ca.c 84 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606
  1. /*
  2. * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include <string.h>
  12. #include <ctype.h>
  13. #include <sys/types.h>
  14. #include <openssl/conf.h>
  15. #include <openssl/bio.h>
  16. #include <openssl/err.h>
  17. #include <openssl/bn.h>
  18. #include <openssl/txt_db.h>
  19. #include <openssl/evp.h>
  20. #include <openssl/x509.h>
  21. #include <openssl/x509v3.h>
  22. #include <openssl/objects.h>
  23. #include <openssl/ocsp.h>
  24. #include <openssl/pem.h>
  25. #ifndef W_OK
  26. # ifdef OPENSSL_SYS_VMS
  27. # include <unistd.h>
  28. # elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS)
  29. # include <sys/file.h>
  30. # endif
  31. #endif
  32. #include "apps.h"
  33. #include "progs.h"
  34. #ifndef W_OK
  35. # define F_OK 0
  36. # define W_OK 2
  37. # define R_OK 4
  38. #endif
  39. #ifndef PATH_MAX
  40. # define PATH_MAX 4096
  41. #endif
  42. #define BASE_SECTION "ca"
  43. #define ENV_DEFAULT_CA "default_ca"
  44. #define STRING_MASK "string_mask"
  45. #define UTF8_IN "utf8"
  46. #define ENV_NEW_CERTS_DIR "new_certs_dir"
  47. #define ENV_CERTIFICATE "certificate"
  48. #define ENV_SERIAL "serial"
  49. #define ENV_RAND_SERIAL "rand_serial"
  50. #define ENV_CRLNUMBER "crlnumber"
  51. #define ENV_PRIVATE_KEY "private_key"
  52. #define ENV_DEFAULT_DAYS "default_days"
  53. #define ENV_DEFAULT_STARTDATE "default_startdate"
  54. #define ENV_DEFAULT_ENDDATE "default_enddate"
  55. #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
  56. #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
  57. #define ENV_DEFAULT_MD "default_md"
  58. #define ENV_DEFAULT_EMAIL_DN "email_in_dn"
  59. #define ENV_PRESERVE "preserve"
  60. #define ENV_POLICY "policy"
  61. #define ENV_EXTENSIONS "x509_extensions"
  62. #define ENV_CRLEXT "crl_extensions"
  63. #define ENV_MSIE_HACK "msie_hack"
  64. #define ENV_NAMEOPT "name_opt"
  65. #define ENV_CERTOPT "cert_opt"
  66. #define ENV_EXTCOPY "copy_extensions"
  67. #define ENV_UNIQUE_SUBJECT "unique_subject"
  68. #define ENV_DATABASE "database"
  69. /* Additional revocation information types */
  70. typedef enum {
  71. REV_VALID = -1, /* Valid (not-revoked) status */
  72. REV_NONE = 0, /* No additional information */
  73. REV_CRL_REASON = 1, /* Value is CRL reason code */
  74. REV_HOLD = 2, /* Value is hold instruction */
  75. REV_KEY_COMPROMISE = 3, /* Value is cert key compromise time */
  76. REV_CA_COMPROMISE = 4 /* Value is CA key compromise time */
  77. } REVINFO_TYPE;
  78. static char *lookup_conf(const CONF *conf, const char *group, const char *tag);
  79. static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
  80. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  81. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  82. BIGNUM *serial, const char *subj, unsigned long chtype,
  83. int multirdn, int email_dn, const char *startdate,
  84. const char *enddate,
  85. long days, int batch, const char *ext_sect, CONF *conf,
  86. int verbose, unsigned long certopt, unsigned long nameopt,
  87. int default_op, int ext_copy, int selfsign);
  88. static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
  89. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  90. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  91. BIGNUM *serial, const char *subj, unsigned long chtype,
  92. int multirdn, int email_dn, const char *startdate,
  93. const char *enddate, long days, int batch, const char *ext_sect,
  94. CONF *conf, int verbose, unsigned long certopt,
  95. unsigned long nameopt, int default_op, int ext_copy);
  96. static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
  97. X509 *x509, const EVP_MD *dgst,
  98. STACK_OF(OPENSSL_STRING) *sigopts,
  99. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  100. BIGNUM *serial, const char *subj, unsigned long chtype,
  101. int multirdn, int email_dn, const char *startdate,
  102. const char *enddate, long days, const char *ext_sect, CONF *conf,
  103. int verbose, unsigned long certopt,
  104. unsigned long nameopt, int default_op, int ext_copy);
  105. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
  106. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  107. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
  108. const char *subj, unsigned long chtype, int multirdn,
  109. int email_dn, const char *startdate, const char *enddate, long days,
  110. int batch, int verbose, X509_REQ *req, const char *ext_sect,
  111. CONF *conf, unsigned long certopt, unsigned long nameopt,
  112. int default_op, int ext_copy, int selfsign);
  113. static int get_certificate_status(const char *ser_status, CA_DB *db);
  114. static int do_updatedb(CA_DB *db);
  115. static int check_time_format(const char *str);
  116. static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
  117. const char *extval);
  118. static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg);
  119. static int make_revoked(X509_REVOKED *rev, const char *str);
  120. static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str);
  121. static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
  122. static CONF *extconf = NULL;
  123. static int preserve = 0;
  124. static int msie_hack = 0;
  125. typedef enum OPTION_choice {
  126. OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
  127. OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
  128. OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE,
  129. OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN,
  130. OPT_KEY, OPT_CERT, OPT_SELFSIGN, OPT_IN, OPT_OUT, OPT_OUTDIR,
  131. OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN,
  132. OPT_GENCRL, OPT_MSIE_HACK, OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC,
  133. OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
  134. OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
  135. OPT_RAND_SERIAL,
  136. OPT_R_ENUM,
  137. /* Do not change the order here; see related case statements below */
  138. OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
  139. } OPTION_CHOICE;
  140. const OPTIONS ca_options[] = {
  141. {"help", OPT_HELP, '-', "Display this summary"},
  142. {"verbose", OPT_VERBOSE, '-', "Verbose output during processing"},
  143. {"config", OPT_CONFIG, 's', "A config file"},
  144. {"name", OPT_NAME, 's', "The particular CA definition to use"},
  145. {"subj", OPT_SUBJ, 's', "Use arg instead of request's subject"},
  146. {"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
  147. {"create_serial", OPT_CREATE_SERIAL, '-',
  148. "If reading serial fails, create a new random serial"},
  149. {"rand_serial", OPT_RAND_SERIAL, '-',
  150. "Always create a random serial; do not store it"},
  151. {"multivalue-rdn", OPT_MULTIVALUE_RDN, '-',
  152. "Enable support for multivalued RDNs"},
  153. {"startdate", OPT_STARTDATE, 's', "Cert notBefore, YYMMDDHHMMSSZ"},
  154. {"enddate", OPT_ENDDATE, 's',
  155. "YYMMDDHHMMSSZ cert notAfter (overrides -days)"},
  156. {"days", OPT_DAYS, 'p', "Number of days to certify the cert for"},
  157. {"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
  158. {"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
  159. {"keyfile", OPT_KEYFILE, 's', "Private key"},
  160. {"keyform", OPT_KEYFORM, 'f', "Private key file format (PEM or ENGINE)"},
  161. {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
  162. {"key", OPT_KEY, 's', "Key to decode the private key if it is encrypted"},
  163. {"cert", OPT_CERT, '<', "The CA cert"},
  164. {"selfsign", OPT_SELFSIGN, '-',
  165. "Sign a cert with the key associated with it"},
  166. {"in", OPT_IN, '<', "The input PEM encoded cert request(s)"},
  167. {"out", OPT_OUT, '>', "Where to put the output file(s)"},
  168. {"outdir", OPT_OUTDIR, '/', "Where to put output cert"},
  169. {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
  170. {"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"},
  171. {"batch", OPT_BATCH, '-', "Don't ask questions"},
  172. {"preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN"},
  173. {"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
  174. {"gencrl", OPT_GENCRL, '-', "Generate a new CRL"},
  175. {"msie_hack", OPT_MSIE_HACK, '-',
  176. "msie modifications to handle all those universal strings"},
  177. {"crldays", OPT_CRLDAYS, 'p', "Days until the next CRL is due"},
  178. {"crlhours", OPT_CRLHOURS, 'p', "Hours until the next CRL is due"},
  179. {"crlsec", OPT_CRLSEC, 'p', "Seconds until the next CRL is due"},
  180. {"infiles", OPT_INFILES, '-', "The last argument, requests to process"},
  181. {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"},
  182. {"spkac", OPT_SPKAC, '<',
  183. "File contains DN and signed public key and challenge"},
  184. {"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
  185. {"valid", OPT_VALID, 's',
  186. "Add a Valid(not-revoked) DB entry about a cert (given in file)"},
  187. {"extensions", OPT_EXTENSIONS, 's',
  188. "Extension section (override value in config file)"},
  189. {"extfile", OPT_EXTFILE, '<',
  190. "Configuration file with X509v3 extensions to add"},
  191. {"status", OPT_STATUS, 's', "Shows cert status given the serial number"},
  192. {"updatedb", OPT_UPDATEDB, '-', "Updates db for expired cert"},
  193. {"crlexts", OPT_CRLEXTS, 's',
  194. "CRL extension section (override value in config file)"},
  195. {"crl_reason", OPT_CRL_REASON, 's', "revocation reason"},
  196. {"crl_hold", OPT_CRL_HOLD, 's',
  197. "the hold instruction, an OID. Sets revocation reason to certificateHold"},
  198. {"crl_compromise", OPT_CRL_COMPROMISE, 's',
  199. "sets compromise time to val and the revocation reason to keyCompromise"},
  200. {"crl_CA_compromise", OPT_CRL_CA_COMPROMISE, 's',
  201. "sets compromise time to val and the revocation reason to CACompromise"},
  202. OPT_R_OPTIONS,
  203. #ifndef OPENSSL_NO_ENGINE
  204. {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
  205. #endif
  206. {NULL}
  207. };
  208. int ca_main(int argc, char **argv)
  209. {
  210. CONF *conf = NULL;
  211. ENGINE *e = NULL;
  212. BIGNUM *crlnumber = NULL, *serial = NULL;
  213. EVP_PKEY *pkey = NULL;
  214. BIO *in = NULL, *out = NULL, *Sout = NULL;
  215. ASN1_INTEGER *tmpser;
  216. ASN1_TIME *tmptm;
  217. CA_DB *db = NULL;
  218. DB_ATTR db_attr;
  219. STACK_OF(CONF_VALUE) *attribs = NULL;
  220. STACK_OF(OPENSSL_STRING) *sigopts = NULL;
  221. STACK_OF(X509) *cert_sk = NULL;
  222. X509_CRL *crl = NULL;
  223. const EVP_MD *dgst = NULL;
  224. char *configfile = default_config_file, *section = NULL;
  225. char *md = NULL, *policy = NULL, *keyfile = NULL;
  226. char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL, *key = NULL;
  227. const char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;
  228. const char *extensions = NULL, *extfile = NULL, *passinarg = NULL;
  229. char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL;
  230. const char *serialfile = NULL, *subj = NULL;
  231. char *prog, *startdate = NULL, *enddate = NULL;
  232. char *dbfile = NULL, *f;
  233. char new_cert[PATH_MAX];
  234. char tmp[10 + 1] = "\0";
  235. char *const *pp;
  236. const char *p;
  237. size_t outdirlen = 0;
  238. int create_ser = 0, free_key = 0, total = 0, total_done = 0;
  239. int batch = 0, default_op = 1, doupdatedb = 0, ext_copy = EXT_COPY_NONE;
  240. int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0;
  241. int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0;
  242. int rand_ser = 0, i, j, selfsign = 0, def_nid, def_ret;
  243. long crldays = 0, crlhours = 0, crlsec = 0, days = 0;
  244. unsigned long chtype = MBSTRING_ASC, certopt = 0;
  245. X509 *x509 = NULL, *x509p = NULL, *x = NULL;
  246. REVINFO_TYPE rev_type = REV_NONE;
  247. X509_REVOKED *r = NULL;
  248. OPTION_CHOICE o;
  249. prog = opt_init(argc, argv, ca_options);
  250. while ((o = opt_next()) != OPT_EOF) {
  251. switch (o) {
  252. case OPT_EOF:
  253. case OPT_ERR:
  254. opthelp:
  255. BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
  256. goto end;
  257. case OPT_HELP:
  258. opt_help(ca_options);
  259. ret = 0;
  260. goto end;
  261. case OPT_IN:
  262. req = 1;
  263. infile = opt_arg();
  264. break;
  265. case OPT_OUT:
  266. outfile = opt_arg();
  267. break;
  268. case OPT_VERBOSE:
  269. verbose = 1;
  270. break;
  271. case OPT_CONFIG:
  272. configfile = opt_arg();
  273. break;
  274. case OPT_NAME:
  275. section = opt_arg();
  276. break;
  277. case OPT_SUBJ:
  278. subj = opt_arg();
  279. /* preserve=1; */
  280. break;
  281. case OPT_UTF8:
  282. chtype = MBSTRING_UTF8;
  283. break;
  284. case OPT_RAND_SERIAL:
  285. rand_ser = 1;
  286. break;
  287. case OPT_CREATE_SERIAL:
  288. create_ser = 1;
  289. break;
  290. case OPT_MULTIVALUE_RDN:
  291. multirdn = 1;
  292. break;
  293. case OPT_STARTDATE:
  294. startdate = opt_arg();
  295. break;
  296. case OPT_ENDDATE:
  297. enddate = opt_arg();
  298. break;
  299. case OPT_DAYS:
  300. days = atoi(opt_arg());
  301. break;
  302. case OPT_MD:
  303. md = opt_arg();
  304. break;
  305. case OPT_POLICY:
  306. policy = opt_arg();
  307. break;
  308. case OPT_KEYFILE:
  309. keyfile = opt_arg();
  310. break;
  311. case OPT_KEYFORM:
  312. if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
  313. goto opthelp;
  314. break;
  315. case OPT_PASSIN:
  316. passinarg = opt_arg();
  317. break;
  318. case OPT_R_CASES:
  319. if (!opt_rand(o))
  320. goto end;
  321. break;
  322. case OPT_KEY:
  323. key = opt_arg();
  324. break;
  325. case OPT_CERT:
  326. certfile = opt_arg();
  327. break;
  328. case OPT_SELFSIGN:
  329. selfsign = 1;
  330. break;
  331. case OPT_OUTDIR:
  332. outdir = opt_arg();
  333. break;
  334. case OPT_SIGOPT:
  335. if (sigopts == NULL)
  336. sigopts = sk_OPENSSL_STRING_new_null();
  337. if (sigopts == NULL || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
  338. goto end;
  339. break;
  340. case OPT_NOTEXT:
  341. notext = 1;
  342. break;
  343. case OPT_BATCH:
  344. batch = 1;
  345. break;
  346. case OPT_PRESERVEDN:
  347. preserve = 1;
  348. break;
  349. case OPT_NOEMAILDN:
  350. email_dn = 0;
  351. break;
  352. case OPT_GENCRL:
  353. gencrl = 1;
  354. break;
  355. case OPT_MSIE_HACK:
  356. msie_hack = 1;
  357. break;
  358. case OPT_CRLDAYS:
  359. crldays = atol(opt_arg());
  360. break;
  361. case OPT_CRLHOURS:
  362. crlhours = atol(opt_arg());
  363. break;
  364. case OPT_CRLSEC:
  365. crlsec = atol(opt_arg());
  366. break;
  367. case OPT_INFILES:
  368. req = 1;
  369. goto end_of_options;
  370. case OPT_SS_CERT:
  371. ss_cert_file = opt_arg();
  372. req = 1;
  373. break;
  374. case OPT_SPKAC:
  375. spkac_file = opt_arg();
  376. req = 1;
  377. break;
  378. case OPT_REVOKE:
  379. infile = opt_arg();
  380. dorevoke = 1;
  381. break;
  382. case OPT_VALID:
  383. infile = opt_arg();
  384. dorevoke = 2;
  385. break;
  386. case OPT_EXTENSIONS:
  387. extensions = opt_arg();
  388. break;
  389. case OPT_EXTFILE:
  390. extfile = opt_arg();
  391. break;
  392. case OPT_STATUS:
  393. ser_status = opt_arg();
  394. break;
  395. case OPT_UPDATEDB:
  396. doupdatedb = 1;
  397. break;
  398. case OPT_CRLEXTS:
  399. crl_ext = opt_arg();
  400. break;
  401. case OPT_CRL_REASON: /* := REV_CRL_REASON */
  402. case OPT_CRL_HOLD:
  403. case OPT_CRL_COMPROMISE:
  404. case OPT_CRL_CA_COMPROMISE:
  405. rev_arg = opt_arg();
  406. rev_type = (o - OPT_CRL_REASON) + REV_CRL_REASON;
  407. break;
  408. case OPT_ENGINE:
  409. e = setup_engine(opt_arg(), 0);
  410. break;
  411. }
  412. }
  413. end_of_options:
  414. argc = opt_num_rest();
  415. argv = opt_rest();
  416. BIO_printf(bio_err, "Using configuration from %s\n", configfile);
  417. if ((conf = app_load_config(configfile)) == NULL)
  418. goto end;
  419. if (configfile != default_config_file && !app_load_modules(conf))
  420. goto end;
  421. /* Lets get the config section we are using */
  422. if (section == NULL
  423. && (section = lookup_conf(conf, BASE_SECTION, ENV_DEFAULT_CA)) == NULL)
  424. goto end;
  425. p = NCONF_get_string(conf, NULL, "oid_file");
  426. if (p == NULL)
  427. ERR_clear_error();
  428. if (p != NULL) {
  429. BIO *oid_bio = BIO_new_file(p, "r");
  430. if (oid_bio == NULL) {
  431. ERR_clear_error();
  432. } else {
  433. OBJ_create_objects(oid_bio);
  434. BIO_free(oid_bio);
  435. }
  436. }
  437. if (!add_oid_section(conf)) {
  438. ERR_print_errors(bio_err);
  439. goto end;
  440. }
  441. app_RAND_load_conf(conf, BASE_SECTION);
  442. f = NCONF_get_string(conf, section, STRING_MASK);
  443. if (f == NULL)
  444. ERR_clear_error();
  445. if (f != NULL && !ASN1_STRING_set_default_mask_asc(f)) {
  446. BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
  447. goto end;
  448. }
  449. if (chtype != MBSTRING_UTF8) {
  450. f = NCONF_get_string(conf, section, UTF8_IN);
  451. if (f == NULL)
  452. ERR_clear_error();
  453. else if (strcmp(f, "yes") == 0)
  454. chtype = MBSTRING_UTF8;
  455. }
  456. db_attr.unique_subject = 1;
  457. p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
  458. if (p != NULL)
  459. db_attr.unique_subject = parse_yesno(p, 1);
  460. else
  461. ERR_clear_error();
  462. /*****************************************************************/
  463. /* report status of cert with serial number given on command line */
  464. if (ser_status) {
  465. dbfile = lookup_conf(conf, section, ENV_DATABASE);
  466. if (dbfile == NULL)
  467. goto end;
  468. db = load_index(dbfile, &db_attr);
  469. if (db == NULL)
  470. goto end;
  471. if (index_index(db) <= 0)
  472. goto end;
  473. if (get_certificate_status(ser_status, db) != 1)
  474. BIO_printf(bio_err, "Error verifying serial %s!\n", ser_status);
  475. goto end;
  476. }
  477. /*****************************************************************/
  478. /* we definitely need a private key, so let's get it */
  479. if (keyfile == NULL
  480. && (keyfile = lookup_conf(conf, section, ENV_PRIVATE_KEY)) == NULL)
  481. goto end;
  482. if (key == NULL) {
  483. free_key = 1;
  484. if (!app_passwd(passinarg, NULL, &key, NULL)) {
  485. BIO_printf(bio_err, "Error getting password\n");
  486. goto end;
  487. }
  488. }
  489. pkey = load_key(keyfile, keyformat, 0, key, e, "CA private key");
  490. if (key != NULL)
  491. OPENSSL_cleanse(key, strlen(key));
  492. if (pkey == NULL)
  493. /* load_key() has already printed an appropriate message */
  494. goto end;
  495. /*****************************************************************/
  496. /* we need a certificate */
  497. if (!selfsign || spkac_file || ss_cert_file || gencrl) {
  498. if (certfile == NULL
  499. && (certfile = lookup_conf(conf, section, ENV_CERTIFICATE)) == NULL)
  500. goto end;
  501. x509 = load_cert(certfile, FORMAT_PEM, "CA certificate");
  502. if (x509 == NULL)
  503. goto end;
  504. if (!X509_check_private_key(x509, pkey)) {
  505. BIO_printf(bio_err,
  506. "CA certificate and CA private key do not match\n");
  507. goto end;
  508. }
  509. }
  510. if (!selfsign)
  511. x509p = x509;
  512. f = NCONF_get_string(conf, BASE_SECTION, ENV_PRESERVE);
  513. if (f == NULL)
  514. ERR_clear_error();
  515. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  516. preserve = 1;
  517. f = NCONF_get_string(conf, BASE_SECTION, ENV_MSIE_HACK);
  518. if (f == NULL)
  519. ERR_clear_error();
  520. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  521. msie_hack = 1;
  522. f = NCONF_get_string(conf, section, ENV_NAMEOPT);
  523. if (f != NULL) {
  524. if (!set_nameopt(f)) {
  525. BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
  526. goto end;
  527. }
  528. default_op = 0;
  529. }
  530. f = NCONF_get_string(conf, section, ENV_CERTOPT);
  531. if (f != NULL) {
  532. if (!set_cert_ex(&certopt, f)) {
  533. BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
  534. goto end;
  535. }
  536. default_op = 0;
  537. } else {
  538. ERR_clear_error();
  539. }
  540. f = NCONF_get_string(conf, section, ENV_EXTCOPY);
  541. if (f != NULL) {
  542. if (!set_ext_copy(&ext_copy, f)) {
  543. BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
  544. goto end;
  545. }
  546. } else {
  547. ERR_clear_error();
  548. }
  549. /*****************************************************************/
  550. /* lookup where to write new certificates */
  551. if ((outdir == NULL) && (req)) {
  552. outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR);
  553. if (outdir == NULL) {
  554. BIO_printf(bio_err,
  555. "there needs to be defined a directory for new certificate to be placed in\n");
  556. goto end;
  557. }
  558. #ifndef OPENSSL_SYS_VMS
  559. /*
  560. * outdir is a directory spec, but access() for VMS demands a
  561. * filename. We could use the DEC C routine to convert the
  562. * directory syntax to Unix, and give that to app_isdir,
  563. * but for now the fopen will catch the error if it's not a
  564. * directory
  565. */
  566. if (app_isdir(outdir) <= 0) {
  567. BIO_printf(bio_err, "%s: %s is not a directory\n", prog, outdir);
  568. perror(outdir);
  569. goto end;
  570. }
  571. #endif
  572. }
  573. /*****************************************************************/
  574. /* we need to load the database file */
  575. dbfile = lookup_conf(conf, section, ENV_DATABASE);
  576. if (dbfile == NULL)
  577. goto end;
  578. db = load_index(dbfile, &db_attr);
  579. if (db == NULL)
  580. goto end;
  581. /* Lets check some fields */
  582. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  583. pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
  584. if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != '\0')) {
  585. BIO_printf(bio_err,
  586. "entry %d: not revoked yet, but has a revocation date\n",
  587. i + 1);
  588. goto end;
  589. }
  590. if ((pp[DB_type][0] == DB_TYPE_REV) &&
  591. !make_revoked(NULL, pp[DB_rev_date])) {
  592. BIO_printf(bio_err, " in entry %d\n", i + 1);
  593. goto end;
  594. }
  595. if (!check_time_format((char *)pp[DB_exp_date])) {
  596. BIO_printf(bio_err, "entry %d: invalid expiry date\n", i + 1);
  597. goto end;
  598. }
  599. p = pp[DB_serial];
  600. j = strlen(p);
  601. if (*p == '-') {
  602. p++;
  603. j--;
  604. }
  605. if ((j & 1) || (j < 2)) {
  606. BIO_printf(bio_err, "entry %d: bad serial number length (%d)\n",
  607. i + 1, j);
  608. goto end;
  609. }
  610. for ( ; *p; p++) {
  611. if (!isxdigit(_UC(*p))) {
  612. BIO_printf(bio_err,
  613. "entry %d: bad char 0%o '%c' in serial number\n",
  614. i + 1, *p, *p);
  615. goto end;
  616. }
  617. }
  618. }
  619. if (verbose) {
  620. TXT_DB_write(bio_out, db->db);
  621. BIO_printf(bio_err, "%d entries loaded from the database\n",
  622. sk_OPENSSL_PSTRING_num(db->db->data));
  623. BIO_printf(bio_err, "generating index\n");
  624. }
  625. if (index_index(db) <= 0)
  626. goto end;
  627. /*****************************************************************/
  628. /* Update the db file for expired certificates */
  629. if (doupdatedb) {
  630. if (verbose)
  631. BIO_printf(bio_err, "Updating %s ...\n", dbfile);
  632. i = do_updatedb(db);
  633. if (i == -1) {
  634. BIO_printf(bio_err, "Malloc failure\n");
  635. goto end;
  636. } else if (i == 0) {
  637. if (verbose)
  638. BIO_printf(bio_err, "No entries found to mark expired\n");
  639. } else {
  640. if (!save_index(dbfile, "new", db))
  641. goto end;
  642. if (!rotate_index(dbfile, "new", "old"))
  643. goto end;
  644. if (verbose)
  645. BIO_printf(bio_err, "Done. %d entries marked as expired\n", i);
  646. }
  647. }
  648. /*****************************************************************/
  649. /* Read extensions config file */
  650. if (extfile) {
  651. if ((extconf = app_load_config(extfile)) == NULL) {
  652. ret = 1;
  653. goto end;
  654. }
  655. if (verbose)
  656. BIO_printf(bio_err, "Successfully loaded extensions file %s\n",
  657. extfile);
  658. /* We can have sections in the ext file */
  659. if (extensions == NULL) {
  660. extensions = NCONF_get_string(extconf, "default", "extensions");
  661. if (extensions == NULL)
  662. extensions = "default";
  663. }
  664. }
  665. /*****************************************************************/
  666. if (req || gencrl) {
  667. if (spkac_file != NULL && outfile != NULL) {
  668. output_der = 1;
  669. batch = 1;
  670. }
  671. }
  672. def_ret = EVP_PKEY_get_default_digest_nid(pkey, &def_nid);
  673. /*
  674. * EVP_PKEY_get_default_digest_nid() returns 2 if the digest is
  675. * mandatory for this algorithm.
  676. */
  677. if (def_ret == 2 && def_nid == NID_undef) {
  678. /* The signing algorithm requires there to be no digest */
  679. dgst = EVP_md_null();
  680. } else if (md == NULL
  681. && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL) {
  682. goto end;
  683. } else {
  684. if (strcmp(md, "default") == 0) {
  685. if (def_ret <= 0) {
  686. BIO_puts(bio_err, "no default digest\n");
  687. goto end;
  688. }
  689. md = (char *)OBJ_nid2sn(def_nid);
  690. }
  691. if (!opt_md(md, &dgst))
  692. goto end;
  693. }
  694. if (req) {
  695. if (email_dn == 1) {
  696. char *tmp_email_dn = NULL;
  697. tmp_email_dn = NCONF_get_string(conf, section, ENV_DEFAULT_EMAIL_DN);
  698. if (tmp_email_dn != NULL && strcmp(tmp_email_dn, "no") == 0)
  699. email_dn = 0;
  700. }
  701. if (verbose)
  702. BIO_printf(bio_err, "message digest is %s\n",
  703. OBJ_nid2ln(EVP_MD_type(dgst)));
  704. if (policy == NULL
  705. && (policy = lookup_conf(conf, section, ENV_POLICY)) == NULL)
  706. goto end;
  707. if (verbose)
  708. BIO_printf(bio_err, "policy is %s\n", policy);
  709. if (NCONF_get_string(conf, section, ENV_RAND_SERIAL) != NULL) {
  710. rand_ser = 1;
  711. } else {
  712. serialfile = lookup_conf(conf, section, ENV_SERIAL);
  713. if (serialfile == NULL)
  714. goto end;
  715. }
  716. if (extconf == NULL) {
  717. /*
  718. * no '-extfile' option, so we look for extensions in the main
  719. * configuration file
  720. */
  721. if (extensions == NULL) {
  722. extensions = NCONF_get_string(conf, section, ENV_EXTENSIONS);
  723. if (extensions == NULL)
  724. ERR_clear_error();
  725. }
  726. if (extensions != NULL) {
  727. /* Check syntax of file */
  728. X509V3_CTX ctx;
  729. X509V3_set_ctx_test(&ctx);
  730. X509V3_set_nconf(&ctx, conf);
  731. if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
  732. BIO_printf(bio_err,
  733. "Error Loading extension section %s\n",
  734. extensions);
  735. ret = 1;
  736. goto end;
  737. }
  738. }
  739. }
  740. if (startdate == NULL) {
  741. startdate = NCONF_get_string(conf, section, ENV_DEFAULT_STARTDATE);
  742. if (startdate == NULL)
  743. ERR_clear_error();
  744. }
  745. if (startdate != NULL && !ASN1_TIME_set_string_X509(NULL, startdate)) {
  746. BIO_printf(bio_err,
  747. "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  748. goto end;
  749. }
  750. if (startdate == NULL)
  751. startdate = "today";
  752. if (enddate == NULL) {
  753. enddate = NCONF_get_string(conf, section, ENV_DEFAULT_ENDDATE);
  754. if (enddate == NULL)
  755. ERR_clear_error();
  756. }
  757. if (enddate != NULL && !ASN1_TIME_set_string_X509(NULL, enddate)) {
  758. BIO_printf(bio_err,
  759. "end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  760. goto end;
  761. }
  762. if (days == 0) {
  763. if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days))
  764. days = 0;
  765. }
  766. if (enddate == NULL && days == 0) {
  767. BIO_printf(bio_err, "cannot lookup how many days to certify for\n");
  768. goto end;
  769. }
  770. if (rand_ser) {
  771. if ((serial = BN_new()) == NULL || !rand_serial(serial, NULL)) {
  772. BIO_printf(bio_err, "error generating serial number\n");
  773. goto end;
  774. }
  775. } else {
  776. if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {
  777. BIO_printf(bio_err, "error while loading serial number\n");
  778. goto end;
  779. }
  780. if (verbose) {
  781. if (BN_is_zero(serial)) {
  782. BIO_printf(bio_err, "next serial number is 00\n");
  783. } else {
  784. if ((f = BN_bn2hex(serial)) == NULL)
  785. goto end;
  786. BIO_printf(bio_err, "next serial number is %s\n", f);
  787. OPENSSL_free(f);
  788. }
  789. }
  790. }
  791. if ((attribs = NCONF_get_section(conf, policy)) == NULL) {
  792. BIO_printf(bio_err, "unable to find 'section' for %s\n", policy);
  793. goto end;
  794. }
  795. if ((cert_sk = sk_X509_new_null()) == NULL) {
  796. BIO_printf(bio_err, "Memory allocation failure\n");
  797. goto end;
  798. }
  799. if (spkac_file != NULL) {
  800. total++;
  801. j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,
  802. attribs, db, serial, subj, chtype, multirdn,
  803. email_dn, startdate, enddate, days, extensions,
  804. conf, verbose, certopt, get_nameopt(), default_op,
  805. ext_copy);
  806. if (j < 0)
  807. goto end;
  808. if (j > 0) {
  809. total_done++;
  810. BIO_printf(bio_err, "\n");
  811. if (!BN_add_word(serial, 1))
  812. goto end;
  813. if (!sk_X509_push(cert_sk, x)) {
  814. BIO_printf(bio_err, "Memory allocation failure\n");
  815. goto end;
  816. }
  817. }
  818. }
  819. if (ss_cert_file != NULL) {
  820. total++;
  821. j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
  822. attribs,
  823. db, serial, subj, chtype, multirdn, email_dn,
  824. startdate, enddate, days, batch, extensions,
  825. conf, verbose, certopt, get_nameopt(), default_op,
  826. ext_copy);
  827. if (j < 0)
  828. goto end;
  829. if (j > 0) {
  830. total_done++;
  831. BIO_printf(bio_err, "\n");
  832. if (!BN_add_word(serial, 1))
  833. goto end;
  834. if (!sk_X509_push(cert_sk, x)) {
  835. BIO_printf(bio_err, "Memory allocation failure\n");
  836. goto end;
  837. }
  838. }
  839. }
  840. if (infile != NULL) {
  841. total++;
  842. j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
  843. serial, subj, chtype, multirdn, email_dn, startdate,
  844. enddate, days, batch, extensions, conf, verbose,
  845. certopt, get_nameopt(), default_op, ext_copy, selfsign);
  846. if (j < 0)
  847. goto end;
  848. if (j > 0) {
  849. total_done++;
  850. BIO_printf(bio_err, "\n");
  851. if (!BN_add_word(serial, 1))
  852. goto end;
  853. if (!sk_X509_push(cert_sk, x)) {
  854. BIO_printf(bio_err, "Memory allocation failure\n");
  855. goto end;
  856. }
  857. }
  858. }
  859. for (i = 0; i < argc; i++) {
  860. total++;
  861. j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
  862. serial, subj, chtype, multirdn, email_dn, startdate,
  863. enddate, days, batch, extensions, conf, verbose,
  864. certopt, get_nameopt(), default_op, ext_copy, selfsign);
  865. if (j < 0)
  866. goto end;
  867. if (j > 0) {
  868. total_done++;
  869. BIO_printf(bio_err, "\n");
  870. if (!BN_add_word(serial, 1)) {
  871. X509_free(x);
  872. goto end;
  873. }
  874. if (!sk_X509_push(cert_sk, x)) {
  875. BIO_printf(bio_err, "Memory allocation failure\n");
  876. X509_free(x);
  877. goto end;
  878. }
  879. }
  880. }
  881. /*
  882. * we have a stack of newly certified certificates and a data base
  883. * and serial number that need updating
  884. */
  885. if (sk_X509_num(cert_sk) > 0) {
  886. if (!batch) {
  887. BIO_printf(bio_err,
  888. "\n%d out of %d certificate requests certified, commit? [y/n]",
  889. total_done, total);
  890. (void)BIO_flush(bio_err);
  891. tmp[0] = '\0';
  892. if (fgets(tmp, sizeof(tmp), stdin) == NULL) {
  893. BIO_printf(bio_err, "CERTIFICATION CANCELED: I/O error\n");
  894. ret = 0;
  895. goto end;
  896. }
  897. if (tmp[0] != 'y' && tmp[0] != 'Y') {
  898. BIO_printf(bio_err, "CERTIFICATION CANCELED\n");
  899. ret = 0;
  900. goto end;
  901. }
  902. }
  903. BIO_printf(bio_err, "Write out database with %d new entries\n",
  904. sk_X509_num(cert_sk));
  905. if (serialfile != NULL
  906. && !save_serial(serialfile, "new", serial, NULL))
  907. goto end;
  908. if (!save_index(dbfile, "new", db))
  909. goto end;
  910. }
  911. outdirlen = OPENSSL_strlcpy(new_cert, outdir, sizeof(new_cert));
  912. #ifndef OPENSSL_SYS_VMS
  913. outdirlen = OPENSSL_strlcat(new_cert, "/", sizeof(new_cert));
  914. #endif
  915. if (verbose)
  916. BIO_printf(bio_err, "writing new certificates\n");
  917. for (i = 0; i < sk_X509_num(cert_sk); i++) {
  918. BIO *Cout = NULL;
  919. X509 *xi = sk_X509_value(cert_sk, i);
  920. ASN1_INTEGER *serialNumber = X509_get_serialNumber(xi);
  921. const unsigned char *psn = ASN1_STRING_get0_data(serialNumber);
  922. const int snl = ASN1_STRING_length(serialNumber);
  923. const int filen_len = 2 * (snl > 0 ? snl : 1) + sizeof(".pem");
  924. char *n = new_cert + outdirlen;
  925. if (outdirlen + filen_len > PATH_MAX) {
  926. BIO_printf(bio_err, "certificate file name too long\n");
  927. goto end;
  928. }
  929. if (snl > 0) {
  930. static const char HEX_DIGITS[] = "0123456789ABCDEF";
  931. for (j = 0; j < snl; j++, psn++) {
  932. *n++ = HEX_DIGITS[*psn >> 4];
  933. *n++ = HEX_DIGITS[*psn & 0x0F];
  934. }
  935. } else {
  936. *(n++) = '0';
  937. *(n++) = '0';
  938. }
  939. *(n++) = '.';
  940. *(n++) = 'p';
  941. *(n++) = 'e';
  942. *(n++) = 'm';
  943. *n = '\0'; /* closing new_cert */
  944. if (verbose)
  945. BIO_printf(bio_err, "writing %s\n", new_cert);
  946. Sout = bio_open_default(outfile, 'w',
  947. output_der ? FORMAT_ASN1 : FORMAT_TEXT);
  948. if (Sout == NULL)
  949. goto end;
  950. Cout = BIO_new_file(new_cert, "w");
  951. if (Cout == NULL) {
  952. perror(new_cert);
  953. goto end;
  954. }
  955. write_new_certificate(Cout, xi, 0, notext);
  956. write_new_certificate(Sout, xi, output_der, notext);
  957. BIO_free_all(Cout);
  958. BIO_free_all(Sout);
  959. Sout = NULL;
  960. }
  961. if (sk_X509_num(cert_sk)) {
  962. /* Rename the database and the serial file */
  963. if (serialfile != NULL
  964. && !rotate_serial(serialfile, "new", "old"))
  965. goto end;
  966. if (!rotate_index(dbfile, "new", "old"))
  967. goto end;
  968. BIO_printf(bio_err, "Data Base Updated\n");
  969. }
  970. }
  971. /*****************************************************************/
  972. if (gencrl) {
  973. int crl_v2 = 0;
  974. if (crl_ext == NULL) {
  975. crl_ext = NCONF_get_string(conf, section, ENV_CRLEXT);
  976. if (crl_ext == NULL)
  977. ERR_clear_error();
  978. }
  979. if (crl_ext != NULL) {
  980. /* Check syntax of file */
  981. X509V3_CTX ctx;
  982. X509V3_set_ctx_test(&ctx);
  983. X509V3_set_nconf(&ctx, conf);
  984. if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {
  985. BIO_printf(bio_err,
  986. "Error Loading CRL extension section %s\n", crl_ext);
  987. ret = 1;
  988. goto end;
  989. }
  990. }
  991. if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER))
  992. != NULL)
  993. if ((crlnumber = load_serial(crlnumberfile, 0, NULL)) == NULL) {
  994. BIO_printf(bio_err, "error while loading CRL number\n");
  995. goto end;
  996. }
  997. if (!crldays && !crlhours && !crlsec) {
  998. if (!NCONF_get_number(conf, section,
  999. ENV_DEFAULT_CRL_DAYS, &crldays))
  1000. crldays = 0;
  1001. if (!NCONF_get_number(conf, section,
  1002. ENV_DEFAULT_CRL_HOURS, &crlhours))
  1003. crlhours = 0;
  1004. ERR_clear_error();
  1005. }
  1006. if ((crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
  1007. BIO_printf(bio_err,
  1008. "cannot lookup how long until the next CRL is issued\n");
  1009. goto end;
  1010. }
  1011. if (verbose)
  1012. BIO_printf(bio_err, "making CRL\n");
  1013. if ((crl = X509_CRL_new()) == NULL)
  1014. goto end;
  1015. if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))
  1016. goto end;
  1017. tmptm = ASN1_TIME_new();
  1018. if (tmptm == NULL
  1019. || X509_gmtime_adj(tmptm, 0) == NULL
  1020. || !X509_CRL_set1_lastUpdate(crl, tmptm)
  1021. || X509_time_adj_ex(tmptm, crldays, crlhours * 60 * 60 + crlsec,
  1022. NULL) == NULL) {
  1023. BIO_puts(bio_err, "error setting CRL nextUpdate\n");
  1024. ASN1_TIME_free(tmptm);
  1025. goto end;
  1026. }
  1027. X509_CRL_set1_nextUpdate(crl, tmptm);
  1028. ASN1_TIME_free(tmptm);
  1029. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  1030. pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
  1031. if (pp[DB_type][0] == DB_TYPE_REV) {
  1032. if ((r = X509_REVOKED_new()) == NULL)
  1033. goto end;
  1034. j = make_revoked(r, pp[DB_rev_date]);
  1035. if (!j)
  1036. goto end;
  1037. if (j == 2)
  1038. crl_v2 = 1;
  1039. if (!BN_hex2bn(&serial, pp[DB_serial]))
  1040. goto end;
  1041. tmpser = BN_to_ASN1_INTEGER(serial, NULL);
  1042. BN_free(serial);
  1043. serial = NULL;
  1044. if (!tmpser)
  1045. goto end;
  1046. X509_REVOKED_set_serialNumber(r, tmpser);
  1047. ASN1_INTEGER_free(tmpser);
  1048. X509_CRL_add0_revoked(crl, r);
  1049. }
  1050. }
  1051. /*
  1052. * sort the data so it will be written in serial number order
  1053. */
  1054. X509_CRL_sort(crl);
  1055. /* we now have a CRL */
  1056. if (verbose)
  1057. BIO_printf(bio_err, "signing CRL\n");
  1058. /* Add any extensions asked for */
  1059. if (crl_ext != NULL || crlnumberfile != NULL) {
  1060. X509V3_CTX crlctx;
  1061. X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
  1062. X509V3_set_nconf(&crlctx, conf);
  1063. if (crl_ext != NULL)
  1064. if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl))
  1065. goto end;
  1066. if (crlnumberfile != NULL) {
  1067. tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
  1068. if (!tmpser)
  1069. goto end;
  1070. X509_CRL_add1_ext_i2d(crl, NID_crl_number, tmpser, 0, 0);
  1071. ASN1_INTEGER_free(tmpser);
  1072. crl_v2 = 1;
  1073. if (!BN_add_word(crlnumber, 1))
  1074. goto end;
  1075. }
  1076. }
  1077. if (crl_ext != NULL || crl_v2) {
  1078. if (!X509_CRL_set_version(crl, 1))
  1079. goto end; /* version 2 CRL */
  1080. }
  1081. /* we have a CRL number that need updating */
  1082. if (crlnumberfile != NULL
  1083. && !save_serial(crlnumberfile, "new", crlnumber, NULL))
  1084. goto end;
  1085. BN_free(crlnumber);
  1086. crlnumber = NULL;
  1087. if (!do_X509_CRL_sign(crl, pkey, dgst, sigopts))
  1088. goto end;
  1089. Sout = bio_open_default(outfile, 'w',
  1090. output_der ? FORMAT_ASN1 : FORMAT_TEXT);
  1091. if (Sout == NULL)
  1092. goto end;
  1093. PEM_write_bio_X509_CRL(Sout, crl);
  1094. /* Rename the crlnumber file */
  1095. if (crlnumberfile != NULL
  1096. && !rotate_serial(crlnumberfile, "new", "old"))
  1097. goto end;
  1098. }
  1099. /*****************************************************************/
  1100. if (dorevoke) {
  1101. if (infile == NULL) {
  1102. BIO_printf(bio_err, "no input files\n");
  1103. goto end;
  1104. } else {
  1105. X509 *revcert;
  1106. revcert = load_cert(infile, FORMAT_PEM, infile);
  1107. if (revcert == NULL)
  1108. goto end;
  1109. if (dorevoke == 2)
  1110. rev_type = REV_VALID;
  1111. j = do_revoke(revcert, db, rev_type, rev_arg);
  1112. if (j <= 0)
  1113. goto end;
  1114. X509_free(revcert);
  1115. if (!save_index(dbfile, "new", db))
  1116. goto end;
  1117. if (!rotate_index(dbfile, "new", "old"))
  1118. goto end;
  1119. BIO_printf(bio_err, "Data Base Updated\n");
  1120. }
  1121. }
  1122. ret = 0;
  1123. end:
  1124. if (ret)
  1125. ERR_print_errors(bio_err);
  1126. BIO_free_all(Sout);
  1127. BIO_free_all(out);
  1128. BIO_free_all(in);
  1129. sk_X509_pop_free(cert_sk, X509_free);
  1130. if (free_key)
  1131. OPENSSL_free(key);
  1132. BN_free(serial);
  1133. BN_free(crlnumber);
  1134. free_index(db);
  1135. sk_OPENSSL_STRING_free(sigopts);
  1136. EVP_PKEY_free(pkey);
  1137. X509_free(x509);
  1138. X509_CRL_free(crl);
  1139. NCONF_free(conf);
  1140. NCONF_free(extconf);
  1141. release_engine(e);
  1142. return ret;
  1143. }
  1144. static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
  1145. {
  1146. char *entry = NCONF_get_string(conf, section, tag);
  1147. if (entry == NULL)
  1148. BIO_printf(bio_err, "variable lookup failed for %s::%s\n", section, tag);
  1149. return entry;
  1150. }
  1151. static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
  1152. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1153. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1154. BIGNUM *serial, const char *subj, unsigned long chtype,
  1155. int multirdn, int email_dn, const char *startdate,
  1156. const char *enddate,
  1157. long days, int batch, const char *ext_sect, CONF *lconf,
  1158. int verbose, unsigned long certopt, unsigned long nameopt,
  1159. int default_op, int ext_copy, int selfsign)
  1160. {
  1161. X509_REQ *req = NULL;
  1162. BIO *in = NULL;
  1163. EVP_PKEY *pktmp = NULL;
  1164. int ok = -1, i;
  1165. in = BIO_new_file(infile, "r");
  1166. if (in == NULL) {
  1167. ERR_print_errors(bio_err);
  1168. goto end;
  1169. }
  1170. if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
  1171. BIO_printf(bio_err, "Error reading certificate request in %s\n",
  1172. infile);
  1173. goto end;
  1174. }
  1175. if (verbose)
  1176. X509_REQ_print_ex(bio_err, req, nameopt, X509_FLAG_COMPAT);
  1177. BIO_printf(bio_err, "Check that the request matches the signature\n");
  1178. if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
  1179. BIO_printf(bio_err,
  1180. "Certificate request and CA private key do not match\n");
  1181. ok = 0;
  1182. goto end;
  1183. }
  1184. if ((pktmp = X509_REQ_get0_pubkey(req)) == NULL) {
  1185. BIO_printf(bio_err, "error unpacking public key\n");
  1186. goto end;
  1187. }
  1188. i = X509_REQ_verify(req, pktmp);
  1189. pktmp = NULL;
  1190. if (i < 0) {
  1191. ok = 0;
  1192. BIO_printf(bio_err, "Signature verification problems....\n");
  1193. ERR_print_errors(bio_err);
  1194. goto end;
  1195. }
  1196. if (i == 0) {
  1197. ok = 0;
  1198. BIO_printf(bio_err,
  1199. "Signature did not match the certificate request\n");
  1200. ERR_print_errors(bio_err);
  1201. goto end;
  1202. } else {
  1203. BIO_printf(bio_err, "Signature ok\n");
  1204. }
  1205. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  1206. chtype, multirdn, email_dn, startdate, enddate, days, batch,
  1207. verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
  1208. ext_copy, selfsign);
  1209. end:
  1210. X509_REQ_free(req);
  1211. BIO_free(in);
  1212. return ok;
  1213. }
  1214. static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
  1215. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1216. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1217. BIGNUM *serial, const char *subj, unsigned long chtype,
  1218. int multirdn, int email_dn, const char *startdate,
  1219. const char *enddate, long days, int batch, const char *ext_sect,
  1220. CONF *lconf, int verbose, unsigned long certopt,
  1221. unsigned long nameopt, int default_op, int ext_copy)
  1222. {
  1223. X509 *req = NULL;
  1224. X509_REQ *rreq = NULL;
  1225. EVP_PKEY *pktmp = NULL;
  1226. int ok = -1, i;
  1227. if ((req = load_cert(infile, FORMAT_PEM, infile)) == NULL)
  1228. goto end;
  1229. if (verbose)
  1230. X509_print(bio_err, req);
  1231. BIO_printf(bio_err, "Check that the request matches the signature\n");
  1232. if ((pktmp = X509_get0_pubkey(req)) == NULL) {
  1233. BIO_printf(bio_err, "error unpacking public key\n");
  1234. goto end;
  1235. }
  1236. i = X509_verify(req, pktmp);
  1237. if (i < 0) {
  1238. ok = 0;
  1239. BIO_printf(bio_err, "Signature verification problems....\n");
  1240. goto end;
  1241. }
  1242. if (i == 0) {
  1243. ok = 0;
  1244. BIO_printf(bio_err, "Signature did not match the certificate\n");
  1245. goto end;
  1246. } else {
  1247. BIO_printf(bio_err, "Signature ok\n");
  1248. }
  1249. if ((rreq = X509_to_X509_REQ(req, NULL, NULL)) == NULL)
  1250. goto end;
  1251. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  1252. chtype, multirdn, email_dn, startdate, enddate, days, batch,
  1253. verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
  1254. ext_copy, 0);
  1255. end:
  1256. X509_REQ_free(rreq);
  1257. X509_free(req);
  1258. return ok;
  1259. }
  1260. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
  1261. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1262. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
  1263. const char *subj, unsigned long chtype, int multirdn,
  1264. int email_dn, const char *startdate, const char *enddate, long days,
  1265. int batch, int verbose, X509_REQ *req, const char *ext_sect,
  1266. CONF *lconf, unsigned long certopt, unsigned long nameopt,
  1267. int default_op, int ext_copy, int selfsign)
  1268. {
  1269. X509_NAME *name = NULL, *CAname = NULL, *subject = NULL;
  1270. const ASN1_TIME *tm;
  1271. ASN1_STRING *str, *str2;
  1272. ASN1_OBJECT *obj;
  1273. X509 *ret = NULL;
  1274. X509_NAME_ENTRY *ne, *tne;
  1275. EVP_PKEY *pktmp;
  1276. int ok = -1, i, j, last, nid;
  1277. const char *p;
  1278. CONF_VALUE *cv;
  1279. OPENSSL_STRING row[DB_NUMBER];
  1280. OPENSSL_STRING *irow = NULL;
  1281. OPENSSL_STRING *rrow = NULL;
  1282. char buf[25];
  1283. for (i = 0; i < DB_NUMBER; i++)
  1284. row[i] = NULL;
  1285. if (subj) {
  1286. X509_NAME *n = parse_name(subj, chtype, multirdn);
  1287. if (!n) {
  1288. ERR_print_errors(bio_err);
  1289. goto end;
  1290. }
  1291. X509_REQ_set_subject_name(req, n);
  1292. X509_NAME_free(n);
  1293. }
  1294. if (default_op)
  1295. BIO_printf(bio_err, "The Subject's Distinguished Name is as follows\n");
  1296. name = X509_REQ_get_subject_name(req);
  1297. for (i = 0; i < X509_NAME_entry_count(name); i++) {
  1298. ne = X509_NAME_get_entry(name, i);
  1299. str = X509_NAME_ENTRY_get_data(ne);
  1300. obj = X509_NAME_ENTRY_get_object(ne);
  1301. nid = OBJ_obj2nid(obj);
  1302. if (msie_hack) {
  1303. /* assume all type should be strings */
  1304. if (str->type == V_ASN1_UNIVERSALSTRING)
  1305. ASN1_UNIVERSALSTRING_to_string(str);
  1306. if (str->type == V_ASN1_IA5STRING && nid != NID_pkcs9_emailAddress)
  1307. str->type = V_ASN1_T61STRING;
  1308. if (nid == NID_pkcs9_emailAddress
  1309. && str->type == V_ASN1_PRINTABLESTRING)
  1310. str->type = V_ASN1_IA5STRING;
  1311. }
  1312. /* If no EMAIL is wanted in the subject */
  1313. if (nid == NID_pkcs9_emailAddress && !email_dn)
  1314. continue;
  1315. /* check some things */
  1316. if (nid == NID_pkcs9_emailAddress && str->type != V_ASN1_IA5STRING) {
  1317. BIO_printf(bio_err,
  1318. "\nemailAddress type needs to be of type IA5STRING\n");
  1319. goto end;
  1320. }
  1321. if (str->type != V_ASN1_BMPSTRING && str->type != V_ASN1_UTF8STRING) {
  1322. j = ASN1_PRINTABLE_type(str->data, str->length);
  1323. if ((j == V_ASN1_T61STRING && str->type != V_ASN1_T61STRING) ||
  1324. (j == V_ASN1_IA5STRING && str->type == V_ASN1_PRINTABLESTRING))
  1325. {
  1326. BIO_printf(bio_err,
  1327. "\nThe string contains characters that are illegal for the ASN.1 type\n");
  1328. goto end;
  1329. }
  1330. }
  1331. if (default_op)
  1332. old_entry_print(obj, str);
  1333. }
  1334. /* Ok, now we check the 'policy' stuff. */
  1335. if ((subject = X509_NAME_new()) == NULL) {
  1336. BIO_printf(bio_err, "Memory allocation failure\n");
  1337. goto end;
  1338. }
  1339. /* take a copy of the issuer name before we mess with it. */
  1340. if (selfsign)
  1341. CAname = X509_NAME_dup(name);
  1342. else
  1343. CAname = X509_NAME_dup(X509_get_subject_name(x509));
  1344. if (CAname == NULL)
  1345. goto end;
  1346. str = str2 = NULL;
  1347. for (i = 0; i < sk_CONF_VALUE_num(policy); i++) {
  1348. cv = sk_CONF_VALUE_value(policy, i); /* get the object id */
  1349. if ((j = OBJ_txt2nid(cv->name)) == NID_undef) {
  1350. BIO_printf(bio_err,
  1351. "%s:unknown object type in 'policy' configuration\n",
  1352. cv->name);
  1353. goto end;
  1354. }
  1355. obj = OBJ_nid2obj(j);
  1356. last = -1;
  1357. for (;;) {
  1358. X509_NAME_ENTRY *push = NULL;
  1359. /* lookup the object in the supplied name list */
  1360. j = X509_NAME_get_index_by_OBJ(name, obj, last);
  1361. if (j < 0) {
  1362. if (last != -1)
  1363. break;
  1364. tne = NULL;
  1365. } else {
  1366. tne = X509_NAME_get_entry(name, j);
  1367. }
  1368. last = j;
  1369. /* depending on the 'policy', decide what to do. */
  1370. if (strcmp(cv->value, "optional") == 0) {
  1371. if (tne != NULL)
  1372. push = tne;
  1373. } else if (strcmp(cv->value, "supplied") == 0) {
  1374. if (tne == NULL) {
  1375. BIO_printf(bio_err,
  1376. "The %s field needed to be supplied and was missing\n",
  1377. cv->name);
  1378. goto end;
  1379. } else {
  1380. push = tne;
  1381. }
  1382. } else if (strcmp(cv->value, "match") == 0) {
  1383. int last2;
  1384. if (tne == NULL) {
  1385. BIO_printf(bio_err,
  1386. "The mandatory %s field was missing\n",
  1387. cv->name);
  1388. goto end;
  1389. }
  1390. last2 = -1;
  1391. again2:
  1392. j = X509_NAME_get_index_by_OBJ(CAname, obj, last2);
  1393. if ((j < 0) && (last2 == -1)) {
  1394. BIO_printf(bio_err,
  1395. "The %s field does not exist in the CA certificate,\n"
  1396. "the 'policy' is misconfigured\n", cv->name);
  1397. goto end;
  1398. }
  1399. if (j >= 0) {
  1400. push = X509_NAME_get_entry(CAname, j);
  1401. str = X509_NAME_ENTRY_get_data(tne);
  1402. str2 = X509_NAME_ENTRY_get_data(push);
  1403. last2 = j;
  1404. if (ASN1_STRING_cmp(str, str2) != 0)
  1405. goto again2;
  1406. }
  1407. if (j < 0) {
  1408. BIO_printf(bio_err,
  1409. "The %s field is different between\n"
  1410. "CA certificate (%s) and the request (%s)\n",
  1411. cv->name,
  1412. ((str2 == NULL) ? "NULL" : (char *)str2->data),
  1413. ((str == NULL) ? "NULL" : (char *)str->data));
  1414. goto end;
  1415. }
  1416. } else {
  1417. BIO_printf(bio_err,
  1418. "%s:invalid type in 'policy' configuration\n",
  1419. cv->value);
  1420. goto end;
  1421. }
  1422. if (push != NULL) {
  1423. if (!X509_NAME_add_entry(subject, push, -1, 0)) {
  1424. BIO_printf(bio_err, "Memory allocation failure\n");
  1425. goto end;
  1426. }
  1427. }
  1428. if (j < 0)
  1429. break;
  1430. }
  1431. }
  1432. if (preserve) {
  1433. X509_NAME_free(subject);
  1434. /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
  1435. subject = X509_NAME_dup(name);
  1436. if (subject == NULL)
  1437. goto end;
  1438. }
  1439. /* We are now totally happy, lets make and sign the certificate */
  1440. if (verbose)
  1441. BIO_printf(bio_err,
  1442. "Everything appears to be ok, creating and signing the certificate\n");
  1443. if ((ret = X509_new()) == NULL)
  1444. goto end;
  1445. #ifdef X509_V3
  1446. /* Make it an X509 v3 certificate. */
  1447. if (!X509_set_version(ret, 2))
  1448. goto end;
  1449. #endif
  1450. if (BN_to_ASN1_INTEGER(serial, X509_get_serialNumber(ret)) == NULL)
  1451. goto end;
  1452. if (selfsign) {
  1453. if (!X509_set_issuer_name(ret, subject))
  1454. goto end;
  1455. } else {
  1456. if (!X509_set_issuer_name(ret, X509_get_subject_name(x509)))
  1457. goto end;
  1458. }
  1459. if (!set_cert_times(ret, startdate, enddate, days))
  1460. goto end;
  1461. if (enddate != NULL) {
  1462. int tdays;
  1463. if (!ASN1_TIME_diff(&tdays, NULL, NULL, X509_get0_notAfter(ret)))
  1464. goto end;
  1465. days = tdays;
  1466. }
  1467. if (!X509_set_subject_name(ret, subject))
  1468. goto end;
  1469. pktmp = X509_REQ_get0_pubkey(req);
  1470. i = X509_set_pubkey(ret, pktmp);
  1471. if (!i)
  1472. goto end;
  1473. /* Lets add the extensions, if there are any */
  1474. if (ext_sect) {
  1475. X509V3_CTX ctx;
  1476. /* Initialize the context structure */
  1477. if (selfsign)
  1478. X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
  1479. else
  1480. X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
  1481. if (extconf != NULL) {
  1482. if (verbose)
  1483. BIO_printf(bio_err, "Extra configuration file found\n");
  1484. /* Use the extconf configuration db LHASH */
  1485. X509V3_set_nconf(&ctx, extconf);
  1486. /* Test the structure (needed?) */
  1487. /* X509V3_set_ctx_test(&ctx); */
  1488. /* Adds exts contained in the configuration file */
  1489. if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect, ret)) {
  1490. BIO_printf(bio_err,
  1491. "ERROR: adding extensions in section %s\n",
  1492. ext_sect);
  1493. ERR_print_errors(bio_err);
  1494. goto end;
  1495. }
  1496. if (verbose)
  1497. BIO_printf(bio_err,
  1498. "Successfully added extensions from file.\n");
  1499. } else if (ext_sect) {
  1500. /* We found extensions to be set from config file */
  1501. X509V3_set_nconf(&ctx, lconf);
  1502. if (!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret)) {
  1503. BIO_printf(bio_err,
  1504. "ERROR: adding extensions in section %s\n",
  1505. ext_sect);
  1506. ERR_print_errors(bio_err);
  1507. goto end;
  1508. }
  1509. if (verbose)
  1510. BIO_printf(bio_err,
  1511. "Successfully added extensions from config\n");
  1512. }
  1513. }
  1514. /* Copy extensions from request (if any) */
  1515. if (!copy_extensions(ret, req, ext_copy)) {
  1516. BIO_printf(bio_err, "ERROR: adding extensions from request\n");
  1517. ERR_print_errors(bio_err);
  1518. goto end;
  1519. }
  1520. {
  1521. const STACK_OF(X509_EXTENSION) *exts = X509_get0_extensions(ret);
  1522. if (exts != NULL && sk_X509_EXTENSION_num(exts) > 0)
  1523. /* Make it an X509 v3 certificate. */
  1524. if (!X509_set_version(ret, 2))
  1525. goto end;
  1526. }
  1527. if (verbose)
  1528. BIO_printf(bio_err,
  1529. "The subject name appears to be ok, checking data base for clashes\n");
  1530. /* Build the correct Subject if no e-mail is wanted in the subject. */
  1531. if (!email_dn) {
  1532. X509_NAME_ENTRY *tmpne;
  1533. X509_NAME *dn_subject;
  1534. /*
  1535. * Its best to dup the subject DN and then delete any email addresses
  1536. * because this retains its structure.
  1537. */
  1538. if ((dn_subject = X509_NAME_dup(subject)) == NULL) {
  1539. BIO_printf(bio_err, "Memory allocation failure\n");
  1540. goto end;
  1541. }
  1542. i = -1;
  1543. while ((i = X509_NAME_get_index_by_NID(dn_subject,
  1544. NID_pkcs9_emailAddress,
  1545. i)) >= 0) {
  1546. tmpne = X509_NAME_delete_entry(dn_subject, i--);
  1547. X509_NAME_ENTRY_free(tmpne);
  1548. }
  1549. if (!X509_set_subject_name(ret, dn_subject)) {
  1550. X509_NAME_free(dn_subject);
  1551. goto end;
  1552. }
  1553. X509_NAME_free(dn_subject);
  1554. }
  1555. row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
  1556. if (row[DB_name] == NULL) {
  1557. BIO_printf(bio_err, "Memory allocation failure\n");
  1558. goto end;
  1559. }
  1560. if (BN_is_zero(serial))
  1561. row[DB_serial] = OPENSSL_strdup("00");
  1562. else
  1563. row[DB_serial] = BN_bn2hex(serial);
  1564. if (row[DB_serial] == NULL) {
  1565. BIO_printf(bio_err, "Memory allocation failure\n");
  1566. goto end;
  1567. }
  1568. if (row[DB_name][0] == '\0') {
  1569. /*
  1570. * An empty subject! We'll use the serial number instead. If
  1571. * unique_subject is in use then we don't want different entries with
  1572. * empty subjects matching each other.
  1573. */
  1574. OPENSSL_free(row[DB_name]);
  1575. row[DB_name] = OPENSSL_strdup(row[DB_serial]);
  1576. if (row[DB_name] == NULL) {
  1577. BIO_printf(bio_err, "Memory allocation failure\n");
  1578. goto end;
  1579. }
  1580. }
  1581. if (db->attributes.unique_subject) {
  1582. OPENSSL_STRING *crow = row;
  1583. rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
  1584. if (rrow != NULL) {
  1585. BIO_printf(bio_err,
  1586. "ERROR:There is already a certificate for %s\n",
  1587. row[DB_name]);
  1588. }
  1589. }
  1590. if (rrow == NULL) {
  1591. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  1592. if (rrow != NULL) {
  1593. BIO_printf(bio_err,
  1594. "ERROR:Serial number %s has already been issued,\n",
  1595. row[DB_serial]);
  1596. BIO_printf(bio_err,
  1597. " check the database/serial_file for corruption\n");
  1598. }
  1599. }
  1600. if (rrow != NULL) {
  1601. BIO_printf(bio_err, "The matching entry has the following details\n");
  1602. if (rrow[DB_type][0] == DB_TYPE_EXP)
  1603. p = "Expired";
  1604. else if (rrow[DB_type][0] == DB_TYPE_REV)
  1605. p = "Revoked";
  1606. else if (rrow[DB_type][0] == DB_TYPE_VAL)
  1607. p = "Valid";
  1608. else
  1609. p = "\ninvalid type, Data base error\n";
  1610. BIO_printf(bio_err, "Type :%s\n", p);;
  1611. if (rrow[DB_type][0] == DB_TYPE_REV) {
  1612. p = rrow[DB_exp_date];
  1613. if (p == NULL)
  1614. p = "undef";
  1615. BIO_printf(bio_err, "Was revoked on:%s\n", p);
  1616. }
  1617. p = rrow[DB_exp_date];
  1618. if (p == NULL)
  1619. p = "undef";
  1620. BIO_printf(bio_err, "Expires on :%s\n", p);
  1621. p = rrow[DB_serial];
  1622. if (p == NULL)
  1623. p = "undef";
  1624. BIO_printf(bio_err, "Serial Number :%s\n", p);
  1625. p = rrow[DB_file];
  1626. if (p == NULL)
  1627. p = "undef";
  1628. BIO_printf(bio_err, "File name :%s\n", p);
  1629. p = rrow[DB_name];
  1630. if (p == NULL)
  1631. p = "undef";
  1632. BIO_printf(bio_err, "Subject Name :%s\n", p);
  1633. ok = -1; /* This is now a 'bad' error. */
  1634. goto end;
  1635. }
  1636. if (!default_op) {
  1637. BIO_printf(bio_err, "Certificate Details:\n");
  1638. /*
  1639. * Never print signature details because signature not present
  1640. */
  1641. certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
  1642. X509_print_ex(bio_err, ret, nameopt, certopt);
  1643. }
  1644. BIO_printf(bio_err, "Certificate is to be certified until ");
  1645. ASN1_TIME_print(bio_err, X509_get0_notAfter(ret));
  1646. if (days)
  1647. BIO_printf(bio_err, " (%ld days)", days);
  1648. BIO_printf(bio_err, "\n");
  1649. if (!batch) {
  1650. BIO_printf(bio_err, "Sign the certificate? [y/n]:");
  1651. (void)BIO_flush(bio_err);
  1652. buf[0] = '\0';
  1653. if (fgets(buf, sizeof(buf), stdin) == NULL) {
  1654. BIO_printf(bio_err,
  1655. "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
  1656. ok = 0;
  1657. goto end;
  1658. }
  1659. if (!(buf[0] == 'y' || buf[0] == 'Y')) {
  1660. BIO_printf(bio_err, "CERTIFICATE WILL NOT BE CERTIFIED\n");
  1661. ok = 0;
  1662. goto end;
  1663. }
  1664. }
  1665. pktmp = X509_get0_pubkey(ret);
  1666. if (EVP_PKEY_missing_parameters(pktmp) &&
  1667. !EVP_PKEY_missing_parameters(pkey))
  1668. EVP_PKEY_copy_parameters(pktmp, pkey);
  1669. if (!do_X509_sign(ret, pkey, dgst, sigopts))
  1670. goto end;
  1671. /* We now just add it to the database as DB_TYPE_VAL('V') */
  1672. row[DB_type] = OPENSSL_strdup("V");
  1673. tm = X509_get0_notAfter(ret);
  1674. row[DB_exp_date] = app_malloc(tm->length + 1, "row expdate");
  1675. memcpy(row[DB_exp_date], tm->data, tm->length);
  1676. row[DB_exp_date][tm->length] = '\0';
  1677. row[DB_rev_date] = NULL;
  1678. row[DB_file] = OPENSSL_strdup("unknown");
  1679. if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
  1680. (row[DB_file] == NULL) || (row[DB_name] == NULL)) {
  1681. BIO_printf(bio_err, "Memory allocation failure\n");
  1682. goto end;
  1683. }
  1684. irow = app_malloc(sizeof(*irow) * (DB_NUMBER + 1), "row space");
  1685. for (i = 0; i < DB_NUMBER; i++)
  1686. irow[i] = row[i];
  1687. irow[DB_NUMBER] = NULL;
  1688. if (!TXT_DB_insert(db->db, irow)) {
  1689. BIO_printf(bio_err, "failed to update database\n");
  1690. BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
  1691. goto end;
  1692. }
  1693. irow = NULL;
  1694. ok = 1;
  1695. end:
  1696. if (ok != 1) {
  1697. for (i = 0; i < DB_NUMBER; i++)
  1698. OPENSSL_free(row[i]);
  1699. }
  1700. OPENSSL_free(irow);
  1701. X509_NAME_free(CAname);
  1702. X509_NAME_free(subject);
  1703. if (ok <= 0)
  1704. X509_free(ret);
  1705. else
  1706. *xret = ret;
  1707. return ok;
  1708. }
  1709. static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
  1710. {
  1711. if (output_der) {
  1712. (void)i2d_X509_bio(bp, x);
  1713. return;
  1714. }
  1715. if (!notext)
  1716. X509_print(bp, x);
  1717. PEM_write_bio_X509(bp, x);
  1718. }
  1719. static int certify_spkac(X509 **xret, const char *infile, EVP_PKEY *pkey,
  1720. X509 *x509, const EVP_MD *dgst,
  1721. STACK_OF(OPENSSL_STRING) *sigopts,
  1722. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1723. BIGNUM *serial, const char *subj, unsigned long chtype,
  1724. int multirdn, int email_dn, const char *startdate,
  1725. const char *enddate, long days, const char *ext_sect,
  1726. CONF *lconf, int verbose, unsigned long certopt,
  1727. unsigned long nameopt, int default_op, int ext_copy)
  1728. {
  1729. STACK_OF(CONF_VALUE) *sk = NULL;
  1730. LHASH_OF(CONF_VALUE) *parms = NULL;
  1731. X509_REQ *req = NULL;
  1732. CONF_VALUE *cv = NULL;
  1733. NETSCAPE_SPKI *spki = NULL;
  1734. char *type, *buf;
  1735. EVP_PKEY *pktmp = NULL;
  1736. X509_NAME *n = NULL;
  1737. X509_NAME_ENTRY *ne = NULL;
  1738. int ok = -1, i, j;
  1739. long errline;
  1740. int nid;
  1741. /*
  1742. * Load input file into a hash table. (This is just an easy
  1743. * way to read and parse the file, then put it into a convenient
  1744. * STACK format).
  1745. */
  1746. parms = CONF_load(NULL, infile, &errline);
  1747. if (parms == NULL) {
  1748. BIO_printf(bio_err, "error on line %ld of %s\n", errline, infile);
  1749. ERR_print_errors(bio_err);
  1750. goto end;
  1751. }
  1752. sk = CONF_get_section(parms, "default");
  1753. if (sk_CONF_VALUE_num(sk) == 0) {
  1754. BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
  1755. goto end;
  1756. }
  1757. /*
  1758. * Now create a dummy X509 request structure. We don't actually
  1759. * have an X509 request, but we have many of the components
  1760. * (a public key, various DN components). The idea is that we
  1761. * put these components into the right X509 request structure
  1762. * and we can use the same code as if you had a real X509 request.
  1763. */
  1764. req = X509_REQ_new();
  1765. if (req == NULL) {
  1766. ERR_print_errors(bio_err);
  1767. goto end;
  1768. }
  1769. /*
  1770. * Build up the subject name set.
  1771. */
  1772. n = X509_REQ_get_subject_name(req);
  1773. for (i = 0;; i++) {
  1774. if (sk_CONF_VALUE_num(sk) <= i)
  1775. break;
  1776. cv = sk_CONF_VALUE_value(sk, i);
  1777. type = cv->name;
  1778. /*
  1779. * Skip past any leading X. X: X, etc to allow for multiple instances
  1780. */
  1781. for (buf = cv->name; *buf; buf++)
  1782. if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
  1783. buf++;
  1784. if (*buf)
  1785. type = buf;
  1786. break;
  1787. }
  1788. buf = cv->value;
  1789. if ((nid = OBJ_txt2nid(type)) == NID_undef) {
  1790. if (strcmp(type, "SPKAC") == 0) {
  1791. spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
  1792. if (spki == NULL) {
  1793. BIO_printf(bio_err,
  1794. "unable to load Netscape SPKAC structure\n");
  1795. ERR_print_errors(bio_err);
  1796. goto end;
  1797. }
  1798. }
  1799. continue;
  1800. }
  1801. if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
  1802. (unsigned char *)buf, -1, -1, 0))
  1803. goto end;
  1804. }
  1805. if (spki == NULL) {
  1806. BIO_printf(bio_err, "Netscape SPKAC structure not found in %s\n",
  1807. infile);
  1808. goto end;
  1809. }
  1810. /*
  1811. * Now extract the key from the SPKI structure.
  1812. */
  1813. BIO_printf(bio_err, "Check that the SPKAC request matches the signature\n");
  1814. if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
  1815. BIO_printf(bio_err, "error unpacking SPKAC public key\n");
  1816. goto end;
  1817. }
  1818. j = NETSCAPE_SPKI_verify(spki, pktmp);
  1819. if (j <= 0) {
  1820. EVP_PKEY_free(pktmp);
  1821. BIO_printf(bio_err,
  1822. "signature verification failed on SPKAC public key\n");
  1823. goto end;
  1824. }
  1825. BIO_printf(bio_err, "Signature ok\n");
  1826. X509_REQ_set_pubkey(req, pktmp);
  1827. EVP_PKEY_free(pktmp);
  1828. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  1829. chtype, multirdn, email_dn, startdate, enddate, days, 1,
  1830. verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
  1831. ext_copy, 0);
  1832. end:
  1833. X509_REQ_free(req);
  1834. CONF_free(parms);
  1835. NETSCAPE_SPKI_free(spki);
  1836. X509_NAME_ENTRY_free(ne);
  1837. return ok;
  1838. }
  1839. static int check_time_format(const char *str)
  1840. {
  1841. return ASN1_TIME_set_string(NULL, str);
  1842. }
  1843. static int do_revoke(X509 *x509, CA_DB *db, REVINFO_TYPE rev_type,
  1844. const char *value)
  1845. {
  1846. const ASN1_TIME *tm = NULL;
  1847. char *row[DB_NUMBER], **rrow, **irow;
  1848. char *rev_str = NULL;
  1849. BIGNUM *bn = NULL;
  1850. int ok = -1, i;
  1851. for (i = 0; i < DB_NUMBER; i++)
  1852. row[i] = NULL;
  1853. row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
  1854. bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);
  1855. if (!bn)
  1856. goto end;
  1857. if (BN_is_zero(bn))
  1858. row[DB_serial] = OPENSSL_strdup("00");
  1859. else
  1860. row[DB_serial] = BN_bn2hex(bn);
  1861. BN_free(bn);
  1862. if (row[DB_name] != NULL && row[DB_name][0] == '\0') {
  1863. /* Entries with empty Subjects actually use the serial number instead */
  1864. OPENSSL_free(row[DB_name]);
  1865. row[DB_name] = OPENSSL_strdup(row[DB_serial]);
  1866. }
  1867. if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
  1868. BIO_printf(bio_err, "Memory allocation failure\n");
  1869. goto end;
  1870. }
  1871. /*
  1872. * We have to lookup by serial number because name lookup skips revoked
  1873. * certs
  1874. */
  1875. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  1876. if (rrow == NULL) {
  1877. BIO_printf(bio_err,
  1878. "Adding Entry with serial number %s to DB for %s\n",
  1879. row[DB_serial], row[DB_name]);
  1880. /* We now just add it to the database as DB_TYPE_REV('V') */
  1881. row[DB_type] = OPENSSL_strdup("V");
  1882. tm = X509_get0_notAfter(x509);
  1883. row[DB_exp_date] = app_malloc(tm->length + 1, "row exp_data");
  1884. memcpy(row[DB_exp_date], tm->data, tm->length);
  1885. row[DB_exp_date][tm->length] = '\0';
  1886. row[DB_rev_date] = NULL;
  1887. row[DB_file] = OPENSSL_strdup("unknown");
  1888. if (row[DB_type] == NULL || row[DB_file] == NULL) {
  1889. BIO_printf(bio_err, "Memory allocation failure\n");
  1890. goto end;
  1891. }
  1892. irow = app_malloc(sizeof(*irow) * (DB_NUMBER + 1), "row ptr");
  1893. for (i = 0; i < DB_NUMBER; i++)
  1894. irow[i] = row[i];
  1895. irow[DB_NUMBER] = NULL;
  1896. if (!TXT_DB_insert(db->db, irow)) {
  1897. BIO_printf(bio_err, "failed to update database\n");
  1898. BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
  1899. OPENSSL_free(irow);
  1900. goto end;
  1901. }
  1902. for (i = 0; i < DB_NUMBER; i++)
  1903. row[i] = NULL;
  1904. /* Revoke Certificate */
  1905. if (rev_type == REV_VALID)
  1906. ok = 1;
  1907. else
  1908. /* Retry revocation after DB insertion */
  1909. ok = do_revoke(x509, db, rev_type, value);
  1910. goto end;
  1911. } else if (index_name_cmp_noconst(row, rrow)) {
  1912. BIO_printf(bio_err, "ERROR:name does not match %s\n", row[DB_name]);
  1913. goto end;
  1914. } else if (rev_type == REV_VALID) {
  1915. BIO_printf(bio_err, "ERROR:Already present, serial number %s\n",
  1916. row[DB_serial]);
  1917. goto end;
  1918. } else if (rrow[DB_type][0] == DB_TYPE_REV) {
  1919. BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\n",
  1920. row[DB_serial]);
  1921. goto end;
  1922. } else {
  1923. BIO_printf(bio_err, "Revoking Certificate %s.\n", rrow[DB_serial]);
  1924. rev_str = make_revocation_str(rev_type, value);
  1925. if (!rev_str) {
  1926. BIO_printf(bio_err, "Error in revocation arguments\n");
  1927. goto end;
  1928. }
  1929. rrow[DB_type][0] = DB_TYPE_REV;
  1930. rrow[DB_type][1] = '\0';
  1931. rrow[DB_rev_date] = rev_str;
  1932. }
  1933. ok = 1;
  1934. end:
  1935. for (i = 0; i < DB_NUMBER; i++)
  1936. OPENSSL_free(row[i]);
  1937. return ok;
  1938. }
  1939. static int get_certificate_status(const char *serial, CA_DB *db)
  1940. {
  1941. char *row[DB_NUMBER], **rrow;
  1942. int ok = -1, i;
  1943. size_t serial_len = strlen(serial);
  1944. /* Free Resources */
  1945. for (i = 0; i < DB_NUMBER; i++)
  1946. row[i] = NULL;
  1947. /* Malloc needed char spaces */
  1948. row[DB_serial] = app_malloc(serial_len + 2, "row serial#");
  1949. if (serial_len % 2) {
  1950. /*
  1951. * Set the first char to 0
  1952. */
  1953. row[DB_serial][0] = '0';
  1954. /* Copy String from serial to row[DB_serial] */
  1955. memcpy(row[DB_serial] + 1, serial, serial_len);
  1956. row[DB_serial][serial_len + 1] = '\0';
  1957. } else {
  1958. /* Copy String from serial to row[DB_serial] */
  1959. memcpy(row[DB_serial], serial, serial_len);
  1960. row[DB_serial][serial_len] = '\0';
  1961. }
  1962. /* Make it Upper Case */
  1963. make_uppercase(row[DB_serial]);
  1964. ok = 1;
  1965. /* Search for the certificate */
  1966. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  1967. if (rrow == NULL) {
  1968. BIO_printf(bio_err, "Serial %s not present in db.\n", row[DB_serial]);
  1969. ok = -1;
  1970. goto end;
  1971. } else if (rrow[DB_type][0] == DB_TYPE_VAL) {
  1972. BIO_printf(bio_err, "%s=Valid (%c)\n",
  1973. row[DB_serial], rrow[DB_type][0]);
  1974. goto end;
  1975. } else if (rrow[DB_type][0] == DB_TYPE_REV) {
  1976. BIO_printf(bio_err, "%s=Revoked (%c)\n",
  1977. row[DB_serial], rrow[DB_type][0]);
  1978. goto end;
  1979. } else if (rrow[DB_type][0] == DB_TYPE_EXP) {
  1980. BIO_printf(bio_err, "%s=Expired (%c)\n",
  1981. row[DB_serial], rrow[DB_type][0]);
  1982. goto end;
  1983. } else if (rrow[DB_type][0] == DB_TYPE_SUSP) {
  1984. BIO_printf(bio_err, "%s=Suspended (%c)\n",
  1985. row[DB_serial], rrow[DB_type][0]);
  1986. goto end;
  1987. } else {
  1988. BIO_printf(bio_err, "%s=Unknown (%c).\n",
  1989. row[DB_serial], rrow[DB_type][0]);
  1990. ok = -1;
  1991. }
  1992. end:
  1993. for (i = 0; i < DB_NUMBER; i++) {
  1994. OPENSSL_free(row[i]);
  1995. }
  1996. return ok;
  1997. }
  1998. static int do_updatedb(CA_DB *db)
  1999. {
  2000. ASN1_UTCTIME *a_tm = NULL;
  2001. int i, cnt = 0;
  2002. int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
  2003. char **rrow, *a_tm_s;
  2004. a_tm = ASN1_UTCTIME_new();
  2005. if (a_tm == NULL)
  2006. return -1;
  2007. /* get actual time and make a string */
  2008. if (X509_gmtime_adj(a_tm, 0) == NULL) {
  2009. ASN1_UTCTIME_free(a_tm);
  2010. return -1;
  2011. }
  2012. a_tm_s = app_malloc(a_tm->length + 1, "time string");
  2013. memcpy(a_tm_s, a_tm->data, a_tm->length);
  2014. a_tm_s[a_tm->length] = '\0';
  2015. if (strncmp(a_tm_s, "49", 2) <= 0)
  2016. a_y2k = 1;
  2017. else
  2018. a_y2k = 0;
  2019. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  2020. rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
  2021. if (rrow[DB_type][0] == DB_TYPE_VAL) {
  2022. /* ignore entries that are not valid */
  2023. if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
  2024. db_y2k = 1;
  2025. else
  2026. db_y2k = 0;
  2027. if (db_y2k == a_y2k) {
  2028. /* all on the same y2k side */
  2029. if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0) {
  2030. rrow[DB_type][0] = DB_TYPE_EXP;
  2031. rrow[DB_type][1] = '\0';
  2032. cnt++;
  2033. BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
  2034. }
  2035. } else if (db_y2k < a_y2k) {
  2036. rrow[DB_type][0] = DB_TYPE_EXP;
  2037. rrow[DB_type][1] = '\0';
  2038. cnt++;
  2039. BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
  2040. }
  2041. }
  2042. }
  2043. ASN1_UTCTIME_free(a_tm);
  2044. OPENSSL_free(a_tm_s);
  2045. return cnt;
  2046. }
  2047. static const char *crl_reasons[] = {
  2048. /* CRL reason strings */
  2049. "unspecified",
  2050. "keyCompromise",
  2051. "CACompromise",
  2052. "affiliationChanged",
  2053. "superseded",
  2054. "cessationOfOperation",
  2055. "certificateHold",
  2056. "removeFromCRL",
  2057. /* Additional pseudo reasons */
  2058. "holdInstruction",
  2059. "keyTime",
  2060. "CAkeyTime"
  2061. };
  2062. #define NUM_REASONS OSSL_NELEM(crl_reasons)
  2063. /*
  2064. * Given revocation information convert to a DB string. The format of the
  2065. * string is: revtime[,reason,extra]. Where 'revtime' is the revocation time
  2066. * (the current time). 'reason' is the optional CRL reason and 'extra' is any
  2067. * additional argument
  2068. */
  2069. static char *make_revocation_str(REVINFO_TYPE rev_type, const char *rev_arg)
  2070. {
  2071. char *str;
  2072. const char *reason = NULL, *other = NULL;
  2073. ASN1_OBJECT *otmp;
  2074. ASN1_UTCTIME *revtm = NULL;
  2075. int i;
  2076. switch (rev_type) {
  2077. case REV_NONE:
  2078. case REV_VALID:
  2079. break;
  2080. case REV_CRL_REASON:
  2081. for (i = 0; i < 8; i++) {
  2082. if (strcasecmp(rev_arg, crl_reasons[i]) == 0) {
  2083. reason = crl_reasons[i];
  2084. break;
  2085. }
  2086. }
  2087. if (reason == NULL) {
  2088. BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
  2089. return NULL;
  2090. }
  2091. break;
  2092. case REV_HOLD:
  2093. /* Argument is an OID */
  2094. otmp = OBJ_txt2obj(rev_arg, 0);
  2095. ASN1_OBJECT_free(otmp);
  2096. if (otmp == NULL) {
  2097. BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
  2098. return NULL;
  2099. }
  2100. reason = "holdInstruction";
  2101. other = rev_arg;
  2102. break;
  2103. case REV_KEY_COMPROMISE:
  2104. case REV_CA_COMPROMISE:
  2105. /* Argument is the key compromise time */
  2106. if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg)) {
  2107. BIO_printf(bio_err,
  2108. "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
  2109. rev_arg);
  2110. return NULL;
  2111. }
  2112. other = rev_arg;
  2113. if (rev_type == REV_KEY_COMPROMISE)
  2114. reason = "keyTime";
  2115. else
  2116. reason = "CAkeyTime";
  2117. break;
  2118. }
  2119. revtm = X509_gmtime_adj(NULL, 0);
  2120. if (!revtm)
  2121. return NULL;
  2122. i = revtm->length + 1;
  2123. if (reason)
  2124. i += strlen(reason) + 1;
  2125. if (other)
  2126. i += strlen(other) + 1;
  2127. str = app_malloc(i, "revocation reason");
  2128. OPENSSL_strlcpy(str, (char *)revtm->data, i);
  2129. if (reason) {
  2130. OPENSSL_strlcat(str, ",", i);
  2131. OPENSSL_strlcat(str, reason, i);
  2132. }
  2133. if (other) {
  2134. OPENSSL_strlcat(str, ",", i);
  2135. OPENSSL_strlcat(str, other, i);
  2136. }
  2137. ASN1_UTCTIME_free(revtm);
  2138. return str;
  2139. }
  2140. /*-
  2141. * Convert revocation field to X509_REVOKED entry
  2142. * return code:
  2143. * 0 error
  2144. * 1 OK
  2145. * 2 OK and some extensions added (i.e. V2 CRL)
  2146. */
  2147. static int make_revoked(X509_REVOKED *rev, const char *str)
  2148. {
  2149. char *tmp = NULL;
  2150. int reason_code = -1;
  2151. int i, ret = 0;
  2152. ASN1_OBJECT *hold = NULL;
  2153. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2154. ASN1_ENUMERATED *rtmp = NULL;
  2155. ASN1_TIME *revDate = NULL;
  2156. i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
  2157. if (i == 0)
  2158. goto end;
  2159. if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
  2160. goto end;
  2161. if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)) {
  2162. rtmp = ASN1_ENUMERATED_new();
  2163. if (rtmp == NULL || !ASN1_ENUMERATED_set(rtmp, reason_code))
  2164. goto end;
  2165. if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
  2166. goto end;
  2167. }
  2168. if (rev && comp_time) {
  2169. if (!X509_REVOKED_add1_ext_i2d
  2170. (rev, NID_invalidity_date, comp_time, 0, 0))
  2171. goto end;
  2172. }
  2173. if (rev && hold) {
  2174. if (!X509_REVOKED_add1_ext_i2d
  2175. (rev, NID_hold_instruction_code, hold, 0, 0))
  2176. goto end;
  2177. }
  2178. if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
  2179. ret = 2;
  2180. else
  2181. ret = 1;
  2182. end:
  2183. OPENSSL_free(tmp);
  2184. ASN1_OBJECT_free(hold);
  2185. ASN1_GENERALIZEDTIME_free(comp_time);
  2186. ASN1_ENUMERATED_free(rtmp);
  2187. ASN1_TIME_free(revDate);
  2188. return ret;
  2189. }
  2190. static int old_entry_print(const ASN1_OBJECT *obj, const ASN1_STRING *str)
  2191. {
  2192. char buf[25], *pbuf;
  2193. const char *p;
  2194. int j;
  2195. j = i2a_ASN1_OBJECT(bio_err, obj);
  2196. pbuf = buf;
  2197. for (j = 22 - j; j > 0; j--)
  2198. *(pbuf++) = ' ';
  2199. *(pbuf++) = ':';
  2200. *(pbuf++) = '\0';
  2201. BIO_puts(bio_err, buf);
  2202. if (str->type == V_ASN1_PRINTABLESTRING)
  2203. BIO_printf(bio_err, "PRINTABLE:'");
  2204. else if (str->type == V_ASN1_T61STRING)
  2205. BIO_printf(bio_err, "T61STRING:'");
  2206. else if (str->type == V_ASN1_IA5STRING)
  2207. BIO_printf(bio_err, "IA5STRING:'");
  2208. else if (str->type == V_ASN1_UNIVERSALSTRING)
  2209. BIO_printf(bio_err, "UNIVERSALSTRING:'");
  2210. else
  2211. BIO_printf(bio_err, "ASN.1 %2d:'", str->type);
  2212. p = (const char *)str->data;
  2213. for (j = str->length; j > 0; j--) {
  2214. if ((*p >= ' ') && (*p <= '~'))
  2215. BIO_printf(bio_err, "%c", *p);
  2216. else if (*p & 0x80)
  2217. BIO_printf(bio_err, "\\0x%02X", *p);
  2218. else if ((unsigned char)*p == 0xf7)
  2219. BIO_printf(bio_err, "^?");
  2220. else
  2221. BIO_printf(bio_err, "^%c", *p + '@');
  2222. p++;
  2223. }
  2224. BIO_printf(bio_err, "'\n");
  2225. return 1;
  2226. }
  2227. int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
  2228. ASN1_GENERALIZEDTIME **pinvtm, const char *str)
  2229. {
  2230. char *tmp;
  2231. char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
  2232. int reason_code = -1;
  2233. int ret = 0;
  2234. unsigned int i;
  2235. ASN1_OBJECT *hold = NULL;
  2236. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2237. tmp = OPENSSL_strdup(str);
  2238. if (!tmp) {
  2239. BIO_printf(bio_err, "memory allocation failure\n");
  2240. goto end;
  2241. }
  2242. p = strchr(tmp, ',');
  2243. rtime_str = tmp;
  2244. if (p) {
  2245. *p = '\0';
  2246. p++;
  2247. reason_str = p;
  2248. p = strchr(p, ',');
  2249. if (p) {
  2250. *p = '\0';
  2251. arg_str = p + 1;
  2252. }
  2253. }
  2254. if (prevtm) {
  2255. *prevtm = ASN1_UTCTIME_new();
  2256. if (*prevtm == NULL) {
  2257. BIO_printf(bio_err, "memory allocation failure\n");
  2258. goto end;
  2259. }
  2260. if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str)) {
  2261. BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
  2262. goto end;
  2263. }
  2264. }
  2265. if (reason_str) {
  2266. for (i = 0; i < NUM_REASONS; i++) {
  2267. if (strcasecmp(reason_str, crl_reasons[i]) == 0) {
  2268. reason_code = i;
  2269. break;
  2270. }
  2271. }
  2272. if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS) {
  2273. BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
  2274. goto end;
  2275. }
  2276. if (reason_code == 7) {
  2277. reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
  2278. } else if (reason_code == 8) { /* Hold instruction */
  2279. if (!arg_str) {
  2280. BIO_printf(bio_err, "missing hold instruction\n");
  2281. goto end;
  2282. }
  2283. reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
  2284. hold = OBJ_txt2obj(arg_str, 0);
  2285. if (!hold) {
  2286. BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
  2287. goto end;
  2288. }
  2289. if (phold)
  2290. *phold = hold;
  2291. else
  2292. ASN1_OBJECT_free(hold);
  2293. } else if ((reason_code == 9) || (reason_code == 10)) {
  2294. if (!arg_str) {
  2295. BIO_printf(bio_err, "missing compromised time\n");
  2296. goto end;
  2297. }
  2298. comp_time = ASN1_GENERALIZEDTIME_new();
  2299. if (comp_time == NULL) {
  2300. BIO_printf(bio_err, "memory allocation failure\n");
  2301. goto end;
  2302. }
  2303. if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str)) {
  2304. BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
  2305. goto end;
  2306. }
  2307. if (reason_code == 9)
  2308. reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
  2309. else
  2310. reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
  2311. }
  2312. }
  2313. if (preason)
  2314. *preason = reason_code;
  2315. if (pinvtm) {
  2316. *pinvtm = comp_time;
  2317. comp_time = NULL;
  2318. }
  2319. ret = 1;
  2320. end:
  2321. OPENSSL_free(tmp);
  2322. ASN1_GENERALIZEDTIME_free(comp_time);
  2323. return ret;
  2324. }