ca.c 93 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918
  1. /* apps/ca.c */
  2. /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  3. * All rights reserved.
  4. *
  5. * This package is an SSL implementation written
  6. * by Eric Young (eay@cryptsoft.com).
  7. * The implementation was written so as to conform with Netscapes SSL.
  8. *
  9. * This library is free for commercial and non-commercial use as long as
  10. * the following conditions are aheared to. The following conditions
  11. * apply to all code found in this distribution, be it the RC4, RSA,
  12. * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  13. * included with this distribution is covered by the same copyright terms
  14. * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15. *
  16. * Copyright remains Eric Young's, and as such any Copyright notices in
  17. * the code are not to be removed.
  18. * If this package is used in a product, Eric Young should be given attribution
  19. * as the author of the parts of the library used.
  20. * This can be in the form of a textual message at program startup or
  21. * in documentation (online or textual) provided with the package.
  22. *
  23. * Redistribution and use in source and binary forms, with or without
  24. * modification, are permitted provided that the following conditions
  25. * are met:
  26. * 1. Redistributions of source code must retain the copyright
  27. * notice, this list of conditions and the following disclaimer.
  28. * 2. Redistributions in binary form must reproduce the above copyright
  29. * notice, this list of conditions and the following disclaimer in the
  30. * documentation and/or other materials provided with the distribution.
  31. * 3. All advertising materials mentioning features or use of this software
  32. * must display the following acknowledgement:
  33. * "This product includes cryptographic software written by
  34. * Eric Young (eay@cryptsoft.com)"
  35. * The word 'cryptographic' can be left out if the rouines from the library
  36. * being used are not cryptographic related :-).
  37. * 4. If you include any Windows specific code (or a derivative thereof) from
  38. * the apps directory (application code) you must include an acknowledgement:
  39. * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40. *
  41. * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51. * SUCH DAMAGE.
  52. *
  53. * The licence and distribution terms for any publically available version or
  54. * derivative of this code cannot be changed. i.e. this code cannot simply be
  55. * copied and put under another distribution licence
  56. * [including the GNU Public Licence.]
  57. */
  58. /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  59. #include <stdio.h>
  60. #include <stdlib.h>
  61. #include <string.h>
  62. #include <ctype.h>
  63. #include <sys/types.h>
  64. #include <openssl/conf.h>
  65. #include <openssl/bio.h>
  66. #include <openssl/err.h>
  67. #include <openssl/bn.h>
  68. #include <openssl/txt_db.h>
  69. #include <openssl/evp.h>
  70. #include <openssl/x509.h>
  71. #include <openssl/x509v3.h>
  72. #include <openssl/objects.h>
  73. #include <openssl/ocsp.h>
  74. #include <openssl/pem.h>
  75. #ifndef W_OK
  76. # ifdef OPENSSL_SYS_VMS
  77. # if defined(__DECC)
  78. # include <unistd.h>
  79. # else
  80. # include <unixlib.h>
  81. # endif
  82. # elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
  83. # include <sys/file.h>
  84. # endif
  85. #endif
  86. #include "apps.h"
  87. #ifndef W_OK
  88. # define F_OK 0
  89. # define X_OK 1
  90. # define W_OK 2
  91. # define R_OK 4
  92. #endif
  93. #undef PROG
  94. #define PROG ca_main
  95. #define BASE_SECTION "ca"
  96. #define CONFIG_FILE "openssl.cnf"
  97. #define ENV_DEFAULT_CA "default_ca"
  98. #define STRING_MASK "string_mask"
  99. #define UTF8_IN "utf8"
  100. #define ENV_NEW_CERTS_DIR "new_certs_dir"
  101. #define ENV_CERTIFICATE "certificate"
  102. #define ENV_SERIAL "serial"
  103. #define ENV_CRLNUMBER "crlnumber"
  104. #define ENV_PRIVATE_KEY "private_key"
  105. #define ENV_DEFAULT_DAYS "default_days"
  106. #define ENV_DEFAULT_STARTDATE "default_startdate"
  107. #define ENV_DEFAULT_ENDDATE "default_enddate"
  108. #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
  109. #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
  110. #define ENV_DEFAULT_MD "default_md"
  111. #define ENV_DEFAULT_EMAIL_DN "email_in_dn"
  112. #define ENV_PRESERVE "preserve"
  113. #define ENV_POLICY "policy"
  114. #define ENV_EXTENSIONS "x509_extensions"
  115. #define ENV_CRLEXT "crl_extensions"
  116. #define ENV_MSIE_HACK "msie_hack"
  117. #define ENV_NAMEOPT "name_opt"
  118. #define ENV_CERTOPT "cert_opt"
  119. #define ENV_EXTCOPY "copy_extensions"
  120. #define ENV_UNIQUE_SUBJECT "unique_subject"
  121. #define ENV_DATABASE "database"
  122. /* Additional revocation information types */
  123. #define REV_NONE 0 /* No addditional information */
  124. #define REV_CRL_REASON 1 /* Value is CRL reason code */
  125. #define REV_HOLD 2 /* Value is hold instruction */
  126. #define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
  127. #define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
  128. static const char *ca_usage[] = {
  129. "usage: ca args\n",
  130. "\n",
  131. " -verbose - Talk alot while doing things\n",
  132. " -config file - A config file\n",
  133. " -name arg - The particular CA definition to use\n",
  134. " -gencrl - Generate a new CRL\n",
  135. " -crldays days - Days is when the next CRL is due\n",
  136. " -crlhours hours - Hours is when the next CRL is due\n",
  137. " -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
  138. " -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
  139. " -days arg - number of days to certify the certificate for\n",
  140. " -md arg - md to use, one of md2, md5, sha or sha1\n",
  141. " -policy arg - The CA 'policy' to support\n",
  142. " -keyfile arg - private key file\n",
  143. " -keyform arg - private key file format (PEM or ENGINE)\n",
  144. " -key arg - key to decode the private key if it is encrypted\n",
  145. " -cert file - The CA certificate\n",
  146. " -selfsign - sign a certificate with the key associated with it\n",
  147. " -in file - The input PEM encoded certificate request(s)\n",
  148. " -out file - Where to put the output file(s)\n",
  149. " -outdir dir - Where to put output certificates\n",
  150. " -infiles .... - The last argument, requests to process\n",
  151. " -spkac file - File contains DN and signed public key and challenge\n",
  152. " -ss_cert file - File contains a self signed cert to sign\n",
  153. " -preserveDN - Don't re-order the DN\n",
  154. " -noemailDN - Don't add the EMAIL field into certificate' subject\n",
  155. " -batch - Don't ask questions\n",
  156. " -msie_hack - msie modifications to handle all those universal strings\n",
  157. " -revoke file - Revoke a certificate (given in file)\n",
  158. " -subj arg - Use arg instead of request's subject\n",
  159. " -utf8 - input characters are UTF8 (default ASCII)\n",
  160. " -multivalue-rdn - enable support for multivalued RDNs\n",
  161. " -extensions .. - Extension section (override value in config file)\n",
  162. " -extfile file - Configuration file with X509v3 extentions to add\n",
  163. " -crlexts .. - CRL extension section (override value in config file)\n",
  164. #ifndef OPENSSL_NO_ENGINE
  165. " -engine e - use engine e, possibly a hardware device.\n",
  166. #endif
  167. " -status serial - Shows certificate status given the serial number\n",
  168. " -updatedb - Updates db for expired certificates\n",
  169. NULL
  170. };
  171. #ifdef EFENCE
  172. extern int EF_PROTECT_FREE;
  173. extern int EF_PROTECT_BELOW;
  174. extern int EF_ALIGNMENT;
  175. #endif
  176. static void lookup_fail(const char *name, const char *tag);
  177. static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  178. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  179. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  180. BIGNUM *serial, char *subj, unsigned long chtype,
  181. int multirdn, int email_dn, char *startdate, char *enddate,
  182. long days, int batch, char *ext_sect, CONF *conf,
  183. int verbose, unsigned long certopt, unsigned long nameopt,
  184. int default_op, int ext_copy, int selfsign);
  185. static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  186. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  187. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  188. BIGNUM *serial, char *subj, unsigned long chtype,
  189. int multirdn, int email_dn, char *startdate,
  190. char *enddate, long days, int batch, char *ext_sect,
  191. CONF *conf, int verbose, unsigned long certopt,
  192. unsigned long nameopt, int default_op, int ext_copy,
  193. ENGINE *e);
  194. static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
  195. X509 *x509, const EVP_MD *dgst,
  196. STACK_OF(OPENSSL_STRING) *sigopts,
  197. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  198. BIGNUM *serial, char *subj, unsigned long chtype,
  199. int multirdn, int email_dn, char *startdate,
  200. char *enddate, long days, char *ext_sect, CONF *conf,
  201. int verbose, unsigned long certopt,
  202. unsigned long nameopt, int default_op, int ext_copy);
  203. static void write_new_certificate(BIO *bp, X509 *x, int output_der,
  204. int notext);
  205. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
  206. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  207. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
  208. char *subj, unsigned long chtype, int multirdn,
  209. int email_dn, char *startdate, char *enddate, long days,
  210. int batch, int verbose, X509_REQ *req, char *ext_sect,
  211. CONF *conf, unsigned long certopt, unsigned long nameopt,
  212. int default_op, int ext_copy, int selfsign);
  213. static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
  214. static int get_certificate_status(const char *ser_status, CA_DB *db);
  215. static int do_updatedb(CA_DB *db);
  216. static int check_time_format(const char *str);
  217. char *make_revocation_str(int rev_type, char *rev_arg);
  218. int make_revoked(X509_REVOKED *rev, const char *str);
  219. int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
  220. static CONF *conf = NULL;
  221. static CONF *extconf = NULL;
  222. static char *section = NULL;
  223. static int preserve = 0;
  224. static int msie_hack = 0;
  225. int MAIN(int, char **);
  226. int MAIN(int argc, char **argv)
  227. {
  228. ENGINE *e = NULL;
  229. char *key = NULL, *passargin = NULL;
  230. int create_ser = 0;
  231. int free_key = 0;
  232. int total = 0;
  233. int total_done = 0;
  234. int badops = 0;
  235. int ret = 1;
  236. int email_dn = 1;
  237. int req = 0;
  238. int verbose = 0;
  239. int gencrl = 0;
  240. int dorevoke = 0;
  241. int doupdatedb = 0;
  242. long crldays = 0;
  243. long crlhours = 0;
  244. long crlsec = 0;
  245. long errorline = -1;
  246. char *configfile = NULL;
  247. char *md = NULL;
  248. char *policy = NULL;
  249. char *keyfile = NULL;
  250. char *certfile = NULL;
  251. int keyform = FORMAT_PEM;
  252. char *infile = NULL;
  253. char *spkac_file = NULL;
  254. char *ss_cert_file = NULL;
  255. char *ser_status = NULL;
  256. EVP_PKEY *pkey = NULL;
  257. int output_der = 0;
  258. char *outfile = NULL;
  259. char *outdir = NULL;
  260. char *serialfile = NULL;
  261. char *crlnumberfile = NULL;
  262. char *extensions = NULL;
  263. char *extfile = NULL;
  264. char *subj = NULL;
  265. unsigned long chtype = MBSTRING_ASC;
  266. int multirdn = 0;
  267. char *tmp_email_dn = NULL;
  268. char *crl_ext = NULL;
  269. int rev_type = REV_NONE;
  270. char *rev_arg = NULL;
  271. BIGNUM *serial = NULL;
  272. BIGNUM *crlnumber = NULL;
  273. char *startdate = NULL;
  274. char *enddate = NULL;
  275. long days = 0;
  276. int batch = 0;
  277. int notext = 0;
  278. unsigned long nameopt = 0, certopt = 0;
  279. int default_op = 1;
  280. int ext_copy = EXT_COPY_NONE;
  281. int selfsign = 0;
  282. X509 *x509 = NULL, *x509p = NULL;
  283. X509 *x = NULL;
  284. BIO *in = NULL, *out = NULL, *Sout = NULL, *Cout = NULL;
  285. char *dbfile = NULL;
  286. CA_DB *db = NULL;
  287. X509_CRL *crl = NULL;
  288. X509_REVOKED *r = NULL;
  289. ASN1_TIME *tmptm;
  290. ASN1_INTEGER *tmpser;
  291. char *f;
  292. const char *p;
  293. char *const *pp;
  294. int i, j;
  295. const EVP_MD *dgst = NULL;
  296. STACK_OF(CONF_VALUE) *attribs = NULL;
  297. STACK_OF(X509) *cert_sk = NULL;
  298. STACK_OF(OPENSSL_STRING) *sigopts = NULL;
  299. #undef BSIZE
  300. #define BSIZE 256
  301. MS_STATIC char buf[3][BSIZE];
  302. char *randfile = NULL;
  303. char *engine = NULL;
  304. char *tofree = NULL;
  305. DB_ATTR db_attr;
  306. #ifdef EFENCE
  307. EF_PROTECT_FREE = 1;
  308. EF_PROTECT_BELOW = 1;
  309. EF_ALIGNMENT = 0;
  310. #endif
  311. apps_startup();
  312. conf = NULL;
  313. key = NULL;
  314. section = NULL;
  315. preserve = 0;
  316. msie_hack = 0;
  317. if (bio_err == NULL)
  318. if ((bio_err = BIO_new(BIO_s_file())) != NULL)
  319. BIO_set_fp(bio_err, stderr, BIO_NOCLOSE | BIO_FP_TEXT);
  320. argc--;
  321. argv++;
  322. while (argc >= 1) {
  323. if (strcmp(*argv, "-verbose") == 0)
  324. verbose = 1;
  325. else if (strcmp(*argv, "-config") == 0) {
  326. if (--argc < 1)
  327. goto bad;
  328. configfile = *(++argv);
  329. } else if (strcmp(*argv, "-name") == 0) {
  330. if (--argc < 1)
  331. goto bad;
  332. section = *(++argv);
  333. } else if (strcmp(*argv, "-subj") == 0) {
  334. if (--argc < 1)
  335. goto bad;
  336. subj = *(++argv);
  337. /* preserve=1; */
  338. } else if (strcmp(*argv, "-utf8") == 0)
  339. chtype = MBSTRING_UTF8;
  340. else if (strcmp(*argv, "-create_serial") == 0)
  341. create_ser = 1;
  342. else if (strcmp(*argv, "-multivalue-rdn") == 0)
  343. multirdn = 1;
  344. else if (strcmp(*argv, "-startdate") == 0) {
  345. if (--argc < 1)
  346. goto bad;
  347. startdate = *(++argv);
  348. } else if (strcmp(*argv, "-enddate") == 0) {
  349. if (--argc < 1)
  350. goto bad;
  351. enddate = *(++argv);
  352. } else if (strcmp(*argv, "-days") == 0) {
  353. if (--argc < 1)
  354. goto bad;
  355. days = atoi(*(++argv));
  356. } else if (strcmp(*argv, "-md") == 0) {
  357. if (--argc < 1)
  358. goto bad;
  359. md = *(++argv);
  360. } else if (strcmp(*argv, "-policy") == 0) {
  361. if (--argc < 1)
  362. goto bad;
  363. policy = *(++argv);
  364. } else if (strcmp(*argv, "-keyfile") == 0) {
  365. if (--argc < 1)
  366. goto bad;
  367. keyfile = *(++argv);
  368. } else if (strcmp(*argv, "-keyform") == 0) {
  369. if (--argc < 1)
  370. goto bad;
  371. keyform = str2fmt(*(++argv));
  372. } else if (strcmp(*argv, "-passin") == 0) {
  373. if (--argc < 1)
  374. goto bad;
  375. passargin = *(++argv);
  376. } else if (strcmp(*argv, "-key") == 0) {
  377. if (--argc < 1)
  378. goto bad;
  379. key = *(++argv);
  380. } else if (strcmp(*argv, "-cert") == 0) {
  381. if (--argc < 1)
  382. goto bad;
  383. certfile = *(++argv);
  384. } else if (strcmp(*argv, "-selfsign") == 0)
  385. selfsign = 1;
  386. else if (strcmp(*argv, "-in") == 0) {
  387. if (--argc < 1)
  388. goto bad;
  389. infile = *(++argv);
  390. req = 1;
  391. } else if (strcmp(*argv, "-out") == 0) {
  392. if (--argc < 1)
  393. goto bad;
  394. outfile = *(++argv);
  395. } else if (strcmp(*argv, "-outdir") == 0) {
  396. if (--argc < 1)
  397. goto bad;
  398. outdir = *(++argv);
  399. } else if (strcmp(*argv, "-sigopt") == 0) {
  400. if (--argc < 1)
  401. goto bad;
  402. if (!sigopts)
  403. sigopts = sk_OPENSSL_STRING_new_null();
  404. if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
  405. goto bad;
  406. } else if (strcmp(*argv, "-notext") == 0)
  407. notext = 1;
  408. else if (strcmp(*argv, "-batch") == 0)
  409. batch = 1;
  410. else if (strcmp(*argv, "-preserveDN") == 0)
  411. preserve = 1;
  412. else if (strcmp(*argv, "-noemailDN") == 0)
  413. email_dn = 0;
  414. else if (strcmp(*argv, "-gencrl") == 0)
  415. gencrl = 1;
  416. else if (strcmp(*argv, "-msie_hack") == 0)
  417. msie_hack = 1;
  418. else if (strcmp(*argv, "-crldays") == 0) {
  419. if (--argc < 1)
  420. goto bad;
  421. crldays = atol(*(++argv));
  422. } else if (strcmp(*argv, "-crlhours") == 0) {
  423. if (--argc < 1)
  424. goto bad;
  425. crlhours = atol(*(++argv));
  426. } else if (strcmp(*argv, "-crlsec") == 0) {
  427. if (--argc < 1)
  428. goto bad;
  429. crlsec = atol(*(++argv));
  430. } else if (strcmp(*argv, "-infiles") == 0) {
  431. argc--;
  432. argv++;
  433. req = 1;
  434. break;
  435. } else if (strcmp(*argv, "-ss_cert") == 0) {
  436. if (--argc < 1)
  437. goto bad;
  438. ss_cert_file = *(++argv);
  439. req = 1;
  440. } else if (strcmp(*argv, "-spkac") == 0) {
  441. if (--argc < 1)
  442. goto bad;
  443. spkac_file = *(++argv);
  444. req = 1;
  445. } else if (strcmp(*argv, "-revoke") == 0) {
  446. if (--argc < 1)
  447. goto bad;
  448. infile = *(++argv);
  449. dorevoke = 1;
  450. } else if (strcmp(*argv, "-valid") == 0) {
  451. if (--argc < 1)
  452. goto bad;
  453. infile = *(++argv);
  454. dorevoke = 2;
  455. } else if (strcmp(*argv, "-extensions") == 0) {
  456. if (--argc < 1)
  457. goto bad;
  458. extensions = *(++argv);
  459. } else if (strcmp(*argv, "-extfile") == 0) {
  460. if (--argc < 1)
  461. goto bad;
  462. extfile = *(++argv);
  463. } else if (strcmp(*argv, "-status") == 0) {
  464. if (--argc < 1)
  465. goto bad;
  466. ser_status = *(++argv);
  467. } else if (strcmp(*argv, "-updatedb") == 0) {
  468. doupdatedb = 1;
  469. } else if (strcmp(*argv, "-crlexts") == 0) {
  470. if (--argc < 1)
  471. goto bad;
  472. crl_ext = *(++argv);
  473. } else if (strcmp(*argv, "-crl_reason") == 0) {
  474. if (--argc < 1)
  475. goto bad;
  476. rev_arg = *(++argv);
  477. rev_type = REV_CRL_REASON;
  478. } else if (strcmp(*argv, "-crl_hold") == 0) {
  479. if (--argc < 1)
  480. goto bad;
  481. rev_arg = *(++argv);
  482. rev_type = REV_HOLD;
  483. } else if (strcmp(*argv, "-crl_compromise") == 0) {
  484. if (--argc < 1)
  485. goto bad;
  486. rev_arg = *(++argv);
  487. rev_type = REV_KEY_COMPROMISE;
  488. } else if (strcmp(*argv, "-crl_CA_compromise") == 0) {
  489. if (--argc < 1)
  490. goto bad;
  491. rev_arg = *(++argv);
  492. rev_type = REV_CA_COMPROMISE;
  493. }
  494. #ifndef OPENSSL_NO_ENGINE
  495. else if (strcmp(*argv, "-engine") == 0) {
  496. if (--argc < 1)
  497. goto bad;
  498. engine = *(++argv);
  499. }
  500. #endif
  501. else {
  502. bad:
  503. BIO_printf(bio_err, "unknown option %s\n", *argv);
  504. badops = 1;
  505. break;
  506. }
  507. argc--;
  508. argv++;
  509. }
  510. if (badops) {
  511. const char **pp2;
  512. for (pp2 = ca_usage; (*pp2 != NULL); pp2++)
  513. BIO_printf(bio_err, "%s", *pp2);
  514. goto err;
  515. }
  516. ERR_load_crypto_strings();
  517. /*****************************************************************/
  518. tofree = NULL;
  519. if (configfile == NULL)
  520. configfile = getenv("OPENSSL_CONF");
  521. if (configfile == NULL)
  522. configfile = getenv("SSLEAY_CONF");
  523. if (configfile == NULL) {
  524. const char *s = X509_get_default_cert_area();
  525. size_t len;
  526. #ifdef OPENSSL_SYS_VMS
  527. len = strlen(s) + sizeof(CONFIG_FILE);
  528. tofree = OPENSSL_malloc(len);
  529. if (!tofree) {
  530. BIO_printf(bio_err, "Out of memory\n");
  531. goto err;
  532. }
  533. strcpy(tofree, s);
  534. #else
  535. len = strlen(s) + sizeof(CONFIG_FILE) + 1;
  536. tofree = OPENSSL_malloc(len);
  537. if (!tofree) {
  538. BIO_printf(bio_err, "Out of memory\n");
  539. goto err;
  540. }
  541. BUF_strlcpy(tofree, s, len);
  542. BUF_strlcat(tofree, "/", len);
  543. #endif
  544. BUF_strlcat(tofree, CONFIG_FILE, len);
  545. configfile = tofree;
  546. }
  547. BIO_printf(bio_err, "Using configuration from %s\n", configfile);
  548. conf = NCONF_new(NULL);
  549. if (NCONF_load(conf, configfile, &errorline) <= 0) {
  550. if (errorline <= 0)
  551. BIO_printf(bio_err, "error loading the config file '%s'\n",
  552. configfile);
  553. else
  554. BIO_printf(bio_err, "error on line %ld of config file '%s'\n",
  555. errorline, configfile);
  556. goto err;
  557. }
  558. if (tofree) {
  559. OPENSSL_free(tofree);
  560. tofree = NULL;
  561. }
  562. if (!load_config(bio_err, conf))
  563. goto err;
  564. e = setup_engine(bio_err, engine, 0);
  565. /* Lets get the config section we are using */
  566. if (section == NULL) {
  567. section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_CA);
  568. if (section == NULL) {
  569. lookup_fail(BASE_SECTION, ENV_DEFAULT_CA);
  570. goto err;
  571. }
  572. }
  573. if (conf != NULL) {
  574. p = NCONF_get_string(conf, NULL, "oid_file");
  575. if (p == NULL)
  576. ERR_clear_error();
  577. if (p != NULL) {
  578. BIO *oid_bio;
  579. oid_bio = BIO_new_file(p, "r");
  580. if (oid_bio == NULL) {
  581. /*-
  582. BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
  583. ERR_print_errors(bio_err);
  584. */
  585. ERR_clear_error();
  586. } else {
  587. OBJ_create_objects(oid_bio);
  588. BIO_free(oid_bio);
  589. }
  590. }
  591. if (!add_oid_section(bio_err, conf)) {
  592. ERR_print_errors(bio_err);
  593. goto err;
  594. }
  595. }
  596. randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
  597. if (randfile == NULL)
  598. ERR_clear_error();
  599. app_RAND_load_file(randfile, bio_err, 0);
  600. f = NCONF_get_string(conf, section, STRING_MASK);
  601. if (!f)
  602. ERR_clear_error();
  603. if (f && !ASN1_STRING_set_default_mask_asc(f)) {
  604. BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
  605. goto err;
  606. }
  607. if (chtype != MBSTRING_UTF8) {
  608. f = NCONF_get_string(conf, section, UTF8_IN);
  609. if (!f)
  610. ERR_clear_error();
  611. else if (!strcmp(f, "yes"))
  612. chtype = MBSTRING_UTF8;
  613. }
  614. db_attr.unique_subject = 1;
  615. p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
  616. if (p) {
  617. #ifdef RL_DEBUG
  618. BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
  619. #endif
  620. db_attr.unique_subject = parse_yesno(p, 1);
  621. } else
  622. ERR_clear_error();
  623. #ifdef RL_DEBUG
  624. if (!p)
  625. BIO_printf(bio_err, "DEBUG: unique_subject undefined\n");
  626. #endif
  627. #ifdef RL_DEBUG
  628. BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
  629. db_attr.unique_subject);
  630. #endif
  631. in = BIO_new(BIO_s_file());
  632. out = BIO_new(BIO_s_file());
  633. Sout = BIO_new(BIO_s_file());
  634. Cout = BIO_new(BIO_s_file());
  635. if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL)) {
  636. ERR_print_errors(bio_err);
  637. goto err;
  638. }
  639. /*****************************************************************/
  640. /* report status of cert with serial number given on command line */
  641. if (ser_status) {
  642. if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
  643. lookup_fail(section, ENV_DATABASE);
  644. goto err;
  645. }
  646. db = load_index(dbfile, &db_attr);
  647. if (db == NULL)
  648. goto err;
  649. if (!index_index(db))
  650. goto err;
  651. if (get_certificate_status(ser_status, db) != 1)
  652. BIO_printf(bio_err, "Error verifying serial %s!\n", ser_status);
  653. goto err;
  654. }
  655. /*****************************************************************/
  656. /* we definitely need a private key, so let's get it */
  657. if ((keyfile == NULL) && ((keyfile = NCONF_get_string(conf,
  658. section,
  659. ENV_PRIVATE_KEY)) ==
  660. NULL)) {
  661. lookup_fail(section, ENV_PRIVATE_KEY);
  662. goto err;
  663. }
  664. if (!key) {
  665. free_key = 1;
  666. if (!app_passwd(bio_err, passargin, NULL, &key, NULL)) {
  667. BIO_printf(bio_err, "Error getting password\n");
  668. goto err;
  669. }
  670. }
  671. pkey = load_key(bio_err, keyfile, keyform, 0, key, e, "CA private key");
  672. if (key)
  673. OPENSSL_cleanse(key, strlen(key));
  674. if (pkey == NULL) {
  675. /* load_key() has already printed an appropriate message */
  676. goto err;
  677. }
  678. /*****************************************************************/
  679. /* we need a certificate */
  680. if (!selfsign || spkac_file || ss_cert_file || gencrl) {
  681. if ((certfile == NULL)
  682. && ((certfile = NCONF_get_string(conf,
  683. section,
  684. ENV_CERTIFICATE)) == NULL)) {
  685. lookup_fail(section, ENV_CERTIFICATE);
  686. goto err;
  687. }
  688. x509 = load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
  689. "CA certificate");
  690. if (x509 == NULL)
  691. goto err;
  692. if (!X509_check_private_key(x509, pkey)) {
  693. BIO_printf(bio_err,
  694. "CA certificate and CA private key do not match\n");
  695. goto err;
  696. }
  697. }
  698. if (!selfsign)
  699. x509p = x509;
  700. f = NCONF_get_string(conf, BASE_SECTION, ENV_PRESERVE);
  701. if (f == NULL)
  702. ERR_clear_error();
  703. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  704. preserve = 1;
  705. f = NCONF_get_string(conf, BASE_SECTION, ENV_MSIE_HACK);
  706. if (f == NULL)
  707. ERR_clear_error();
  708. if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
  709. msie_hack = 1;
  710. f = NCONF_get_string(conf, section, ENV_NAMEOPT);
  711. if (f) {
  712. if (!set_name_ex(&nameopt, f)) {
  713. BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
  714. goto err;
  715. }
  716. default_op = 0;
  717. } else
  718. ERR_clear_error();
  719. f = NCONF_get_string(conf, section, ENV_CERTOPT);
  720. if (f) {
  721. if (!set_cert_ex(&certopt, f)) {
  722. BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
  723. goto err;
  724. }
  725. default_op = 0;
  726. } else
  727. ERR_clear_error();
  728. f = NCONF_get_string(conf, section, ENV_EXTCOPY);
  729. if (f) {
  730. if (!set_ext_copy(&ext_copy, f)) {
  731. BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
  732. goto err;
  733. }
  734. } else
  735. ERR_clear_error();
  736. /*****************************************************************/
  737. /* lookup where to write new certificates */
  738. if ((outdir == NULL) && (req)) {
  739. if ((outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR))
  740. == NULL) {
  741. BIO_printf(bio_err,
  742. "there needs to be defined a directory for new certificate to be placed in\n");
  743. goto err;
  744. }
  745. #ifndef OPENSSL_SYS_VMS
  746. /*
  747. * outdir is a directory spec, but access() for VMS demands a
  748. * filename. In any case, stat(), below, will catch the problem if
  749. * outdir is not a directory spec, and the fopen() or open() will
  750. * catch an error if there is no write access.
  751. *
  752. * Presumably, this problem could also be solved by using the DEC C
  753. * routines to convert the directory syntax to Unixly, and give that
  754. * to access(). However, time's too short to do that just now.
  755. */
  756. # ifndef _WIN32
  757. if (access(outdir, R_OK | W_OK | X_OK) != 0)
  758. # else
  759. if (_access(outdir, R_OK | W_OK | X_OK) != 0)
  760. # endif
  761. {
  762. BIO_printf(bio_err, "I am unable to access the %s directory\n",
  763. outdir);
  764. perror(outdir);
  765. goto err;
  766. }
  767. if (app_isdir(outdir) <= 0) {
  768. BIO_printf(bio_err, "%s need to be a directory\n", outdir);
  769. perror(outdir);
  770. goto err;
  771. }
  772. #endif
  773. }
  774. /*****************************************************************/
  775. /* we need to load the database file */
  776. if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
  777. lookup_fail(section, ENV_DATABASE);
  778. goto err;
  779. }
  780. db = load_index(dbfile, &db_attr);
  781. if (db == NULL)
  782. goto err;
  783. /* Lets check some fields */
  784. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  785. pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
  786. if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != '\0')) {
  787. BIO_printf(bio_err,
  788. "entry %d: not revoked yet, but has a revocation date\n",
  789. i + 1);
  790. goto err;
  791. }
  792. if ((pp[DB_type][0] == DB_TYPE_REV) &&
  793. !make_revoked(NULL, pp[DB_rev_date])) {
  794. BIO_printf(bio_err, " in entry %d\n", i + 1);
  795. goto err;
  796. }
  797. if (!check_time_format((char *)pp[DB_exp_date])) {
  798. BIO_printf(bio_err, "entry %d: invalid expiry date\n", i + 1);
  799. goto err;
  800. }
  801. p = pp[DB_serial];
  802. j = strlen(p);
  803. if (*p == '-') {
  804. p++;
  805. j--;
  806. }
  807. if ((j & 1) || (j < 2)) {
  808. BIO_printf(bio_err, "entry %d: bad serial number length (%d)\n",
  809. i + 1, j);
  810. goto err;
  811. }
  812. while (*p) {
  813. if (!(((*p >= '0') && (*p <= '9')) ||
  814. ((*p >= 'A') && (*p <= 'F')) ||
  815. ((*p >= 'a') && (*p <= 'f')))) {
  816. BIO_printf(bio_err,
  817. "entry %d: bad serial number characters, char pos %ld, char is '%c'\n",
  818. i + 1, (long)(p - pp[DB_serial]), *p);
  819. goto err;
  820. }
  821. p++;
  822. }
  823. }
  824. if (verbose) {
  825. BIO_set_fp(out, stdout, BIO_NOCLOSE | BIO_FP_TEXT); /* cannot fail */
  826. #ifdef OPENSSL_SYS_VMS
  827. {
  828. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  829. out = BIO_push(tmpbio, out);
  830. }
  831. #endif
  832. TXT_DB_write(out, db->db);
  833. BIO_printf(bio_err, "%d entries loaded from the database\n",
  834. sk_OPENSSL_PSTRING_num(db->db->data));
  835. BIO_printf(bio_err, "generating index\n");
  836. }
  837. if (!index_index(db))
  838. goto err;
  839. /*****************************************************************/
  840. /* Update the db file for expired certificates */
  841. if (doupdatedb) {
  842. if (verbose)
  843. BIO_printf(bio_err, "Updating %s ...\n", dbfile);
  844. i = do_updatedb(db);
  845. if (i == -1) {
  846. BIO_printf(bio_err, "Malloc failure\n");
  847. goto err;
  848. } else if (i == 0) {
  849. if (verbose)
  850. BIO_printf(bio_err, "No entries found to mark expired\n");
  851. } else {
  852. if (!save_index(dbfile, "new", db))
  853. goto err;
  854. if (!rotate_index(dbfile, "new", "old"))
  855. goto err;
  856. if (verbose)
  857. BIO_printf(bio_err,
  858. "Done. %d entries marked as expired\n", i);
  859. }
  860. }
  861. /*****************************************************************/
  862. /* Read extentions config file */
  863. if (extfile) {
  864. extconf = NCONF_new(NULL);
  865. if (NCONF_load(extconf, extfile, &errorline) <= 0) {
  866. if (errorline <= 0)
  867. BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
  868. extfile);
  869. else
  870. BIO_printf(bio_err,
  871. "ERROR: on line %ld of config file '%s'\n",
  872. errorline, extfile);
  873. ret = 1;
  874. goto err;
  875. }
  876. if (verbose)
  877. BIO_printf(bio_err, "Successfully loaded extensions file %s\n",
  878. extfile);
  879. /* We can have sections in the ext file */
  880. if (!extensions
  881. && !(extensions =
  882. NCONF_get_string(extconf, "default", "extensions")))
  883. extensions = "default";
  884. }
  885. /*****************************************************************/
  886. if (req || gencrl) {
  887. if (outfile != NULL) {
  888. if (BIO_write_filename(Sout, outfile) <= 0) {
  889. perror(outfile);
  890. goto err;
  891. }
  892. } else {
  893. BIO_set_fp(Sout, stdout, BIO_NOCLOSE | BIO_FP_TEXT);
  894. #ifdef OPENSSL_SYS_VMS
  895. {
  896. BIO *tmpbio = BIO_new(BIO_f_linebuffer());
  897. Sout = BIO_push(tmpbio, Sout);
  898. }
  899. #endif
  900. }
  901. }
  902. if ((md == NULL) && ((md = NCONF_get_string(conf,
  903. section,
  904. ENV_DEFAULT_MD)) == NULL)) {
  905. lookup_fail(section, ENV_DEFAULT_MD);
  906. goto err;
  907. }
  908. if (!strcmp(md, "default")) {
  909. int def_nid;
  910. if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
  911. BIO_puts(bio_err, "no default digest\n");
  912. goto err;
  913. }
  914. md = (char *)OBJ_nid2sn(def_nid);
  915. }
  916. if ((dgst = EVP_get_digestbyname(md)) == NULL) {
  917. BIO_printf(bio_err, "%s is an unsupported message digest type\n", md);
  918. goto err;
  919. }
  920. if (req) {
  921. if ((email_dn == 1) && ((tmp_email_dn = NCONF_get_string(conf,
  922. section,
  923. ENV_DEFAULT_EMAIL_DN))
  924. != NULL)) {
  925. if (strcmp(tmp_email_dn, "no") == 0)
  926. email_dn = 0;
  927. }
  928. if (verbose)
  929. BIO_printf(bio_err, "message digest is %s\n",
  930. OBJ_nid2ln(dgst->type));
  931. if ((policy == NULL) && ((policy = NCONF_get_string(conf,
  932. section,
  933. ENV_POLICY)) ==
  934. NULL)) {
  935. lookup_fail(section, ENV_POLICY);
  936. goto err;
  937. }
  938. if (verbose)
  939. BIO_printf(bio_err, "policy is %s\n", policy);
  940. if ((serialfile = NCONF_get_string(conf, section, ENV_SERIAL))
  941. == NULL) {
  942. lookup_fail(section, ENV_SERIAL);
  943. goto err;
  944. }
  945. if (!extconf) {
  946. /*
  947. * no '-extfile' option, so we look for extensions in the main
  948. * configuration file
  949. */
  950. if (!extensions) {
  951. extensions = NCONF_get_string(conf, section, ENV_EXTENSIONS);
  952. if (!extensions)
  953. ERR_clear_error();
  954. }
  955. if (extensions) {
  956. /* Check syntax of file */
  957. X509V3_CTX ctx;
  958. X509V3_set_ctx_test(&ctx);
  959. X509V3_set_nconf(&ctx, conf);
  960. if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {
  961. BIO_printf(bio_err,
  962. "Error Loading extension section %s\n",
  963. extensions);
  964. ret = 1;
  965. goto err;
  966. }
  967. }
  968. }
  969. if (startdate == NULL) {
  970. startdate = NCONF_get_string(conf, section,
  971. ENV_DEFAULT_STARTDATE);
  972. if (startdate == NULL)
  973. ERR_clear_error();
  974. }
  975. if (startdate && !ASN1_TIME_set_string(NULL, startdate)) {
  976. BIO_printf(bio_err,
  977. "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  978. goto err;
  979. }
  980. if (startdate == NULL)
  981. startdate = "today";
  982. if (enddate == NULL) {
  983. enddate = NCONF_get_string(conf, section, ENV_DEFAULT_ENDDATE);
  984. if (enddate == NULL)
  985. ERR_clear_error();
  986. }
  987. if (enddate && !ASN1_TIME_set_string(NULL, enddate)) {
  988. BIO_printf(bio_err,
  989. "end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
  990. goto err;
  991. }
  992. if (days == 0) {
  993. if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days))
  994. days = 0;
  995. }
  996. if (!enddate && (days == 0)) {
  997. BIO_printf(bio_err,
  998. "cannot lookup how many days to certify for\n");
  999. goto err;
  1000. }
  1001. if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {
  1002. BIO_printf(bio_err, "error while loading serial number\n");
  1003. goto err;
  1004. }
  1005. if (verbose) {
  1006. if (BN_is_zero(serial))
  1007. BIO_printf(bio_err, "next serial number is 00\n");
  1008. else {
  1009. if ((f = BN_bn2hex(serial)) == NULL)
  1010. goto err;
  1011. BIO_printf(bio_err, "next serial number is %s\n", f);
  1012. OPENSSL_free(f);
  1013. }
  1014. }
  1015. if ((attribs = NCONF_get_section(conf, policy)) == NULL) {
  1016. BIO_printf(bio_err, "unable to find 'section' for %s\n", policy);
  1017. goto err;
  1018. }
  1019. if ((cert_sk = sk_X509_new_null()) == NULL) {
  1020. BIO_printf(bio_err, "Memory allocation failure\n");
  1021. goto err;
  1022. }
  1023. if (spkac_file != NULL) {
  1024. total++;
  1025. j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,
  1026. attribs, db, serial, subj, chtype, multirdn,
  1027. email_dn, startdate, enddate, days, extensions,
  1028. conf, verbose, certopt, nameopt, default_op,
  1029. ext_copy);
  1030. if (j < 0)
  1031. goto err;
  1032. if (j > 0) {
  1033. total_done++;
  1034. BIO_printf(bio_err, "\n");
  1035. if (!BN_add_word(serial, 1))
  1036. goto err;
  1037. if (!sk_X509_push(cert_sk, x)) {
  1038. BIO_printf(bio_err, "Memory allocation failure\n");
  1039. goto err;
  1040. }
  1041. if (outfile) {
  1042. output_der = 1;
  1043. batch = 1;
  1044. }
  1045. }
  1046. }
  1047. if (ss_cert_file != NULL) {
  1048. total++;
  1049. j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
  1050. attribs,
  1051. db, serial, subj, chtype, multirdn, email_dn,
  1052. startdate, enddate, days, batch, extensions,
  1053. conf, verbose, certopt, nameopt, default_op,
  1054. ext_copy, e);
  1055. if (j < 0)
  1056. goto err;
  1057. if (j > 0) {
  1058. total_done++;
  1059. BIO_printf(bio_err, "\n");
  1060. if (!BN_add_word(serial, 1))
  1061. goto err;
  1062. if (!sk_X509_push(cert_sk, x)) {
  1063. BIO_printf(bio_err, "Memory allocation failure\n");
  1064. goto err;
  1065. }
  1066. }
  1067. }
  1068. if (infile != NULL) {
  1069. total++;
  1070. j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
  1071. serial, subj, chtype, multirdn, email_dn, startdate,
  1072. enddate, days, batch, extensions, conf, verbose,
  1073. certopt, nameopt, default_op, ext_copy, selfsign);
  1074. if (j < 0)
  1075. goto err;
  1076. if (j > 0) {
  1077. total_done++;
  1078. BIO_printf(bio_err, "\n");
  1079. if (!BN_add_word(serial, 1))
  1080. goto err;
  1081. if (!sk_X509_push(cert_sk, x)) {
  1082. BIO_printf(bio_err, "Memory allocation failure\n");
  1083. goto err;
  1084. }
  1085. }
  1086. }
  1087. for (i = 0; i < argc; i++) {
  1088. total++;
  1089. j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
  1090. serial, subj, chtype, multirdn, email_dn, startdate,
  1091. enddate, days, batch, extensions, conf, verbose,
  1092. certopt, nameopt, default_op, ext_copy, selfsign);
  1093. if (j < 0)
  1094. goto err;
  1095. if (j > 0) {
  1096. total_done++;
  1097. BIO_printf(bio_err, "\n");
  1098. if (!BN_add_word(serial, 1))
  1099. goto err;
  1100. if (!sk_X509_push(cert_sk, x)) {
  1101. BIO_printf(bio_err, "Memory allocation failure\n");
  1102. goto err;
  1103. }
  1104. }
  1105. }
  1106. /*
  1107. * we have a stack of newly certified certificates and a data base
  1108. * and serial number that need updating
  1109. */
  1110. if (sk_X509_num(cert_sk) > 0) {
  1111. if (!batch) {
  1112. BIO_printf(bio_err,
  1113. "\n%d out of %d certificate requests certified, commit? [y/n]",
  1114. total_done, total);
  1115. (void)BIO_flush(bio_err);
  1116. buf[0][0] = '\0';
  1117. if (!fgets(buf[0], 10, stdin)) {
  1118. BIO_printf(bio_err,
  1119. "CERTIFICATION CANCELED: I/O error\n");
  1120. ret = 0;
  1121. goto err;
  1122. }
  1123. if ((buf[0][0] != 'y') && (buf[0][0] != 'Y')) {
  1124. BIO_printf(bio_err, "CERTIFICATION CANCELED\n");
  1125. ret = 0;
  1126. goto err;
  1127. }
  1128. }
  1129. BIO_printf(bio_err, "Write out database with %d new entries\n",
  1130. sk_X509_num(cert_sk));
  1131. if (!save_serial(serialfile, "new", serial, NULL))
  1132. goto err;
  1133. if (!save_index(dbfile, "new", db))
  1134. goto err;
  1135. }
  1136. if (verbose)
  1137. BIO_printf(bio_err, "writing new certificates\n");
  1138. for (i = 0; i < sk_X509_num(cert_sk); i++) {
  1139. int k;
  1140. char *n;
  1141. x = sk_X509_value(cert_sk, i);
  1142. j = x->cert_info->serialNumber->length;
  1143. p = (const char *)x->cert_info->serialNumber->data;
  1144. if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {
  1145. BIO_printf(bio_err, "certificate file name too long\n");
  1146. goto err;
  1147. }
  1148. strcpy(buf[2], outdir);
  1149. #ifndef OPENSSL_SYS_VMS
  1150. BUF_strlcat(buf[2], "/", sizeof(buf[2]));
  1151. #endif
  1152. n = (char *)&(buf[2][strlen(buf[2])]);
  1153. if (j > 0) {
  1154. for (k = 0; k < j; k++) {
  1155. if (n >= &(buf[2][sizeof(buf[2])]))
  1156. break;
  1157. BIO_snprintf(n,
  1158. &buf[2][0] + sizeof(buf[2]) - n,
  1159. "%02X", (unsigned char)*(p++));
  1160. n += 2;
  1161. }
  1162. } else {
  1163. *(n++) = '0';
  1164. *(n++) = '0';
  1165. }
  1166. *(n++) = '.';
  1167. *(n++) = 'p';
  1168. *(n++) = 'e';
  1169. *(n++) = 'm';
  1170. *n = '\0';
  1171. if (verbose)
  1172. BIO_printf(bio_err, "writing %s\n", buf[2]);
  1173. if (BIO_write_filename(Cout, buf[2]) <= 0) {
  1174. perror(buf[2]);
  1175. goto err;
  1176. }
  1177. write_new_certificate(Cout, x, 0, notext);
  1178. write_new_certificate(Sout, x, output_der, notext);
  1179. }
  1180. if (sk_X509_num(cert_sk)) {
  1181. /* Rename the database and the serial file */
  1182. if (!rotate_serial(serialfile, "new", "old"))
  1183. goto err;
  1184. if (!rotate_index(dbfile, "new", "old"))
  1185. goto err;
  1186. BIO_printf(bio_err, "Data Base Updated\n");
  1187. }
  1188. }
  1189. /*****************************************************************/
  1190. if (gencrl) {
  1191. int crl_v2 = 0;
  1192. if (!crl_ext) {
  1193. crl_ext = NCONF_get_string(conf, section, ENV_CRLEXT);
  1194. if (!crl_ext)
  1195. ERR_clear_error();
  1196. }
  1197. if (crl_ext) {
  1198. /* Check syntax of file */
  1199. X509V3_CTX ctx;
  1200. X509V3_set_ctx_test(&ctx);
  1201. X509V3_set_nconf(&ctx, conf);
  1202. if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {
  1203. BIO_printf(bio_err,
  1204. "Error Loading CRL extension section %s\n",
  1205. crl_ext);
  1206. ret = 1;
  1207. goto err;
  1208. }
  1209. }
  1210. if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER))
  1211. != NULL)
  1212. if ((crlnumber = load_serial(crlnumberfile, 0, NULL)) == NULL) {
  1213. BIO_printf(bio_err, "error while loading CRL number\n");
  1214. goto err;
  1215. }
  1216. if (!crldays && !crlhours && !crlsec) {
  1217. if (!NCONF_get_number(conf, section,
  1218. ENV_DEFAULT_CRL_DAYS, &crldays))
  1219. crldays = 0;
  1220. if (!NCONF_get_number(conf, section,
  1221. ENV_DEFAULT_CRL_HOURS, &crlhours))
  1222. crlhours = 0;
  1223. ERR_clear_error();
  1224. }
  1225. if ((crldays == 0) && (crlhours == 0) && (crlsec == 0)) {
  1226. BIO_printf(bio_err,
  1227. "cannot lookup how long until the next CRL is issued\n");
  1228. goto err;
  1229. }
  1230. if (verbose)
  1231. BIO_printf(bio_err, "making CRL\n");
  1232. if ((crl = X509_CRL_new()) == NULL)
  1233. goto err;
  1234. if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))
  1235. goto err;
  1236. tmptm = ASN1_TIME_new();
  1237. if (!tmptm)
  1238. goto err;
  1239. X509_gmtime_adj(tmptm, 0);
  1240. X509_CRL_set_lastUpdate(crl, tmptm);
  1241. if (!X509_time_adj_ex(tmptm, crldays, crlhours * 60 * 60 + crlsec,
  1242. NULL)) {
  1243. BIO_puts(bio_err, "error setting CRL nextUpdate\n");
  1244. goto err;
  1245. }
  1246. X509_CRL_set_nextUpdate(crl, tmptm);
  1247. ASN1_TIME_free(tmptm);
  1248. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  1249. pp = sk_OPENSSL_PSTRING_value(db->db->data, i);
  1250. if (pp[DB_type][0] == DB_TYPE_REV) {
  1251. if ((r = X509_REVOKED_new()) == NULL)
  1252. goto err;
  1253. j = make_revoked(r, pp[DB_rev_date]);
  1254. if (!j)
  1255. goto err;
  1256. if (j == 2)
  1257. crl_v2 = 1;
  1258. if (!BN_hex2bn(&serial, pp[DB_serial]))
  1259. goto err;
  1260. tmpser = BN_to_ASN1_INTEGER(serial, NULL);
  1261. BN_free(serial);
  1262. serial = NULL;
  1263. if (!tmpser)
  1264. goto err;
  1265. X509_REVOKED_set_serialNumber(r, tmpser);
  1266. ASN1_INTEGER_free(tmpser);
  1267. X509_CRL_add0_revoked(crl, r);
  1268. }
  1269. }
  1270. /*
  1271. * sort the data so it will be written in serial number order
  1272. */
  1273. X509_CRL_sort(crl);
  1274. /* we now have a CRL */
  1275. if (verbose)
  1276. BIO_printf(bio_err, "signing CRL\n");
  1277. /* Add any extensions asked for */
  1278. if (crl_ext || crlnumberfile != NULL) {
  1279. X509V3_CTX crlctx;
  1280. X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
  1281. X509V3_set_nconf(&crlctx, conf);
  1282. if (crl_ext)
  1283. if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl))
  1284. goto err;
  1285. if (crlnumberfile != NULL) {
  1286. tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
  1287. if (!tmpser)
  1288. goto err;
  1289. X509_CRL_add1_ext_i2d(crl, NID_crl_number, tmpser, 0, 0);
  1290. ASN1_INTEGER_free(tmpser);
  1291. crl_v2 = 1;
  1292. if (!BN_add_word(crlnumber, 1))
  1293. goto err;
  1294. }
  1295. }
  1296. if (crl_ext || crl_v2) {
  1297. if (!X509_CRL_set_version(crl, 1))
  1298. goto err; /* version 2 CRL */
  1299. }
  1300. /* we have a CRL number that need updating */
  1301. if (crlnumberfile != NULL)
  1302. if (!save_serial(crlnumberfile, "new", crlnumber, NULL))
  1303. goto err;
  1304. if (crlnumber) {
  1305. BN_free(crlnumber);
  1306. crlnumber = NULL;
  1307. }
  1308. if (!do_X509_CRL_sign(bio_err, crl, pkey, dgst, sigopts))
  1309. goto err;
  1310. PEM_write_bio_X509_CRL(Sout, crl);
  1311. if (crlnumberfile != NULL) /* Rename the crlnumber file */
  1312. if (!rotate_serial(crlnumberfile, "new", "old"))
  1313. goto err;
  1314. }
  1315. /*****************************************************************/
  1316. if (dorevoke) {
  1317. if (infile == NULL) {
  1318. BIO_printf(bio_err, "no input files\n");
  1319. goto err;
  1320. } else {
  1321. X509 *revcert;
  1322. revcert = load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile);
  1323. if (revcert == NULL)
  1324. goto err;
  1325. if (dorevoke == 2)
  1326. rev_type = -1;
  1327. j = do_revoke(revcert, db, rev_type, rev_arg);
  1328. if (j <= 0)
  1329. goto err;
  1330. X509_free(revcert);
  1331. if (!save_index(dbfile, "new", db))
  1332. goto err;
  1333. if (!rotate_index(dbfile, "new", "old"))
  1334. goto err;
  1335. BIO_printf(bio_err, "Data Base Updated\n");
  1336. }
  1337. }
  1338. /*****************************************************************/
  1339. ret = 0;
  1340. err:
  1341. if (tofree)
  1342. OPENSSL_free(tofree);
  1343. BIO_free_all(Cout);
  1344. BIO_free_all(Sout);
  1345. BIO_free_all(out);
  1346. BIO_free_all(in);
  1347. if (cert_sk)
  1348. sk_X509_pop_free(cert_sk, X509_free);
  1349. if (ret)
  1350. ERR_print_errors(bio_err);
  1351. app_RAND_write_file(randfile, bio_err);
  1352. if (free_key && key)
  1353. OPENSSL_free(key);
  1354. BN_free(serial);
  1355. BN_free(crlnumber);
  1356. free_index(db);
  1357. if (sigopts)
  1358. sk_OPENSSL_STRING_free(sigopts);
  1359. EVP_PKEY_free(pkey);
  1360. if (x509)
  1361. X509_free(x509);
  1362. X509_CRL_free(crl);
  1363. NCONF_free(conf);
  1364. NCONF_free(extconf);
  1365. release_engine(e);
  1366. OBJ_cleanup();
  1367. apps_shutdown();
  1368. OPENSSL_EXIT(ret);
  1369. }
  1370. static void lookup_fail(const char *name, const char *tag)
  1371. {
  1372. BIO_printf(bio_err, "variable lookup failed for %s::%s\n", name, tag);
  1373. }
  1374. static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  1375. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1376. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1377. BIGNUM *serial, char *subj, unsigned long chtype,
  1378. int multirdn, int email_dn, char *startdate, char *enddate,
  1379. long days, int batch, char *ext_sect, CONF *lconf,
  1380. int verbose, unsigned long certopt, unsigned long nameopt,
  1381. int default_op, int ext_copy, int selfsign)
  1382. {
  1383. X509_REQ *req = NULL;
  1384. BIO *in = NULL;
  1385. EVP_PKEY *pktmp = NULL;
  1386. int ok = -1, i;
  1387. in = BIO_new(BIO_s_file());
  1388. if (BIO_read_filename(in, infile) <= 0) {
  1389. perror(infile);
  1390. goto err;
  1391. }
  1392. if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
  1393. BIO_printf(bio_err, "Error reading certificate request in %s\n",
  1394. infile);
  1395. goto err;
  1396. }
  1397. if (verbose)
  1398. X509_REQ_print(bio_err, req);
  1399. BIO_printf(bio_err, "Check that the request matches the signature\n");
  1400. if (selfsign && !X509_REQ_check_private_key(req, pkey)) {
  1401. BIO_printf(bio_err,
  1402. "Certificate request and CA private key do not match\n");
  1403. ok = 0;
  1404. goto err;
  1405. }
  1406. if ((pktmp = X509_REQ_get_pubkey(req)) == NULL) {
  1407. BIO_printf(bio_err, "error unpacking public key\n");
  1408. goto err;
  1409. }
  1410. i = X509_REQ_verify(req, pktmp);
  1411. EVP_PKEY_free(pktmp);
  1412. if (i < 0) {
  1413. ok = 0;
  1414. BIO_printf(bio_err, "Signature verification problems....\n");
  1415. ERR_print_errors(bio_err);
  1416. goto err;
  1417. }
  1418. if (i == 0) {
  1419. ok = 0;
  1420. BIO_printf(bio_err,
  1421. "Signature did not match the certificate request\n");
  1422. ERR_print_errors(bio_err);
  1423. goto err;
  1424. } else
  1425. BIO_printf(bio_err, "Signature ok\n");
  1426. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  1427. chtype, multirdn, email_dn, startdate, enddate, days, batch,
  1428. verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
  1429. ext_copy, selfsign);
  1430. err:
  1431. if (req != NULL)
  1432. X509_REQ_free(req);
  1433. if (in != NULL)
  1434. BIO_free(in);
  1435. return (ok);
  1436. }
  1437. static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
  1438. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1439. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1440. BIGNUM *serial, char *subj, unsigned long chtype,
  1441. int multirdn, int email_dn, char *startdate,
  1442. char *enddate, long days, int batch, char *ext_sect,
  1443. CONF *lconf, int verbose, unsigned long certopt,
  1444. unsigned long nameopt, int default_op, int ext_copy,
  1445. ENGINE *e)
  1446. {
  1447. X509 *req = NULL;
  1448. X509_REQ *rreq = NULL;
  1449. EVP_PKEY *pktmp = NULL;
  1450. int ok = -1, i;
  1451. if ((req =
  1452. load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
  1453. goto err;
  1454. if (verbose)
  1455. X509_print(bio_err, req);
  1456. BIO_printf(bio_err, "Check that the request matches the signature\n");
  1457. if ((pktmp = X509_get_pubkey(req)) == NULL) {
  1458. BIO_printf(bio_err, "error unpacking public key\n");
  1459. goto err;
  1460. }
  1461. i = X509_verify(req, pktmp);
  1462. EVP_PKEY_free(pktmp);
  1463. if (i < 0) {
  1464. ok = 0;
  1465. BIO_printf(bio_err, "Signature verification problems....\n");
  1466. goto err;
  1467. }
  1468. if (i == 0) {
  1469. ok = 0;
  1470. BIO_printf(bio_err, "Signature did not match the certificate\n");
  1471. goto err;
  1472. } else
  1473. BIO_printf(bio_err, "Signature ok\n");
  1474. if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL)
  1475. goto err;
  1476. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  1477. chtype, multirdn, email_dn, startdate, enddate, days, batch,
  1478. verbose, rreq, ext_sect, lconf, certopt, nameopt, default_op,
  1479. ext_copy, 0);
  1480. err:
  1481. if (rreq != NULL)
  1482. X509_REQ_free(rreq);
  1483. if (req != NULL)
  1484. X509_free(req);
  1485. return (ok);
  1486. }
  1487. static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
  1488. const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
  1489. STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,
  1490. char *subj, unsigned long chtype, int multirdn,
  1491. int email_dn, char *startdate, char *enddate, long days,
  1492. int batch, int verbose, X509_REQ *req, char *ext_sect,
  1493. CONF *lconf, unsigned long certopt, unsigned long nameopt,
  1494. int default_op, int ext_copy, int selfsign)
  1495. {
  1496. X509_NAME *name = NULL, *CAname = NULL, *subject = NULL, *dn_subject =
  1497. NULL;
  1498. ASN1_UTCTIME *tm, *tmptm;
  1499. ASN1_STRING *str, *str2;
  1500. ASN1_OBJECT *obj;
  1501. X509 *ret = NULL;
  1502. X509_CINF *ci;
  1503. X509_NAME_ENTRY *ne;
  1504. X509_NAME_ENTRY *tne, *push;
  1505. EVP_PKEY *pktmp;
  1506. int ok = -1, i, j, last, nid;
  1507. const char *p;
  1508. CONF_VALUE *cv;
  1509. OPENSSL_STRING row[DB_NUMBER];
  1510. OPENSSL_STRING *irow = NULL;
  1511. OPENSSL_STRING *rrow = NULL;
  1512. char buf[25];
  1513. tmptm = ASN1_UTCTIME_new();
  1514. if (tmptm == NULL) {
  1515. BIO_printf(bio_err, "malloc error\n");
  1516. return (0);
  1517. }
  1518. for (i = 0; i < DB_NUMBER; i++)
  1519. row[i] = NULL;
  1520. if (subj) {
  1521. X509_NAME *n = parse_name(subj, chtype, multirdn);
  1522. if (!n) {
  1523. ERR_print_errors(bio_err);
  1524. goto err;
  1525. }
  1526. X509_REQ_set_subject_name(req, n);
  1527. req->req_info->enc.modified = 1;
  1528. X509_NAME_free(n);
  1529. }
  1530. if (default_op)
  1531. BIO_printf(bio_err,
  1532. "The Subject's Distinguished Name is as follows\n");
  1533. name = X509_REQ_get_subject_name(req);
  1534. for (i = 0; i < X509_NAME_entry_count(name); i++) {
  1535. ne = X509_NAME_get_entry(name, i);
  1536. str = X509_NAME_ENTRY_get_data(ne);
  1537. obj = X509_NAME_ENTRY_get_object(ne);
  1538. if (msie_hack) {
  1539. /* assume all type should be strings */
  1540. nid = OBJ_obj2nid(ne->object);
  1541. if (str->type == V_ASN1_UNIVERSALSTRING)
  1542. ASN1_UNIVERSALSTRING_to_string(str);
  1543. if ((str->type == V_ASN1_IA5STRING) &&
  1544. (nid != NID_pkcs9_emailAddress))
  1545. str->type = V_ASN1_T61STRING;
  1546. if ((nid == NID_pkcs9_emailAddress) &&
  1547. (str->type == V_ASN1_PRINTABLESTRING))
  1548. str->type = V_ASN1_IA5STRING;
  1549. }
  1550. /* If no EMAIL is wanted in the subject */
  1551. if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
  1552. continue;
  1553. /* check some things */
  1554. if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
  1555. (str->type != V_ASN1_IA5STRING)) {
  1556. BIO_printf(bio_err,
  1557. "\nemailAddress type needs to be of type IA5STRING\n");
  1558. goto err;
  1559. }
  1560. if ((str->type != V_ASN1_BMPSTRING)
  1561. && (str->type != V_ASN1_UTF8STRING)) {
  1562. j = ASN1_PRINTABLE_type(str->data, str->length);
  1563. if (((j == V_ASN1_T61STRING) &&
  1564. (str->type != V_ASN1_T61STRING)) ||
  1565. ((j == V_ASN1_IA5STRING) &&
  1566. (str->type == V_ASN1_PRINTABLESTRING))) {
  1567. BIO_printf(bio_err,
  1568. "\nThe string contains characters that are illegal for the ASN.1 type\n");
  1569. goto err;
  1570. }
  1571. }
  1572. if (default_op)
  1573. old_entry_print(bio_err, obj, str);
  1574. }
  1575. /* Ok, now we check the 'policy' stuff. */
  1576. if ((subject = X509_NAME_new()) == NULL) {
  1577. BIO_printf(bio_err, "Memory allocation failure\n");
  1578. goto err;
  1579. }
  1580. /* take a copy of the issuer name before we mess with it. */
  1581. if (selfsign)
  1582. CAname = X509_NAME_dup(name);
  1583. else
  1584. CAname = X509_NAME_dup(x509->cert_info->subject);
  1585. if (CAname == NULL)
  1586. goto err;
  1587. str = str2 = NULL;
  1588. for (i = 0; i < sk_CONF_VALUE_num(policy); i++) {
  1589. cv = sk_CONF_VALUE_value(policy, i); /* get the object id */
  1590. if ((j = OBJ_txt2nid(cv->name)) == NID_undef) {
  1591. BIO_printf(bio_err,
  1592. "%s:unknown object type in 'policy' configuration\n",
  1593. cv->name);
  1594. goto err;
  1595. }
  1596. obj = OBJ_nid2obj(j);
  1597. last = -1;
  1598. for (;;) {
  1599. /* lookup the object in the supplied name list */
  1600. j = X509_NAME_get_index_by_OBJ(name, obj, last);
  1601. if (j < 0) {
  1602. if (last != -1)
  1603. break;
  1604. tne = NULL;
  1605. } else {
  1606. tne = X509_NAME_get_entry(name, j);
  1607. }
  1608. last = j;
  1609. /* depending on the 'policy', decide what to do. */
  1610. push = NULL;
  1611. if (strcmp(cv->value, "optional") == 0) {
  1612. if (tne != NULL)
  1613. push = tne;
  1614. } else if (strcmp(cv->value, "supplied") == 0) {
  1615. if (tne == NULL) {
  1616. BIO_printf(bio_err,
  1617. "The %s field needed to be supplied and was missing\n",
  1618. cv->name);
  1619. goto err;
  1620. } else
  1621. push = tne;
  1622. } else if (strcmp(cv->value, "match") == 0) {
  1623. int last2;
  1624. if (tne == NULL) {
  1625. BIO_printf(bio_err,
  1626. "The mandatory %s field was missing\n",
  1627. cv->name);
  1628. goto err;
  1629. }
  1630. last2 = -1;
  1631. again2:
  1632. j = X509_NAME_get_index_by_OBJ(CAname, obj, last2);
  1633. if ((j < 0) && (last2 == -1)) {
  1634. BIO_printf(bio_err,
  1635. "The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",
  1636. cv->name);
  1637. goto err;
  1638. }
  1639. if (j >= 0) {
  1640. push = X509_NAME_get_entry(CAname, j);
  1641. str = X509_NAME_ENTRY_get_data(tne);
  1642. str2 = X509_NAME_ENTRY_get_data(push);
  1643. last2 = j;
  1644. if (ASN1_STRING_cmp(str, str2) != 0)
  1645. goto again2;
  1646. }
  1647. if (j < 0) {
  1648. BIO_printf(bio_err,
  1649. "The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",
  1650. cv->name,
  1651. ((str2 == NULL) ? "NULL" : (char *)str2->data),
  1652. ((str == NULL) ? "NULL" : (char *)str->data));
  1653. goto err;
  1654. }
  1655. } else {
  1656. BIO_printf(bio_err,
  1657. "%s:invalid type in 'policy' configuration\n",
  1658. cv->value);
  1659. goto err;
  1660. }
  1661. if (push != NULL) {
  1662. if (!X509_NAME_add_entry(subject, push, -1, 0)) {
  1663. if (push != NULL)
  1664. X509_NAME_ENTRY_free(push);
  1665. BIO_printf(bio_err, "Memory allocation failure\n");
  1666. goto err;
  1667. }
  1668. }
  1669. if (j < 0)
  1670. break;
  1671. }
  1672. }
  1673. if (preserve) {
  1674. X509_NAME_free(subject);
  1675. /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
  1676. subject = X509_NAME_dup(name);
  1677. if (subject == NULL)
  1678. goto err;
  1679. }
  1680. if (verbose)
  1681. BIO_printf(bio_err,
  1682. "The subject name appears to be ok, checking data base for clashes\n");
  1683. /* Build the correct Subject if no e-mail is wanted in the subject */
  1684. /*
  1685. * and add it later on because of the method extensions are added
  1686. * (altName)
  1687. */
  1688. if (email_dn)
  1689. dn_subject = subject;
  1690. else {
  1691. X509_NAME_ENTRY *tmpne;
  1692. /*
  1693. * Its best to dup the subject DN and then delete any email addresses
  1694. * because this retains its structure.
  1695. */
  1696. if (!(dn_subject = X509_NAME_dup(subject))) {
  1697. BIO_printf(bio_err, "Memory allocation failure\n");
  1698. goto err;
  1699. }
  1700. while ((i = X509_NAME_get_index_by_NID(dn_subject,
  1701. NID_pkcs9_emailAddress,
  1702. -1)) >= 0) {
  1703. tmpne = X509_NAME_get_entry(dn_subject, i);
  1704. X509_NAME_delete_entry(dn_subject, i);
  1705. X509_NAME_ENTRY_free(tmpne);
  1706. }
  1707. }
  1708. if (BN_is_zero(serial))
  1709. row[DB_serial] = BUF_strdup("00");
  1710. else
  1711. row[DB_serial] = BN_bn2hex(serial);
  1712. if (row[DB_serial] == NULL) {
  1713. BIO_printf(bio_err, "Memory allocation failure\n");
  1714. goto err;
  1715. }
  1716. if (db->attributes.unique_subject) {
  1717. OPENSSL_STRING *crow = row;
  1718. rrow = TXT_DB_get_by_index(db->db, DB_name, crow);
  1719. if (rrow != NULL) {
  1720. BIO_printf(bio_err,
  1721. "ERROR:There is already a certificate for %s\n",
  1722. row[DB_name]);
  1723. }
  1724. }
  1725. if (rrow == NULL) {
  1726. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  1727. if (rrow != NULL) {
  1728. BIO_printf(bio_err,
  1729. "ERROR:Serial number %s has already been issued,\n",
  1730. row[DB_serial]);
  1731. BIO_printf(bio_err,
  1732. " check the database/serial_file for corruption\n");
  1733. }
  1734. }
  1735. if (rrow != NULL) {
  1736. BIO_printf(bio_err, "The matching entry has the following details\n");
  1737. if (rrow[DB_type][0] == 'E')
  1738. p = "Expired";
  1739. else if (rrow[DB_type][0] == 'R')
  1740. p = "Revoked";
  1741. else if (rrow[DB_type][0] == 'V')
  1742. p = "Valid";
  1743. else
  1744. p = "\ninvalid type, Data base error\n";
  1745. BIO_printf(bio_err, "Type :%s\n", p);;
  1746. if (rrow[DB_type][0] == 'R') {
  1747. p = rrow[DB_exp_date];
  1748. if (p == NULL)
  1749. p = "undef";
  1750. BIO_printf(bio_err, "Was revoked on:%s\n", p);
  1751. }
  1752. p = rrow[DB_exp_date];
  1753. if (p == NULL)
  1754. p = "undef";
  1755. BIO_printf(bio_err, "Expires on :%s\n", p);
  1756. p = rrow[DB_serial];
  1757. if (p == NULL)
  1758. p = "undef";
  1759. BIO_printf(bio_err, "Serial Number :%s\n", p);
  1760. p = rrow[DB_file];
  1761. if (p == NULL)
  1762. p = "undef";
  1763. BIO_printf(bio_err, "File name :%s\n", p);
  1764. p = rrow[DB_name];
  1765. if (p == NULL)
  1766. p = "undef";
  1767. BIO_printf(bio_err, "Subject Name :%s\n", p);
  1768. ok = -1; /* This is now a 'bad' error. */
  1769. goto err;
  1770. }
  1771. /* We are now totally happy, lets make and sign the certificate */
  1772. if (verbose)
  1773. BIO_printf(bio_err,
  1774. "Everything appears to be ok, creating and signing the certificate\n");
  1775. if ((ret = X509_new()) == NULL)
  1776. goto err;
  1777. ci = ret->cert_info;
  1778. #ifdef X509_V3
  1779. /* Make it an X509 v3 certificate. */
  1780. if (!X509_set_version(ret, 2))
  1781. goto err;
  1782. #endif
  1783. if (BN_to_ASN1_INTEGER(serial, ci->serialNumber) == NULL)
  1784. goto err;
  1785. if (selfsign) {
  1786. if (!X509_set_issuer_name(ret, subject))
  1787. goto err;
  1788. } else {
  1789. if (!X509_set_issuer_name(ret, X509_get_subject_name(x509)))
  1790. goto err;
  1791. }
  1792. if (strcmp(startdate, "today") == 0)
  1793. X509_gmtime_adj(X509_get_notBefore(ret), 0);
  1794. else
  1795. ASN1_TIME_set_string(X509_get_notBefore(ret), startdate);
  1796. if (enddate == NULL)
  1797. X509_time_adj_ex(X509_get_notAfter(ret), days, 0, NULL);
  1798. else {
  1799. int tdays;
  1800. ASN1_TIME_set_string(X509_get_notAfter(ret), enddate);
  1801. ASN1_TIME_diff(&tdays, NULL, NULL, X509_get_notAfter(ret));
  1802. days = tdays;
  1803. }
  1804. if (!X509_set_subject_name(ret, subject))
  1805. goto err;
  1806. pktmp = X509_REQ_get_pubkey(req);
  1807. i = X509_set_pubkey(ret, pktmp);
  1808. EVP_PKEY_free(pktmp);
  1809. if (!i)
  1810. goto err;
  1811. /* Lets add the extensions, if there are any */
  1812. if (ext_sect) {
  1813. X509V3_CTX ctx;
  1814. if (ci->version == NULL)
  1815. if ((ci->version = ASN1_INTEGER_new()) == NULL)
  1816. goto err;
  1817. ASN1_INTEGER_set(ci->version, 2); /* version 3 certificate */
  1818. /*
  1819. * Free the current entries if any, there should not be any I believe
  1820. */
  1821. if (ci->extensions != NULL)
  1822. sk_X509_EXTENSION_pop_free(ci->extensions, X509_EXTENSION_free);
  1823. ci->extensions = NULL;
  1824. /* Initialize the context structure */
  1825. if (selfsign)
  1826. X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
  1827. else
  1828. X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
  1829. if (extconf) {
  1830. if (verbose)
  1831. BIO_printf(bio_err, "Extra configuration file found\n");
  1832. /* Use the extconf configuration db LHASH */
  1833. X509V3_set_nconf(&ctx, extconf);
  1834. /* Test the structure (needed?) */
  1835. /* X509V3_set_ctx_test(&ctx); */
  1836. /* Adds exts contained in the configuration file */
  1837. if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect, ret)) {
  1838. BIO_printf(bio_err,
  1839. "ERROR: adding extensions in section %s\n",
  1840. ext_sect);
  1841. ERR_print_errors(bio_err);
  1842. goto err;
  1843. }
  1844. if (verbose)
  1845. BIO_printf(bio_err,
  1846. "Successfully added extensions from file.\n");
  1847. } else if (ext_sect) {
  1848. /* We found extensions to be set from config file */
  1849. X509V3_set_nconf(&ctx, lconf);
  1850. if (!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret)) {
  1851. BIO_printf(bio_err,
  1852. "ERROR: adding extensions in section %s\n",
  1853. ext_sect);
  1854. ERR_print_errors(bio_err);
  1855. goto err;
  1856. }
  1857. if (verbose)
  1858. BIO_printf(bio_err,
  1859. "Successfully added extensions from config\n");
  1860. }
  1861. }
  1862. /* Copy extensions from request (if any) */
  1863. if (!copy_extensions(ret, req, ext_copy)) {
  1864. BIO_printf(bio_err, "ERROR: adding extensions from request\n");
  1865. ERR_print_errors(bio_err);
  1866. goto err;
  1867. }
  1868. /* Set the right value for the noemailDN option */
  1869. if (email_dn == 0) {
  1870. if (!X509_set_subject_name(ret, dn_subject))
  1871. goto err;
  1872. }
  1873. if (!default_op) {
  1874. BIO_printf(bio_err, "Certificate Details:\n");
  1875. /*
  1876. * Never print signature details because signature not present
  1877. */
  1878. certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
  1879. X509_print_ex(bio_err, ret, nameopt, certopt);
  1880. }
  1881. BIO_printf(bio_err, "Certificate is to be certified until ");
  1882. ASN1_TIME_print(bio_err, X509_get_notAfter(ret));
  1883. if (days)
  1884. BIO_printf(bio_err, " (%ld days)", days);
  1885. BIO_printf(bio_err, "\n");
  1886. if (!batch) {
  1887. BIO_printf(bio_err, "Sign the certificate? [y/n]:");
  1888. (void)BIO_flush(bio_err);
  1889. buf[0] = '\0';
  1890. if (!fgets(buf, sizeof(buf) - 1, stdin)) {
  1891. BIO_printf(bio_err,
  1892. "CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
  1893. ok = 0;
  1894. goto err;
  1895. }
  1896. if (!((buf[0] == 'y') || (buf[0] == 'Y'))) {
  1897. BIO_printf(bio_err, "CERTIFICATE WILL NOT BE CERTIFIED\n");
  1898. ok = 0;
  1899. goto err;
  1900. }
  1901. }
  1902. pktmp = X509_get_pubkey(ret);
  1903. if (EVP_PKEY_missing_parameters(pktmp) &&
  1904. !EVP_PKEY_missing_parameters(pkey))
  1905. EVP_PKEY_copy_parameters(pktmp, pkey);
  1906. EVP_PKEY_free(pktmp);
  1907. if (!do_X509_sign(bio_err, ret, pkey, dgst, sigopts))
  1908. goto err;
  1909. /* We now just add it to the database */
  1910. tm = X509_get_notAfter(ret);
  1911. row[DB_type] = OPENSSL_malloc(2);
  1912. row[DB_exp_date] = OPENSSL_malloc(tm->length + 1);
  1913. row[DB_rev_date] = OPENSSL_malloc(1);
  1914. row[DB_file] = OPENSSL_malloc(8);
  1915. row[DB_name] = X509_NAME_oneline(X509_get_subject_name(ret), NULL, 0);
  1916. if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
  1917. (row[DB_rev_date] == NULL) ||
  1918. (row[DB_file] == NULL) || (row[DB_name] == NULL)) {
  1919. BIO_printf(bio_err, "Memory allocation failure\n");
  1920. goto err;
  1921. }
  1922. memcpy(row[DB_exp_date], tm->data, tm->length);
  1923. row[DB_exp_date][tm->length] = '\0';
  1924. row[DB_rev_date][0] = '\0';
  1925. strcpy(row[DB_file], "unknown");
  1926. row[DB_type][0] = 'V';
  1927. row[DB_type][1] = '\0';
  1928. if ((irow =
  1929. (char **)OPENSSL_malloc(sizeof(char *) * (DB_NUMBER + 1))) == NULL) {
  1930. BIO_printf(bio_err, "Memory allocation failure\n");
  1931. goto err;
  1932. }
  1933. for (i = 0; i < DB_NUMBER; i++)
  1934. irow[i] = row[i];
  1935. irow[DB_NUMBER] = NULL;
  1936. if (!TXT_DB_insert(db->db, irow)) {
  1937. BIO_printf(bio_err, "failed to update database\n");
  1938. BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
  1939. goto err;
  1940. }
  1941. irow = NULL;
  1942. ok = 1;
  1943. err:
  1944. if (irow != NULL) {
  1945. for (i = 0; i < DB_NUMBER; i++)
  1946. OPENSSL_free(row[i]);
  1947. OPENSSL_free(irow);
  1948. }
  1949. if (CAname != NULL)
  1950. X509_NAME_free(CAname);
  1951. if (subject != NULL)
  1952. X509_NAME_free(subject);
  1953. if ((dn_subject != NULL) && !email_dn)
  1954. X509_NAME_free(dn_subject);
  1955. if (tmptm != NULL)
  1956. ASN1_UTCTIME_free(tmptm);
  1957. if (ok <= 0) {
  1958. if (ret != NULL)
  1959. X509_free(ret);
  1960. ret = NULL;
  1961. } else
  1962. *xret = ret;
  1963. return (ok);
  1964. }
  1965. static void write_new_certificate(BIO *bp, X509 *x, int output_der,
  1966. int notext)
  1967. {
  1968. if (output_der) {
  1969. (void)i2d_X509_bio(bp, x);
  1970. return;
  1971. }
  1972. #if 0
  1973. /* ??? Not needed since X509_print prints all this stuff anyway */
  1974. f = X509_NAME_oneline(X509_get_issuer_name(x), buf, 256);
  1975. BIO_printf(bp, "issuer :%s\n", f);
  1976. f = X509_NAME_oneline(X509_get_subject_name(x), buf, 256);
  1977. BIO_printf(bp, "subject:%s\n", f);
  1978. BIO_puts(bp, "serial :");
  1979. i2a_ASN1_INTEGER(bp, x->cert_info->serialNumber);
  1980. BIO_puts(bp, "\n\n");
  1981. #endif
  1982. if (!notext)
  1983. X509_print(bp, x);
  1984. PEM_write_bio_X509(bp, x);
  1985. }
  1986. static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
  1987. X509 *x509, const EVP_MD *dgst,
  1988. STACK_OF(OPENSSL_STRING) *sigopts,
  1989. STACK_OF(CONF_VALUE) *policy, CA_DB *db,
  1990. BIGNUM *serial, char *subj, unsigned long chtype,
  1991. int multirdn, int email_dn, char *startdate,
  1992. char *enddate, long days, char *ext_sect,
  1993. CONF *lconf, int verbose, unsigned long certopt,
  1994. unsigned long nameopt, int default_op, int ext_copy)
  1995. {
  1996. STACK_OF(CONF_VALUE) *sk = NULL;
  1997. LHASH_OF(CONF_VALUE) *parms = NULL;
  1998. X509_REQ *req = NULL;
  1999. CONF_VALUE *cv = NULL;
  2000. NETSCAPE_SPKI *spki = NULL;
  2001. X509_REQ_INFO *ri;
  2002. char *type, *buf;
  2003. EVP_PKEY *pktmp = NULL;
  2004. X509_NAME *n = NULL;
  2005. X509_NAME_ENTRY *ne = NULL;
  2006. int ok = -1, i, j;
  2007. long errline;
  2008. int nid;
  2009. /*
  2010. * Load input file into a hash table. (This is just an easy
  2011. * way to read and parse the file, then put it into a convenient
  2012. * STACK format).
  2013. */
  2014. parms = CONF_load(NULL, infile, &errline);
  2015. if (parms == NULL) {
  2016. BIO_printf(bio_err, "error on line %ld of %s\n", errline, infile);
  2017. ERR_print_errors(bio_err);
  2018. goto err;
  2019. }
  2020. sk = CONF_get_section(parms, "default");
  2021. if (sk_CONF_VALUE_num(sk) == 0) {
  2022. BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
  2023. goto err;
  2024. }
  2025. /*
  2026. * Now create a dummy X509 request structure. We don't actually
  2027. * have an X509 request, but we have many of the components
  2028. * (a public key, various DN components). The idea is that we
  2029. * put these components into the right X509 request structure
  2030. * and we can use the same code as if you had a real X509 request.
  2031. */
  2032. req = X509_REQ_new();
  2033. if (req == NULL) {
  2034. ERR_print_errors(bio_err);
  2035. goto err;
  2036. }
  2037. /*
  2038. * Build up the subject name set.
  2039. */
  2040. ri = req->req_info;
  2041. n = ri->subject;
  2042. for (i = 0;; i++) {
  2043. if (sk_CONF_VALUE_num(sk) <= i)
  2044. break;
  2045. cv = sk_CONF_VALUE_value(sk, i);
  2046. type = cv->name;
  2047. /*
  2048. * Skip past any leading X. X: X, etc to allow for multiple instances
  2049. */
  2050. for (buf = cv->name; *buf; buf++)
  2051. if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
  2052. buf++;
  2053. if (*buf)
  2054. type = buf;
  2055. break;
  2056. }
  2057. buf = cv->value;
  2058. if ((nid = OBJ_txt2nid(type)) == NID_undef) {
  2059. if (strcmp(type, "SPKAC") == 0) {
  2060. spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
  2061. if (spki == NULL) {
  2062. BIO_printf(bio_err,
  2063. "unable to load Netscape SPKAC structure\n");
  2064. ERR_print_errors(bio_err);
  2065. goto err;
  2066. }
  2067. }
  2068. continue;
  2069. }
  2070. if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
  2071. (unsigned char *)buf, -1, -1, 0))
  2072. goto err;
  2073. }
  2074. if (spki == NULL) {
  2075. BIO_printf(bio_err, "Netscape SPKAC structure not found in %s\n",
  2076. infile);
  2077. goto err;
  2078. }
  2079. /*
  2080. * Now extract the key from the SPKI structure.
  2081. */
  2082. BIO_printf(bio_err,
  2083. "Check that the SPKAC request matches the signature\n");
  2084. if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
  2085. BIO_printf(bio_err, "error unpacking SPKAC public key\n");
  2086. goto err;
  2087. }
  2088. j = NETSCAPE_SPKI_verify(spki, pktmp);
  2089. if (j <= 0) {
  2090. EVP_PKEY_free(pktmp);
  2091. BIO_printf(bio_err,
  2092. "signature verification failed on SPKAC public key\n");
  2093. goto err;
  2094. }
  2095. BIO_printf(bio_err, "Signature ok\n");
  2096. X509_REQ_set_pubkey(req, pktmp);
  2097. EVP_PKEY_free(pktmp);
  2098. ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj,
  2099. chtype, multirdn, email_dn, startdate, enddate, days, 1,
  2100. verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
  2101. ext_copy, 0);
  2102. err:
  2103. if (req != NULL)
  2104. X509_REQ_free(req);
  2105. if (parms != NULL)
  2106. CONF_free(parms);
  2107. if (spki != NULL)
  2108. NETSCAPE_SPKI_free(spki);
  2109. if (ne != NULL)
  2110. X509_NAME_ENTRY_free(ne);
  2111. return (ok);
  2112. }
  2113. static int check_time_format(const char *str)
  2114. {
  2115. return ASN1_TIME_set_string(NULL, str);
  2116. }
  2117. static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
  2118. {
  2119. ASN1_UTCTIME *tm = NULL;
  2120. char *row[DB_NUMBER], **rrow, **irow;
  2121. char *rev_str = NULL;
  2122. BIGNUM *bn = NULL;
  2123. int ok = -1, i;
  2124. for (i = 0; i < DB_NUMBER; i++)
  2125. row[i] = NULL;
  2126. row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);
  2127. bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);
  2128. if (!bn)
  2129. goto err;
  2130. if (BN_is_zero(bn))
  2131. row[DB_serial] = BUF_strdup("00");
  2132. else
  2133. row[DB_serial] = BN_bn2hex(bn);
  2134. BN_free(bn);
  2135. if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {
  2136. BIO_printf(bio_err, "Memory allocation failure\n");
  2137. goto err;
  2138. }
  2139. /*
  2140. * We have to lookup by serial number because name lookup skips revoked
  2141. * certs
  2142. */
  2143. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  2144. if (rrow == NULL) {
  2145. BIO_printf(bio_err,
  2146. "Adding Entry with serial number %s to DB for %s\n",
  2147. row[DB_serial], row[DB_name]);
  2148. /* We now just add it to the database */
  2149. row[DB_type] = (char *)OPENSSL_malloc(2);
  2150. tm = X509_get_notAfter(x509);
  2151. row[DB_exp_date] = (char *)OPENSSL_malloc(tm->length + 1);
  2152. memcpy(row[DB_exp_date], tm->data, tm->length);
  2153. row[DB_exp_date][tm->length] = '\0';
  2154. row[DB_rev_date] = NULL;
  2155. /* row[DB_serial] done already */
  2156. row[DB_file] = (char *)OPENSSL_malloc(8);
  2157. /* row[DB_name] done already */
  2158. if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
  2159. (row[DB_file] == NULL)) {
  2160. BIO_printf(bio_err, "Memory allocation failure\n");
  2161. goto err;
  2162. }
  2163. BUF_strlcpy(row[DB_file], "unknown", 8);
  2164. row[DB_type][0] = 'V';
  2165. row[DB_type][1] = '\0';
  2166. if ((irow =
  2167. (char **)OPENSSL_malloc(sizeof(char *) * (DB_NUMBER + 1))) ==
  2168. NULL) {
  2169. BIO_printf(bio_err, "Memory allocation failure\n");
  2170. goto err;
  2171. }
  2172. for (i = 0; i < DB_NUMBER; i++)
  2173. irow[i] = row[i];
  2174. irow[DB_NUMBER] = NULL;
  2175. if (!TXT_DB_insert(db->db, irow)) {
  2176. BIO_printf(bio_err, "failed to update database\n");
  2177. BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);
  2178. OPENSSL_free(irow);
  2179. goto err;
  2180. }
  2181. for (i = 0; i < DB_NUMBER; i++)
  2182. row[i] = NULL;
  2183. /* Revoke Certificate */
  2184. if (type == -1)
  2185. ok = 1;
  2186. else
  2187. ok = do_revoke(x509, db, type, value);
  2188. goto err;
  2189. } else if (index_name_cmp_noconst(row, rrow)) {
  2190. BIO_printf(bio_err, "ERROR:name does not match %s\n", row[DB_name]);
  2191. goto err;
  2192. } else if (type == -1) {
  2193. BIO_printf(bio_err, "ERROR:Already present, serial number %s\n",
  2194. row[DB_serial]);
  2195. goto err;
  2196. } else if (rrow[DB_type][0] == 'R') {
  2197. BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\n",
  2198. row[DB_serial]);
  2199. goto err;
  2200. } else {
  2201. BIO_printf(bio_err, "Revoking Certificate %s.\n", rrow[DB_serial]);
  2202. rev_str = make_revocation_str(type, value);
  2203. if (!rev_str) {
  2204. BIO_printf(bio_err, "Error in revocation arguments\n");
  2205. goto err;
  2206. }
  2207. rrow[DB_type][0] = 'R';
  2208. rrow[DB_type][1] = '\0';
  2209. rrow[DB_rev_date] = rev_str;
  2210. }
  2211. ok = 1;
  2212. err:
  2213. for (i = 0; i < DB_NUMBER; i++) {
  2214. if (row[i] != NULL)
  2215. OPENSSL_free(row[i]);
  2216. }
  2217. return (ok);
  2218. }
  2219. static int get_certificate_status(const char *serial, CA_DB *db)
  2220. {
  2221. char *row[DB_NUMBER], **rrow;
  2222. int ok = -1, i;
  2223. /* Free Resources */
  2224. for (i = 0; i < DB_NUMBER; i++)
  2225. row[i] = NULL;
  2226. /* Malloc needed char spaces */
  2227. row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
  2228. if (row[DB_serial] == NULL) {
  2229. BIO_printf(bio_err, "Malloc failure\n");
  2230. goto err;
  2231. }
  2232. if (strlen(serial) % 2) {
  2233. /*
  2234. * Set the first char to 0
  2235. */ ;
  2236. row[DB_serial][0] = '0';
  2237. /* Copy String from serial to row[DB_serial] */
  2238. memcpy(row[DB_serial] + 1, serial, strlen(serial));
  2239. row[DB_serial][strlen(serial) + 1] = '\0';
  2240. } else {
  2241. /* Copy String from serial to row[DB_serial] */
  2242. memcpy(row[DB_serial], serial, strlen(serial));
  2243. row[DB_serial][strlen(serial)] = '\0';
  2244. }
  2245. /* Make it Upper Case */
  2246. for (i = 0; row[DB_serial][i] != '\0'; i++)
  2247. row[DB_serial][i] = toupper((unsigned char)row[DB_serial][i]);
  2248. ok = 1;
  2249. /* Search for the certificate */
  2250. rrow = TXT_DB_get_by_index(db->db, DB_serial, row);
  2251. if (rrow == NULL) {
  2252. BIO_printf(bio_err, "Serial %s not present in db.\n", row[DB_serial]);
  2253. ok = -1;
  2254. goto err;
  2255. } else if (rrow[DB_type][0] == 'V') {
  2256. BIO_printf(bio_err, "%s=Valid (%c)\n",
  2257. row[DB_serial], rrow[DB_type][0]);
  2258. goto err;
  2259. } else if (rrow[DB_type][0] == 'R') {
  2260. BIO_printf(bio_err, "%s=Revoked (%c)\n",
  2261. row[DB_serial], rrow[DB_type][0]);
  2262. goto err;
  2263. } else if (rrow[DB_type][0] == 'E') {
  2264. BIO_printf(bio_err, "%s=Expired (%c)\n",
  2265. row[DB_serial], rrow[DB_type][0]);
  2266. goto err;
  2267. } else if (rrow[DB_type][0] == 'S') {
  2268. BIO_printf(bio_err, "%s=Suspended (%c)\n",
  2269. row[DB_serial], rrow[DB_type][0]);
  2270. goto err;
  2271. } else {
  2272. BIO_printf(bio_err, "%s=Unknown (%c).\n",
  2273. row[DB_serial], rrow[DB_type][0]);
  2274. ok = -1;
  2275. }
  2276. err:
  2277. for (i = 0; i < DB_NUMBER; i++) {
  2278. if (row[i] != NULL)
  2279. OPENSSL_free(row[i]);
  2280. }
  2281. return (ok);
  2282. }
  2283. static int do_updatedb(CA_DB *db)
  2284. {
  2285. ASN1_UTCTIME *a_tm = NULL;
  2286. int i, cnt = 0;
  2287. int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
  2288. char **rrow, *a_tm_s;
  2289. a_tm = ASN1_UTCTIME_new();
  2290. if (a_tm == NULL)
  2291. return -1;
  2292. /* get actual time and make a string */
  2293. a_tm = X509_gmtime_adj(a_tm, 0);
  2294. a_tm_s = (char *)OPENSSL_malloc(a_tm->length + 1);
  2295. if (a_tm_s == NULL) {
  2296. cnt = -1;
  2297. goto err;
  2298. }
  2299. memcpy(a_tm_s, a_tm->data, a_tm->length);
  2300. a_tm_s[a_tm->length] = '\0';
  2301. if (strncmp(a_tm_s, "49", 2) <= 0)
  2302. a_y2k = 1;
  2303. else
  2304. a_y2k = 0;
  2305. for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {
  2306. rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
  2307. if (rrow[DB_type][0] == 'V') {
  2308. /* ignore entries that are not valid */
  2309. if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
  2310. db_y2k = 1;
  2311. else
  2312. db_y2k = 0;
  2313. if (db_y2k == a_y2k) {
  2314. /* all on the same y2k side */
  2315. if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0) {
  2316. rrow[DB_type][0] = 'E';
  2317. rrow[DB_type][1] = '\0';
  2318. cnt++;
  2319. BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
  2320. }
  2321. } else if (db_y2k < a_y2k) {
  2322. rrow[DB_type][0] = 'E';
  2323. rrow[DB_type][1] = '\0';
  2324. cnt++;
  2325. BIO_printf(bio_err, "%s=Expired\n", rrow[DB_serial]);
  2326. }
  2327. }
  2328. }
  2329. err:
  2330. ASN1_UTCTIME_free(a_tm);
  2331. OPENSSL_free(a_tm_s);
  2332. return (cnt);
  2333. }
  2334. static const char *crl_reasons[] = {
  2335. /* CRL reason strings */
  2336. "unspecified",
  2337. "keyCompromise",
  2338. "CACompromise",
  2339. "affiliationChanged",
  2340. "superseded",
  2341. "cessationOfOperation",
  2342. "certificateHold",
  2343. "removeFromCRL",
  2344. /* Additional pseudo reasons */
  2345. "holdInstruction",
  2346. "keyTime",
  2347. "CAkeyTime"
  2348. };
  2349. #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
  2350. /*
  2351. * Given revocation information convert to a DB string. The format of the
  2352. * string is: revtime[,reason,extra]. Where 'revtime' is the revocation time
  2353. * (the current time). 'reason' is the optional CRL reason and 'extra' is any
  2354. * additional argument
  2355. */
  2356. char *make_revocation_str(int rev_type, char *rev_arg)
  2357. {
  2358. char *other = NULL, *str;
  2359. const char *reason = NULL;
  2360. ASN1_OBJECT *otmp;
  2361. ASN1_UTCTIME *revtm = NULL;
  2362. int i;
  2363. switch (rev_type) {
  2364. case REV_NONE:
  2365. break;
  2366. case REV_CRL_REASON:
  2367. for (i = 0; i < 8; i++) {
  2368. if (!strcasecmp(rev_arg, crl_reasons[i])) {
  2369. reason = crl_reasons[i];
  2370. break;
  2371. }
  2372. }
  2373. if (reason == NULL) {
  2374. BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
  2375. return NULL;
  2376. }
  2377. break;
  2378. case REV_HOLD:
  2379. /* Argument is an OID */
  2380. otmp = OBJ_txt2obj(rev_arg, 0);
  2381. ASN1_OBJECT_free(otmp);
  2382. if (otmp == NULL) {
  2383. BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
  2384. return NULL;
  2385. }
  2386. reason = "holdInstruction";
  2387. other = rev_arg;
  2388. break;
  2389. case REV_KEY_COMPROMISE:
  2390. case REV_CA_COMPROMISE:
  2391. /* Argument is the key compromise time */
  2392. if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg)) {
  2393. BIO_printf(bio_err,
  2394. "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n",
  2395. rev_arg);
  2396. return NULL;
  2397. }
  2398. other = rev_arg;
  2399. if (rev_type == REV_KEY_COMPROMISE)
  2400. reason = "keyTime";
  2401. else
  2402. reason = "CAkeyTime";
  2403. break;
  2404. }
  2405. revtm = X509_gmtime_adj(NULL, 0);
  2406. if (!revtm)
  2407. return NULL;
  2408. i = revtm->length + 1;
  2409. if (reason)
  2410. i += strlen(reason) + 1;
  2411. if (other)
  2412. i += strlen(other) + 1;
  2413. str = OPENSSL_malloc(i);
  2414. if (!str)
  2415. return NULL;
  2416. BUF_strlcpy(str, (char *)revtm->data, i);
  2417. if (reason) {
  2418. BUF_strlcat(str, ",", i);
  2419. BUF_strlcat(str, reason, i);
  2420. }
  2421. if (other) {
  2422. BUF_strlcat(str, ",", i);
  2423. BUF_strlcat(str, other, i);
  2424. }
  2425. ASN1_UTCTIME_free(revtm);
  2426. return str;
  2427. }
  2428. /*-
  2429. * Convert revocation field to X509_REVOKED entry
  2430. * return code:
  2431. * 0 error
  2432. * 1 OK
  2433. * 2 OK and some extensions added (i.e. V2 CRL)
  2434. */
  2435. int make_revoked(X509_REVOKED *rev, const char *str)
  2436. {
  2437. char *tmp = NULL;
  2438. int reason_code = -1;
  2439. int i, ret = 0;
  2440. ASN1_OBJECT *hold = NULL;
  2441. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2442. ASN1_ENUMERATED *rtmp = NULL;
  2443. ASN1_TIME *revDate = NULL;
  2444. i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
  2445. if (i == 0)
  2446. goto err;
  2447. if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
  2448. goto err;
  2449. if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)) {
  2450. rtmp = ASN1_ENUMERATED_new();
  2451. if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
  2452. goto err;
  2453. if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
  2454. goto err;
  2455. }
  2456. if (rev && comp_time) {
  2457. if (!X509_REVOKED_add1_ext_i2d
  2458. (rev, NID_invalidity_date, comp_time, 0, 0))
  2459. goto err;
  2460. }
  2461. if (rev && hold) {
  2462. if (!X509_REVOKED_add1_ext_i2d
  2463. (rev, NID_hold_instruction_code, hold, 0, 0))
  2464. goto err;
  2465. }
  2466. if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
  2467. ret = 2;
  2468. else
  2469. ret = 1;
  2470. err:
  2471. if (tmp)
  2472. OPENSSL_free(tmp);
  2473. ASN1_OBJECT_free(hold);
  2474. ASN1_GENERALIZEDTIME_free(comp_time);
  2475. ASN1_ENUMERATED_free(rtmp);
  2476. ASN1_TIME_free(revDate);
  2477. return ret;
  2478. }
  2479. int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
  2480. {
  2481. char buf[25], *pbuf, *p;
  2482. int j;
  2483. j = i2a_ASN1_OBJECT(bp, obj);
  2484. pbuf = buf;
  2485. for (j = 22 - j; j > 0; j--)
  2486. *(pbuf++) = ' ';
  2487. *(pbuf++) = ':';
  2488. *(pbuf++) = '\0';
  2489. BIO_puts(bp, buf);
  2490. if (str->type == V_ASN1_PRINTABLESTRING)
  2491. BIO_printf(bp, "PRINTABLE:'");
  2492. else if (str->type == V_ASN1_T61STRING)
  2493. BIO_printf(bp, "T61STRING:'");
  2494. else if (str->type == V_ASN1_IA5STRING)
  2495. BIO_printf(bp, "IA5STRING:'");
  2496. else if (str->type == V_ASN1_UNIVERSALSTRING)
  2497. BIO_printf(bp, "UNIVERSALSTRING:'");
  2498. else
  2499. BIO_printf(bp, "ASN.1 %2d:'", str->type);
  2500. p = (char *)str->data;
  2501. for (j = str->length; j > 0; j--) {
  2502. if ((*p >= ' ') && (*p <= '~'))
  2503. BIO_printf(bp, "%c", *p);
  2504. else if (*p & 0x80)
  2505. BIO_printf(bp, "\\0x%02X", *p);
  2506. else if ((unsigned char)*p == 0xf7)
  2507. BIO_printf(bp, "^?");
  2508. else
  2509. BIO_printf(bp, "^%c", *p + '@');
  2510. p++;
  2511. }
  2512. BIO_printf(bp, "'\n");
  2513. return 1;
  2514. }
  2515. int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
  2516. ASN1_GENERALIZEDTIME **pinvtm, const char *str)
  2517. {
  2518. char *tmp = NULL;
  2519. char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
  2520. int reason_code = -1;
  2521. int ret = 0;
  2522. unsigned int i;
  2523. ASN1_OBJECT *hold = NULL;
  2524. ASN1_GENERALIZEDTIME *comp_time = NULL;
  2525. tmp = BUF_strdup(str);
  2526. if (!tmp) {
  2527. BIO_printf(bio_err, "memory allocation failure\n");
  2528. goto err;
  2529. }
  2530. p = strchr(tmp, ',');
  2531. rtime_str = tmp;
  2532. if (p) {
  2533. *p = '\0';
  2534. p++;
  2535. reason_str = p;
  2536. p = strchr(p, ',');
  2537. if (p) {
  2538. *p = '\0';
  2539. arg_str = p + 1;
  2540. }
  2541. }
  2542. if (prevtm) {
  2543. *prevtm = ASN1_UTCTIME_new();
  2544. if (!*prevtm) {
  2545. BIO_printf(bio_err, "memory allocation failure\n");
  2546. goto err;
  2547. }
  2548. if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str)) {
  2549. BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
  2550. goto err;
  2551. }
  2552. }
  2553. if (reason_str) {
  2554. for (i = 0; i < NUM_REASONS; i++) {
  2555. if (!strcasecmp(reason_str, crl_reasons[i])) {
  2556. reason_code = i;
  2557. break;
  2558. }
  2559. }
  2560. if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS) {
  2561. BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
  2562. goto err;
  2563. }
  2564. if (reason_code == 7)
  2565. reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
  2566. else if (reason_code == 8) { /* Hold instruction */
  2567. if (!arg_str) {
  2568. BIO_printf(bio_err, "missing hold instruction\n");
  2569. goto err;
  2570. }
  2571. reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
  2572. hold = OBJ_txt2obj(arg_str, 0);
  2573. if (!hold) {
  2574. BIO_printf(bio_err, "invalid object identifier %s\n",
  2575. arg_str);
  2576. goto err;
  2577. }
  2578. if (phold)
  2579. *phold = hold;
  2580. } else if ((reason_code == 9) || (reason_code == 10)) {
  2581. if (!arg_str) {
  2582. BIO_printf(bio_err, "missing compromised time\n");
  2583. goto err;
  2584. }
  2585. comp_time = ASN1_GENERALIZEDTIME_new();
  2586. if (!comp_time) {
  2587. BIO_printf(bio_err, "memory allocation failure\n");
  2588. goto err;
  2589. }
  2590. if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str)) {
  2591. BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
  2592. goto err;
  2593. }
  2594. if (reason_code == 9)
  2595. reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
  2596. else
  2597. reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
  2598. }
  2599. }
  2600. if (preason)
  2601. *preason = reason_code;
  2602. if (pinvtm)
  2603. *pinvtm = comp_time;
  2604. else
  2605. ASN1_GENERALIZEDTIME_free(comp_time);
  2606. ret = 1;
  2607. err:
  2608. if (tmp)
  2609. OPENSSL_free(tmp);
  2610. if (!phold)
  2611. ASN1_OBJECT_free(hold);
  2612. if (!pinvtm)
  2613. ASN1_GENERALIZEDTIME_free(comp_time);
  2614. return ret;
  2615. }