CA.pl.in 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238
  1. #!{- $config{HASHBANGPERL} -}
  2. # Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. #
  9. # Wrapper around the ca to make it easier to use
  10. #
  11. # {- join("\n# ", @autowarntext) -}
  12. use strict;
  13. use warnings;
  14. my $verbose = 1;
  15. my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
  16. my $openssl = $ENV{'OPENSSL'} // "openssl";
  17. $ENV{'OPENSSL'} = $openssl;
  18. my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} // "";
  19. # Command invocations.
  20. my $REQ = "$openssl req $OPENSSL_CONFIG";
  21. my $CA = "$openssl ca $OPENSSL_CONFIG";
  22. my $VERIFY = "$openssl verify";
  23. my $X509 = "$openssl x509";
  24. my $PKCS12 = "$openssl pkcs12";
  25. # Default values for various configuration settings.
  26. my $CATOP = "./demoCA";
  27. my $CAKEY = "cakey.pem";
  28. my $CAREQ = "careq.pem";
  29. my $CACERT = "cacert.pem";
  30. my $CACRL = "crl.pem";
  31. my $DAYS = "-days 365";
  32. my $CADAYS = "-days 1095"; # 3 years
  33. my $EXTENSIONS = "-extensions v3_ca";
  34. my $POLICY = "-policy policy_anything";
  35. my $NEWKEY = "newkey.pem";
  36. my $NEWREQ = "newreq.pem";
  37. my $NEWCERT = "newcert.pem";
  38. my $NEWP12 = "newcert.p12";
  39. # Commandline parsing
  40. my %EXTRA;
  41. my $WHAT = shift @ARGV || "";
  42. @ARGV = parse_extra(@ARGV);
  43. my $RET = 0;
  44. # Split out "-extra-CMD value", and return new |@ARGV|. Fill in
  45. # |EXTRA{CMD}| with list of values.
  46. sub parse_extra
  47. {
  48. foreach ( @OPENSSL_CMDS ) {
  49. $EXTRA{$_} = '';
  50. }
  51. my @result;
  52. while ( scalar(@_) > 0 ) {
  53. my $arg = shift;
  54. if ( $arg !~ m/-extra-([a-z0-9]+)/ ) {
  55. push @result, $arg;
  56. next;
  57. }
  58. $arg =~ s/-extra-//;
  59. die("Unknown \"-${arg}-extra\" option, exiting")
  60. unless scalar grep { $arg eq $_ } @OPENSSL_CMDS;
  61. $EXTRA{$arg} .= " " . shift;
  62. }
  63. return @result;
  64. }
  65. # See if reason for a CRL entry is valid; exit if not.
  66. sub crl_reason_ok
  67. {
  68. my $r = shift;
  69. if ($r eq 'unspecified' || $r eq 'keyCompromise'
  70. || $r eq 'CACompromise' || $r eq 'affiliationChanged'
  71. || $r eq 'superseded' || $r eq 'cessationOfOperation'
  72. || $r eq 'certificateHold' || $r eq 'removeFromCRL') {
  73. return 1;
  74. }
  75. print STDERR "Invalid CRL reason; must be one of:\n";
  76. print STDERR " unspecified, keyCompromise, CACompromise,\n";
  77. print STDERR " affiliationChanged, superseded, cessationOfOperation\n";
  78. print STDERR " certificateHold, removeFromCRL";
  79. exit 1;
  80. }
  81. # Copy a PEM-format file; return like exit status (zero means ok)
  82. sub copy_pemfile
  83. {
  84. my ($infile, $outfile, $bound) = @_;
  85. my $found = 0;
  86. open IN, $infile || die "Cannot open $infile, $!";
  87. open OUT, ">$outfile" || die "Cannot write to $outfile, $!";
  88. while (<IN>) {
  89. $found = 1 if /^-----BEGIN.*$bound/;
  90. print OUT $_ if $found;
  91. $found = 2, last if /^-----END.*$bound/;
  92. }
  93. close IN;
  94. close OUT;
  95. return $found == 2 ? 0 : 1;
  96. }
  97. # Wrapper around system; useful for debugging. Returns just the exit status
  98. sub run
  99. {
  100. my $cmd = shift;
  101. print "====\n$cmd\n" if $verbose;
  102. my $status = system($cmd);
  103. print "==> $status\n====\n" if $verbose;
  104. return $status >> 8;
  105. }
  106. if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
  107. print STDERR <<EOF;
  108. Usage:
  109. CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd parameter]
  110. CA.pl -pkcs12 [certname]
  111. CA.pl -verify certfile ...
  112. CA.pl -revoke certfile [reason]
  113. EOF
  114. exit 0;
  115. }
  116. if ($WHAT eq '-newcert' ) {
  117. # create a certificate
  118. $RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS"
  119. . " $EXTRA{req}");
  120. print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
  121. } elsif ($WHAT eq '-precert' ) {
  122. # create a pre-certificate
  123. $RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS"
  124. . " $EXTRA{req}");
  125. print "Pre-cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
  126. } elsif ($WHAT =~ /^\-newreq(\-nodes)?$/ ) {
  127. # create a certificate request
  128. $RET = run("$REQ -new $1 -keyout $NEWKEY -out $NEWREQ $DAYS $EXTRA{req}");
  129. print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
  130. } elsif ($WHAT eq '-newca' ) {
  131. # create the directory hierarchy
  132. my @dirs = ( "${CATOP}", "${CATOP}/certs", "${CATOP}/crl",
  133. "${CATOP}/newcerts", "${CATOP}/private" );
  134. die "${CATOP}/index.txt exists.\nRemove old sub-tree to proceed,"
  135. if -f "${CATOP}/index.txt";
  136. die "${CATOP}/serial exists.\nRemove old sub-tree to proceed,"
  137. if -f "${CATOP}/serial";
  138. foreach my $d ( @dirs ) {
  139. if ( -d $d ) {
  140. warn "Directory $d exists" if -d $d;
  141. } else {
  142. mkdir $d or die "Can't mkdir $d, $!";
  143. }
  144. }
  145. open OUT, ">${CATOP}/index.txt";
  146. close OUT;
  147. open OUT, ">${CATOP}/crlnumber";
  148. print OUT "01\n";
  149. close OUT;
  150. # ask user for existing CA certificate
  151. print "CA certificate filename (or enter to create)\n";
  152. my $FILE;
  153. $FILE = "" unless defined($FILE = <STDIN>);
  154. $FILE =~ s{\R$}{};
  155. if ($FILE ne "") {
  156. copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
  157. copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
  158. } else {
  159. print "Making CA certificate ...\n";
  160. $RET = run("$REQ -new -keyout ${CATOP}/private/$CAKEY"
  161. . " -out ${CATOP}/$CAREQ $EXTRA{req}");
  162. $RET = run("$CA -create_serial"
  163. . " -out ${CATOP}/$CACERT $CADAYS -batch"
  164. . " -keyfile ${CATOP}/private/$CAKEY -selfsign"
  165. . " $EXTENSIONS"
  166. . " -infiles ${CATOP}/$CAREQ $EXTRA{ca}") if $RET == 0;
  167. print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
  168. }
  169. } elsif ($WHAT eq '-pkcs12' ) {
  170. my $cname = $ARGV[0];
  171. $cname = "My Certificate" unless defined $cname;
  172. $RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
  173. . " -certfile ${CATOP}/$CACERT -out $NEWP12"
  174. . " -export -name \"$cname\" $EXTRA{pkcs12}");
  175. print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
  176. } elsif ($WHAT eq '-xsign' ) {
  177. $RET = run("$CA $POLICY -infiles $NEWREQ $EXTRA{ca}");
  178. } elsif ($WHAT eq '-sign' ) {
  179. $RET = run("$CA $POLICY -out $NEWCERT"
  180. . " -infiles $NEWREQ $EXTRA{ca}");
  181. print "Signed certificate is in $NEWCERT\n" if $RET == 0;
  182. } elsif ($WHAT eq '-signCA' ) {
  183. $RET = run("$CA $POLICY -out $NEWCERT"
  184. . " $EXTENSIONS -infiles $NEWREQ $EXTRA{ca}");
  185. print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
  186. } elsif ($WHAT eq '-signcert' ) {
  187. $RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
  188. . " -out tmp.pem $EXTRA{x509}");
  189. $RET = run("$CA $POLICY -out $NEWCERT"
  190. . "-infiles tmp.pem $EXTRA{ca}") if $RET == 0;
  191. print "Signed certificate is in $NEWCERT\n" if $RET == 0;
  192. } elsif ($WHAT eq '-verify' ) {
  193. my @files = @ARGV ? @ARGV : ( $NEWCERT );
  194. foreach my $file (@files) {
  195. # -CAfile quoted for VMS, since the C RTL downcases all unquoted
  196. # arguments to C programs
  197. my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file $EXTRA{verify}");
  198. $RET = $status if $status != 0;
  199. }
  200. } elsif ($WHAT eq '-crl' ) {
  201. $RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL $EXTRA{ca}");
  202. print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;
  203. } elsif ($WHAT eq '-revoke' ) {
  204. my $cname = $ARGV[0];
  205. if (!defined $cname) {
  206. print "Certificate filename is required; reason optional.\n";
  207. exit 1;
  208. }
  209. my $reason = $ARGV[1];
  210. $reason = " -crl_reason $reason"
  211. if defined $reason && crl_reason_ok($reason);
  212. $RET = run("$CA -revoke \"$cname\"" . $reason . $EXTRA{ca});
  213. } else {
  214. print STDERR "Unknown arg \"$WHAT\"\n";
  215. print STDERR "Use -help for help.\n";
  216. exit 1;
  217. }
  218. exit $RET;