + 1 140 Else 141 myFh.Write myLabel & vbLf 142 myFh.Write String(Len(myLabel), "=") & vbLf 143 myPem = "-----BEGIN CERTIFICATE-----" & vbLf & _ 144 Base64Encode(myData) & vbLf & _ 145 "-----END CERTIFICATE-----" & vbLf 146 If (myOptTxt = FALSE) Then 147 myFh.Write myPem & vbLf 148 Else 149 Dim myCmd, myRval, myTmpIn, myTmpOut 150 myTmpIn = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName 151 myTmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName 152 Set myTmpFh = objFSO.OpenTextFile(myTmpIn, 2, TRUE) 153 myTmpFh.Write myPem 154 myTmpFh.Close 155 myCmd = myOpenssl & " x509 -md5 -fingerprint -text -inform PEM" & _ 156 " -in " & myTmpIn & " -out " & myTmpOut 157 myRval = objShell.Run (myCmd, 0, TRUE) 158 objFSO.DeleteFile myTmpIn, TRUE 159 If Not (myRval = 0) Then 160 MsgBox("Failed to process PEM cert with OpenSSL commandline!"), vbCritical, mySelf 161 objFSO.DeleteFile myTmpOut, TRUE 162 WScript.Quit 3 163 End If 164 Set myTmpFh = objFSO.OpenTextFile(myTmpOut, 1) 165 myFh.Write myTmpFh.ReadAll & vbLf 166 myTmpFh.Close 167 objFSO.DeleteFile myTmpOut, TRUE 168 End If 169 myNumCerts = myNumCerts + 1 170 End If 171 Else 172 myOctets = Split(myLines(i), "\") 173 For j = 1 To UBound(myOctets) 174 myData = myData & Chr(CByte("&o" & myOctets(j))) 175 Next 176 End If 177 End If 178 If InstrRev(myLines(i), "CVS_ID ") Then 179 myPattern = "^CVS_ID\s+""(.+?)""" 180 myRev = RegExprFirst(myPattern, myLines(i)) 181 myFh.Write "# " & myRev & vbLf & vbLf 182 End If 183 If InstrRev(myLines(i), "CKA_VALUE MULTILINE_OCTAL") Then 184 myInsideCert = TRUE 185 myUntrusted = FALSE 186 myData = "" 187 End If 188 If InstrRev(myLines(i), "***** BEGIN LICENSE BLOCK *****") Then 189 myInsideLicense = TRUE 190 End If 191 If (myInsideLicense = TRUE) Then 192 myFh.Write myLines(i) & vbLf 193 myLicenseText = myLicenseText & Mid(myLines(i), 2) & vbLf 194 End If 195 If InstrRev(myLines(i), "***** END LICENSE BLOCK *****") Then 196 myInsideLicense = FALSE 197 If (myAskLiF = TRUE) Then 198 If Not (6 = objShell.PopUp(myLicenseText & vbLf & _ 199 "Do you agree to the license shown above (required to proceed) ?",, _ 200 mySelf, vbQuestion + vbYesNo + vbDefaultButton1)) Then 201 myFh.Close 202 objFSO.DeleteFile myCaFile, TRUE 203 WScript.Quit 2 204 End If 205 End If 206 End If 207Next 208myFh.Close 209objShell.PopUp "Done (" & myNumCerts & " CA certs processed, " & myNumSkipped & _ 210 " untrusted skipped).", 20, mySelf, vbInformation 211WScript.Quit 0 212 213Function ConvertBinaryData(arrBytes) 214 Dim objStream 215 Set objStream = CreateObject("ADODB.Stream") 216 objStream.Open 217 objStream.Type = 1 218 objStream.Write arrBytes 219 objStream.Position = 0 220 objStream.Type = 2 221 objStream.Charset = "ascii" 222 ConvertBinaryData = objStream.ReadText 223 Set objStream = Nothing 224End Function 225 226Function RegExprFirst(SearchPattern, TheString) 227 Dim objRegExp, Matches ' create variables. 228 Set objRegExp = New RegExp ' create a regular expression. 229 objRegExp.Pattern = SearchPattern ' sets the search pattern. 230 objRegExp.IgnoreCase = TRUE ' set to ignores case. 231 objRegExp.Global = TRUE ' set to gloabal search. 232 Set Matches = objRegExp.Execute(TheString) ' do the search. 233 If (Matches.Count) Then 234 RegExprFirst = Matches(0).SubMatches(0) ' return first match. 235 Else 236 RegExprFirst = "" 237 End If 238 Set objRegExp = Nothing 239End Function 240 241Function Base64Encode(inData) 242 Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" 243 Dim cOut, sOut, lWrap, I 244 lWrap = Int(myWrapLe * 3 / 4) 245 246 'For each group of 3 bytes 247 For I = 1 To Len(inData) Step 3 248 Dim nGroup, pOut, sGroup 249 250 'Create one long from this 3 bytes. 251 nGroup = &H10000 * Asc(Mid(inData, I, 1)) + _ 252 &H100 * MyASC(Mid(inData, I + 1, 1)) + _ 253 MyASC(Mid(inData, I + 2, 1)) 254 255 'Oct splits the long To 8 groups with 3 bits 256 nGroup = Oct(nGroup) 257 258 'Add leading zeros 259 nGroup = String(8 - Len(nGroup), "0") & nGroup 260 261 'Convert To base64 262 pOut = Mid(Base64, CLng("&o" & Mid(nGroup, 1, 2)) + 1, 1) & _ 263 Mid(Base64, CLng("&o" & Mid(nGroup, 3, 2)) + 1, 1) & _ 264 Mid(Base64, CLng("&o" & Mid(nGroup, 5, 2)) + 1, 1) & _ 265 Mid(Base64, CLng("&o" & Mid(nGroup, 7, 2)) + 1, 1) 266 267 'Add the part To OutPut string 268 sOut = sOut + pOut 269 270 'Add a new line For Each myWrapLe chars In dest 271 If (I < Len(inData) - 2) Then 272 If (I + 2) Mod lWrap = 0 Then sOut = sOut & vbLf 273 End If 274 Next 275 Select Case Len(inData) Mod 3 276 Case 1: '8 bit final 277 sOut = Left(sOut, Len(sOut) - 2) & "==" 278 Case 2: '16 bit final 279 sOut = Left(sOut, Len(sOut) - 1) & "=" 280 End Select 281 Base64Encode = sOut 282End Function 283 284Function MyASC(OneChar) 285 If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar) 286End Function 287 288 289