apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include "apps.h"
  68 #include <openssl/conf.h>
  69 #include <openssl/bio.h>
  70 #include <openssl/err.h>
  71 #include <openssl/bn.h>
  72 #include <openssl/txt_db.h>
  73 #include <openssl/evp.h>
  74 #include <openssl/x509.h>
  75 #include <openssl/x509v3.h>
  76 #include <openssl/objects.h>
  77 #include <openssl/ocsp.h>
  78 #include <openssl/pem.h>
  79
  80 #ifdef OPENSSL_SYS_WINDOWS
  81 #define strcasecmp _stricmp
  82 #else
  83 #include <strings.h>
  84 #endif
  85
  86 #ifndef W_OK
  87 #  ifdef OPENSSL_SYS_VMS
  88 #    if defined(__DECC)
  89 #      include <unistd.h>
  90 #    else
  91 #      include <unixlib.h>
  92 #    endif
  93 #  elif !defined(OPENSSL_SYS_VXWORKS)
  94 #    include <sys/file.h>
  95 #  endif
  96 #endif
  97
  98 #ifndef W_OK
  99 #  define F_OK 0
 100 #  define X_OK 1
 101 #  define W_OK 2
 102 #  define R_OK 4
 103 #endif
 104
 105 #undef PROG
 106 #define PROG ca_main
 107
 108 #define BASE_SECTION    "ca"
 109 #define CONFIG_FILE "openssl.cnf"
 110
 111 #define ENV_DEFAULT_CA          "default_ca"
 112
 113 #define ENV_DIR                 "dir"
 114 #define ENV_CERTS               "certs"
 115 #define ENV_CRL_DIR             "crl_dir"
 116 #define ENV_CA_DB               "CA_DB"
 117 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 118 #define ENV_CERTIFICATE         "certificate"
 119 #define ENV_SERIAL              "serial"
 120 #define ENV_CRL                 "crl"
 121 #define ENV_PRIVATE_KEY         "private_key"
 122 #define ENV_RANDFILE            "RANDFILE"
 123 #define ENV_DEFAULT_DAYS        "default_days"
 124 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 125 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 126 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 127 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 128 #define ENV_DEFAULT_MD          "default_md"
 129 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 130 #define ENV_PRESERVE            "preserve"
 131 #define ENV_POLICY              "policy"
 132 #define ENV_EXTENSIONS          "x509_extensions"
 133 #define ENV_CRLEXT              "crl_extensions"
 134 #define ENV_MSIE_HACK           "msie_hack"
 135 #define ENV_NAMEOPT             "name_opt"
 136 #define ENV_CERTOPT             "cert_opt"
 137 #define ENV_EXTCOPY             "copy_extensions"
 138
 139 #define ENV_DATABASE            "database"
 140
 141 #define DB_type         0
 142 #define DB_exp_date     1
 143 #define DB_rev_date     2
 144 #define DB_serial       3       /* index - unique */
 145 #define DB_file         4
 146 #define DB_name         5       /* index - unique for active */
 147 #define DB_NUMBER       6
 148
 149 #define DB_TYPE_REV     'R'
 150 #define DB_TYPE_EXP     'E'
 151 #define DB_TYPE_VAL     'V'
 152
 153 /* Additional revocation information types */
 154
 155 #define REV_NONE                0       /* No addditional information */
 156 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 157 #define REV_HOLD                2       /* Value is hold instruction */
 158 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 159 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 160
 161 static char *ca_usage[]={
 162 "usage: ca args\n",
 163 "\n",
 164 " -verbose        - Talk alot while doing things\n",
 165 " -config file    - A config file\n",
 166 " -name arg       - The particular CA definition to use\n",
 167 " -gencrl         - Generate a new CRL\n",
 168 " -crldays days   - Days is when the next CRL is due\n",
 169 " -crlhours hours - Hours is when the next CRL is due\n",
 170 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 171 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 172 " -days arg       - number of days to certify the certificate for\n",
 173 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 174 " -policy arg     - The CA 'policy' to support\n",
 175 " -keyfile arg    - private key file\n",
 176 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 177 " -key arg        - key to decode the private key if it is encrypted\n",
 178 " -cert file      - The CA certificate\n",
 179 " -in file        - The input PEM encoded certificate request(s)\n",
 180 " -out file       - Where to put the output file(s)\n",
 181 " -outdir dir     - Where to put output certificates\n",
 182 " -infiles ....   - The last argument, requests to process\n",
 183 " -spkac file     - File contains DN and signed public key and challenge\n",
 184 " -ss_cert file   - File contains a self signed cert to sign\n",
 185 " -preserveDN     - Don't re-order the DN\n",
 186 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 187 " -batch          - Don't ask questions\n",
 188 " -msie_hack      - msie modifications to handle all those universal strings\n",
 189 " -revoke file    - Revoke a certificate (given in file)\n",
 190 " -subj arg       - Use arg instead of request's subject\n",
 191 " -extensions ..  - Extension section (override value in config file)\n",
 192 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 193 " -crlexts ..     - CRL extension section (override value in config file)\n",
 194 " -engine e       - use engine e, possibly a hardware device.\n",
 195 " -status serial  - Shows certificate status given the serial number\n",
 196 " -updatedb       - Updates db for expired certificates\n",
 197 NULL
 198 };
 199
 200 #ifdef EFENCE
 201 extern int EF_PROTECT_FREE;
 202 extern int EF_PROTECT_BELOW;
 203 extern int EF_ALIGNMENT;
 204 #endif
 205
 206 static void lookup_fail(char *name,char *tag);
 207 static unsigned long index_serial_hash(const char **a);
 208 static int index_serial_cmp(const char **a, const char **b);
 209 static unsigned long index_name_hash(const char **a);
 210 static int index_name_qual(char **a);
 211 static int index_name_cmp(const char **a,const char **b);
 212 static BIGNUM *load_serial(char *serialfile);
 213 static int save_serial(char *serialfile, BIGNUM *serial);
 214 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 215                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
 216                    BIGNUM *serial, char *subj, int email_dn, char *startdate,
 217                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 218                    int verbose, unsigned long certopt, unsigned long nameopt,
 219                    int default_op, int ext_copy);
 220 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 221                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 222                         TXT_DB *db, BIGNUM *serial, char *subj, int email_dn,
 223                         char *startdate, char *enddate, long days, int batch,
 224                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 225                         unsigned long nameopt, int default_op, int ext_copy,
 226                         ENGINE *e);
 227 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 228                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 229                          TXT_DB *db, BIGNUM *serial,char *subj, int email_dn,
 230                          char *startdate, char *enddate, long days, char *ext_sect,
 231                          CONF *conf, int verbose, unsigned long certopt,
 232                          unsigned long nameopt, int default_op, int ext_copy);
 233 static int fix_data(int nid, int *type);
 234 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 235 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 236         STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
 237         int email_dn, char *startdate, char *enddate, long days, int batch,
 238         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 239         unsigned long certopt, unsigned long nameopt, int default_op,
 240         int ext_copy);
 241 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 242 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 243 static int do_updatedb(TXT_DB *db);
 244 static int check_time_format(char *str);
 245 char *make_revocation_str(int rev_type, char *rev_arg);
 246 int make_revoked(X509_REVOKED *rev, char *str);
 247 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 248 static CONF *conf=NULL;
 249 static CONF *extconf=NULL;
 250 static char *section=NULL;
 251
 252 static int preserve=0;
 253 static int msie_hack=0;
 254
 255 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
 256 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
 257 static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
 258 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
 259
 260
 261 int MAIN(int, char **);
 262
 263 int MAIN(int argc, char **argv)
 264         {
 265         ENGINE *e = NULL;
 266         char *key=NULL,*passargin=NULL;
 267         int free_key = 0;
 268         int total=0;
 269         int total_done=0;
 270         int badops=0;
 271         int ret=1;
 272         int email_dn=1;
 273         int req=0;
 274         int verbose=0;
 275         int gencrl=0;
 276         int dorevoke=0;
 277         int doupdatedb=0;
 278         long crldays=0;
 279         long crlhours=0;
 280         long errorline= -1;
 281         char *configfile=NULL;
 282         char *md=NULL;
 283         char *policy=NULL;
 284         char *keyfile=NULL;
 285         char *certfile=NULL;
 286         int keyform=FORMAT_PEM;
 287         char *infile=NULL;
 288         char *spkac_file=NULL;
 289         char *ss_cert_file=NULL;
 290         char *ser_status=NULL;
 291         EVP_PKEY *pkey=NULL;
 292         int output_der = 0;
 293         char *outfile=NULL;
 294         char *outdir=NULL;
 295         char *serialfile=NULL;
 296         char *extensions=NULL;
 297         char *extfile=NULL;
 298         char *subj=NULL;
 299         char *tmp_email_dn=NULL;
 300         char *crl_ext=NULL;
 301         int rev_type = REV_NONE;
 302         char *rev_arg = NULL;
 303         BIGNUM *serial=NULL;
 304         char *startdate=NULL;
 305         char *enddate=NULL;
 306         long days=0;
 307         int batch=0;
 308         int notext=0;
 309         unsigned long nameopt = 0, certopt = 0;
 310         int default_op = 1;
 311         int ext_copy = EXT_COPY_NONE;
 312         X509 *x509=NULL;
 313         X509 *x=NULL;
 314         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 315         char *dbfile=NULL;
 316         TXT_DB *db=NULL;
 317         X509_CRL *crl=NULL;
 318         X509_REVOKED *r=NULL;
 319         ASN1_TIME *tmptm;
 320         ASN1_INTEGER *tmpser;
 321         char **pp,*p,*f;
 322         int i,j;
 323         long l;
 324         const EVP_MD *dgst=NULL;
 325         STACK_OF(CONF_VALUE) *attribs=NULL;
 326         STACK_OF(X509) *cert_sk=NULL;
 327 #undef BSIZE
 328 #define BSIZE 256
 329         MS_STATIC char buf[3][BSIZE];
 330         char *randfile=NULL;
 331         char *engine = NULL;
 332
 333 #ifdef EFENCE
 334 EF_PROTECT_FREE=1;
 335 EF_PROTECT_BELOW=1;
 336 EF_ALIGNMENT=0;
 337 #endif
 338
 339         apps_startup();
 340
 341         conf = NULL;
 342         key = NULL;
 343         section = NULL;
 344
 345         preserve=0;
 346         msie_hack=0;
 347         if (bio_err == NULL)
 348                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 349                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 350
 351         argc--;
 352         argv++;
 353         while (argc >= 1)
 354                 {
 355                 if      (strcmp(*argv,"-verbose") == 0)
 356                         verbose=1;
 357                 else if (strcmp(*argv,"-config") == 0)
 358                         {
 359                         if (--argc < 1) goto bad;
 360                         configfile= *(++argv);
 361                         }
 362                 else if (strcmp(*argv,"-name") == 0)
 363                         {
 364                         if (--argc < 1) goto bad;
 365                         section= *(++argv);
 366                         }
 367                 else if (strcmp(*argv,"-subj") == 0)
 368                         {
 369                         if (--argc < 1) goto bad;
 370                         subj= *(++argv);
 371                         /* preserve=1; */
 372                         }
 373                 else if (strcmp(*argv,"-startdate") == 0)
 374                         {
 375                         if (--argc < 1) goto bad;
 376                         startdate= *(++argv);
 377                         }
 378                 else if (strcmp(*argv,"-enddate") == 0)
 379                         {
 380                         if (--argc < 1) goto bad;
 381                         enddate= *(++argv);
 382                         }
 383                 else if (strcmp(*argv,"-days") == 0)
 384                         {
 385                         if (--argc < 1) goto bad;
 386                         days=atoi(*(++argv));
 387                         }
 388                 else if (strcmp(*argv,"-md") == 0)
 389                         {
 390                         if (--argc < 1) goto bad;
 391                         md= *(++argv);
 392                         }
 393                 else if (strcmp(*argv,"-policy") == 0)
 394                         {
 395                         if (--argc < 1) goto bad;
 396                         policy= *(++argv);
 397                         }
 398                 else if (strcmp(*argv,"-keyfile") == 0)
 399                         {
 400                         if (--argc < 1) goto bad;
 401                         keyfile= *(++argv);
 402                         }
 403                 else if (strcmp(*argv,"-keyform") == 0)
 404                         {
 405                         if (--argc < 1) goto bad;
 406                         keyform=str2fmt(*(++argv));
 407                         }
 408                 else if (strcmp(*argv,"-passin") == 0)
 409                         {
 410                         if (--argc < 1) goto bad;
 411                         passargin= *(++argv);
 412                         }
 413                 else if (strcmp(*argv,"-key") == 0)
 414                         {
 415                         if (--argc < 1) goto bad;
 416                         key= *(++argv);
 417                         }
 418                 else if (strcmp(*argv,"-cert") == 0)
 419                         {
 420                         if (--argc < 1) goto bad;
 421                         certfile= *(++argv);
 422                         }
 423                 else if (strcmp(*argv,"-in") == 0)
 424                         {
 425                         if (--argc < 1) goto bad;
 426                         infile= *(++argv);
 427                         req=1;
 428                         }
 429                 else if (strcmp(*argv,"-out") == 0)
 430                         {
 431                         if (--argc < 1) goto bad;
 432                         outfile= *(++argv);
 433                         }
 434                 else if (strcmp(*argv,"-outdir") == 0)
 435                         {
 436                         if (--argc < 1) goto bad;
 437                         outdir= *(++argv);
 438                         }
 439                 else if (strcmp(*argv,"-notext") == 0)
 440                         notext=1;
 441                 else if (strcmp(*argv,"-batch") == 0)
 442                         batch=1;
 443                 else if (strcmp(*argv,"-preserveDN") == 0)
 444                         preserve=1;
 445                 else if (strcmp(*argv,"-noemailDN") == 0)
 446                         email_dn=0;
 447                 else if (strcmp(*argv,"-gencrl") == 0)
 448                         gencrl=1;
 449                 else if (strcmp(*argv,"-msie_hack") == 0)
 450                         msie_hack=1;
 451                 else if (strcmp(*argv,"-crldays") == 0)
 452                         {
 453                         if (--argc < 1) goto bad;
 454                         crldays= atol(*(++argv));
 455                         }
 456                 else if (strcmp(*argv,"-crlhours") == 0)
 457                         {
 458                         if (--argc < 1) goto bad;
 459                         crlhours= atol(*(++argv));
 460                         }
 461                 else if (strcmp(*argv,"-infiles") == 0)
 462                         {
 463                         argc--;
 464                         argv++;
 465                         req=1;
 466                         break;
 467                         }
 468                 else if (strcmp(*argv, "-ss_cert") == 0)
 469                         {
 470                         if (--argc < 1) goto bad;
 471                         ss_cert_file = *(++argv);
 472                         req=1;
 473                         }
 474                 else if (strcmp(*argv, "-spkac") == 0)
 475                         {
 476                         if (--argc < 1) goto bad;
 477                         spkac_file = *(++argv);
 478                         req=1;
 479                         }
 480                 else if (strcmp(*argv,"-revoke") == 0)
 481                         {
 482                         if (--argc < 1) goto bad;
 483                         infile= *(++argv);
 484                         dorevoke=1;
 485                         }
 486                 else if (strcmp(*argv,"-extensions") == 0)
 487                         {
 488                         if (--argc < 1) goto bad;
 489                         extensions= *(++argv);
 490                         }
 491                 else if (strcmp(*argv,"-extfile") == 0)
 492                         {
 493                         if (--argc < 1) goto bad;
 494                         extfile= *(++argv);
 495                         }
 496                 else if (strcmp(*argv,"-status") == 0)
 497                         {
 498                         if (--argc < 1) goto bad;
 499                         ser_status= *(++argv);
 500                         }
 501                 else if (strcmp(*argv,"-updatedb") == 0)
 502                         {
 503                         doupdatedb=1;
 504                         }
 505                 else if (strcmp(*argv,"-crlexts") == 0)
 506                         {
 507                         if (--argc < 1) goto bad;
 508                         crl_ext= *(++argv);
 509                         }
 510                 else if (strcmp(*argv,"-crl_reason") == 0)
 511                         {
 512                         if (--argc < 1) goto bad;
 513                         rev_arg = *(++argv);
 514                         rev_type = REV_CRL_REASON;
 515                         }
 516                 else if (strcmp(*argv,"-crl_hold") == 0)
 517                         {
 518                         if (--argc < 1) goto bad;
 519                         rev_arg = *(++argv);
 520                         rev_type = REV_HOLD;
 521                         }
 522                 else if (strcmp(*argv,"-crl_compromise") == 0)
 523                         {
 524                         if (--argc < 1) goto bad;
 525                         rev_arg = *(++argv);
 526                         rev_type = REV_KEY_COMPROMISE;
 527                         }
 528                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 529                         {
 530                         if (--argc < 1) goto bad;
 531                         rev_arg = *(++argv);
 532                         rev_type = REV_CA_COMPROMISE;
 533                         }
 534                 else if (strcmp(*argv,"-engine") == 0)
 535                         {
 536                         if (--argc < 1) goto bad;
 537                         engine= *(++argv);
 538                         }
 539                 else
 540                         {
 541 bad:
 542                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 543                         badops=1;
 544                         break;
 545                         }
 546                 argc--;
 547                 argv++;
 548                 }
 549
 550         if (badops)
 551                 {
 552                 for (pp=ca_usage; (*pp != NULL); pp++)
 553                         BIO_printf(bio_err,"%s",*pp);
 554                 goto err;
 555                 }
 556
 557         ERR_load_crypto_strings();
 558
 559         e = setup_engine(bio_err, engine, 0);
 560
 561         /*****************************************************************/
 562         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 563         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 564         if (configfile == NULL)
 565                 {
 566                 /* We will just use 'buf[0]' as a temporary buffer.  */
 567 #ifdef OPENSSL_SYS_VMS
 568                 strncpy(buf[0],X509_get_default_cert_area(),
 569                         sizeof(buf[0])-1-sizeof(CONFIG_FILE));
 570 #else
 571                 strncpy(buf[0],X509_get_default_cert_area(),
 572                         sizeof(buf[0])-2-sizeof(CONFIG_FILE));
 573                 buf[0][sizeof(buf[0])-2-sizeof(CONFIG_FILE)]='\0';
 574                 strcat(buf[0],"/");
 575 #endif
 576                 strcat(buf[0],CONFIG_FILE);
 577                 configfile=buf[0];
 578                 }
 579
 580         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 581         conf = NCONF_new(NULL);
 582         if (NCONF_load(conf,configfile,&errorline) <= 0)
 583                 {
 584                 if (errorline <= 0)
 585                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 586                                 configfile);
 587                 else
 588                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 589                                 ,errorline,configfile);
 590                 goto err;
 591                 }
 592
 593         if (!load_config(bio_err, conf))
 594                 goto err;
 595
 596         /* Lets get the config section we are using */
 597         if (section == NULL)
 598                 {
 599                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 600                 if (section == NULL)
 601                         {
 602                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 603                         goto err;
 604                         }
 605                 }
 606
 607         if (conf != NULL)
 608                 {
 609                 p=NCONF_get_string(conf,NULL,"oid_file");
 610                 if (p == NULL)
 611                         ERR_clear_error();
 612                 if (p != NULL)
 613                         {
 614                         BIO *oid_bio;
 615
 616                         oid_bio=BIO_new_file(p,"r");
 617                         if (oid_bio == NULL)
 618                                 {
 619                                 /*
 620                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 621                                 ERR_print_errors(bio_err);
 622                                 */
 623                                 ERR_clear_error();
 624                                 }
 625                         else
 626                                 {
 627                                 OBJ_create_objects(oid_bio);
 628                                 BIO_free(oid_bio);
 629                                 }
 630                         }
 631                 if (!add_oid_section(bio_err,conf))
 632                         {
 633                         ERR_print_errors(bio_err);
 634                         goto err;
 635                         }
 636                 }
 637
 638         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 639         if (randfile == NULL)
 640                 ERR_clear_error();
 641         app_RAND_load_file(randfile, bio_err, 0);
 642
 643         in=BIO_new(BIO_s_file());
 644         out=BIO_new(BIO_s_file());
 645         Sout=BIO_new(BIO_s_file());
 646         Cout=BIO_new(BIO_s_file());
 647         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 648                 {
 649                 ERR_print_errors(bio_err);
 650                 goto err;
 651                 }
 652
 653         /*****************************************************************/
 654         /* report status of cert with serial number given on command line */
 655         if (ser_status)
 656         {
 657                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 658                         {
 659                         lookup_fail(section,ENV_DATABASE);
 660                         goto err;
 661                         }
 662                 if (BIO_read_filename(in,dbfile) <= 0)
 663                         {
 664                         perror(dbfile);
 665                         BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 666                         goto err;
 667                         }
 668                 db=TXT_DB_read(in,DB_NUMBER);
 669                 if (db == NULL) goto err;
 670
 671                 if (!make_serial_index(db))
 672                         goto err;
 673
 674                 if (get_certificate_status(ser_status,db) != 1)
 675                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 676                                  ser_status);
 677                 goto err;
 678         }
 679
 680         /*****************************************************************/
 681         /* we definitely need a public key, so let's get it */
 682
 683         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 684                 section,ENV_PRIVATE_KEY)) == NULL))
 685                 {
 686                 lookup_fail(section,ENV_PRIVATE_KEY);
 687                 goto err;
 688                 }
 689         if (!key)
 690                 {
 691                 free_key = 1;
 692                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 693                         {
 694                         BIO_printf(bio_err,"Error getting password\n");
 695                         goto err;
 696                         }
 697                 }
 698         pkey = load_key(bio_err, keyfile, keyform, key, e,
 699                 "CA private key");
 700         if (key) memset(key,0,strlen(key));
 701         if (pkey == NULL)
 702                 {
 703                 /* load_key() has already printed an appropriate message */
 704                 goto err;
 705                 }
 706
 707         /*****************************************************************/
 708         /* we need a certificate */
 709         if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
 710                 section,ENV_CERTIFICATE)) == NULL))
 711                 {
 712                 lookup_fail(section,ENV_CERTIFICATE);
 713                 goto err;
 714                 }
 715         x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 716                 "CA certificate");
 717         if (x509 == NULL)
 718                 goto err;
 719
 720         if (!X509_check_private_key(x509,pkey))
 721                 {
 722                 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 723                 goto err;
 724                 }
 725
 726         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 727         if (f == NULL)
 728                 ERR_clear_error();
 729         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 730                 preserve=1;
 731         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 732         if (f == NULL)
 733                 ERR_clear_error();
 734         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 735                 msie_hack=1;
 736
 737         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 738
 739         if (f)
 740                 {
 741                 if (!set_name_ex(&nameopt, f))
 742                         {
 743                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 744                         goto err;
 745                         }
 746                 default_op = 0;
 747                 }
 748         else
 749                 ERR_clear_error();
 750
 751         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 752
 753         if (f)
 754                 {
 755                 if (!set_cert_ex(&certopt, f))
 756                         {
 757                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 758                         goto err;
 759                         }
 760                 default_op = 0;
 761                 }
 762         else
 763                 ERR_clear_error();
 764
 765         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 766
 767         if (f)
 768                 {
 769                 if (!set_ext_copy(&ext_copy, f))
 770                         {
 771                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 772                         goto err;
 773                         }
 774                 }
 775         else
 776                 ERR_clear_error();
 777
 778         /*****************************************************************/
 779         /* lookup where to write new certificates */
 780         if ((outdir == NULL) && (req))
 781                 {
 782                 struct stat sb;
 783
 784                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 785                         == NULL)
 786                         {
 787                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 788                         goto err;
 789                         }
 790 #ifndef OPENSSL_SYS_VMS
 791             /* outdir is a directory spec, but access() for VMS demands a
 792                filename.  In any case, stat(), below, will catch the problem
 793                if outdir is not a directory spec, and the fopen() or open()
 794                will catch an error if there is no write access.
 795
 796                Presumably, this problem could also be solved by using the DEC
 797                C routines to convert the directory syntax to Unixly, and give
 798                that to access().  However, time's too short to do that just
 799                now.
 800             */
 801                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 802                         {
 803                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 804                         perror(outdir);
 805                         goto err;
 806                         }
 807
 808                 if (stat(outdir,&sb) != 0)
 809                         {
 810                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 811                         perror(outdir);
 812                         goto err;
 813                         }
 814 #ifdef S_IFDIR
 815                 if (!(sb.st_mode & S_IFDIR))
 816                         {
 817                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 818                         perror(outdir);
 819                         goto err;
 820                         }
 821 #endif
 822 #endif
 823                 }
 824
 825         /*****************************************************************/
 826         /* we need to load the database file */
 827         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 828                 {
 829                 lookup_fail(section,ENV_DATABASE);
 830                 goto err;
 831                 }
 832         if (BIO_read_filename(in,dbfile) <= 0)
 833                 {
 834                 perror(dbfile);
 835                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
 836                 goto err;
 837                 }
 838         db=TXT_DB_read(in,DB_NUMBER);
 839         if (db == NULL) goto err;
 840
 841         /* Lets check some fields */
 842         for (i=0; i<sk_num(db->data); i++)
 843                 {
 844                 pp=(char **)sk_value(db->data,i);
 845                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 846                         (pp[DB_rev_date][0] != '\0'))
 847                         {
 848                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 849                         goto err;
 850                         }
 851                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 852                         !make_revoked(NULL, pp[DB_rev_date]))
 853                         {
 854                         BIO_printf(bio_err," in entry %d\n", i+1);
 855                         goto err;
 856                         }
 857                 if (!check_time_format(pp[DB_exp_date]))
 858                         {
 859                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 860                         goto err;
 861                         }
 862                 p=pp[DB_serial];
 863                 j=strlen(p);
 864                 if (*p == '-')
 865                         {
 866                         p++;
 867                         j--;
 868                         }
 869                 if ((j&1) || (j < 2))
 870                         {
 871                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 872                         goto err;
 873                         }
 874                 while (*p)
 875                         {
 876                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 877                                 ((*p >= 'A') && (*p <= 'F')) ||
 878                                 ((*p >= 'a') && (*p <= 'f')))  )
 879                                 {
 880                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 881                                 goto err;
 882                                 }
 883                         p++;
 884                         }
 885                 }
 886         if (verbose)
 887                 {
 888                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 889 #ifdef OPENSSL_SYS_VMS
 890                 {
 891                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 892                 out = BIO_push(tmpbio, out);
 893                 }
 894 #endif
 895                 TXT_DB_write(out,db);
 896                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 897                         db->data->num);
 898                 BIO_printf(bio_err,"generating index\n");
 899                 }
 900
 901         if (!make_serial_index(db))
 902                 goto err;
 903
 904         if (!TXT_DB_create_index(db, DB_name, index_name_qual,
 905                         LHASH_HASH_FN(index_name_hash),
 906                         LHASH_COMP_FN(index_name_cmp)))
 907                 {
 908                 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
 909                         db->error,db->arg1,db->arg2);
 910                 goto err;
 911                 }
 912
 913         /*****************************************************************/
 914         /* Update the db file for expired certificates */
 915         if (doupdatedb)
 916                 {
 917                 if (verbose)
 918                         BIO_printf(bio_err, "Updating %s ...\n",
 919                                                         dbfile);
 920
 921                 i = do_updatedb(db);
 922                 if (i == -1)
 923                         {
 924                         BIO_printf(bio_err,"Malloc failure\n");
 925                         goto err;
 926                         }
 927                 else if (i == 0)
 928                         {
 929                         if (verbose) BIO_printf(bio_err,
 930                                         "No entries found to mark expired\n");
 931                         }
 932                 else
 933                         {
 934                         out = BIO_new(BIO_s_file());
 935                         if (out == NULL)
 936                                 {
 937                                 ERR_print_errors(bio_err);
 938                                 goto err;
 939                                 }
 940
 941 #ifndef OPENSSL_SYS_VMS
 942                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
 943 #else
 944                         j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
 945 #endif
 946                         if (j < 0 || j >= sizeof buf[0])
 947                                 {
 948                                 BIO_printf(bio_err, "file name too long\n");
 949                                 goto err;
 950                                 }
 951                         if (BIO_write_filename(out,buf[0]) <= 0)
 952                                 {
 953                                 perror(dbfile);
 954                                 BIO_printf(bio_err,"unable to open '%s'\n",
 955                                                                         dbfile);
 956                                 goto err;
 957                                 }
 958                         j=TXT_DB_write(out,db);
 959                         if (j <= 0) goto err;
 960
 961                         BIO_free(out);
 962                         out = NULL;
 963 #ifndef OPENSSL_SYS_VMS
 964                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
 965 #else
 966                         j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
 967 #endif
 968                         if (j < 0 || j >= sizeof buf[1])
 969                                 {
 970                                 BIO_printf(bio_err, "file name too long\n");
 971                                 goto err;
 972                                 }
 973                         if (rename(dbfile,buf[1]) < 0)
 974                                 {
 975                                 BIO_printf(bio_err,
 976                                                 "unable to rename %s to %s\n",
 977                                                 dbfile, buf[1]);
 978                                 perror("reason");
 979                                 goto err;
 980                                 }
 981                         if (rename(buf[0],dbfile) < 0)
 982                                 {
 983                                 BIO_printf(bio_err,
 984                                                 "unable to rename %s to %s\n",
 985                                                 buf[0],dbfile);
 986                                 perror("reason");
 987                                 rename(buf[1],dbfile);
 988                                 goto err;
 989                                 }
 990
 991                         if (verbose) BIO_printf(bio_err,
 992                                 "Done. %d entries marked as expired\n",i);
 993                         }
 994                         goto err;
 995                 }
 996
 997         /*****************************************************************/
 998         /* Read extentions config file                                   */
 999         if (extfile)
1000                 {
1001                 extconf = NCONF_new(NULL);
1002                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
1003                         {
1004                         if (errorline <= 0)
1005                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
1006                                         extfile);
1007                         else
1008                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
1009                                         errorline,extfile);
1010                         ret = 1;
1011                         goto err;
1012                         }
1013
1014                 if (verbose)
1015                         BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
1016
1017                 /* We can have sections in the ext file */
1018                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
1019                         extensions = "default";
1020                 }
1021
1022         /*****************************************************************/
1023         if (req || gencrl)
1024                 {
1025                 if (outfile != NULL)
1026                         {
1027                         if (BIO_write_filename(Sout,outfile) <= 0)
1028                                 {
1029                                 perror(outfile);
1030                                 goto err;
1031                                 }
1032                         }
1033                 else
1034                         {
1035                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1036 #ifdef OPENSSL_SYS_VMS
1037                         {
1038                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1039                         Sout = BIO_push(tmpbio, Sout);
1040                         }
1041 #endif
1042                         }
1043                 }
1044
1045         if (req)
1046                 {
1047                 if ((md == NULL) && ((md=NCONF_get_string(conf,
1048                         section,ENV_DEFAULT_MD)) == NULL))
1049                         {
1050                         lookup_fail(section,ENV_DEFAULT_MD);
1051                         goto err;
1052                         }
1053                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1054                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1055                         {
1056                         if(strcmp(tmp_email_dn,"no") == 0)
1057                                 email_dn=0;
1058                         }
1059                 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1060                         {
1061                         BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1062                         goto err;
1063                         }
1064                 if (verbose)
1065                         BIO_printf(bio_err,"message digest is %s\n",
1066                                 OBJ_nid2ln(dgst->type));
1067                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1068                         section,ENV_POLICY)) == NULL))
1069                         {
1070                         lookup_fail(section,ENV_POLICY);
1071                         goto err;
1072                         }
1073                 if (verbose)
1074                         BIO_printf(bio_err,"policy is %s\n",policy);
1075
1076                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1077                         == NULL)
1078                         {
1079                         lookup_fail(section,ENV_SERIAL);
1080                         goto err;
1081                         }
1082
1083                 if (!extconf)
1084                         {
1085                         /* no '-extfile' option, so we look for extensions
1086                          * in the main configuration file */
1087                         if (!extensions)
1088                                 {
1089                                 extensions=NCONF_get_string(conf,section,
1090                                                                 ENV_EXTENSIONS);
1091                                 if (!extensions)
1092                                         ERR_clear_error();
1093                                 }
1094                         if (extensions)
1095                                 {
1096                                 /* Check syntax of file */
1097                                 X509V3_CTX ctx;
1098                                 X509V3_set_ctx_test(&ctx);
1099                                 X509V3_set_nconf(&ctx, conf);
1100                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1101                                                                 NULL))
1102                                         {
1103                                         BIO_printf(bio_err,
1104                                         "Error Loading extension section %s\n",
1105                                                                  extensions);
1106                                         ret = 1;
1107                                         goto err;
1108                                         }
1109                                 }
1110                         }
1111
1112                 if (startdate == NULL)
1113                         {
1114                         startdate=NCONF_get_string(conf,section,
1115                                 ENV_DEFAULT_STARTDATE);
1116                         if (startdate == NULL)
1117                                 ERR_clear_error();
1118                         }
1119                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1120                         {
1121                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1122                         goto err;
1123                         }
1124                 if (startdate == NULL) startdate="today";
1125
1126                 if (enddate == NULL)
1127                         {
1128                         enddate=NCONF_get_string(conf,section,
1129                                 ENV_DEFAULT_ENDDATE);
1130                         if (enddate == NULL)
1131                                 ERR_clear_error();
1132                         }
1133                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1134                         {
1135                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1136                         goto err;
1137                         }
1138
1139                 if (days == 0)
1140                         {
1141                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1142                                 days = 0;
1143                         }
1144                 if (!enddate && (days == 0))
1145                         {
1146                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1147                         goto err;
1148                         }
1149
1150                 if ((serial=load_serial(serialfile)) == NULL)
1151                         {
1152                         BIO_printf(bio_err,"error while loading serial number\n");
1153                         goto err;
1154                         }
1155                 if (verbose)
1156                         {
1157                         if ((f=BN_bn2hex(serial)) == NULL) goto err;
1158                         BIO_printf(bio_err,"next serial number is %s\n",f);
1159                         OPENSSL_free(f);
1160                         }
1161
1162                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1163                         {
1164                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1165                         goto err;
1166                         }
1167
1168                 if ((cert_sk=sk_X509_new_null()) == NULL)
1169                         {
1170                         BIO_printf(bio_err,"Memory allocation failure\n");
1171                         goto err;
1172                         }
1173                 if (spkac_file != NULL)
1174                         {
1175                         total++;
1176                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1177                                 serial,subj,email_dn,startdate,enddate,days,extensions,
1178                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1179                         if (j < 0) goto err;
1180                         if (j > 0)
1181                                 {
1182                                 total_done++;
1183                                 BIO_printf(bio_err,"\n");
1184                                 if (!BN_add_word(serial,1)) goto err;
1185                                 if (!sk_X509_push(cert_sk,x))
1186                                         {
1187                                         BIO_printf(bio_err,"Memory allocation failure\n");
1188                                         goto err;
1189                                         }
1190                                 if (outfile)
1191                                         {
1192                                         output_der = 1;
1193                                         batch = 1;
1194                                         }
1195                                 }
1196                         }
1197                 if (ss_cert_file != NULL)
1198                         {
1199                         total++;
1200                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1201                                 db,serial,subj,email_dn,startdate,enddate,days,batch,
1202                                 extensions,conf,verbose, certopt, nameopt,
1203                                 default_op, ext_copy, e);
1204                         if (j < 0) goto err;
1205                         if (j > 0)
1206                                 {
1207                                 total_done++;
1208                                 BIO_printf(bio_err,"\n");
1209                                 if (!BN_add_word(serial,1)) goto err;
1210                                 if (!sk_X509_push(cert_sk,x))
1211                                         {
1212                                         BIO_printf(bio_err,"Memory allocation failure\n");
1213                                         goto err;
1214                                         }
1215                                 }
1216                         }
1217                 if (infile != NULL)
1218                         {
1219                         total++;
1220                         j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1221                                 serial,subj,email_dn,startdate,enddate,days,batch,
1222                                 extensions,conf,verbose, certopt, nameopt,
1223                                 default_op, ext_copy);
1224                         if (j < 0) goto err;
1225                         if (j > 0)
1226                                 {
1227                                 total_done++;
1228                                 BIO_printf(bio_err,"\n");
1229                                 if (!BN_add_word(serial,1)) goto err;
1230                                 if (!sk_X509_push(cert_sk,x))
1231                                         {
1232                                         BIO_printf(bio_err,"Memory allocation failure\n");
1233                                         goto err;
1234                                         }
1235                                 }
1236                         }
1237                 for (i=0; i<argc; i++)
1238                         {
1239                         total++;
1240                         j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1241                                 serial,subj,email_dn,startdate,enddate,days,batch,
1242                                 extensions,conf,verbose, certopt, nameopt,
1243                                 default_op, ext_copy);
1244                         if (j < 0) goto err;
1245                         if (j > 0)
1246                                 {
1247                                 total_done++;
1248                                 BIO_printf(bio_err,"\n");
1249                                 if (!BN_add_word(serial,1)) goto err;
1250                                 if (!sk_X509_push(cert_sk,x))
1251                                         {
1252                                         BIO_printf(bio_err,"Memory allocation failure\n");
1253                                         goto err;
1254                                         }
1255                                 }
1256                         }
1257                 /* we have a stack of newly certified certificates
1258                  * and a data base and serial number that need
1259                  * updating */
1260
1261                 if (sk_X509_num(cert_sk) > 0)
1262                         {
1263                         if (!batch)
1264                                 {
1265                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1266                                 (void)BIO_flush(bio_err);
1267                                 buf[0][0]='\0';
1268                                 fgets(buf[0],10,stdin);
1269                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1270                                         {
1271                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1272                                         ret=0;
1273                                         goto err;
1274                                         }
1275                                 }
1276
1277                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1278
1279                         strncpy(buf[0],serialfile,BSIZE-4);
1280                         buf[0][BSIZE-4]='\0';
1281
1282 #ifdef OPENSSL_SYS_VMS
1283                         strcat(buf[0],"-new");
1284 #else
1285                         strcat(buf[0],".new");
1286 #endif
1287
1288                         if (!save_serial(buf[0],serial)) goto err;
1289
1290                         strncpy(buf[1],dbfile,BSIZE-4);
1291                         buf[1][BSIZE-4]='\0';
1292
1293 #ifdef OPENSSL_SYS_VMS
1294                         strcat(buf[1],"-new");
1295 #else
1296                         strcat(buf[1],".new");
1297 #endif
1298
1299                         if (BIO_write_filename(out,buf[1]) <= 0)
1300                                 {
1301                                 perror(dbfile);
1302                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1303                                 goto err;
1304                                 }
1305                         l=TXT_DB_write(out,db);
1306                         if (l <= 0) goto err;
1307                         }
1308
1309                 if (verbose)
1310                         BIO_printf(bio_err,"writing new certificates\n");
1311                 for (i=0; i<sk_X509_num(cert_sk); i++)
1312                         {
1313                         int k;
1314                         unsigned char *n;
1315
1316                         x=sk_X509_value(cert_sk,i);
1317
1318                         j=x->cert_info->serialNumber->length;
1319                         p=(char *)x->cert_info->serialNumber->data;
1320
1321                         strncpy(buf[2],outdir,BSIZE-(j*2)-6);
1322                         buf[2][BSIZE-(j*2)-6]='\0';
1323
1324 #ifndef OPENSSL_SYS_VMS
1325                         strcat(buf[2],"/");
1326 #endif
1327
1328                         n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1329                         if (j > 0)
1330                                 {
1331                                 for (k=0; k<j; k++)
1332                                         {
1333                                         sprintf((char *)n,"%02X",(unsigned char)*(p++));
1334                                         n+=2;
1335                                         }
1336                                 }
1337                         else
1338                                 {
1339                                 *(n++)='0';
1340                                 *(n++)='0';
1341                                 }
1342                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1343                         *n='\0';
1344                         if (verbose)
1345                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1346
1347                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1348                                 {
1349                                 perror(buf[2]);
1350                                 goto err;
1351                                 }
1352                         write_new_certificate(Cout,x, 0, notext);
1353                         write_new_certificate(Sout,x, output_der, notext);
1354                         }
1355
1356                 if (sk_X509_num(cert_sk))
1357                         {
1358                         /* Rename the database and the serial file */
1359                         strncpy(buf[2],serialfile,BSIZE-4);
1360                         buf[2][BSIZE-4]='\0';
1361
1362 #ifdef OPENSSL_SYS_VMS
1363                         strcat(buf[2],"-old");
1364 #else
1365                         strcat(buf[2],".old");
1366 #endif
1367
1368                         BIO_free(in);
1369                         BIO_free_all(out);
1370                         in=NULL;
1371                         out=NULL;
1372                         if (rename(serialfile,buf[2]) < 0)
1373                                 {
1374                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1375                                         serialfile,buf[2]);
1376                                 perror("reason");
1377                                 goto err;
1378                                 }
1379                         if (rename(buf[0],serialfile) < 0)
1380                                 {
1381                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1382                                         buf[0],serialfile);
1383                                 perror("reason");
1384                                 rename(buf[2],serialfile);
1385                                 goto err;
1386                                 }
1387
1388                         strncpy(buf[2],dbfile,BSIZE-4);
1389                         buf[2][BSIZE-4]='\0';
1390
1391 #ifdef OPENSSL_SYS_VMS
1392                         strcat(buf[2],"-old");
1393 #else
1394                         strcat(buf[2],".old");
1395 #endif
1396
1397                         if (rename(dbfile,buf[2]) < 0)
1398                                 {
1399                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1400                                         dbfile,buf[2]);
1401                                 perror("reason");
1402                                 goto err;
1403                                 }
1404                         if (rename(buf[1],dbfile) < 0)
1405                                 {
1406                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1407                                         buf[1],dbfile);
1408                                 perror("reason");
1409                                 rename(buf[2],dbfile);
1410                                 goto err;
1411                                 }
1412                         BIO_printf(bio_err,"Data Base Updated\n");
1413                         }
1414                 }
1415
1416         /*****************************************************************/
1417         if (gencrl)
1418                 {
1419                 int crl_v2 = 0;
1420                 if (!crl_ext)
1421                         {
1422                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1423                         if (!crl_ext)
1424                                 ERR_clear_error();
1425                         }
1426                 if (crl_ext)
1427                         {
1428                         /* Check syntax of file */
1429                         X509V3_CTX ctx;
1430                         X509V3_set_ctx_test(&ctx);
1431                         X509V3_set_nconf(&ctx, conf);
1432                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1433                                 {
1434                                 BIO_printf(bio_err,
1435                                  "Error Loading CRL extension section %s\n",
1436                                                                  crl_ext);
1437                                 ret = 1;
1438                                 goto err;
1439                                 }
1440                         }
1441
1442                 if (!crldays && !crlhours)
1443                         {
1444                         if (!NCONF_get_number(conf,section,
1445                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1446                                 crldays = 0;
1447                         if (!NCONF_get_number(conf,section,
1448                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1449                                 crlhours = 0;
1450                         }
1451                 if ((crldays == 0) && (crlhours == 0))
1452                         {
1453                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
1454                         goto err;
1455                         }
1456
1457                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1458                 if ((crl=X509_CRL_new()) == NULL) goto err;
1459                 if (!X509_CRL_set_issuer_name(crl, X509_get_issuer_name(x509))) goto err;
1460
1461                 tmptm = ASN1_TIME_new();
1462                 if (!tmptm) goto err;
1463                 X509_gmtime_adj(tmptm,0);
1464                 X509_CRL_set_lastUpdate(crl, tmptm);
1465                 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
1466                 X509_CRL_set_nextUpdate(crl, tmptm);
1467
1468                 ASN1_TIME_free(tmptm);
1469
1470                 for (i=0; i<sk_num(db->data); i++)
1471                         {
1472                         pp=(char **)sk_value(db->data,i);
1473                         if (pp[DB_type][0] == DB_TYPE_REV)
1474                                 {
1475                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1476                                 j = make_revoked(r, pp[DB_rev_date]);
1477                                 if (!j) goto err;
1478                                 if (j == 2) crl_v2 = 1;
1479                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1480                                         goto err;
1481                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1482                                 BN_free(serial);
1483                                 serial = NULL;
1484                                 if (!tmpser)
1485                                         goto err;
1486                                 X509_REVOKED_set_serialNumber(r, tmpser);
1487                                 ASN1_INTEGER_free(tmpser);
1488                                 X509_CRL_add0_revoked(crl,r);
1489                                 }
1490                         }
1491
1492                 /* sort the data so it will be written in serial
1493                  * number order */
1494                 X509_CRL_sort(crl);
1495
1496                 /* we now have a CRL */
1497                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1498                 if (md != NULL)
1499                         {
1500                         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1501                                 {
1502                                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1503                                 goto err;
1504                                 }
1505                         }
1506                 else
1507                         {
1508 #ifndef OPENSSL_NO_DSA
1509                         if (pkey->type == EVP_PKEY_DSA)
1510                                 dgst=EVP_dss1();
1511                         else
1512 #endif
1513                                 dgst=EVP_md5();
1514                         }
1515
1516                 /* Add any extensions asked for */
1517
1518                 if (crl_ext)
1519                         {
1520                         X509V3_CTX crlctx;
1521                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1522                         X509V3_set_nconf(&crlctx, conf);
1523
1524                         if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1525                                 crl_ext, crl)) goto err;
1526                         }
1527                 if (crl_ext || crl_v2)
1528                         {
1529                         if (!X509_CRL_set_version(crl, 1))
1530                                 goto err; /* version 2 CRL */
1531                         }
1532
1533                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1534
1535                 PEM_write_bio_X509_CRL(Sout,crl);
1536                 }
1537         /*****************************************************************/
1538         if (dorevoke)
1539                 {
1540                 if (infile == NULL)
1541                         {
1542                         BIO_printf(bio_err,"no input files\n");
1543                         goto err;
1544                         }
1545                 else
1546                         {
1547                         X509 *revcert;
1548                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1549                                 NULL, e, infile);
1550                         if (revcert == NULL)
1551                                 goto err;
1552                         j=do_revoke(revcert,db, rev_type, rev_arg);
1553                         if (j <= 0) goto err;
1554                         X509_free(revcert);
1555
1556                         strncpy(buf[0],dbfile,BSIZE-4);
1557                         buf[0][BSIZE-4]='\0';
1558 #ifndef OPENSSL_SYS_VMS
1559                         strcat(buf[0],".new");
1560 #else
1561                         strcat(buf[0],"-new");
1562 #endif
1563                         if (BIO_write_filename(out,buf[0]) <= 0)
1564                                 {
1565                                 perror(dbfile);
1566                                 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1567                                 goto err;
1568                                 }
1569                         j=TXT_DB_write(out,db);
1570                         if (j <= 0) goto err;
1571                         BIO_free_all(out);
1572                         out = NULL;
1573                         BIO_free_all(in);
1574                         in = NULL;
1575                         strncpy(buf[1],dbfile,BSIZE-4);
1576                         buf[1][BSIZE-4]='\0';
1577 #ifndef OPENSSL_SYS_VMS
1578                         strcat(buf[1],".old");
1579 #else
1580                         strcat(buf[1],"-old");
1581 #endif
1582                         if (rename(dbfile,buf[1]) < 0)
1583                                 {
1584                                 BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
1585                                 perror("reason");
1586                                 goto err;
1587                                 }
1588                         if (rename(buf[0],dbfile) < 0)
1589                                 {
1590                                 BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
1591                                 perror("reason");
1592                                 rename(buf[1],dbfile);
1593                                 goto err;
1594                                 }
1595                         BIO_printf(bio_err,"Data Base Updated\n");
1596                         }
1597                 }
1598         /*****************************************************************/
1599         ret=0;
1600 err:
1601         BIO_free_all(Cout);
1602         BIO_free_all(Sout);
1603         BIO_free_all(out);
1604         BIO_free_all(in);
1605
1606         sk_X509_pop_free(cert_sk,X509_free);
1607
1608         if (ret) ERR_print_errors(bio_err);
1609         app_RAND_write_file(randfile, bio_err);
1610         if (free_key)
1611                 OPENSSL_free(key);
1612         BN_free(serial);
1613         TXT_DB_free(db);
1614         EVP_PKEY_free(pkey);
1615         X509_free(x509);
1616         X509_CRL_free(crl);
1617         NCONF_free(conf);
1618         OBJ_cleanup();
1619         apps_shutdown();
1620         EXIT(ret);
1621         }
1622
1623 static void lookup_fail(char *name, char *tag)
1624         {
1625         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1626         }
1627
1628 static unsigned long index_serial_hash(const char **a)
1629         {
1630         const char *n;
1631
1632         n=a[DB_serial];
1633         while (*n == '0') n++;
1634         return(lh_strhash(n));
1635         }
1636
1637 static int index_serial_cmp(const char **a, const char **b)
1638         {
1639         const char *aa,*bb;
1640
1641         for (aa=a[DB_serial]; *aa == '0'; aa++);
1642         for (bb=b[DB_serial]; *bb == '0'; bb++);
1643         return(strcmp(aa,bb));
1644         }
1645
1646 static unsigned long index_name_hash(const char **a)
1647         { return(lh_strhash(a[DB_name])); }
1648
1649 static int index_name_qual(char **a)
1650         { return(a[0][0] == 'V'); }
1651
1652 static int index_name_cmp(const char **a, const char **b)
1653         { return(strcmp(a[DB_name],
1654              b[DB_name])); }
1655
1656 static BIGNUM *load_serial(char *serialfile)
1657         {
1658         BIO *in=NULL;
1659         BIGNUM *ret=NULL;
1660         MS_STATIC char buf[1024];
1661         ASN1_INTEGER *ai=NULL;
1662
1663         if ((in=BIO_new(BIO_s_file())) == NULL)
1664                 {
1665                 ERR_print_errors(bio_err);
1666                 goto err;
1667                 }
1668
1669         if (BIO_read_filename(in,serialfile) <= 0)
1670                 {
1671                 perror(serialfile);
1672                 goto err;
1673                 }
1674         ai=ASN1_INTEGER_new();
1675         if (ai == NULL) goto err;
1676         if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1677                 {
1678                 BIO_printf(bio_err,"unable to load number from %s\n",
1679                         serialfile);
1680                 goto err;
1681                 }
1682         ret=ASN1_INTEGER_to_BN(ai,NULL);
1683         if (ret == NULL)
1684                 {
1685                 BIO_printf(bio_err,"error converting number from bin to BIGNUM");
1686                 goto err;
1687                 }
1688 err:
1689         if (in != NULL) BIO_free(in);
1690         if (ai != NULL) ASN1_INTEGER_free(ai);
1691         return(ret);
1692         }
1693
1694 static int save_serial(char *serialfile, BIGNUM *serial)
1695         {
1696         BIO *out;
1697         int ret=0;
1698         ASN1_INTEGER *ai=NULL;
1699
1700         out=BIO_new(BIO_s_file());
1701         if (out == NULL)
1702                 {
1703                 ERR_print_errors(bio_err);
1704                 goto err;
1705                 }
1706         if (BIO_write_filename(out,serialfile) <= 0)
1707                 {
1708                 perror(serialfile);
1709                 goto err;
1710                 }
1711
1712         if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1713                 {
1714                 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1715                 goto err;
1716                 }
1717         i2a_ASN1_INTEGER(out,ai);
1718         BIO_puts(out,"\n");
1719         ret=1;
1720 err:
1721         if (out != NULL) BIO_free_all(out);
1722         if (ai != NULL) ASN1_INTEGER_free(ai);
1723         return(ret);
1724         }
1725
1726 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1727              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1728              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1729              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1730              unsigned long certopt, unsigned long nameopt, int default_op,
1731              int ext_copy)
1732         {
1733         X509_REQ *req=NULL;
1734         BIO *in=NULL;
1735         EVP_PKEY *pktmp=NULL;
1736         int ok= -1,i;
1737
1738         in=BIO_new(BIO_s_file());
1739
1740         if (BIO_read_filename(in,infile) <= 0)
1741                 {
1742                 perror(infile);
1743                 goto err;
1744                 }
1745         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1746                 {
1747                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1748                         infile);
1749                 goto err;
1750                 }
1751         if (verbose)
1752                 X509_REQ_print(bio_err,req);
1753
1754         BIO_printf(bio_err,"Check that the request matches the signature\n");
1755
1756         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1757                 {
1758                 BIO_printf(bio_err,"error unpacking public key\n");
1759                 goto err;
1760                 }
1761         i=X509_REQ_verify(req,pktmp);
1762         EVP_PKEY_free(pktmp);
1763         if (i < 0)
1764                 {
1765                 ok=0;
1766                 BIO_printf(bio_err,"Signature verification problems....\n");
1767                 goto err;
1768                 }
1769         if (i == 0)
1770                 {
1771                 ok=0;
1772                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1773                 goto err;
1774                 }
1775         else
1776                 BIO_printf(bio_err,"Signature ok\n");
1777
1778         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
1779                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1780                 certopt, nameopt, default_op, ext_copy);
1781
1782 err:
1783         if (req != NULL) X509_REQ_free(req);
1784         if (in != NULL) BIO_free(in);
1785         return(ok);
1786         }
1787
1788 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1789              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1790              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1791              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1792              unsigned long certopt, unsigned long nameopt, int default_op,
1793              int ext_copy, ENGINE *e)
1794         {
1795         X509 *req=NULL;
1796         X509_REQ *rreq=NULL;
1797         EVP_PKEY *pktmp=NULL;
1798         int ok= -1,i;
1799
1800         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1801                 goto err;
1802         if (verbose)
1803                 X509_print(bio_err,req);
1804
1805         BIO_printf(bio_err,"Check that the request matches the signature\n");
1806
1807         if ((pktmp=X509_get_pubkey(req)) == NULL)
1808                 {
1809                 BIO_printf(bio_err,"error unpacking public key\n");
1810                 goto err;
1811                 }
1812         i=X509_verify(req,pktmp);
1813         EVP_PKEY_free(pktmp);
1814         if (i < 0)
1815                 {
1816                 ok=0;
1817                 BIO_printf(bio_err,"Signature verification problems....\n");
1818                 goto err;
1819                 }
1820         if (i == 0)
1821                 {
1822                 ok=0;
1823                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1824                 goto err;
1825                 }
1826         else
1827                 BIO_printf(bio_err,"Signature ok\n");
1828
1829         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1830                 goto err;
1831
1832         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
1833                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1834                 ext_copy);
1835
1836 err:
1837         if (rreq != NULL) X509_REQ_free(rreq);
1838         if (req != NULL) X509_free(req);
1839         return(ok);
1840         }
1841
1842 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1843              STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
1844              int email_dn, char *startdate, char *enddate, long days, int batch,
1845              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1846              unsigned long certopt, unsigned long nameopt, int default_op,
1847              int ext_copy)
1848         {
1849         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1850         ASN1_UTCTIME *tm,*tmptm;
1851         ASN1_STRING *str,*str2;
1852         ASN1_OBJECT *obj;
1853         X509 *ret=NULL;
1854         X509_CINF *ci;
1855         X509_NAME_ENTRY *ne;
1856         X509_NAME_ENTRY *tne,*push;
1857         EVP_PKEY *pktmp;
1858         int ok= -1,i,j,last,nid;
1859         char *p;
1860         CONF_VALUE *cv;
1861         char *row[DB_NUMBER],**rrow,**irow=NULL;
1862         char buf[25];
1863
1864         tmptm=ASN1_UTCTIME_new();
1865         if (tmptm == NULL)
1866                 {
1867                 BIO_printf(bio_err,"malloc error\n");
1868                 return(0);
1869                 }
1870
1871         for (i=0; i<DB_NUMBER; i++)
1872                 row[i]=NULL;
1873
1874         if (subj)
1875                 {
1876                 X509_NAME *n = do_subject(subj, MBSTRING_ASC);
1877
1878                 if (!n)
1879                         {
1880                         ERR_print_errors(bio_err);
1881                         goto err;
1882                         }
1883                 X509_REQ_set_subject_name(req,n);
1884                 req->req_info->enc.modified = 1;
1885                 X509_NAME_free(n);
1886                 }
1887
1888         if (default_op)
1889                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1890
1891         name=X509_REQ_get_subject_name(req);
1892         for (i=0; i<X509_NAME_entry_count(name); i++)
1893                 {
1894                 ne= X509_NAME_get_entry(name,i);
1895                 str=X509_NAME_ENTRY_get_data(ne);
1896                 obj=X509_NAME_ENTRY_get_object(ne);
1897
1898                 if (msie_hack)
1899                         {
1900                         /* assume all type should be strings */
1901                         nid=OBJ_obj2nid(ne->object);
1902
1903                         if (str->type == V_ASN1_UNIVERSALSTRING)
1904                                 ASN1_UNIVERSALSTRING_to_string(str);
1905
1906                         if ((str->type == V_ASN1_IA5STRING) &&
1907                                 (nid != NID_pkcs9_emailAddress))
1908                                 str->type=V_ASN1_T61STRING;
1909
1910                         if ((nid == NID_pkcs9_emailAddress) &&
1911                                 (str->type == V_ASN1_PRINTABLESTRING))
1912                                 str->type=V_ASN1_IA5STRING;
1913                         }
1914
1915                 /* If no EMAIL is wanted in the subject */
1916                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1917                         continue;
1918
1919                 /* check some things */
1920                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1921                         (str->type != V_ASN1_IA5STRING))
1922                         {
1923                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1924                         goto err;
1925                         }
1926                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1927                         {
1928                         j=ASN1_PRINTABLE_type(str->data,str->length);
1929                         if (    ((j == V_ASN1_T61STRING) &&
1930                                  (str->type != V_ASN1_T61STRING)) ||
1931                                 ((j == V_ASN1_IA5STRING) &&
1932                                  (str->type == V_ASN1_PRINTABLESTRING)))
1933                                 {
1934                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1935                                 goto err;
1936                                 }
1937                         }
1938
1939                 if (default_op)
1940                         old_entry_print(bio_err, obj, str);
1941                 }
1942
1943         /* Ok, now we check the 'policy' stuff. */
1944         if ((subject=X509_NAME_new()) == NULL)
1945                 {
1946                 BIO_printf(bio_err,"Memory allocation failure\n");
1947                 goto err;
1948                 }
1949
1950         /* take a copy of the issuer name before we mess with it. */
1951         CAname=X509_NAME_dup(x509->cert_info->subject);
1952         if (CAname == NULL) goto err;
1953         str=str2=NULL;
1954
1955         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1956                 {
1957                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1958                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1959                         {
1960                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1961                         goto err;
1962                         }
1963                 obj=OBJ_nid2obj(j);
1964
1965                 last= -1;
1966                 for (;;)
1967                         {
1968                         /* lookup the object in the supplied name list */
1969                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1970                         if (j < 0)
1971                                 {
1972                                 if (last != -1) break;
1973                                 tne=NULL;
1974                                 }
1975                         else
1976                                 {
1977                                 tne=X509_NAME_get_entry(name,j);
1978                                 }
1979                         last=j;
1980
1981                         /* depending on the 'policy', decide what to do. */
1982                         push=NULL;
1983                         if (strcmp(cv->value,"optional") == 0)
1984                                 {
1985                                 if (tne != NULL)
1986                                         push=tne;
1987                                 }
1988                         else if (strcmp(cv->value,"supplied") == 0)
1989                                 {
1990                                 if (tne == NULL)
1991                                         {
1992                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1993                                         goto err;
1994                                         }
1995                                 else
1996                                         push=tne;
1997                                 }
1998                         else if (strcmp(cv->value,"match") == 0)
1999                                 {
2000                                 int last2;
2001
2002                                 if (tne == NULL)
2003                                         {
2004                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
2005                                         goto err;
2006                                         }
2007
2008                                 last2= -1;
2009
2010 again2:
2011                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
2012                                 if ((j < 0) && (last2 == -1))
2013                                         {
2014                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
2015                                         goto err;
2016                                         }
2017                                 if (j >= 0)
2018                                         {
2019                                         push=X509_NAME_get_entry(CAname,j);
2020                                         str=X509_NAME_ENTRY_get_data(tne);
2021                                         str2=X509_NAME_ENTRY_get_data(push);
2022                                         last2=j;
2023                                         if (ASN1_STRING_cmp(str,str2) != 0)
2024                                                 goto again2;
2025                                         }
2026                                 if (j < 0)
2027                                         {
2028                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
2029                                         goto err;
2030                                         }
2031                                 }
2032                         else
2033                                 {
2034                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
2035                                 goto err;
2036                                 }
2037
2038                         if (push != NULL)
2039                                 {
2040                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
2041                                         {
2042                                         if (push != NULL)
2043                                                 X509_NAME_ENTRY_free(push);
2044                                         BIO_printf(bio_err,"Memory allocation failure\n");
2045                                         goto err;
2046                                         }
2047                                 }
2048                         if (j < 0) break;
2049                         }
2050                 }
2051
2052         if (preserve)
2053                 {
2054                 X509_NAME_free(subject);
2055                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
2056                 subject=X509_NAME_dup(name);
2057                 if (subject == NULL) goto err;
2058                 }
2059
2060         if (verbose)
2061                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2062
2063         /* Build the correct Subject if no e-mail is wanted in the subject */
2064         /* and add it later on because of the method extensions are added (altName) */
2065
2066         if (email_dn)
2067                 dn_subject = subject;
2068         else
2069                 {
2070                 X509_NAME_ENTRY *tmpne;
2071                 /* Its best to dup the subject DN and then delete any email
2072                  * addresses because this retains its structure.
2073                  */
2074                 if (!(dn_subject = X509_NAME_dup(subject)))
2075                         {
2076                         BIO_printf(bio_err,"Memory allocation failure\n");
2077                         goto err;
2078                         }
2079                 while((i = X509_NAME_get_index_by_NID(dn_subject,
2080                                         NID_pkcs9_emailAddress, -1)) >= 0)
2081                         {
2082                         tmpne = X509_NAME_get_entry(dn_subject, i);
2083                         X509_NAME_delete_entry(dn_subject, i);
2084                         X509_NAME_ENTRY_free(tmpne);
2085                         }
2086                 }
2087
2088         row[DB_name]=X509_NAME_oneline(dn_subject,NULL,0);
2089         row[DB_serial]=BN_bn2hex(serial);
2090         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2091                 {
2092                 BIO_printf(bio_err,"Memory allocation failure\n");
2093                 goto err;
2094                 }
2095
2096         rrow=TXT_DB_get_by_index(db,DB_name,row);
2097         if (rrow != NULL)
2098                 {
2099                 BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
2100                         row[DB_name]);
2101                 }
2102         else
2103                 {
2104                 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2105                 if (rrow != NULL)
2106                         {
2107                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
2108                                 row[DB_serial]);
2109                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
2110                         }
2111                 }
2112
2113         if (rrow != NULL)
2114                 {
2115                 BIO_printf(bio_err,
2116                         "The matching entry has the following details\n");
2117                 if (rrow[DB_type][0] == 'E')
2118                         p="Expired";
2119                 else if (rrow[DB_type][0] == 'R')
2120                         p="Revoked";
2121                 else if (rrow[DB_type][0] == 'V')
2122                         p="Valid";
2123                 else
2124                         p="\ninvalid type, Data base error\n";
2125                 BIO_printf(bio_err,"Type          :%s\n",p);;
2126                 if (rrow[DB_type][0] == 'R')
2127                         {
2128                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2129                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
2130                         }
2131                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2132                 BIO_printf(bio_err,"Expires on    :%s\n",p);
2133                 p=rrow[DB_serial]; if (p == NULL) p="undef";
2134                 BIO_printf(bio_err,"Serial Number :%s\n",p);
2135                 p=rrow[DB_file]; if (p == NULL) p="undef";
2136                 BIO_printf(bio_err,"File name     :%s\n",p);
2137                 p=rrow[DB_name]; if (p == NULL) p="undef";
2138                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
2139                 ok= -1; /* This is now a 'bad' error. */
2140                 goto err;
2141                 }
2142
2143         /* We are now totally happy, lets make and sign the certificate */
2144         if (verbose)
2145                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
2146
2147         if ((ret=X509_new()) == NULL) goto err;
2148         ci=ret->cert_info;
2149
2150 #ifdef X509_V3
2151         /* Make it an X509 v3 certificate. */
2152         if (!X509_set_version(x509,2)) goto err;
2153 #endif
2154
2155         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2156                 goto err;
2157         if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2158                 goto err;
2159
2160         if (strcmp(startdate,"today") == 0)
2161                 X509_gmtime_adj(X509_get_notBefore(ret),0);
2162         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2163
2164         if (enddate == NULL)
2165                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2166         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2167
2168         if (!X509_set_subject_name(ret,subject)) goto err;
2169
2170         pktmp=X509_REQ_get_pubkey(req);
2171         i = X509_set_pubkey(ret,pktmp);
2172         EVP_PKEY_free(pktmp);
2173         if (!i) goto err;
2174
2175         /* Lets add the extensions, if there are any */
2176         if (ext_sect)
2177                 {
2178                 X509V3_CTX ctx;
2179                 if (ci->version == NULL)
2180                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2181                                 goto err;
2182                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2183
2184                 /* Free the current entries if any, there should not
2185                  * be any I believe */
2186                 if (ci->extensions != NULL)
2187                         sk_X509_EXTENSION_pop_free(ci->extensions,
2188                                                    X509_EXTENSION_free);
2189
2190                 ci->extensions = NULL;
2191
2192                 /* Initialize the context structure */
2193                 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2194
2195                 if (extconf)
2196                         {
2197                         if (verbose)
2198                                 BIO_printf(bio_err, "Extra configuration file found\n");
2199
2200                         /* Use the extconf configuration db LHASH */
2201                         X509V3_set_nconf(&ctx, extconf);
2202
2203                         /* Test the structure (needed?) */
2204                         /* X509V3_set_ctx_test(&ctx); */
2205
2206                         /* Adds exts contained in the configuration file */
2207                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2208                                 {
2209                                 BIO_printf(bio_err,
2210                                     "ERROR: adding extensions in section %s\n",
2211                                                                 ext_sect);
2212                                 ERR_print_errors(bio_err);
2213                                 goto err;
2214                                 }
2215                         if (verbose)
2216                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2217                         }
2218                 else if (ext_sect)
2219                         {
2220                         /* We found extensions to be set from config file */
2221                         X509V3_set_nconf(&ctx, lconf);
2222
2223                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2224                                 {
2225                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2226                                 ERR_print_errors(bio_err);
2227                                 goto err;
2228                                 }
2229
2230                         if (verbose)
2231                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2232                         }
2233                 }
2234
2235         /* Copy extensions from request (if any) */
2236
2237         if (!copy_extensions(ret, req, ext_copy))
2238                 {
2239                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2240                 ERR_print_errors(bio_err);
2241                 goto err;
2242                 }
2243
2244         /* Set the right value for the noemailDN option */
2245         if( email_dn == 0 )
2246                 {
2247                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2248                 }
2249
2250         if (!default_op)
2251                 {
2252                 BIO_printf(bio_err, "Certificate Details:\n");
2253                 /* Never print signature details because signature not present */
2254                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2255                 X509_print_ex(bio_err, ret, nameopt, certopt);
2256                 }
2257
2258         BIO_printf(bio_err,"Certificate is to be certified until ");
2259         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2260         if (days) BIO_printf(bio_err," (%d days)",days);
2261         BIO_printf(bio_err, "\n");
2262
2263         if (!batch)
2264                 {
2265
2266                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2267                 (void)BIO_flush(bio_err);
2268                 buf[0]='\0';
2269                 fgets(buf,sizeof(buf)-1,stdin);
2270                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2271                         {
2272                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2273                         ok=0;
2274                         goto err;
2275                         }
2276                 }
2277
2278
2279 #ifndef OPENSSL_NO_DSA
2280         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2281         pktmp=X509_get_pubkey(ret);
2282         if (EVP_PKEY_missing_parameters(pktmp) &&
2283                 !EVP_PKEY_missing_parameters(pkey))
2284                 EVP_PKEY_copy_parameters(pktmp,pkey);
2285         EVP_PKEY_free(pktmp);
2286 #endif
2287
2288         if (!X509_sign(ret,pkey,dgst))
2289                 goto err;
2290
2291         /* We now just add it to the database */
2292         row[DB_type]=(char *)OPENSSL_malloc(2);
2293
2294         tm=X509_get_notAfter(ret);
2295         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2296         memcpy(row[DB_exp_date],tm->data,tm->length);
2297         row[DB_exp_date][tm->length]='\0';
2298
2299         row[DB_rev_date]=NULL;
2300
2301         /* row[DB_serial] done already */
2302         row[DB_file]=(char *)OPENSSL_malloc(8);
2303         /* row[DB_name] done already */
2304
2305         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2306                 (row[DB_file] == NULL))
2307                 {
2308                 BIO_printf(bio_err,"Memory allocation failure\n");
2309                 goto err;
2310                 }
2311         strcpy(row[DB_file],"unknown");
2312         row[DB_type][0]='V';
2313         row[DB_type][1]='\0';
2314
2315         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2316                 {
2317                 BIO_printf(bio_err,"Memory allocation failure\n");
2318                 goto err;
2319                 }
2320
2321         for (i=0; i<DB_NUMBER; i++)
2322                 {
2323                 irow[i]=row[i];
2324                 row[i]=NULL;
2325                 }
2326         irow[DB_NUMBER]=NULL;
2327
2328         if (!TXT_DB_insert(db,irow))
2329                 {
2330                 BIO_printf(bio_err,"failed to update database\n");
2331                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2332                 goto err;
2333                 }
2334         ok=1;
2335 err:
2336         for (i=0; i<DB_NUMBER; i++)
2337                 if (row[i] != NULL) OPENSSL_free(row[i]);
2338
2339         if (CAname != NULL)
2340                 X509_NAME_free(CAname);
2341         if (subject != NULL)
2342                 X509_NAME_free(subject);
2343         if ((dn_subject != NULL) && !email_dn)
2344                 X509_NAME_free(dn_subject);
2345         if (tmptm != NULL)
2346                 ASN1_UTCTIME_free(tmptm);
2347         if (ok <= 0)
2348                 {
2349                 if (ret != NULL) X509_free(ret);
2350                 ret=NULL;
2351                 }
2352         else
2353                 *xret=ret;
2354         return(ok);
2355         }
2356
2357 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2358         {
2359
2360         if (output_der)
2361                 {
2362                 (void)i2d_X509_bio(bp,x);
2363                 return;
2364                 }
2365 #if 0
2366         /* ??? Not needed since X509_print prints all this stuff anyway */
2367         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2368         BIO_printf(bp,"issuer :%s\n",f);
2369
2370         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2371         BIO_printf(bp,"subject:%s\n",f);
2372
2373         BIO_puts(bp,"serial :");
2374         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2375         BIO_puts(bp,"\n\n");
2376 #endif
2377         if (!notext)X509_print(bp,x);
2378         PEM_write_bio_X509(bp,x);
2379         }
2380
2381 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2382              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2383              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
2384              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2385              unsigned long nameopt, int default_op, int ext_copy)
2386         {
2387         STACK_OF(CONF_VALUE) *sk=NULL;
2388         LHASH *parms=NULL;
2389         X509_REQ *req=NULL;
2390         CONF_VALUE *cv=NULL;
2391         NETSCAPE_SPKI *spki = NULL;
2392         X509_REQ_INFO *ri;
2393         char *type,*buf;
2394         EVP_PKEY *pktmp=NULL;
2395         X509_NAME *n=NULL;
2396         X509_NAME_ENTRY *ne=NULL;
2397         int ok= -1,i,j;
2398         long errline;
2399         int nid;
2400
2401         /*
2402          * Load input file into a hash table.  (This is just an easy
2403          * way to read and parse the file, then put it into a convenient
2404          * STACK format).
2405          */
2406         parms=CONF_load(NULL,infile,&errline);
2407         if (parms == NULL)
2408                 {
2409                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2410                 ERR_print_errors(bio_err);
2411                 goto err;
2412                 }
2413
2414         sk=CONF_get_section(parms, "default");
2415         if (sk_CONF_VALUE_num(sk) == 0)
2416                 {
2417                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2418                 CONF_free(parms);
2419                 goto err;
2420                 }
2421
2422         /*
2423          * Now create a dummy X509 request structure.  We don't actually
2424          * have an X509 request, but we have many of the components
2425          * (a public key, various DN components).  The idea is that we
2426          * put these components into the right X509 request structure
2427          * and we can use the same code as if you had a real X509 request.
2428          */
2429         req=X509_REQ_new();
2430         if (req == NULL)
2431                 {
2432                 ERR_print_errors(bio_err);
2433                 goto err;
2434                 }
2435
2436         /*
2437          * Build up the subject name set.
2438          */
2439         ri=req->req_info;
2440         n = ri->subject;
2441
2442         for (i = 0; ; i++)
2443                 {
2444                 if (sk_CONF_VALUE_num(sk) <= i) break;
2445
2446                 cv=sk_CONF_VALUE_value(sk,i);
2447                 type=cv->name;
2448                 /* Skip past any leading X. X: X, etc to allow for
2449                  * multiple instances
2450                  */
2451                 for (buf = cv->name; *buf ; buf++)
2452                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2453                                 {
2454                                 buf++;
2455                                 if (*buf) type = buf;
2456                                 break;
2457                                 }
2458
2459                 buf=cv->value;
2460                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2461                         {
2462                         if (strcmp(type, "SPKAC") == 0)
2463                                 {
2464                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2465                                 if (spki == NULL)
2466                                         {
2467                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2468                                         ERR_print_errors(bio_err);
2469                                         goto err;
2470                                         }
2471                                 }
2472                         continue;
2473                         }
2474
2475                 /*
2476                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2477                         continue;
2478                 */
2479
2480                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2481                 if (fix_data(nid, &j) == 0)
2482                         {
2483                         BIO_printf(bio_err,
2484                                 "invalid characters in string %s\n",buf);
2485                         goto err;
2486                         }
2487
2488                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2489                         (unsigned char *)buf,
2490                         strlen(buf))) == NULL)
2491                         goto err;
2492
2493                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2494                 }
2495         if (spki == NULL)
2496                 {
2497                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2498                         infile);
2499                 goto err;
2500                 }
2501
2502         /*
2503          * Now extract the key from the SPKI structure.
2504          */
2505
2506         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2507
2508         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2509                 {
2510                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2511                 goto err;
2512                 }
2513
2514         j = NETSCAPE_SPKI_verify(spki, pktmp);
2515         if (j <= 0)
2516                 {
2517                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2518                 goto err;
2519                 }
2520         BIO_printf(bio_err,"Signature ok\n");
2521
2522         X509_REQ_set_pubkey(req,pktmp);
2523         EVP_PKEY_free(pktmp);
2524         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
2525                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2526                         ext_copy);
2527 err:
2528         if (req != NULL) X509_REQ_free(req);
2529         if (parms != NULL) CONF_free(parms);
2530         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2531         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2532
2533         return(ok);
2534         }
2535
2536 static int fix_data(int nid, int *type)
2537         {
2538         if (nid == NID_pkcs9_emailAddress)
2539                 *type=V_ASN1_IA5STRING;
2540         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2541                 *type=V_ASN1_T61STRING;
2542         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2543                 *type=V_ASN1_T61STRING;
2544         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2545                 return(0);
2546         if (nid == NID_pkcs9_unstructuredName)
2547                 *type=V_ASN1_IA5STRING;
2548         return(1);
2549         }
2550
2551 static int check_time_format(char *str)
2552         {
2553         ASN1_UTCTIME tm;
2554
2555         tm.data=(unsigned char *)str;
2556         tm.length=strlen(str);
2557         tm.type=V_ASN1_UTCTIME;
2558         return(ASN1_UTCTIME_check(&tm));
2559         }
2560
2561 static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2562         {
2563         ASN1_UTCTIME *tm=NULL;
2564         char *row[DB_NUMBER],**rrow,**irow;
2565         char *rev_str = NULL;
2566         BIGNUM *bn = NULL;
2567         int ok=-1,i;
2568
2569         for (i=0; i<DB_NUMBER; i++)
2570                 row[i]=NULL;
2571         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2572         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2573         row[DB_serial]=BN_bn2hex(bn);
2574         BN_free(bn);
2575         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2576                 {
2577                 BIO_printf(bio_err,"Memory allocation failure\n");
2578                 goto err;
2579                 }
2580         /* We have to lookup by serial number because name lookup
2581          * skips revoked certs
2582          */
2583         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2584         if (rrow == NULL)
2585                 {
2586                 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
2587
2588                 /* We now just add it to the database */
2589                 row[DB_type]=(char *)OPENSSL_malloc(2);
2590
2591                 tm=X509_get_notAfter(x509);
2592                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2593                 memcpy(row[DB_exp_date],tm->data,tm->length);
2594                 row[DB_exp_date][tm->length]='\0';
2595
2596                 row[DB_rev_date]=NULL;
2597
2598                 /* row[DB_serial] done already */
2599                 row[DB_file]=(char *)OPENSSL_malloc(8);
2600
2601                 /* row[DB_name] done already */
2602
2603                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2604                         (row[DB_file] == NULL))
2605                         {
2606                         BIO_printf(bio_err,"Memory allocation failure\n");
2607                         goto err;
2608                         }
2609                 strcpy(row[DB_file],"unknown");
2610                 row[DB_type][0]='V';
2611                 row[DB_type][1]='\0';
2612
2613                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2614                         {
2615                         BIO_printf(bio_err,"Memory allocation failure\n");
2616                         goto err;
2617                         }
2618
2619                 for (i=0; i<DB_NUMBER; i++)
2620                         {
2621                         irow[i]=row[i];
2622                         row[i]=NULL;
2623                         }
2624                 irow[DB_NUMBER]=NULL;
2625
2626                 if (!TXT_DB_insert(db,irow))
2627                         {
2628                         BIO_printf(bio_err,"failed to update database\n");
2629                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2630                         goto err;
2631                         }
2632
2633                 /* Revoke Certificate */
2634                 ok = do_revoke(x509,db, type, value);
2635
2636                 goto err;
2637
2638                 }
2639         else if (index_name_cmp((const char **)row,(const char **)rrow))
2640                 {
2641                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2642                            row[DB_name]);
2643                 goto err;
2644                 }
2645         else if (rrow[DB_type][0]=='R')
2646                 {
2647                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2648                            row[DB_serial]);
2649                 goto err;
2650                 }
2651         else
2652                 {
2653                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2654                 rev_str = make_revocation_str(type, value);
2655                 if (!rev_str)
2656                         {
2657                         BIO_printf(bio_err, "Error in revocation arguments\n");
2658                         goto err;
2659                         }
2660                 rrow[DB_type][0]='R';
2661                 rrow[DB_type][1]='\0';
2662                 rrow[DB_rev_date] = rev_str;
2663                 }
2664         ok=1;
2665 err:
2666         for (i=0; i<DB_NUMBER; i++)
2667                 {
2668                 if (row[i] != NULL)
2669                         OPENSSL_free(row[i]);
2670                 }
2671         return(ok);
2672         }
2673
2674 static int get_certificate_status(const char *serial, TXT_DB *db)
2675         {
2676         char *row[DB_NUMBER],**rrow;
2677         int ok=-1,i;
2678
2679         /* Free Resources */
2680         for (i=0; i<DB_NUMBER; i++)
2681                 row[i]=NULL;
2682
2683         /* Malloc needed char spaces */
2684         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2685         if (row[DB_serial] == NULL)
2686                 {
2687                 BIO_printf(bio_err,"Malloc failure\n");
2688                 goto err;
2689                 }
2690
2691         if (strlen(serial) % 2)
2692                 {
2693                 /* Set the first char to 0 */;
2694                 row[DB_serial][0]='0';
2695
2696                 /* Copy String from serial to row[DB_serial] */
2697                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2698                 row[DB_serial][strlen(serial)+1]='\0';
2699                 }
2700         else
2701                 {
2702                 /* Copy String from serial to row[DB_serial] */
2703                 memcpy(row[DB_serial], serial, strlen(serial));
2704                 row[DB_serial][strlen(serial)]='\0';
2705                 }
2706
2707         /* Make it Upper Case */
2708         for (i=0; row[DB_serial][i] != '\0'; i++)
2709                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2710
2711
2712         ok=1;
2713
2714         /* Search for the certificate */
2715         rrow=TXT_DB_get_by_index(db,DB_serial,row);
2716         if (rrow == NULL)
2717                 {
2718                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2719                                  row[DB_serial]);
2720                 ok=-1;
2721                 goto err;
2722                 }
2723         else if (rrow[DB_type][0]=='V')
2724                 {
2725                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2726                         row[DB_serial], rrow[DB_type][0]);
2727                 goto err;
2728                 }
2729         else if (rrow[DB_type][0]=='R')
2730                 {
2731                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2732                         row[DB_serial], rrow[DB_type][0]);
2733                 goto err;
2734                 }
2735         else if (rrow[DB_type][0]=='E')
2736                 {
2737                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2738                         row[DB_serial], rrow[DB_type][0]);
2739                 goto err;
2740                 }
2741         else if (rrow[DB_type][0]=='S')
2742                 {
2743                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2744                         row[DB_serial], rrow[DB_type][0]);
2745                 goto err;
2746                 }
2747         else
2748                 {
2749                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2750                         row[DB_serial], rrow[DB_type][0]);
2751                 ok=-1;
2752                 }
2753 err:
2754         for (i=0; i<DB_NUMBER; i++)
2755                 {
2756                 if (row[i] != NULL)
2757                         OPENSSL_free(row[i]);
2758                 }
2759         return(ok);
2760         }
2761
2762 static int do_updatedb (TXT_DB *db)
2763         {
2764         ASN1_UTCTIME    *a_tm = NULL;
2765         int i, cnt = 0;
2766         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2767         char **rrow, *a_tm_s;
2768
2769         a_tm = ASN1_UTCTIME_new();
2770
2771         /* get actual time and make a string */
2772         a_tm = X509_gmtime_adj(a_tm, 0);
2773         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2774         if (a_tm_s == NULL)
2775                 {
2776                 cnt = -1;
2777                 goto err;
2778                 }
2779
2780         memcpy(a_tm_s, a_tm->data, a_tm->length);
2781         a_tm_s[a_tm->length] = '\0';
2782
2783         if (strncmp(a_tm_s, "49", 2) <= 0)
2784                 a_y2k = 1;
2785         else
2786                 a_y2k = 0;
2787
2788         for (i = 0; i < sk_num(db->data); i++)
2789                 {
2790                 rrow = (char **) sk_value(db->data, i);
2791
2792                 if (rrow[DB_type][0] == 'V')
2793                         {
2794                         /* ignore entries that are not valid */
2795                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2796                                 db_y2k = 1;
2797                         else
2798                                 db_y2k = 0;
2799
2800                         if (db_y2k == a_y2k)
2801                                 {
2802                                 /* all on the same y2k side */
2803                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2804                                         {
2805                                         rrow[DB_type][0]  = 'E';
2806                                         rrow[DB_type][1]  = '\0';
2807                                         cnt++;
2808
2809                                         BIO_printf(bio_err, "%s=Expired\n",
2810                                                         rrow[DB_serial]);
2811                                         }
2812                                 }
2813                         else if (db_y2k < a_y2k)
2814                                 {
2815                                 rrow[DB_type][0]  = 'E';
2816                                 rrow[DB_type][1]  = '\0';
2817                                 cnt++;
2818
2819                                 BIO_printf(bio_err, "%s=Expired\n",
2820                                                         rrow[DB_serial]);
2821                                 }
2822
2823                         }
2824                 }
2825
2826 err:
2827
2828         ASN1_UTCTIME_free(a_tm);
2829         OPENSSL_free(a_tm_s);
2830
2831         return (cnt);
2832         }
2833
2834 static char *crl_reasons[] = {
2835         /* CRL reason strings */
2836         "unspecified",
2837         "keyCompromise",
2838         "CACompromise",
2839         "affiliationChanged",
2840         "superseded",
2841         "cessationOfOperation",
2842         "certificateHold",
2843         "removeFromCRL",
2844         /* Additional pseudo reasons */
2845         "holdInstruction",
2846         "keyTime",
2847         "CAkeyTime"
2848 };
2849
2850 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2851
2852 /* Given revocation information convert to a DB string.
2853  * The format of the string is:
2854  * revtime[,reason,extra]. Where 'revtime' is the
2855  * revocation time (the current time). 'reason' is the
2856  * optional CRL reason and 'extra' is any additional
2857  * argument
2858  */
2859
2860 char *make_revocation_str(int rev_type, char *rev_arg)
2861         {
2862         char *reason = NULL, *other = NULL, *str;
2863         ASN1_OBJECT *otmp;
2864         ASN1_UTCTIME *revtm = NULL;
2865         int i;
2866         switch (rev_type)
2867                 {
2868         case REV_NONE:
2869                 break;
2870
2871         case REV_CRL_REASON:
2872                 for (i = 0; i < 8; i++)
2873                         {
2874                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2875                                 {
2876                                 reason = crl_reasons[i];
2877                                 break;
2878                                 }
2879                         }
2880                 if (reason == NULL)
2881                         {
2882                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2883                         return NULL;
2884                         }
2885                 break;
2886
2887         case REV_HOLD:
2888                 /* Argument is an OID */
2889
2890                 otmp = OBJ_txt2obj(rev_arg, 0);
2891                 ASN1_OBJECT_free(otmp);
2892
2893                 if (otmp == NULL)
2894                         {
2895                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2896                         return NULL;
2897                         }
2898
2899                 reason = "holdInstruction";
2900                 other = rev_arg;
2901                 break;
2902
2903         case REV_KEY_COMPROMISE:
2904         case REV_CA_COMPROMISE:
2905
2906                 /* Argument is the key compromise time  */
2907                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2908                         {
2909                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2910                         return NULL;
2911                         }
2912                 other = rev_arg;
2913                 if (rev_type == REV_KEY_COMPROMISE)
2914                         reason = "keyTime";
2915                 else
2916                         reason = "CAkeyTime";
2917
2918                 break;
2919
2920                 }
2921
2922         revtm = X509_gmtime_adj(NULL, 0);
2923
2924         i = revtm->length + 1;
2925
2926         if (reason) i += strlen(reason) + 1;
2927         if (other) i += strlen(other) + 1;
2928
2929         str = OPENSSL_malloc(i);
2930
2931         if (!str) return NULL;
2932
2933         strcpy(str, (char *)revtm->data);
2934         if (reason)
2935                 {
2936                 strcat(str, ",");
2937                 strcat(str, reason);
2938                 }
2939         if (other)
2940                 {
2941                 strcat(str, ",");
2942                 strcat(str, other);
2943                 }
2944         ASN1_UTCTIME_free(revtm);
2945         return str;
2946         }
2947
2948 /* Convert revocation field to X509_REVOKED entry
2949  * return code:
2950  * 0 error
2951  * 1 OK
2952  * 2 OK and some extensions added (i.e. V2 CRL)
2953  */
2954
2955
2956 int make_revoked(X509_REVOKED *rev, char *str)
2957         {
2958         char *tmp = NULL;
2959         int reason_code = -1;
2960         int i, ret = 0;
2961         ASN1_OBJECT *hold = NULL;
2962         ASN1_GENERALIZEDTIME *comp_time = NULL;
2963         ASN1_ENUMERATED *rtmp = NULL;
2964
2965         ASN1_TIME *revDate = NULL;
2966
2967         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2968
2969         if (i == 0)
2970                 goto err;
2971
2972         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2973                 goto err;
2974
2975         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2976                 {
2977                 rtmp = ASN1_ENUMERATED_new();
2978                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2979                         goto err;
2980                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2981                         goto err;
2982                 }
2983
2984         if (rev && comp_time)
2985                 {
2986                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2987                         goto err;
2988                 }
2989         if (rev && hold)
2990                 {
2991                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2992                         goto err;
2993                 }
2994
2995         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2996                 ret = 2;
2997         else ret = 1;
2998
2999         err:
3000
3001         if (tmp) OPENSSL_free(tmp);
3002         ASN1_OBJECT_free(hold);
3003         ASN1_GENERALIZEDTIME_free(comp_time);
3004         ASN1_ENUMERATED_free(rtmp);
3005         ASN1_TIME_free(revDate);
3006
3007         return ret;
3008         }
3009
3010 /*
3011  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
3012  * where characters may be escaped by \
3013  */
3014 X509_NAME *do_subject(char *subject, long chtype)
3015         {
3016         size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
3017         char *buf = OPENSSL_malloc(buflen);
3018         size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
3019         char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
3020         char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
3021
3022         char *sp = subject, *bp = buf;
3023         int i, ne_num = 0;
3024
3025         X509_NAME *n = NULL;
3026         int nid;
3027
3028         if (!buf || !ne_types || !ne_values)
3029         {
3030                 BIO_printf(bio_err, "malloc error\n");
3031                 goto error;
3032         }
3033
3034         if (*subject != '/')
3035         {
3036                 BIO_printf(bio_err, "Subject does not start with '/'.\n");
3037                 goto error;
3038         }
3039         sp++; /* skip leading / */
3040
3041         while (*sp)
3042         {
3043                 /* collect type */
3044                 ne_types[ne_num] = bp;
3045                 while (*sp)
3046                 {
3047                         if (*sp == '\\') /* is there anything to escape in the type...? */
3048                                 if (*++sp)
3049                                         *bp++ = *sp++;
3050                                 else
3051                                 {
3052                                         BIO_printf(bio_err, "escape character at end of string\n");
3053                                         goto error;
3054                                 }
3055                         else if (*sp == '=')
3056                         {
3057                                 sp++;
3058                                 *bp++ = '\0';
3059                                 break;
3060                         }
3061                         else
3062                                 *bp++ = *sp++;
3063                 }
3064                 if (!*sp)
3065                 {
3066                         BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
3067                         goto error;
3068                 }
3069                 ne_values[ne_num] = bp;
3070                 while (*sp)
3071                 {
3072                         if (*sp == '\\')
3073                                 if (*++sp)
3074                                         *bp++ = *sp++;
3075                                 else
3076                                 {
3077                                         BIO_printf(bio_err, "escape character at end of string\n");
3078                                         goto error;
3079                                 }
3080                         else if (*sp == '/')
3081                         {
3082                                 sp++;
3083                                 break;
3084                         }
3085                         else
3086                                 *bp++ = *sp++;
3087                 }
3088                 *bp++ = '\0';
3089                 ne_num++;
3090         }
3091
3092         if (!(n = X509_NAME_new()))
3093                 goto error;
3094
3095         for (i = 0; i < ne_num; i++)
3096                 {
3097                 if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
3098                         {
3099                         BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
3100                         continue;
3101                         }
3102
3103                 if (!*ne_values[i])
3104                         {
3105                         BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
3106                         continue;
3107                         }
3108
3109                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
3110                         goto error;
3111                 }
3112
3113         OPENSSL_free(ne_values);
3114         OPENSSL_free(ne_types);
3115         OPENSSL_free(buf);
3116         return n;
3117
3118 error:
3119         X509_NAME_free(n);
3120         if (ne_values)
3121                 OPENSSL_free(ne_values);
3122         if (ne_types)
3123                 OPENSSL_free(ne_types);
3124         if (buf)
3125                 OPENSSL_free(buf);
3126         return NULL;
3127 }
3128
3129 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
3130         {
3131         char buf[25],*pbuf, *p;
3132         int j;
3133         j=i2a_ASN1_OBJECT(bp,obj);
3134         pbuf=buf;
3135         for (j=22-j; j>0; j--)
3136                 *(pbuf++)=' ';
3137         *(pbuf++)=':';
3138         *(pbuf++)='\0';
3139         BIO_puts(bp,buf);
3140
3141         if (str->type == V_ASN1_PRINTABLESTRING)
3142                 BIO_printf(bp,"PRINTABLE:'");
3143         else if (str->type == V_ASN1_T61STRING)
3144                 BIO_printf(bp,"T61STRING:'");
3145         else if (str->type == V_ASN1_IA5STRING)
3146                 BIO_printf(bp,"IA5STRING:'");
3147         else if (str->type == V_ASN1_UNIVERSALSTRING)
3148                 BIO_printf(bp,"UNIVERSALSTRING:'");
3149         else
3150                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
3151
3152         p=(char *)str->data;
3153         for (j=str->length; j>0; j--)
3154                 {
3155                 if ((*p >= ' ') && (*p <= '~'))
3156                         BIO_printf(bp,"%c",*p);
3157                 else if (*p & 0x80)
3158                         BIO_printf(bp,"\\0x%02X",*p);
3159                 else if ((unsigned char)*p == 0xf7)
3160                         BIO_printf(bp,"^?");
3161                 else    BIO_printf(bp,"^%c",*p+'@');
3162                 p++;
3163                 }
3164         BIO_printf(bp,"'\n");
3165         return 1;
3166         }
3167
3168 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
3169         {
3170         char *tmp = NULL;
3171         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
3172         int reason_code = -1;
3173         int i, ret = 0;
3174         ASN1_OBJECT *hold = NULL;
3175         ASN1_GENERALIZEDTIME *comp_time = NULL;
3176         tmp = BUF_strdup(str);
3177
3178         p = strchr(tmp, ',');
3179
3180         rtime_str = tmp;
3181
3182         if (p)
3183                 {
3184                 *p = '\0';
3185                 p++;
3186                 reason_str = p;
3187                 p = strchr(p, ',');
3188                 if (p)
3189                         {
3190                         *p = '\0';
3191                         arg_str = p + 1;
3192                         }
3193                 }
3194
3195         if (prevtm)
3196                 {
3197                 *prevtm = ASN1_UTCTIME_new();
3198                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
3199                         {
3200                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
3201                         goto err;
3202                         }
3203                 }
3204         if (reason_str)
3205                 {
3206                 for (i = 0; i < NUM_REASONS; i++)
3207                         {
3208                         if(!strcasecmp(reason_str, crl_reasons[i]))
3209                                 {
3210                                 reason_code = i;
3211                                 break;
3212                                 }
3213                         }
3214                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
3215                         {
3216                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
3217                         goto err;
3218                         }
3219
3220                 if (reason_code == 7)
3221                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
3222                 else if (reason_code == 8)              /* Hold instruction */
3223                         {
3224                         if (!arg_str)
3225                                 {
3226                                 BIO_printf(bio_err, "missing hold instruction\n");
3227                                 goto err;
3228                                 }
3229                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
3230                         hold = OBJ_txt2obj(arg_str, 0);
3231
3232                         if (!hold)
3233                                 {
3234                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
3235                                 goto err;
3236                                 }
3237                         if (phold) *phold = hold;
3238                         }
3239                 else if ((reason_code == 9) || (reason_code == 10))
3240                         {
3241                         if (!arg_str)
3242                                 {
3243                                 BIO_printf(bio_err, "missing compromised time\n");
3244                                 goto err;
3245                                 }
3246                         comp_time = ASN1_GENERALIZEDTIME_new();
3247                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
3248                                 {
3249                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
3250                                 goto err;
3251                                 }
3252                         if (reason_code == 9)
3253                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
3254                         else
3255                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
3256                         }
3257                 }
3258
3259         if (preason) *preason = reason_code;
3260         if (pinvtm) *pinvtm = comp_time;
3261         else ASN1_GENERALIZEDTIME_free(comp_time);
3262
3263         ret = 1;
3264
3265         err:
3266
3267         if (tmp) OPENSSL_free(tmp);
3268         if (!phold) ASN1_OBJECT_free(hold);
3269         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
3270
3271         return ret;
3272         }
3273
3274 int make_serial_index(TXT_DB *db)
3275         {
3276         if (!TXT_DB_create_index(db, DB_serial, NULL,
3277                                 LHASH_HASH_FN(index_serial_hash),
3278                                 LHASH_COMP_FN(index_serial_cmp)))
3279                 {
3280                 BIO_printf(bio_err,
3281                   "error creating serial number index:(%ld,%ld,%ld)\n",
3282                                         db->error,db->arg1,db->arg2);
3283                         return 0;
3284                 }
3285         return 1;
3286         }