x509.c 39 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196
  1. /*
  2. * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include <string.h>
  12. #include "apps.h"
  13. #include "progs.h"
  14. #include <openssl/bio.h>
  15. #include <openssl/asn1.h>
  16. #include <openssl/err.h>
  17. #include <openssl/bn.h>
  18. #include <openssl/evp.h>
  19. #include <openssl/x509.h>
  20. #include <openssl/x509v3.h>
  21. #include <openssl/objects.h>
  22. #include <openssl/pem.h>
  23. #ifndef OPENSSL_NO_RSA
  24. # include <openssl/rsa.h>
  25. #endif
  26. #ifndef OPENSSL_NO_DSA
  27. # include <openssl/dsa.h>
  28. #endif
  29. #undef POSTFIX
  30. #define POSTFIX ".srl"
  31. #define DEF_DAYS 30
  32. static int callb(int ok, X509_STORE_CTX *ctx);
  33. static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext,
  34. const EVP_MD *digest, CONF *conf, const char *section,
  35. int preserve_dates);
  36. static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *digest,
  37. X509 *x, X509 *xca, EVP_PKEY *pkey,
  38. STACK_OF(OPENSSL_STRING) *sigopts, const char *serialfile,
  39. int create, int days, int clrext, CONF *conf,
  40. const char *section, ASN1_INTEGER *sno, int reqfile,
  41. int preserve_dates);
  42. static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
  43. static int print_x509v3_exts(BIO *bio, X509 *x, const char *exts);
  44. typedef enum OPTION_choice {
  45. OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
  46. OPT_INFORM, OPT_OUTFORM, OPT_KEYFORM, OPT_REQ, OPT_CAFORM,
  47. OPT_CAKEYFORM, OPT_SIGOPT, OPT_DAYS, OPT_PASSIN, OPT_EXTFILE,
  48. OPT_EXTENSIONS, OPT_IN, OPT_OUT, OPT_SIGNKEY, OPT_CA,
  49. OPT_CAKEY, OPT_CASERIAL, OPT_SET_SERIAL, OPT_FORCE_PUBKEY,
  50. OPT_ADDTRUST, OPT_ADDREJECT, OPT_SETALIAS, OPT_CERTOPT, OPT_NAMEOPT,
  51. OPT_C, OPT_EMAIL, OPT_OCSP_URI, OPT_SERIAL, OPT_NEXT_SERIAL,
  52. OPT_MODULUS, OPT_PUBKEY, OPT_X509TOREQ, OPT_TEXT, OPT_HASH,
  53. OPT_ISSUER_HASH, OPT_SUBJECT, OPT_ISSUER, OPT_FINGERPRINT, OPT_DATES,
  54. OPT_PURPOSE, OPT_STARTDATE, OPT_ENDDATE, OPT_CHECKEND, OPT_CHECKHOST,
  55. OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST,
  56. OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID,
  57. OPT_SUBJECT_HASH_OLD,
  58. OPT_ISSUER_HASH_OLD,
  59. OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES,
  60. OPT_R_ENUM, OPT_EXT
  61. } OPTION_CHOICE;
  62. const OPTIONS x509_options[] = {
  63. {"help", OPT_HELP, '-', "Display this summary"},
  64. {"inform", OPT_INFORM, 'f',
  65. "Input format - default PEM (one of DER, NET or PEM)"},
  66. {"in", OPT_IN, '<', "Input file - default stdin"},
  67. {"outform", OPT_OUTFORM, 'f',
  68. "Output format - default PEM (one of DER, NET or PEM)"},
  69. {"out", OPT_OUT, '>', "Output file - default stdout"},
  70. {"keyform", OPT_KEYFORM, 'F', "Private key format - default PEM"},
  71. {"passin", OPT_PASSIN, 's', "Private key password/pass-phrase source"},
  72. {"serial", OPT_SERIAL, '-', "Print serial number value"},
  73. {"subject_hash", OPT_HASH, '-', "Print subject hash value"},
  74. {"issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value"},
  75. {"hash", OPT_HASH, '-', "Synonym for -subject_hash"},
  76. {"subject", OPT_SUBJECT, '-', "Print subject DN"},
  77. {"issuer", OPT_ISSUER, '-', "Print issuer DN"},
  78. {"email", OPT_EMAIL, '-', "Print email address(es)"},
  79. {"startdate", OPT_STARTDATE, '-', "Set notBefore field"},
  80. {"enddate", OPT_ENDDATE, '-', "Set notAfter field"},
  81. {"purpose", OPT_PURPOSE, '-', "Print out certificate purposes"},
  82. {"dates", OPT_DATES, '-', "Both Before and After dates"},
  83. {"modulus", OPT_MODULUS, '-', "Print the RSA key modulus"},
  84. {"pubkey", OPT_PUBKEY, '-', "Output the public key"},
  85. {"fingerprint", OPT_FINGERPRINT, '-',
  86. "Print the certificate fingerprint"},
  87. {"alias", OPT_ALIAS, '-', "Output certificate alias"},
  88. {"noout", OPT_NOOUT, '-', "No output, just status"},
  89. {"nocert", OPT_NOCERT, '-', "No certificate output"},
  90. {"ocspid", OPT_OCSPID, '-',
  91. "Print OCSP hash values for the subject name and public key"},
  92. {"ocsp_uri", OPT_OCSP_URI, '-', "Print OCSP Responder URL(s)"},
  93. {"trustout", OPT_TRUSTOUT, '-', "Output a trusted certificate"},
  94. {"clrtrust", OPT_CLRTRUST, '-', "Clear all trusted purposes"},
  95. {"clrext", OPT_CLREXT, '-', "Clear all certificate extensions"},
  96. {"addtrust", OPT_ADDTRUST, 's', "Trust certificate for a given purpose"},
  97. {"addreject", OPT_ADDREJECT, 's',
  98. "Reject certificate for a given purpose"},
  99. {"setalias", OPT_SETALIAS, 's', "Set certificate alias"},
  100. {"days", OPT_DAYS, 'n',
  101. "How long till expiry of a signed certificate - def 30 days"},
  102. {"checkend", OPT_CHECKEND, 'M',
  103. "Check whether the cert expires in the next arg seconds"},
  104. {OPT_MORE_STR, 1, 1, "Exit 1 if so, 0 if not"},
  105. {"signkey", OPT_SIGNKEY, '<', "Self sign cert with arg"},
  106. {"x509toreq", OPT_X509TOREQ, '-',
  107. "Output a certification request object"},
  108. {"req", OPT_REQ, '-', "Input is a certificate request, sign and output"},
  109. {"CA", OPT_CA, '<', "Set the CA certificate, must be PEM format"},
  110. {"CAkey", OPT_CAKEY, 's',
  111. "The CA key, must be PEM format; if not in CAfile"},
  112. {"CAcreateserial", OPT_CACREATESERIAL, '-',
  113. "Create serial number file if it does not exist"},
  114. {"CAserial", OPT_CASERIAL, 's', "Serial file"},
  115. {"set_serial", OPT_SET_SERIAL, 's', "Serial number to use"},
  116. {"text", OPT_TEXT, '-', "Print the certificate in text form"},
  117. {"ext", OPT_EXT, 's', "Print various X509V3 extensions"},
  118. {"C", OPT_C, '-', "Print out C code forms"},
  119. {"extfile", OPT_EXTFILE, '<', "File with X509V3 extensions to add"},
  120. OPT_R_OPTIONS,
  121. {"extensions", OPT_EXTENSIONS, 's', "Section from config file to use"},
  122. {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
  123. {"certopt", OPT_CERTOPT, 's', "Various certificate text options"},
  124. {"checkhost", OPT_CHECKHOST, 's', "Check certificate matches host"},
  125. {"checkemail", OPT_CHECKEMAIL, 's', "Check certificate matches email"},
  126. {"checkip", OPT_CHECKIP, 's', "Check certificate matches ipaddr"},
  127. {"CAform", OPT_CAFORM, 'F', "CA format - default PEM"},
  128. {"CAkeyform", OPT_CAKEYFORM, 'f', "CA key format - default PEM"},
  129. {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
  130. {"force_pubkey", OPT_FORCE_PUBKEY, '<', "Force the Key to put inside certificate"},
  131. {"next_serial", OPT_NEXT_SERIAL, '-', "Increment current certificate serial number"},
  132. {"clrreject", OPT_CLRREJECT, '-',
  133. "Clears all the prohibited or rejected uses of the certificate"},
  134. {"badsig", OPT_BADSIG, '-', "Corrupt last byte of certificate signature (for test)"},
  135. {"", OPT_MD, '-', "Any supported digest"},
  136. #ifndef OPENSSL_NO_MD5
  137. {"subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
  138. "Print old-style (MD5) issuer hash value"},
  139. {"issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
  140. "Print old-style (MD5) subject hash value"},
  141. #endif
  142. #ifndef OPENSSL_NO_ENGINE
  143. {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
  144. #endif
  145. {"preserve_dates", OPT_PRESERVE_DATES, '-', "preserve existing dates when signing"},
  146. {NULL}
  147. };
  148. int x509_main(int argc, char **argv)
  149. {
  150. ASN1_INTEGER *sno = NULL;
  151. ASN1_OBJECT *objtmp = NULL;
  152. BIO *out = NULL;
  153. CONF *extconf = NULL;
  154. EVP_PKEY *Upkey = NULL, *CApkey = NULL, *fkey = NULL;
  155. STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
  156. STACK_OF(OPENSSL_STRING) *sigopts = NULL;
  157. X509 *x = NULL, *xca = NULL;
  158. X509_REQ *req = NULL, *rq = NULL;
  159. X509_STORE *ctx = NULL;
  160. const EVP_MD *digest = NULL;
  161. char *CAkeyfile = NULL, *CAserial = NULL, *fkeyfile = NULL, *alias = NULL;
  162. char *checkhost = NULL, *checkemail = NULL, *checkip = NULL, *exts = NULL;
  163. char *extsect = NULL, *extfile = NULL, *passin = NULL, *passinarg = NULL;
  164. char *infile = NULL, *outfile = NULL, *keyfile = NULL, *CAfile = NULL;
  165. char *prog;
  166. int x509req = 0, days = DEF_DAYS, modulus = 0, pubkey = 0, pprint = 0;
  167. int C = 0, CAformat = FORMAT_PEM, CAkeyformat = FORMAT_PEM;
  168. int fingerprint = 0, reqfile = 0, checkend = 0;
  169. int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM;
  170. int next_serial = 0, subject_hash = 0, issuer_hash = 0, ocspid = 0;
  171. int noout = 0, sign_flag = 0, CA_flag = 0, CA_createserial = 0, email = 0;
  172. int ocsp_uri = 0, trustout = 0, clrtrust = 0, clrreject = 0, aliasout = 0;
  173. int ret = 1, i, num = 0, badsig = 0, clrext = 0, nocert = 0;
  174. int text = 0, serial = 0, subject = 0, issuer = 0, startdate = 0, ext = 0;
  175. int enddate = 0;
  176. time_t checkoffset = 0;
  177. unsigned long certflag = 0;
  178. int preserve_dates = 0;
  179. OPTION_CHOICE o;
  180. ENGINE *e = NULL;
  181. #ifndef OPENSSL_NO_MD5
  182. int subject_hash_old = 0, issuer_hash_old = 0;
  183. #endif
  184. ctx = X509_STORE_new();
  185. if (ctx == NULL)
  186. goto end;
  187. X509_STORE_set_verify_cb(ctx, callb);
  188. prog = opt_init(argc, argv, x509_options);
  189. while ((o = opt_next()) != OPT_EOF) {
  190. switch (o) {
  191. case OPT_EOF:
  192. case OPT_ERR:
  193. opthelp:
  194. BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
  195. goto end;
  196. case OPT_HELP:
  197. opt_help(x509_options);
  198. ret = 0;
  199. goto end;
  200. case OPT_INFORM:
  201. if (!opt_format(opt_arg(), OPT_FMT_ANY, &informat))
  202. goto opthelp;
  203. break;
  204. case OPT_IN:
  205. infile = opt_arg();
  206. break;
  207. case OPT_OUTFORM:
  208. if (!opt_format(opt_arg(), OPT_FMT_ANY, &outformat))
  209. goto opthelp;
  210. break;
  211. case OPT_KEYFORM:
  212. if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat))
  213. goto opthelp;
  214. break;
  215. case OPT_CAFORM:
  216. if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &CAformat))
  217. goto opthelp;
  218. break;
  219. case OPT_CAKEYFORM:
  220. if (!opt_format(opt_arg(), OPT_FMT_ANY, &CAkeyformat))
  221. goto opthelp;
  222. break;
  223. case OPT_OUT:
  224. outfile = opt_arg();
  225. break;
  226. case OPT_REQ:
  227. reqfile = 1;
  228. break;
  229. case OPT_SIGOPT:
  230. if (!sigopts)
  231. sigopts = sk_OPENSSL_STRING_new_null();
  232. if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
  233. goto opthelp;
  234. break;
  235. case OPT_DAYS:
  236. if (preserve_dates)
  237. goto opthelp;
  238. days = atoi(opt_arg());
  239. break;
  240. case OPT_PASSIN:
  241. passinarg = opt_arg();
  242. break;
  243. case OPT_EXTFILE:
  244. extfile = opt_arg();
  245. break;
  246. case OPT_R_CASES:
  247. if (!opt_rand(o))
  248. goto end;
  249. break;
  250. case OPT_EXTENSIONS:
  251. extsect = opt_arg();
  252. break;
  253. case OPT_SIGNKEY:
  254. keyfile = opt_arg();
  255. sign_flag = ++num;
  256. break;
  257. case OPT_CA:
  258. CAfile = opt_arg();
  259. CA_flag = ++num;
  260. break;
  261. case OPT_CAKEY:
  262. CAkeyfile = opt_arg();
  263. break;
  264. case OPT_CASERIAL:
  265. CAserial = opt_arg();
  266. break;
  267. case OPT_SET_SERIAL:
  268. if (sno != NULL) {
  269. BIO_printf(bio_err, "Serial number supplied twice\n");
  270. goto opthelp;
  271. }
  272. if ((sno = s2i_ASN1_INTEGER(NULL, opt_arg())) == NULL)
  273. goto opthelp;
  274. break;
  275. case OPT_FORCE_PUBKEY:
  276. fkeyfile = opt_arg();
  277. break;
  278. case OPT_ADDTRUST:
  279. if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
  280. BIO_printf(bio_err,
  281. "%s: Invalid trust object value %s\n",
  282. prog, opt_arg());
  283. goto opthelp;
  284. }
  285. if (trust == NULL && (trust = sk_ASN1_OBJECT_new_null()) == NULL)
  286. goto end;
  287. sk_ASN1_OBJECT_push(trust, objtmp);
  288. objtmp = NULL;
  289. trustout = 1;
  290. break;
  291. case OPT_ADDREJECT:
  292. if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
  293. BIO_printf(bio_err,
  294. "%s: Invalid reject object value %s\n",
  295. prog, opt_arg());
  296. goto opthelp;
  297. }
  298. if (reject == NULL
  299. && (reject = sk_ASN1_OBJECT_new_null()) == NULL)
  300. goto end;
  301. sk_ASN1_OBJECT_push(reject, objtmp);
  302. objtmp = NULL;
  303. trustout = 1;
  304. break;
  305. case OPT_SETALIAS:
  306. alias = opt_arg();
  307. trustout = 1;
  308. break;
  309. case OPT_CERTOPT:
  310. if (!set_cert_ex(&certflag, opt_arg()))
  311. goto opthelp;
  312. break;
  313. case OPT_NAMEOPT:
  314. if (!set_nameopt(opt_arg()))
  315. goto opthelp;
  316. break;
  317. case OPT_ENGINE:
  318. e = setup_engine(opt_arg(), 0);
  319. break;
  320. case OPT_C:
  321. C = ++num;
  322. break;
  323. case OPT_EMAIL:
  324. email = ++num;
  325. break;
  326. case OPT_OCSP_URI:
  327. ocsp_uri = ++num;
  328. break;
  329. case OPT_SERIAL:
  330. serial = ++num;
  331. break;
  332. case OPT_NEXT_SERIAL:
  333. next_serial = ++num;
  334. break;
  335. case OPT_MODULUS:
  336. modulus = ++num;
  337. break;
  338. case OPT_PUBKEY:
  339. pubkey = ++num;
  340. break;
  341. case OPT_X509TOREQ:
  342. x509req = ++num;
  343. break;
  344. case OPT_TEXT:
  345. text = ++num;
  346. break;
  347. case OPT_SUBJECT:
  348. subject = ++num;
  349. break;
  350. case OPT_ISSUER:
  351. issuer = ++num;
  352. break;
  353. case OPT_FINGERPRINT:
  354. fingerprint = ++num;
  355. break;
  356. case OPT_HASH:
  357. subject_hash = ++num;
  358. break;
  359. case OPT_ISSUER_HASH:
  360. issuer_hash = ++num;
  361. break;
  362. case OPT_PURPOSE:
  363. pprint = ++num;
  364. break;
  365. case OPT_STARTDATE:
  366. startdate = ++num;
  367. break;
  368. case OPT_ENDDATE:
  369. enddate = ++num;
  370. break;
  371. case OPT_NOOUT:
  372. noout = ++num;
  373. break;
  374. case OPT_EXT:
  375. ext = ++num;
  376. exts = opt_arg();
  377. break;
  378. case OPT_NOCERT:
  379. nocert = 1;
  380. break;
  381. case OPT_TRUSTOUT:
  382. trustout = 1;
  383. break;
  384. case OPT_CLRTRUST:
  385. clrtrust = ++num;
  386. break;
  387. case OPT_CLRREJECT:
  388. clrreject = ++num;
  389. break;
  390. case OPT_ALIAS:
  391. aliasout = ++num;
  392. break;
  393. case OPT_CACREATESERIAL:
  394. CA_createserial = ++num;
  395. break;
  396. case OPT_CLREXT:
  397. clrext = 1;
  398. break;
  399. case OPT_OCSPID:
  400. ocspid = ++num;
  401. break;
  402. case OPT_BADSIG:
  403. badsig = 1;
  404. break;
  405. #ifndef OPENSSL_NO_MD5
  406. case OPT_SUBJECT_HASH_OLD:
  407. subject_hash_old = ++num;
  408. break;
  409. case OPT_ISSUER_HASH_OLD:
  410. issuer_hash_old = ++num;
  411. break;
  412. #else
  413. case OPT_SUBJECT_HASH_OLD:
  414. case OPT_ISSUER_HASH_OLD:
  415. break;
  416. #endif
  417. case OPT_DATES:
  418. startdate = ++num;
  419. enddate = ++num;
  420. break;
  421. case OPT_CHECKEND:
  422. checkend = 1;
  423. {
  424. intmax_t temp = 0;
  425. if (!opt_imax(opt_arg(), &temp))
  426. goto opthelp;
  427. checkoffset = (time_t)temp;
  428. if ((intmax_t)checkoffset != temp) {
  429. BIO_printf(bio_err, "%s: checkend time out of range %s\n",
  430. prog, opt_arg());
  431. goto opthelp;
  432. }
  433. }
  434. break;
  435. case OPT_CHECKHOST:
  436. checkhost = opt_arg();
  437. break;
  438. case OPT_CHECKEMAIL:
  439. checkemail = opt_arg();
  440. break;
  441. case OPT_CHECKIP:
  442. checkip = opt_arg();
  443. break;
  444. case OPT_PRESERVE_DATES:
  445. if (days != DEF_DAYS)
  446. goto opthelp;
  447. preserve_dates = 1;
  448. break;
  449. case OPT_MD:
  450. if (!opt_md(opt_unknown(), &digest))
  451. goto opthelp;
  452. }
  453. }
  454. argc = opt_num_rest();
  455. argv = opt_rest();
  456. if (argc != 0) {
  457. BIO_printf(bio_err, "%s: Unknown parameter %s\n", prog, argv[0]);
  458. goto opthelp;
  459. }
  460. if (!app_passwd(passinarg, NULL, &passin, NULL)) {
  461. BIO_printf(bio_err, "Error getting password\n");
  462. goto end;
  463. }
  464. if (!X509_STORE_set_default_paths(ctx)) {
  465. ERR_print_errors(bio_err);
  466. goto end;
  467. }
  468. if (fkeyfile != NULL) {
  469. fkey = load_pubkey(fkeyfile, keyformat, 0, NULL, e, "Forced key");
  470. if (fkey == NULL)
  471. goto end;
  472. }
  473. if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM)) {
  474. CAkeyfile = CAfile;
  475. } else if ((CA_flag) && (CAkeyfile == NULL)) {
  476. BIO_printf(bio_err,
  477. "need to specify a CAkey if using the CA command\n");
  478. goto end;
  479. }
  480. if (extfile != NULL) {
  481. X509V3_CTX ctx2;
  482. if ((extconf = app_load_config(extfile)) == NULL)
  483. goto end;
  484. if (extsect == NULL) {
  485. extsect = NCONF_get_string(extconf, "default", "extensions");
  486. if (extsect == NULL) {
  487. ERR_clear_error();
  488. extsect = "default";
  489. }
  490. }
  491. X509V3_set_ctx_test(&ctx2);
  492. X509V3_set_nconf(&ctx2, extconf);
  493. if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL)) {
  494. BIO_printf(bio_err,
  495. "Error Loading extension section %s\n", extsect);
  496. ERR_print_errors(bio_err);
  497. goto end;
  498. }
  499. }
  500. if (reqfile) {
  501. EVP_PKEY *pkey;
  502. BIO *in;
  503. if (!sign_flag && !CA_flag) {
  504. BIO_printf(bio_err, "We need a private key to sign with\n");
  505. goto end;
  506. }
  507. in = bio_open_default(infile, 'r', informat);
  508. if (in == NULL)
  509. goto end;
  510. req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
  511. BIO_free(in);
  512. if (req == NULL) {
  513. ERR_print_errors(bio_err);
  514. goto end;
  515. }
  516. if ((pkey = X509_REQ_get0_pubkey(req)) == NULL) {
  517. BIO_printf(bio_err, "error unpacking public key\n");
  518. goto end;
  519. }
  520. i = X509_REQ_verify(req, pkey);
  521. if (i < 0) {
  522. BIO_printf(bio_err, "Signature verification error\n");
  523. ERR_print_errors(bio_err);
  524. goto end;
  525. }
  526. if (i == 0) {
  527. BIO_printf(bio_err,
  528. "Signature did not match the certificate request\n");
  529. goto end;
  530. } else {
  531. BIO_printf(bio_err, "Signature ok\n");
  532. }
  533. print_name(bio_err, "subject=", X509_REQ_get_subject_name(req),
  534. get_nameopt());
  535. if ((x = X509_new()) == NULL)
  536. goto end;
  537. if (sno == NULL) {
  538. sno = ASN1_INTEGER_new();
  539. if (sno == NULL || !rand_serial(NULL, sno))
  540. goto end;
  541. if (!X509_set_serialNumber(x, sno))
  542. goto end;
  543. ASN1_INTEGER_free(sno);
  544. sno = NULL;
  545. } else if (!X509_set_serialNumber(x, sno)) {
  546. goto end;
  547. }
  548. if (!X509_set_issuer_name(x, X509_REQ_get_subject_name(req)))
  549. goto end;
  550. if (!X509_set_subject_name(x, X509_REQ_get_subject_name(req)))
  551. goto end;
  552. if (!set_cert_times(x, NULL, NULL, days))
  553. goto end;
  554. if (fkey != NULL) {
  555. X509_set_pubkey(x, fkey);
  556. } else {
  557. pkey = X509_REQ_get0_pubkey(req);
  558. X509_set_pubkey(x, pkey);
  559. }
  560. } else {
  561. x = load_cert(infile, informat, "Certificate");
  562. }
  563. if (x == NULL)
  564. goto end;
  565. if (CA_flag) {
  566. xca = load_cert(CAfile, CAformat, "CA Certificate");
  567. if (xca == NULL)
  568. goto end;
  569. }
  570. out = bio_open_default(outfile, 'w', outformat);
  571. if (out == NULL)
  572. goto end;
  573. if (!noout || text || next_serial)
  574. OBJ_create("2.99999.3", "SET.ex3", "SET x509v3 extension 3");
  575. if (alias)
  576. X509_alias_set1(x, (unsigned char *)alias, -1);
  577. if (clrtrust)
  578. X509_trust_clear(x);
  579. if (clrreject)
  580. X509_reject_clear(x);
  581. if (trust != NULL) {
  582. for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) {
  583. objtmp = sk_ASN1_OBJECT_value(trust, i);
  584. X509_add1_trust_object(x, objtmp);
  585. }
  586. objtmp = NULL;
  587. }
  588. if (reject != NULL) {
  589. for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) {
  590. objtmp = sk_ASN1_OBJECT_value(reject, i);
  591. X509_add1_reject_object(x, objtmp);
  592. }
  593. objtmp = NULL;
  594. }
  595. if (badsig) {
  596. const ASN1_BIT_STRING *signature;
  597. X509_get0_signature(&signature, NULL, x);
  598. corrupt_signature(signature);
  599. }
  600. if (num) {
  601. for (i = 1; i <= num; i++) {
  602. if (issuer == i) {
  603. print_name(out, "issuer=", X509_get_issuer_name(x), get_nameopt());
  604. } else if (subject == i) {
  605. print_name(out, "subject=",
  606. X509_get_subject_name(x), get_nameopt());
  607. } else if (serial == i) {
  608. BIO_printf(out, "serial=");
  609. i2a_ASN1_INTEGER(out, X509_get_serialNumber(x));
  610. BIO_printf(out, "\n");
  611. } else if (next_serial == i) {
  612. ASN1_INTEGER *ser = X509_get_serialNumber(x);
  613. BIGNUM *bnser = ASN1_INTEGER_to_BN(ser, NULL);
  614. if (!bnser)
  615. goto end;
  616. if (!BN_add_word(bnser, 1))
  617. goto end;
  618. ser = BN_to_ASN1_INTEGER(bnser, NULL);
  619. if (!ser)
  620. goto end;
  621. BN_free(bnser);
  622. i2a_ASN1_INTEGER(out, ser);
  623. ASN1_INTEGER_free(ser);
  624. BIO_puts(out, "\n");
  625. } else if ((email == i) || (ocsp_uri == i)) {
  626. int j;
  627. STACK_OF(OPENSSL_STRING) *emlst;
  628. if (email == i)
  629. emlst = X509_get1_email(x);
  630. else
  631. emlst = X509_get1_ocsp(x);
  632. for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
  633. BIO_printf(out, "%s\n",
  634. sk_OPENSSL_STRING_value(emlst, j));
  635. X509_email_free(emlst);
  636. } else if (aliasout == i) {
  637. unsigned char *alstr;
  638. alstr = X509_alias_get0(x, NULL);
  639. if (alstr)
  640. BIO_printf(out, "%s\n", alstr);
  641. else
  642. BIO_puts(out, "<No Alias>\n");
  643. } else if (subject_hash == i) {
  644. BIO_printf(out, "%08lx\n", X509_subject_name_hash(x));
  645. }
  646. #ifndef OPENSSL_NO_MD5
  647. else if (subject_hash_old == i) {
  648. BIO_printf(out, "%08lx\n", X509_subject_name_hash_old(x));
  649. }
  650. #endif
  651. else if (issuer_hash == i) {
  652. BIO_printf(out, "%08lx\n", X509_issuer_name_hash(x));
  653. }
  654. #ifndef OPENSSL_NO_MD5
  655. else if (issuer_hash_old == i) {
  656. BIO_printf(out, "%08lx\n", X509_issuer_name_hash_old(x));
  657. }
  658. #endif
  659. else if (pprint == i) {
  660. X509_PURPOSE *ptmp;
  661. int j;
  662. BIO_printf(out, "Certificate purposes:\n");
  663. for (j = 0; j < X509_PURPOSE_get_count(); j++) {
  664. ptmp = X509_PURPOSE_get0(j);
  665. purpose_print(out, x, ptmp);
  666. }
  667. } else if (modulus == i) {
  668. EVP_PKEY *pkey;
  669. pkey = X509_get0_pubkey(x);
  670. if (pkey == NULL) {
  671. BIO_printf(bio_err, "Modulus=unavailable\n");
  672. ERR_print_errors(bio_err);
  673. goto end;
  674. }
  675. BIO_printf(out, "Modulus=");
  676. #ifndef OPENSSL_NO_RSA
  677. if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
  678. const BIGNUM *n;
  679. RSA_get0_key(EVP_PKEY_get0_RSA(pkey), &n, NULL, NULL);
  680. BN_print(out, n);
  681. } else
  682. #endif
  683. #ifndef OPENSSL_NO_DSA
  684. if (EVP_PKEY_id(pkey) == EVP_PKEY_DSA) {
  685. const BIGNUM *dsapub = NULL;
  686. DSA_get0_key(EVP_PKEY_get0_DSA(pkey), &dsapub, NULL);
  687. BN_print(out, dsapub);
  688. } else
  689. #endif
  690. {
  691. BIO_printf(out, "Wrong Algorithm type");
  692. }
  693. BIO_printf(out, "\n");
  694. } else if (pubkey == i) {
  695. EVP_PKEY *pkey;
  696. pkey = X509_get0_pubkey(x);
  697. if (pkey == NULL) {
  698. BIO_printf(bio_err, "Error getting public key\n");
  699. ERR_print_errors(bio_err);
  700. goto end;
  701. }
  702. PEM_write_bio_PUBKEY(out, pkey);
  703. } else if (C == i) {
  704. unsigned char *d;
  705. char *m;
  706. int len;
  707. print_name(out, "/*\n"
  708. " * Subject: ", X509_get_subject_name(x), get_nameopt());
  709. print_name(out, " * Issuer: ", X509_get_issuer_name(x), get_nameopt());
  710. BIO_puts(out, " */\n");
  711. len = i2d_X509(x, NULL);
  712. m = app_malloc(len, "x509 name buffer");
  713. d = (unsigned char *)m;
  714. len = i2d_X509_NAME(X509_get_subject_name(x), &d);
  715. print_array(out, "the_subject_name", len, (unsigned char *)m);
  716. d = (unsigned char *)m;
  717. len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x), &d);
  718. print_array(out, "the_public_key", len, (unsigned char *)m);
  719. d = (unsigned char *)m;
  720. len = i2d_X509(x, &d);
  721. print_array(out, "the_certificate", len, (unsigned char *)m);
  722. OPENSSL_free(m);
  723. } else if (text == i) {
  724. X509_print_ex(out, x, get_nameopt(), certflag);
  725. } else if (startdate == i) {
  726. BIO_puts(out, "notBefore=");
  727. ASN1_TIME_print(out, X509_get0_notBefore(x));
  728. BIO_puts(out, "\n");
  729. } else if (enddate == i) {
  730. BIO_puts(out, "notAfter=");
  731. ASN1_TIME_print(out, X509_get0_notAfter(x));
  732. BIO_puts(out, "\n");
  733. } else if (fingerprint == i) {
  734. int j;
  735. unsigned int n;
  736. unsigned char md[EVP_MAX_MD_SIZE];
  737. const EVP_MD *fdig = digest;
  738. if (fdig == NULL)
  739. fdig = EVP_sha1();
  740. if (!X509_digest(x, fdig, md, &n)) {
  741. BIO_printf(bio_err, "out of memory\n");
  742. goto end;
  743. }
  744. BIO_printf(out, "%s Fingerprint=",
  745. OBJ_nid2sn(EVP_MD_type(fdig)));
  746. for (j = 0; j < (int)n; j++) {
  747. BIO_printf(out, "%02X%c", md[j], (j + 1 == (int)n)
  748. ? '\n' : ':');
  749. }
  750. }
  751. /* should be in the library */
  752. else if ((sign_flag == i) && (x509req == 0)) {
  753. BIO_printf(bio_err, "Getting Private key\n");
  754. if (Upkey == NULL) {
  755. Upkey = load_key(keyfile, keyformat, 0,
  756. passin, e, "Private key");
  757. if (Upkey == NULL)
  758. goto end;
  759. }
  760. if (!sign(x, Upkey, days, clrext, digest, extconf, extsect, preserve_dates))
  761. goto end;
  762. } else if (CA_flag == i) {
  763. BIO_printf(bio_err, "Getting CA Private Key\n");
  764. if (CAkeyfile != NULL) {
  765. CApkey = load_key(CAkeyfile, CAkeyformat,
  766. 0, passin, e, "CA Private Key");
  767. if (CApkey == NULL)
  768. goto end;
  769. }
  770. if (!x509_certify(ctx, CAfile, digest, x, xca,
  771. CApkey, sigopts,
  772. CAserial, CA_createserial, days, clrext,
  773. extconf, extsect, sno, reqfile, preserve_dates))
  774. goto end;
  775. } else if (x509req == i) {
  776. EVP_PKEY *pk;
  777. BIO_printf(bio_err, "Getting request Private Key\n");
  778. if (keyfile == NULL) {
  779. BIO_printf(bio_err, "no request key file specified\n");
  780. goto end;
  781. } else {
  782. pk = load_key(keyfile, keyformat, 0,
  783. passin, e, "request key");
  784. if (pk == NULL)
  785. goto end;
  786. }
  787. BIO_printf(bio_err, "Generating certificate request\n");
  788. rq = X509_to_X509_REQ(x, pk, digest);
  789. EVP_PKEY_free(pk);
  790. if (rq == NULL) {
  791. ERR_print_errors(bio_err);
  792. goto end;
  793. }
  794. if (!noout) {
  795. X509_REQ_print_ex(out, rq, get_nameopt(), X509_FLAG_COMPAT);
  796. PEM_write_bio_X509_REQ(out, rq);
  797. }
  798. noout = 1;
  799. } else if (ocspid == i) {
  800. X509_ocspid_print(out, x);
  801. } else if (ext == i) {
  802. print_x509v3_exts(out, x, exts);
  803. }
  804. }
  805. }
  806. if (checkend) {
  807. time_t tcheck = time(NULL) + checkoffset;
  808. if (X509_cmp_time(X509_get0_notAfter(x), &tcheck) < 0) {
  809. BIO_printf(out, "Certificate will expire\n");
  810. ret = 1;
  811. } else {
  812. BIO_printf(out, "Certificate will not expire\n");
  813. ret = 0;
  814. }
  815. goto end;
  816. }
  817. print_cert_checks(out, x, checkhost, checkemail, checkip);
  818. if (noout || nocert) {
  819. ret = 0;
  820. goto end;
  821. }
  822. if (outformat == FORMAT_ASN1) {
  823. i = i2d_X509_bio(out, x);
  824. } else if (outformat == FORMAT_PEM) {
  825. if (trustout)
  826. i = PEM_write_bio_X509_AUX(out, x);
  827. else
  828. i = PEM_write_bio_X509(out, x);
  829. } else {
  830. BIO_printf(bio_err, "bad output format specified for outfile\n");
  831. goto end;
  832. }
  833. if (!i) {
  834. BIO_printf(bio_err, "unable to write certificate\n");
  835. ERR_print_errors(bio_err);
  836. goto end;
  837. }
  838. ret = 0;
  839. end:
  840. NCONF_free(extconf);
  841. BIO_free_all(out);
  842. X509_STORE_free(ctx);
  843. X509_REQ_free(req);
  844. X509_free(x);
  845. X509_free(xca);
  846. EVP_PKEY_free(Upkey);
  847. EVP_PKEY_free(CApkey);
  848. EVP_PKEY_free(fkey);
  849. sk_OPENSSL_STRING_free(sigopts);
  850. X509_REQ_free(rq);
  851. ASN1_INTEGER_free(sno);
  852. sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
  853. sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
  854. ASN1_OBJECT_free(objtmp);
  855. release_engine(e);
  856. OPENSSL_free(passin);
  857. return ret;
  858. }
  859. static ASN1_INTEGER *x509_load_serial(const char *CAfile,
  860. const char *serialfile, int create)
  861. {
  862. char *buf = NULL;
  863. ASN1_INTEGER *bs = NULL;
  864. BIGNUM *serial = NULL;
  865. if (serialfile == NULL) {
  866. const char *p = strchr(CAfile, '.');
  867. size_t len = p != NULL ? (size_t)(p - CAfile) : strlen(CAfile);
  868. buf = app_malloc(len + sizeof(POSTFIX), "serial# buffer");
  869. memcpy(buf, CAfile, len);
  870. memcpy(buf + len, POSTFIX, sizeof(POSTFIX));
  871. serialfile = buf;
  872. }
  873. serial = load_serial(serialfile, create, NULL);
  874. if (serial == NULL)
  875. goto end;
  876. if (!BN_add_word(serial, 1)) {
  877. BIO_printf(bio_err, "add_word failure\n");
  878. goto end;
  879. }
  880. if (!save_serial(serialfile, NULL, serial, &bs))
  881. goto end;
  882. end:
  883. OPENSSL_free(buf);
  884. BN_free(serial);
  885. return bs;
  886. }
  887. static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *digest,
  888. X509 *x, X509 *xca, EVP_PKEY *pkey,
  889. STACK_OF(OPENSSL_STRING) *sigopts,
  890. const char *serialfile, int create,
  891. int days, int clrext, CONF *conf, const char *section,
  892. ASN1_INTEGER *sno, int reqfile, int preserve_dates)
  893. {
  894. int ret = 0;
  895. ASN1_INTEGER *bs = NULL;
  896. X509_STORE_CTX *xsc = NULL;
  897. EVP_PKEY *upkey;
  898. upkey = X509_get0_pubkey(xca);
  899. if (upkey == NULL) {
  900. BIO_printf(bio_err, "Error obtaining CA X509 public key\n");
  901. goto end;
  902. }
  903. EVP_PKEY_copy_parameters(upkey, pkey);
  904. xsc = X509_STORE_CTX_new();
  905. if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, x, NULL)) {
  906. BIO_printf(bio_err, "Error initialising X509 store\n");
  907. goto end;
  908. }
  909. if (sno)
  910. bs = sno;
  911. else if ((bs = x509_load_serial(CAfile, serialfile, create)) == NULL)
  912. goto end;
  913. /*
  914. * NOTE: this certificate can/should be self signed, unless it was a
  915. * certificate request in which case it is not.
  916. */
  917. X509_STORE_CTX_set_cert(xsc, x);
  918. X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);
  919. if (!reqfile && X509_verify_cert(xsc) <= 0)
  920. goto end;
  921. if (!X509_check_private_key(xca, pkey)) {
  922. BIO_printf(bio_err,
  923. "CA certificate and CA private key do not match\n");
  924. goto end;
  925. }
  926. if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
  927. goto end;
  928. if (!X509_set_serialNumber(x, bs))
  929. goto end;
  930. if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))
  931. goto end;
  932. if (clrext) {
  933. while (X509_get_ext_count(x) > 0)
  934. X509_delete_ext(x, 0);
  935. }
  936. if (conf != NULL) {
  937. X509V3_CTX ctx2;
  938. X509_set_version(x, 2); /* version 3 certificate */
  939. X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
  940. X509V3_set_nconf(&ctx2, conf);
  941. if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x))
  942. goto end;
  943. }
  944. if (!do_X509_sign(x, pkey, digest, sigopts))
  945. goto end;
  946. ret = 1;
  947. end:
  948. X509_STORE_CTX_free(xsc);
  949. if (!ret)
  950. ERR_print_errors(bio_err);
  951. if (!sno)
  952. ASN1_INTEGER_free(bs);
  953. return ret;
  954. }
  955. static int callb(int ok, X509_STORE_CTX *ctx)
  956. {
  957. int err;
  958. X509 *err_cert;
  959. /*
  960. * it is ok to use a self signed certificate This case will catch both
  961. * the initial ok == 0 and the final ok == 1 calls to this function
  962. */
  963. err = X509_STORE_CTX_get_error(ctx);
  964. if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
  965. return 1;
  966. /*
  967. * BAD we should have gotten an error. Normally if everything worked
  968. * X509_STORE_CTX_get_error(ctx) will still be set to
  969. * DEPTH_ZERO_SELF_....
  970. */
  971. if (ok) {
  972. BIO_printf(bio_err,
  973. "error with certificate to be certified - should be self signed\n");
  974. return 0;
  975. } else {
  976. err_cert = X509_STORE_CTX_get_current_cert(ctx);
  977. print_name(bio_err, NULL, X509_get_subject_name(err_cert), 0);
  978. BIO_printf(bio_err,
  979. "error with certificate - error %d at depth %d\n%s\n", err,
  980. X509_STORE_CTX_get_error_depth(ctx),
  981. X509_verify_cert_error_string(err));
  982. return 1;
  983. }
  984. }
  985. /* self sign */
  986. static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext,
  987. const EVP_MD *digest, CONF *conf, const char *section,
  988. int preserve_dates)
  989. {
  990. if (!X509_set_issuer_name(x, X509_get_subject_name(x)))
  991. goto err;
  992. if (!preserve_dates && !set_cert_times(x, NULL, NULL, days))
  993. goto err;
  994. if (!X509_set_pubkey(x, pkey))
  995. goto err;
  996. if (clrext) {
  997. while (X509_get_ext_count(x) > 0)
  998. X509_delete_ext(x, 0);
  999. }
  1000. if (conf != NULL) {
  1001. X509V3_CTX ctx;
  1002. X509_set_version(x, 2); /* version 3 certificate */
  1003. X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);
  1004. X509V3_set_nconf(&ctx, conf);
  1005. if (!X509V3_EXT_add_nconf(conf, &ctx, section, x))
  1006. goto err;
  1007. }
  1008. if (!X509_sign(x, pkey, digest))
  1009. goto err;
  1010. return 1;
  1011. err:
  1012. ERR_print_errors(bio_err);
  1013. return 0;
  1014. }
  1015. static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
  1016. {
  1017. int id, i, idret;
  1018. const char *pname;
  1019. id = X509_PURPOSE_get_id(pt);
  1020. pname = X509_PURPOSE_get0_name(pt);
  1021. for (i = 0; i < 2; i++) {
  1022. idret = X509_check_purpose(cert, id, i);
  1023. BIO_printf(bio, "%s%s : ", pname, i ? " CA" : "");
  1024. if (idret == 1)
  1025. BIO_printf(bio, "Yes\n");
  1026. else if (idret == 0)
  1027. BIO_printf(bio, "No\n");
  1028. else
  1029. BIO_printf(bio, "Yes (WARNING code=%d)\n", idret);
  1030. }
  1031. return 1;
  1032. }
  1033. static int parse_ext_names(char *names, const char **result)
  1034. {
  1035. char *p, *q;
  1036. int cnt = 0, len = 0;
  1037. p = q = names;
  1038. len = strlen(names);
  1039. while (q - names <= len) {
  1040. if (*q != ',' && *q != '\0') {
  1041. q++;
  1042. continue;
  1043. }
  1044. if (p != q) {
  1045. /* found */
  1046. if (result != NULL) {
  1047. result[cnt] = p;
  1048. *q = '\0';
  1049. }
  1050. cnt++;
  1051. }
  1052. p = ++q;
  1053. }
  1054. return cnt;
  1055. }
  1056. static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names)
  1057. {
  1058. const STACK_OF(X509_EXTENSION) *exts = NULL;
  1059. STACK_OF(X509_EXTENSION) *exts2 = NULL;
  1060. X509_EXTENSION *ext = NULL;
  1061. ASN1_OBJECT *obj;
  1062. int i, j, ret = 0, num, nn = 0;
  1063. const char *sn, **names = NULL;
  1064. char *tmp_ext_names = NULL;
  1065. exts = X509_get0_extensions(x);
  1066. if ((num = sk_X509_EXTENSION_num(exts)) <= 0) {
  1067. BIO_printf(bio, "No extensions in certificate\n");
  1068. ret = 1;
  1069. goto end;
  1070. }
  1071. /* parse comma separated ext name string */
  1072. if ((tmp_ext_names = OPENSSL_strdup(ext_names)) == NULL)
  1073. goto end;
  1074. if ((nn = parse_ext_names(tmp_ext_names, NULL)) == 0) {
  1075. BIO_printf(bio, "Invalid extension names: %s\n", ext_names);
  1076. goto end;
  1077. }
  1078. if ((names = OPENSSL_malloc(sizeof(char *) * nn)) == NULL)
  1079. goto end;
  1080. parse_ext_names(tmp_ext_names, names);
  1081. for (i = 0; i < num; i++) {
  1082. ext = sk_X509_EXTENSION_value(exts, i);
  1083. /* check if this ext is what we want */
  1084. obj = X509_EXTENSION_get_object(ext);
  1085. sn = OBJ_nid2sn(OBJ_obj2nid(obj));
  1086. if (sn == NULL || strcmp(sn, "UNDEF") == 0)
  1087. continue;
  1088. for (j = 0; j < nn; j++) {
  1089. if (strcmp(sn, names[j]) == 0) {
  1090. /* push the extension into a new stack */
  1091. if (exts2 == NULL
  1092. && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
  1093. goto end;
  1094. if (!sk_X509_EXTENSION_push(exts2, ext))
  1095. goto end;
  1096. }
  1097. }
  1098. }
  1099. if (!sk_X509_EXTENSION_num(exts2)) {
  1100. BIO_printf(bio, "No extensions matched with %s\n", ext_names);
  1101. ret = 1;
  1102. goto end;
  1103. }
  1104. ret = X509V3_extensions_print(bio, NULL, exts2, 0, 0);
  1105. end:
  1106. sk_X509_EXTENSION_free(exts2);
  1107. OPENSSL_free(names);
  1108. OPENSSL_free(tmp_ext_names);
  1109. return ret;
  1110. }