2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
65 #include <sys/types.h>
68 #include <openssl/conf.h>
69 #include <openssl/bio.h>
70 #include <openssl/err.h>
71 #include <openssl/bn.h>
72 #include <openssl/txt_db.h>
73 #include <openssl/evp.h>
74 #include <openssl/x509.h>
75 #include <openssl/x509v3.h>
76 #include <openssl/objects.h>
77 #include <openssl/ocsp.h>
78 #include <openssl/pem.h>
79 #include <openssl/engine.h>
81 #ifdef OPENSSL_SYS_WINDOWS
82 #define strcasecmp _stricmp
88 # ifdef OPENSSL_SYS_VMS
95 # include <sys/file.h>
109 #define BASE_SECTION "ca"
110 #define CONFIG_FILE "openssl.cnf"
112 #define ENV_DEFAULT_CA "default_ca"
114 #define ENV_DIR "dir"
115 #define ENV_CERTS "certs"
116 #define ENV_CRL_DIR "crl_dir"
117 #define ENV_CA_DB "CA_DB"
118 #define ENV_NEW_CERTS_DIR "new_certs_dir"
119 #define ENV_CERTIFICATE "certificate"
120 #define ENV_SERIAL "serial"
121 #define ENV_CRL "crl"
122 #define ENV_PRIVATE_KEY "private_key"
123 #define ENV_RANDFILE "RANDFILE"
124 #define ENV_DEFAULT_DAYS "default_days"
125 #define ENV_DEFAULT_STARTDATE "default_startdate"
126 #define ENV_DEFAULT_ENDDATE "default_enddate"
127 #define ENV_DEFAULT_CRL_DAYS "default_crl_days"
128 #define ENV_DEFAULT_CRL_HOURS "default_crl_hours"
129 #define ENV_DEFAULT_MD "default_md"
130 #define ENV_PRESERVE "preserve"
131 #define ENV_POLICY "policy"
132 #define ENV_EXTENSIONS "x509_extensions"
133 #define ENV_CRLEXT "crl_extensions"
134 #define ENV_MSIE_HACK "msie_hack"
135 #define ENV_NAMEOPT "name_opt"
136 #define ENV_CERTOPT "cert_opt"
137 #define ENV_EXTCOPY "copy_extensions"
139 #define ENV_DATABASE "database"
142 #define DB_exp_date 1
143 #define DB_rev_date 2
144 #define DB_serial 3 /* index - unique */
146 #define DB_name 5 /* index - unique for active */
149 #define DB_TYPE_REV 'R'
150 #define DB_TYPE_EXP 'E'
151 #define DB_TYPE_VAL 'V'
153 /* Additional revocation information types */
155 #define REV_NONE 0 /* No addditional information */
156 #define REV_CRL_REASON 1 /* Value is CRL reason code */
157 #define REV_HOLD 2 /* Value is hold instruction */
158 #define REV_KEY_COMPROMISE 3 /* Value is cert key compromise time */
159 #define REV_CA_COMPROMISE 4 /* Value is CA key compromise time */
161 static char *ca_usage[]={
164 " -verbose - Talk alot while doing things\n",
165 " -config file - A config file\n",
166 " -name arg - The particular CA definition to use\n",
167 " -gencrl - Generate a new CRL\n",
168 " -crldays days - Days is when the next CRL is due\n",
169 " -crlhours hours - Hours is when the next CRL is due\n",
170 " -startdate YYMMDDHHMMSSZ - certificate validity notBefore\n",
171 " -enddate YYMMDDHHMMSSZ - certificate validity notAfter (overrides -days)\n",
172 " -days arg - number of days to certify the certificate for\n",
173 " -md arg - md to use, one of md2, md5, sha or sha1\n",
174 " -policy arg - The CA 'policy' to support\n",
175 " -keyfile arg - private key file\n",
176 " -keyform arg - private key file format (PEM or ENGINE)\n",
177 " -key arg - key to decode the private key if it is encrypted\n",
178 " -cert file - The CA certificate\n",
179 " -in file - The input PEM encoded certificate request(s)\n",
180 " -out file - Where to put the output file(s)\n",
181 " -outdir dir - Where to put output certificates\n",
182 " -infiles .... - The last argument, requests to process\n",
183 " -spkac file - File contains DN and signed public key and challenge\n",
184 " -ss_cert file - File contains a self signed cert to sign\n",
185 " -preserveDN - Don't re-order the DN\n",
186 " -batch - Don't ask questions\n",
187 " -msie_hack - msie modifications to handle all those universal strings\n",
188 " -revoke file - Revoke a certificate (given in file)\n",
189 " -subj arg - Use arg instead of request's subject\n",
190 " -extensions .. - Extension section (override value in config file)\n",
191 " -extfile file - Configuration file with X509v3 extentions to add\n",
192 " -crlexts .. - CRL extension section (override value in config file)\n",
193 " -engine e - use engine e, possibly a hardware device.\n",
194 " -status serial - Shows certificate status given the serial number\n",
195 " -updatedb - Updates db for expired certificates\n",
200 extern int EF_PROTECT_FREE;
201 extern int EF_PROTECT_BELOW;
202 extern int EF_ALIGNMENT;
205 static void lookup_fail(char *name,char *tag);
206 static unsigned long index_serial_hash(const char **a);
207 static int index_serial_cmp(const char **a, const char **b);
208 static unsigned long index_name_hash(const char **a);
209 static int index_name_qual(char **a);
210 static int index_name_cmp(const char **a,const char **b);
211 static BIGNUM *load_serial(char *serialfile);
212 static int save_serial(char *serialfile, BIGNUM *serial);
213 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
214 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
215 BIGNUM *serial, char *subj, char *startdate,char *enddate,
216 long days, int batch, char *ext_sect, CONF *conf,int verbose,
217 unsigned long certopt, unsigned long nameopt, int default_op,
219 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
220 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
221 TXT_DB *db, BIGNUM *serial, char *subj, char *startdate,
222 char *enddate, long days, int batch, char *ext_sect,
223 CONF *conf,int verbose, unsigned long certopt,
224 unsigned long nameopt, int default_op, int ext_copy,
226 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
227 const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
228 TXT_DB *db, BIGNUM *serial,char *subj, char *startdate,
229 char *enddate, long days, char *ext_sect,CONF *conf,
230 int verbose, unsigned long certopt, unsigned long nameopt,
231 int default_op, int ext_copy);
232 static int fix_data(int nid, int *type);
233 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
234 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
235 STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
236 char *startdate, char *enddate, long days, int batch, int verbose,
237 X509_REQ *req, char *ext_sect, CONF *conf,
238 unsigned long certopt, unsigned long nameopt, int default_op,
240 static X509_NAME *do_subject(char *subject);
241 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
242 static int get_certificate_status(const char *ser_status, TXT_DB *db);
243 static int do_updatedb(TXT_DB *db);
244 static int check_time_format(char *str);
245 char *make_revocation_str(int rev_type, char *rev_arg);
246 int make_revoked(X509_REVOKED *rev, char *str);
247 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
248 static CONF *conf=NULL;
249 static CONF *extconf=NULL;
250 static char *section=NULL;
252 static int preserve=0;
253 static int msie_hack=0;
255 static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)
256 static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)
257 static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)
258 static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)
261 int MAIN(int, char **);
263 int MAIN(int argc, char **argv)
266 char *key=NULL,*passargin=NULL;
279 char *configfile=NULL;
284 int keyform=FORMAT_PEM;
286 char *spkac_file=NULL;
287 char *ss_cert_file=NULL;
288 char *ser_status=NULL;
293 char *serialfile=NULL;
294 char *extensions=NULL;
298 int rev_type = REV_NONE;
299 char *rev_arg = NULL;
301 char *startdate=NULL;
306 unsigned long nameopt = 0, certopt = 0;
308 int ext_copy = EXT_COPY_NONE;
311 BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
315 X509_CRL_INFO *ci=NULL;
316 X509_REVOKED *r=NULL;
320 const EVP_MD *dgst=NULL;
321 STACK_OF(CONF_VALUE) *attribs=NULL;
322 STACK_OF(X509) *cert_sk=NULL;
325 MS_STATIC char buf[3][BSIZE];
344 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
345 BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
351 if (strcmp(*argv,"-verbose") == 0)
353 else if (strcmp(*argv,"-config") == 0)
355 if (--argc < 1) goto bad;
356 configfile= *(++argv);
358 else if (strcmp(*argv,"-name") == 0)
360 if (--argc < 1) goto bad;
363 else if (strcmp(*argv,"-subj") == 0)
365 if (--argc < 1) goto bad;
369 else if (strcmp(*argv,"-startdate") == 0)
371 if (--argc < 1) goto bad;
372 startdate= *(++argv);
374 else if (strcmp(*argv,"-enddate") == 0)
376 if (--argc < 1) goto bad;
379 else if (strcmp(*argv,"-days") == 0)
381 if (--argc < 1) goto bad;
382 days=atoi(*(++argv));
384 else if (strcmp(*argv,"-md") == 0)
386 if (--argc < 1) goto bad;
389 else if (strcmp(*argv,"-policy") == 0)
391 if (--argc < 1) goto bad;
394 else if (strcmp(*argv,"-keyfile") == 0)
396 if (--argc < 1) goto bad;
399 else if (strcmp(*argv,"-keyform") == 0)
401 if (--argc < 1) goto bad;
402 keyform=str2fmt(*(++argv));
404 else if (strcmp(*argv,"-passin") == 0)
406 if (--argc < 1) goto bad;
407 passargin= *(++argv);
409 else if (strcmp(*argv,"-key") == 0)
411 if (--argc < 1) goto bad;
414 else if (strcmp(*argv,"-cert") == 0)
416 if (--argc < 1) goto bad;
419 else if (strcmp(*argv,"-in") == 0)
421 if (--argc < 1) goto bad;
425 else if (strcmp(*argv,"-out") == 0)
427 if (--argc < 1) goto bad;
430 else if (strcmp(*argv,"-outdir") == 0)
432 if (--argc < 1) goto bad;
435 else if (strcmp(*argv,"-notext") == 0)
437 else if (strcmp(*argv,"-batch") == 0)
439 else if (strcmp(*argv,"-preserveDN") == 0)
441 else if (strcmp(*argv,"-gencrl") == 0)
443 else if (strcmp(*argv,"-msie_hack") == 0)
445 else if (strcmp(*argv,"-crldays") == 0)
447 if (--argc < 1) goto bad;
448 crldays= atol(*(++argv));
450 else if (strcmp(*argv,"-crlhours") == 0)
452 if (--argc < 1) goto bad;
453 crlhours= atol(*(++argv));
455 else if (strcmp(*argv,"-infiles") == 0)
462 else if (strcmp(*argv, "-ss_cert") == 0)
464 if (--argc < 1) goto bad;
465 ss_cert_file = *(++argv);
468 else if (strcmp(*argv, "-spkac") == 0)
470 if (--argc < 1) goto bad;
471 spkac_file = *(++argv);
474 else if (strcmp(*argv,"-revoke") == 0)
476 if (--argc < 1) goto bad;
480 else if (strcmp(*argv,"-extensions") == 0)
482 if (--argc < 1) goto bad;
483 extensions= *(++argv);
485 else if (strcmp(*argv,"-extfile") == 0)
487 if (--argc < 1) goto bad;
490 else if (strcmp(*argv,"-status") == 0)
492 if (--argc < 1) goto bad;
493 ser_status= *(++argv);
495 else if (strcmp(*argv,"-updatedb") == 0)
499 else if (strcmp(*argv,"-crlexts") == 0)
501 if (--argc < 1) goto bad;
504 else if (strcmp(*argv,"-crl_reason") == 0)
506 if (--argc < 1) goto bad;
508 rev_type = REV_CRL_REASON;
510 else if (strcmp(*argv,"-crl_hold") == 0)
512 if (--argc < 1) goto bad;
516 else if (strcmp(*argv,"-crl_compromise") == 0)
518 if (--argc < 1) goto bad;
520 rev_type = REV_KEY_COMPROMISE;
522 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
524 if (--argc < 1) goto bad;
526 rev_type = REV_CA_COMPROMISE;
528 else if (strcmp(*argv,"-engine") == 0)
530 if (--argc < 1) goto bad;
536 BIO_printf(bio_err,"unknown option %s\n",*argv);
546 for (pp=ca_usage; (*pp != NULL); pp++)
547 BIO_printf(bio_err,"%s",*pp);
551 ERR_load_crypto_strings();
553 e = setup_engine(bio_err, engine, 0);
555 /*****************************************************************/
556 if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
557 if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
558 if (configfile == NULL)
560 /* We will just use 'buf[0]' as a temporary buffer. */
561 #ifdef OPENSSL_SYS_VMS
562 strncpy(buf[0],X509_get_default_cert_area(),
563 sizeof(buf[0])-1-sizeof(CONFIG_FILE));
565 strncpy(buf[0],X509_get_default_cert_area(),
566 sizeof(buf[0])-2-sizeof(CONFIG_FILE));
569 strcat(buf[0],CONFIG_FILE);
573 BIO_printf(bio_err,"Using configuration from %s\n",configfile);
574 conf = NCONF_new(NULL);
575 if (NCONF_load(conf,configfile,&errorline) <= 0)
578 BIO_printf(bio_err,"error loading the config file '%s'\n",
581 BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
582 ,errorline,configfile);
586 /* Lets get the config section we are using */
589 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
592 lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
599 p=NCONF_get_string(conf,NULL,"oid_file");
606 oid_bio=BIO_new_file(p,"r");
610 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
611 ERR_print_errors(bio_err);
617 OBJ_create_objects(oid_bio);
621 if (!add_oid_section(bio_err,conf))
623 ERR_print_errors(bio_err);
628 randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
629 if (randfile == NULL)
631 app_RAND_load_file(randfile, bio_err, 0);
633 in=BIO_new(BIO_s_file());
634 out=BIO_new(BIO_s_file());
635 Sout=BIO_new(BIO_s_file());
636 Cout=BIO_new(BIO_s_file());
637 if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
639 ERR_print_errors(bio_err);
643 /*****************************************************************/
644 /* report status of cert with serial number given on command line */
647 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
649 lookup_fail(section,ENV_DATABASE);
652 if (BIO_read_filename(in,dbfile) <= 0)
655 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
658 db=TXT_DB_read(in,DB_NUMBER);
659 if (db == NULL) goto err;
661 if (!TXT_DB_create_index(db, DB_serial, NULL,
662 LHASH_HASH_FN(index_serial_hash),
663 LHASH_COMP_FN(index_serial_cmp)))
666 "error creating serial number index:(%ld,%ld,%ld)\n",
667 db->error,db->arg1,db->arg2);
671 if (get_certificate_status(ser_status,db) != 1)
672 BIO_printf(bio_err,"Error verifying serial %s!\n",
677 /*****************************************************************/
678 /* we definitely need a public key, so let's get it */
680 if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
681 section,ENV_PRIVATE_KEY)) == NULL))
683 lookup_fail(section,ENV_PRIVATE_KEY);
686 if (!key && !app_passwd(bio_err, passargin, NULL, &key, NULL))
688 BIO_printf(bio_err,"Error getting password\n");
691 pkey = load_key(bio_err, keyfile, keyform, key, e,
693 if (key) memset(key,0,strlen(key));
696 /* load_key() has already printed an appropriate message */
700 /*****************************************************************/
701 /* we need a certificate */
702 if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
703 section,ENV_CERTIFICATE)) == NULL))
705 lookup_fail(section,ENV_CERTIFICATE);
708 x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
713 if (!X509_check_private_key(x509,pkey))
715 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
719 f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
722 if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
724 f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
727 if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
730 f=NCONF_get_string(conf,section,ENV_NAMEOPT);
734 if (!set_name_ex(&nameopt, f))
736 BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
744 f=NCONF_get_string(conf,section,ENV_CERTOPT);
748 if (!set_cert_ex(&certopt, f))
750 BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
758 f=NCONF_get_string(conf,section,ENV_EXTCOPY);
762 if (!set_ext_copy(&ext_copy, f))
764 BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
771 /*****************************************************************/
772 /* lookup where to write new certificates */
773 if ((outdir == NULL) && (req))
777 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
780 BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
783 #ifndef OPENSSL_SYS_VMS
784 /* outdir is a directory spec, but access() for VMS demands a
785 filename. In any case, stat(), below, will catch the problem
786 if outdir is not a directory spec, and the fopen() or open()
787 will catch an error if there is no write access.
789 Presumably, this problem could also be solved by using the DEC
790 C routines to convert the directory syntax to Unixly, and give
791 that to access(). However, time's too short to do that just
794 if (access(outdir,R_OK|W_OK|X_OK) != 0)
796 BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
801 if (stat(outdir,&sb) != 0)
803 BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
808 if (!(sb.st_mode & S_IFDIR))
810 BIO_printf(bio_err,"%s need to be a directory\n",outdir);
818 /*****************************************************************/
819 /* we need to load the database file */
820 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
822 lookup_fail(section,ENV_DATABASE);
825 if (BIO_read_filename(in,dbfile) <= 0)
828 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
831 db=TXT_DB_read(in,DB_NUMBER);
832 if (db == NULL) goto err;
834 /* Lets check some fields */
835 for (i=0; i<sk_num(db->data); i++)
837 pp=(char **)sk_value(db->data,i);
838 if ((pp[DB_type][0] != DB_TYPE_REV) &&
839 (pp[DB_rev_date][0] != '\0'))
841 BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
844 if ((pp[DB_type][0] == DB_TYPE_REV) &&
845 !make_revoked(NULL, pp[DB_rev_date]))
847 BIO_printf(bio_err," in entry %d\n", i+1);
850 if (!check_time_format(pp[DB_exp_date]))
852 BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
862 if ((j&1) || (j < 2))
864 BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
869 if (!( ((*p >= '0') && (*p <= '9')) ||
870 ((*p >= 'A') && (*p <= 'F')) ||
871 ((*p >= 'a') && (*p <= 'f'))) )
873 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
881 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
882 #ifdef OPENSSL_SYS_VMS
884 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
885 out = BIO_push(tmpbio, out);
888 TXT_DB_write(out,db);
889 BIO_printf(bio_err,"%d entries loaded from the database\n",
891 BIO_printf(bio_err,"generating index\n");
894 if (!TXT_DB_create_index(db, DB_serial, NULL,
895 LHASH_HASH_FN(index_serial_hash),
896 LHASH_COMP_FN(index_serial_cmp)))
898 BIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\n",db->error,db->arg1,db->arg2);
902 if (!TXT_DB_create_index(db, DB_name, index_name_qual,
903 LHASH_HASH_FN(index_name_hash),
904 LHASH_COMP_FN(index_name_cmp)))
906 BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
907 db->error,db->arg1,db->arg2);
911 /*****************************************************************/
912 /* Update the db file for expired certificates */
916 BIO_printf(bio_err, "Updating %s ...\n",
922 BIO_printf(bio_err,"Malloc failure\n");
927 if (verbose) BIO_printf(bio_err,
928 "No entries found to mark expired\n");
932 out = BIO_new(BIO_s_file());
935 ERR_print_errors(bio_err);
939 #ifndef OPENSSL_SYS_VMS
940 j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
942 j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
944 if (j < 0 || j >= sizeof buf[0])
946 BIO_printf(bio_err, "file name too long\n");
949 if (BIO_write_filename(out,buf[0]) <= 0)
952 BIO_printf(bio_err,"unable to open '%s'\n",
956 j=TXT_DB_write(out,db);
957 if (j <= 0) goto err;
961 #ifndef OPENSSL_SYS_VMS
962 j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
964 j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
966 if (j < 0 || j >= sizeof buf[1])
968 BIO_printf(bio_err, "file name too long\n");
971 if (rename(dbfile,buf[1]) < 0)
974 "unable to rename %s to %s\n",
979 if (rename(buf[0],dbfile) < 0)
982 "unable to rename %s to %s\n",
985 rename(buf[1],dbfile);
989 if (verbose) BIO_printf(bio_err,
990 "Done. %d entries marked as expired\n",i);
995 /*****************************************************************/
996 /* Read extentions config file */
999 extconf = NCONF_new(NULL);
1000 if (NCONF_load(extconf,extfile,&errorline) <= 0)
1003 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
1006 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
1013 BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
1015 /* We can have sections in the ext file */
1016 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
1017 extensions = "default";
1020 /*****************************************************************/
1023 if (outfile != NULL)
1025 if (BIO_write_filename(Sout,outfile) <= 0)
1033 BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1034 #ifdef OPENSSL_SYS_VMS
1036 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1037 Sout = BIO_push(tmpbio, Sout);
1045 if ((md == NULL) && ((md=NCONF_get_string(conf,
1046 section,ENV_DEFAULT_MD)) == NULL))
1048 lookup_fail(section,ENV_DEFAULT_MD);
1051 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1053 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1057 BIO_printf(bio_err,"message digest is %s\n",
1058 OBJ_nid2ln(dgst->type));
1059 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1060 section,ENV_POLICY)) == NULL))
1062 lookup_fail(section,ENV_POLICY);
1066 BIO_printf(bio_err,"policy is %s\n",policy);
1068 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1071 lookup_fail(section,ENV_SERIAL);
1077 /* no '-extfile' option, so we look for extensions
1078 * in the main configuration file */
1081 extensions=NCONF_get_string(conf,section,
1088 /* Check syntax of file */
1090 X509V3_set_ctx_test(&ctx);
1091 X509V3_set_nconf(&ctx, conf);
1092 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1096 "Error Loading extension section %s\n",
1104 if (startdate == NULL)
1106 startdate=NCONF_get_string(conf,section,
1107 ENV_DEFAULT_STARTDATE);
1108 if (startdate == NULL)
1111 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1113 BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1116 if (startdate == NULL) startdate="today";
1118 if (enddate == NULL)
1120 enddate=NCONF_get_string(conf,section,
1121 ENV_DEFAULT_ENDDATE);
1122 if (enddate == NULL)
1125 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1127 BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1133 if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1136 if (!enddate && (days == 0))
1138 BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1142 if ((serial=load_serial(serialfile)) == NULL)
1144 BIO_printf(bio_err,"error while loading serial number\n");
1149 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1150 BIO_printf(bio_err,"next serial number is %s\n",f);
1154 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1156 BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1160 if ((cert_sk=sk_X509_new_null()) == NULL)
1162 BIO_printf(bio_err,"Memory allocation failure\n");
1165 if (spkac_file != NULL)
1168 j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1169 serial,subj,startdate,enddate, days,extensions,conf,
1170 verbose, certopt, nameopt, default_op, ext_copy);
1171 if (j < 0) goto err;
1175 BIO_printf(bio_err,"\n");
1176 if (!BN_add_word(serial,1)) goto err;
1177 if (!sk_X509_push(cert_sk,x))
1179 BIO_printf(bio_err,"Memory allocation failure\n");
1189 if (ss_cert_file != NULL)
1192 j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1193 db,serial,subj,startdate,enddate,days,batch,
1194 extensions,conf,verbose, certopt, nameopt,
1195 default_op, ext_copy, e);
1196 if (j < 0) goto err;
1200 BIO_printf(bio_err,"\n");
1201 if (!BN_add_word(serial,1)) goto err;
1202 if (!sk_X509_push(cert_sk,x))
1204 BIO_printf(bio_err,"Memory allocation failure\n");
1212 j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1213 serial,subj,startdate,enddate,days,batch,
1214 extensions,conf,verbose, certopt, nameopt,
1215 default_op, ext_copy);
1216 if (j < 0) goto err;
1220 BIO_printf(bio_err,"\n");
1221 if (!BN_add_word(serial,1)) goto err;
1222 if (!sk_X509_push(cert_sk,x))
1224 BIO_printf(bio_err,"Memory allocation failure\n");
1229 for (i=0; i<argc; i++)
1232 j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1233 serial,subj,startdate,enddate,days,batch,
1234 extensions,conf,verbose, certopt, nameopt,
1235 default_op, ext_copy);
1236 if (j < 0) goto err;
1240 BIO_printf(bio_err,"\n");
1241 if (!BN_add_word(serial,1)) goto err;
1242 if (!sk_X509_push(cert_sk,x))
1244 BIO_printf(bio_err,"Memory allocation failure\n");
1249 /* we have a stack of newly certified certificates
1250 * and a data base and serial number that need
1253 if (sk_X509_num(cert_sk) > 0)
1257 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1258 (void)BIO_flush(bio_err);
1260 fgets(buf[0],10,stdin);
1261 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1263 BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1269 BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1271 strncpy(buf[0],serialfile,BSIZE-4);
1273 #ifdef OPENSSL_SYS_VMS
1274 strcat(buf[0],"-new");
1276 strcat(buf[0],".new");
1279 if (!save_serial(buf[0],serial)) goto err;
1281 strncpy(buf[1],dbfile,BSIZE-4);
1283 #ifdef OPENSSL_SYS_VMS
1284 strcat(buf[1],"-new");
1286 strcat(buf[1],".new");
1289 if (BIO_write_filename(out,buf[1]) <= 0)
1292 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1295 l=TXT_DB_write(out,db);
1296 if (l <= 0) goto err;
1300 BIO_printf(bio_err,"writing new certificates\n");
1301 for (i=0; i<sk_X509_num(cert_sk); i++)
1306 x=sk_X509_value(cert_sk,i);
1308 j=x->cert_info->serialNumber->length;
1309 p=(char *)x->cert_info->serialNumber->data;
1311 strncpy(buf[2],outdir,BSIZE-(j*2)-6);
1313 #ifndef OPENSSL_SYS_VMS
1317 n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1322 sprintf((char *)n,"%02X",(unsigned char)*(p++));
1331 *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1334 BIO_printf(bio_err,"writing %s\n",buf[2]);
1336 if (BIO_write_filename(Cout,buf[2]) <= 0)
1341 write_new_certificate(Cout,x, 0, notext);
1342 write_new_certificate(Sout,x, output_der, notext);
1345 if (sk_X509_num(cert_sk))
1347 /* Rename the database and the serial file */
1348 strncpy(buf[2],serialfile,BSIZE-4);
1350 #ifdef OPENSSL_SYS_VMS
1351 strcat(buf[2],"-old");
1353 strcat(buf[2],".old");
1360 if (rename(serialfile,buf[2]) < 0)
1362 BIO_printf(bio_err,"unable to rename %s to %s\n",
1367 if (rename(buf[0],serialfile) < 0)
1369 BIO_printf(bio_err,"unable to rename %s to %s\n",
1372 rename(buf[2],serialfile);
1376 strncpy(buf[2],dbfile,BSIZE-4);
1378 #ifdef OPENSSL_SYS_VMS
1379 strcat(buf[2],"-old");
1381 strcat(buf[2],".old");
1384 if (rename(dbfile,buf[2]) < 0)
1386 BIO_printf(bio_err,"unable to rename %s to %s\n",
1391 if (rename(buf[1],dbfile) < 0)
1393 BIO_printf(bio_err,"unable to rename %s to %s\n",
1396 rename(buf[2],dbfile);
1399 BIO_printf(bio_err,"Data Base Updated\n");
1403 /*****************************************************************/
1409 crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1415 /* Check syntax of file */
1417 X509V3_set_ctx_test(&ctx);
1418 X509V3_set_nconf(&ctx, conf);
1419 if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1422 "Error Loading CRL extension section %s\n",
1429 if (!crldays && !crlhours)
1431 if (!NCONF_get_number(conf,section,
1432 ENV_DEFAULT_CRL_DAYS, &crldays))
1434 if (!NCONF_get_number(conf,section,
1435 ENV_DEFAULT_CRL_HOURS, &crlhours))
1438 if ((crldays == 0) && (crlhours == 0))
1440 BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
1444 if (verbose) BIO_printf(bio_err,"making CRL\n");
1445 if ((crl=X509_CRL_new()) == NULL) goto err;
1447 X509_NAME_free(ci->issuer);
1448 ci->issuer=X509_NAME_dup(x509->cert_info->subject);
1449 if (ci->issuer == NULL) goto err;
1451 X509_gmtime_adj(ci->lastUpdate,0);
1452 if (ci->nextUpdate == NULL)
1453 ci->nextUpdate=ASN1_UTCTIME_new();
1454 X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);
1456 for (i=0; i<sk_num(db->data); i++)
1458 pp=(char **)sk_value(db->data,i);
1459 if (pp[DB_type][0] == DB_TYPE_REV)
1461 if ((r=X509_REVOKED_new()) == NULL) goto err;
1462 j = make_revoked(r, pp[DB_rev_date]);
1464 if (j == 2) crl_v2 = 1;
1465 if (!BN_hex2bn(&serial, pp[DB_serial]))
1467 r->serialNumber = BN_to_ASN1_INTEGER(serial, r->serialNumber);
1470 if (!r->serialNumber)
1472 X509_CRL_add0_revoked(crl,r);
1475 /* sort the data so it will be written in serial
1477 sk_X509_REVOKED_sort(ci->revoked);
1478 for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)
1480 r=sk_X509_REVOKED_value(ci->revoked,i);
1484 /* we now have a CRL */
1485 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1488 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1490 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1496 #ifndef OPENSSL_NO_DSA
1497 if (pkey->type == EVP_PKEY_DSA)
1504 /* Add any extensions asked for */
1509 if (ci->version == NULL)
1510 if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
1511 X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1512 X509V3_set_nconf(&crlctx, conf);
1514 if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1515 crl_ext, crl)) goto err;
1517 if (crl_ext || crl_v2)
1519 if (ci->version == NULL)
1520 if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
1521 ASN1_INTEGER_set(ci->version,1); /* version 2 CRL */
1524 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1526 PEM_write_bio_X509_CRL(Sout,crl);
1528 /*****************************************************************/
1533 BIO_printf(bio_err,"no input files\n");
1539 revcert=load_cert(bio_err, infile, FORMAT_PEM,
1541 if (revcert == NULL)
1543 j=do_revoke(revcert,db, rev_type, rev_arg);
1544 if (j <= 0) goto err;
1547 strncpy(buf[0],dbfile,BSIZE-4);
1548 #ifndef OPENSSL_SYS_VMS
1549 strcat(buf[0],".new");
1551 strcat(buf[0],"-new");
1553 if (BIO_write_filename(out,buf[0]) <= 0)
1556 BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
1559 j=TXT_DB_write(out,db);
1560 if (j <= 0) goto err;
1561 strncpy(buf[1],dbfile,BSIZE-4);
1562 #ifndef OPENSSL_SYS_VMS
1563 strcat(buf[1],".old");
1565 strcat(buf[1],"-old");
1567 if (rename(dbfile,buf[1]) < 0)
1569 BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
1573 if (rename(buf[0],dbfile) < 0)
1575 BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
1577 rename(buf[1],dbfile);
1580 BIO_printf(bio_err,"Data Base Updated\n");
1583 /*****************************************************************/
1591 sk_X509_pop_free(cert_sk,X509_free);
1593 if (ret) ERR_print_errors(bio_err);
1594 app_RAND_write_file(randfile, bio_err);
1597 EVP_PKEY_free(pkey);
1606 static void lookup_fail(char *name, char *tag)
1608 BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1611 static unsigned long index_serial_hash(const char **a)
1616 while (*n == '0') n++;
1617 return(lh_strhash(n));
1620 static int index_serial_cmp(const char **a, const char **b)
1624 for (aa=a[DB_serial]; *aa == '0'; aa++);
1625 for (bb=b[DB_serial]; *bb == '0'; bb++);
1626 return(strcmp(aa,bb));
1629 static unsigned long index_name_hash(const char **a)
1630 { return(lh_strhash(a[DB_name])); }
1632 static int index_name_qual(char **a)
1633 { return(a[0][0] == 'V'); }
1635 static int index_name_cmp(const char **a, const char **b)
1636 { return(strcmp(a[DB_name],
1639 static BIGNUM *load_serial(char *serialfile)
1643 MS_STATIC char buf[1024];
1644 ASN1_INTEGER *ai=NULL;
1646 if ((in=BIO_new(BIO_s_file())) == NULL)
1648 ERR_print_errors(bio_err);
1652 if (BIO_read_filename(in,serialfile) <= 0)
1657 ai=ASN1_INTEGER_new();
1658 if (ai == NULL) goto err;
1659 if (!a2i_ASN1_INTEGER(in,ai,buf,1024))
1661 BIO_printf(bio_err,"unable to load number from %s\n",
1665 ret=ASN1_INTEGER_to_BN(ai,NULL);
1668 BIO_printf(bio_err,"error converting number from bin to BIGNUM");
1672 if (in != NULL) BIO_free(in);
1673 if (ai != NULL) ASN1_INTEGER_free(ai);
1677 static int save_serial(char *serialfile, BIGNUM *serial)
1681 ASN1_INTEGER *ai=NULL;
1683 out=BIO_new(BIO_s_file());
1686 ERR_print_errors(bio_err);
1689 if (BIO_write_filename(out,serialfile) <= 0)
1695 if ((ai=BN_to_ASN1_INTEGER(serial,NULL)) == NULL)
1697 BIO_printf(bio_err,"error converting serial to ASN.1 format\n");
1700 i2a_ASN1_INTEGER(out,ai);
1704 if (out != NULL) BIO_free_all(out);
1705 if (ai != NULL) ASN1_INTEGER_free(ai);
1709 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1710 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1711 BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
1712 int batch, char *ext_sect, CONF *lconf, int verbose,
1713 unsigned long certopt, unsigned long nameopt, int default_op,
1718 EVP_PKEY *pktmp=NULL;
1721 in=BIO_new(BIO_s_file());
1723 if (BIO_read_filename(in,infile) <= 0)
1728 if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1730 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1735 X509_REQ_print(bio_err,req);
1737 BIO_printf(bio_err,"Check that the request matches the signature\n");
1739 if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1741 BIO_printf(bio_err,"error unpacking public key\n");
1744 i=X509_REQ_verify(req,pktmp);
1745 EVP_PKEY_free(pktmp);
1749 BIO_printf(bio_err,"Signature verification problems....\n");
1755 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1759 BIO_printf(bio_err,"Signature ok\n");
1761 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate, enddate,
1762 days,batch,verbose,req,ext_sect,lconf,
1763 certopt, nameopt, default_op, ext_copy);
1766 if (req != NULL) X509_REQ_free(req);
1767 if (in != NULL) BIO_free(in);
1771 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1772 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
1773 BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
1774 int batch, char *ext_sect, CONF *lconf, int verbose,
1775 unsigned long certopt, unsigned long nameopt, int default_op,
1776 int ext_copy, ENGINE *e)
1779 X509_REQ *rreq=NULL;
1780 EVP_PKEY *pktmp=NULL;
1783 if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1786 X509_print(bio_err,req);
1788 BIO_printf(bio_err,"Check that the request matches the signature\n");
1790 if ((pktmp=X509_get_pubkey(req)) == NULL)
1792 BIO_printf(bio_err,"error unpacking public key\n");
1795 i=X509_verify(req,pktmp);
1796 EVP_PKEY_free(pktmp);
1800 BIO_printf(bio_err,"Signature verification problems....\n");
1806 BIO_printf(bio_err,"Signature did not match the certificate\n");
1810 BIO_printf(bio_err,"Signature ok\n");
1812 if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1815 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate,enddate,days,
1816 batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1820 if (rreq != NULL) X509_REQ_free(rreq);
1821 if (req != NULL) X509_free(req);
1825 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1826 STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
1827 char *startdate, char *enddate, long days, int batch, int verbose,
1828 X509_REQ *req, char *ext_sect, CONF *lconf,
1829 unsigned long certopt, unsigned long nameopt, int default_op,
1832 X509_NAME *name=NULL,*CAname=NULL,*subject=NULL;
1833 ASN1_UTCTIME *tm,*tmptm;
1834 ASN1_STRING *str,*str2;
1838 X509_NAME_ENTRY *ne;
1839 X509_NAME_ENTRY *tne,*push;
1841 int ok= -1,i,j,last,nid;
1844 char *row[DB_NUMBER],**rrow,**irow=NULL;
1847 tmptm=ASN1_UTCTIME_new();
1850 BIO_printf(bio_err,"malloc error\n");
1854 for (i=0; i<DB_NUMBER; i++)
1859 X509_NAME *n = do_subject(subj);
1863 ERR_print_errors(bio_err);
1866 X509_REQ_set_subject_name(req,n);
1867 req->req_info->enc.modified = 1;
1872 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1873 name=X509_REQ_get_subject_name(req);
1874 for (i=0; i<X509_NAME_entry_count(name); i++)
1876 ne= X509_NAME_get_entry(name,i);
1877 str=X509_NAME_ENTRY_get_data(ne);
1878 obj=X509_NAME_ENTRY_get_object(ne);
1882 /* assume all type should be strings */
1883 nid=OBJ_obj2nid(ne->object);
1885 if (str->type == V_ASN1_UNIVERSALSTRING)
1886 ASN1_UNIVERSALSTRING_to_string(str);
1888 if ((str->type == V_ASN1_IA5STRING) &&
1889 (nid != NID_pkcs9_emailAddress))
1890 str->type=V_ASN1_T61STRING;
1892 if ((nid == NID_pkcs9_emailAddress) &&
1893 (str->type == V_ASN1_PRINTABLESTRING))
1894 str->type=V_ASN1_IA5STRING;
1897 /* check some things */
1898 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1899 (str->type != V_ASN1_IA5STRING))
1901 BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1904 j=ASN1_PRINTABLE_type(str->data,str->length);
1905 if ( ((j == V_ASN1_T61STRING) &&
1906 (str->type != V_ASN1_T61STRING)) ||
1907 ((j == V_ASN1_IA5STRING) &&
1908 (str->type == V_ASN1_PRINTABLESTRING)))
1910 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1915 old_entry_print(bio_err, obj, str);
1918 /* Ok, now we check the 'policy' stuff. */
1919 if ((subject=X509_NAME_new()) == NULL)
1921 BIO_printf(bio_err,"Memory allocation failure\n");
1925 /* take a copy of the issuer name before we mess with it. */
1926 CAname=X509_NAME_dup(x509->cert_info->subject);
1927 if (CAname == NULL) goto err;
1930 for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1932 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1933 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1935 BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1943 /* lookup the object in the supplied name list */
1944 j=X509_NAME_get_index_by_OBJ(name,obj,last);
1947 if (last != -1) break;
1952 tne=X509_NAME_get_entry(name,j);
1956 /* depending on the 'policy', decide what to do. */
1958 if (strcmp(cv->value,"optional") == 0)
1963 else if (strcmp(cv->value,"supplied") == 0)
1967 BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1973 else if (strcmp(cv->value,"match") == 0)
1979 BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1986 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1987 if ((j < 0) && (last2 == -1))
1989 BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1994 push=X509_NAME_get_entry(CAname,j);
1995 str=X509_NAME_ENTRY_get_data(tne);
1996 str2=X509_NAME_ENTRY_get_data(push);
1998 if (ASN1_STRING_cmp(str,str2) != 0)
2003 BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
2009 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
2015 if (!X509_NAME_add_entry(subject,push, -1, 0))
2018 X509_NAME_ENTRY_free(push);
2019 BIO_printf(bio_err,"Memory allocation failure\n");
2029 X509_NAME_free(subject);
2030 subject=X509_NAME_dup(X509_REQ_get_subject_name(req));
2031 if (subject == NULL) goto err;
2035 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
2037 row[DB_name]=X509_NAME_oneline(subject,NULL,0);
2038 row[DB_serial]=BN_bn2hex(serial);
2039 if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2041 BIO_printf(bio_err,"Memory allocation failure\n");
2045 rrow=TXT_DB_get_by_index(db,DB_name,row);
2048 BIO_printf(bio_err,"ERROR:There is already a certificate for %s\n",
2053 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2056 BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
2058 BIO_printf(bio_err," check the database/serial_file for corruption\n");
2065 "The matching entry has the following details\n");
2066 if (rrow[DB_type][0] == 'E')
2068 else if (rrow[DB_type][0] == 'R')
2070 else if (rrow[DB_type][0] == 'V')
2073 p="\ninvalid type, Data base error\n";
2074 BIO_printf(bio_err,"Type :%s\n",p);;
2075 if (rrow[DB_type][0] == 'R')
2077 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2078 BIO_printf(bio_err,"Was revoked on:%s\n",p);
2080 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
2081 BIO_printf(bio_err,"Expires on :%s\n",p);
2082 p=rrow[DB_serial]; if (p == NULL) p="undef";
2083 BIO_printf(bio_err,"Serial Number :%s\n",p);
2084 p=rrow[DB_file]; if (p == NULL) p="undef";
2085 BIO_printf(bio_err,"File name :%s\n",p);
2086 p=rrow[DB_name]; if (p == NULL) p="undef";
2087 BIO_printf(bio_err,"Subject Name :%s\n",p);
2088 ok= -1; /* This is now a 'bad' error. */
2092 /* We are now totally happy, lets make and sign the certificate */
2094 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
2096 if ((ret=X509_new()) == NULL) goto err;
2100 /* Make it an X509 v3 certificate. */
2101 if (!X509_set_version(x509,2)) goto err;
2104 if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2106 if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2109 if (strcmp(startdate,"today") == 0)
2110 X509_gmtime_adj(X509_get_notBefore(ret),0);
2111 else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
2113 if (enddate == NULL)
2114 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
2115 else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
2117 if (!X509_set_subject_name(ret,subject)) goto err;
2119 pktmp=X509_REQ_get_pubkey(req);
2120 i = X509_set_pubkey(ret,pktmp);
2121 EVP_PKEY_free(pktmp);
2124 /* Lets add the extensions, if there are any */
2128 if (ci->version == NULL)
2129 if ((ci->version=ASN1_INTEGER_new()) == NULL)
2131 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2133 /* Free the current entries if any, there should not
2134 * be any I believe */
2135 if (ci->extensions != NULL)
2136 sk_X509_EXTENSION_pop_free(ci->extensions,
2137 X509_EXTENSION_free);
2139 ci->extensions = NULL;
2141 /* Initialize the context structure */
2142 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2147 BIO_printf(bio_err, "Extra configuration file found\n");
2149 /* Use the extconf configuration db LHASH */
2150 X509V3_set_nconf(&ctx, extconf);
2152 /* Test the structure (needed?) */
2153 /* X509V3_set_ctx_test(&ctx); */
2155 /* Adds exts contained in the configuration file */
2156 if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2159 "ERROR: adding extensions in section %s\n",
2161 ERR_print_errors(bio_err);
2165 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2169 /* We found extensions to be set from config file */
2170 X509V3_set_nconf(&ctx, lconf);
2172 if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2174 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2175 ERR_print_errors(bio_err);
2180 BIO_printf(bio_err, "Successfully added extensions from config\n");
2184 /* Copy extensions from request (if any) */
2186 if (!copy_extensions(ret, req, ext_copy))
2188 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2189 ERR_print_errors(bio_err);
2196 BIO_printf(bio_err, "Certificate Details:\n");
2197 /* Never print signature details because signature not present */
2198 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2199 X509_print_ex(bio_err, ret, nameopt, certopt);
2202 BIO_printf(bio_err,"Certificate is to be certified until ");
2203 ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2204 if (days) BIO_printf(bio_err," (%d days)",days);
2205 BIO_printf(bio_err, "\n");
2210 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2211 (void)BIO_flush(bio_err);
2213 fgets(buf,sizeof(buf)-1,stdin);
2214 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2216 BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2223 #ifndef OPENSSL_NO_DSA
2224 if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2225 pktmp=X509_get_pubkey(ret);
2226 if (EVP_PKEY_missing_parameters(pktmp) &&
2227 !EVP_PKEY_missing_parameters(pkey))
2228 EVP_PKEY_copy_parameters(pktmp,pkey);
2229 EVP_PKEY_free(pktmp);
2232 if (!X509_sign(ret,pkey,dgst))
2235 /* We now just add it to the database */
2236 row[DB_type]=(char *)OPENSSL_malloc(2);
2238 tm=X509_get_notAfter(ret);
2239 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2240 memcpy(row[DB_exp_date],tm->data,tm->length);
2241 row[DB_exp_date][tm->length]='\0';
2243 row[DB_rev_date]=NULL;
2245 /* row[DB_serial] done already */
2246 row[DB_file]=(char *)OPENSSL_malloc(8);
2247 /* row[DB_name] done already */
2249 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2250 (row[DB_file] == NULL))
2252 BIO_printf(bio_err,"Memory allocation failure\n");
2255 strcpy(row[DB_file],"unknown");
2256 row[DB_type][0]='V';
2257 row[DB_type][1]='\0';
2259 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2261 BIO_printf(bio_err,"Memory allocation failure\n");
2265 for (i=0; i<DB_NUMBER; i++)
2270 irow[DB_NUMBER]=NULL;
2272 if (!TXT_DB_insert(db,irow))
2274 BIO_printf(bio_err,"failed to update database\n");
2275 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2280 for (i=0; i<DB_NUMBER; i++)
2281 if (row[i] != NULL) OPENSSL_free(row[i]);
2284 X509_NAME_free(CAname);
2285 if (subject != NULL)
2286 X509_NAME_free(subject);
2288 ASN1_UTCTIME_free(tmptm);
2291 if (ret != NULL) X509_free(ret);
2299 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2304 (void)i2d_X509_bio(bp,x);
2308 /* ??? Not needed since X509_print prints all this stuff anyway */
2309 f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2310 BIO_printf(bp,"issuer :%s\n",f);
2312 f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2313 BIO_printf(bp,"subject:%s\n",f);
2315 BIO_puts(bp,"serial :");
2316 i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2317 BIO_puts(bp,"\n\n");
2319 if (!notext)X509_print(bp,x);
2320 PEM_write_bio_X509(bp,x);
2323 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2324 const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
2325 BIGNUM *serial, char *subj, char *startdate, char *enddate, long days,
2326 char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2327 unsigned long nameopt, int default_op, int ext_copy)
2329 STACK_OF(CONF_VALUE) *sk=NULL;
2332 CONF_VALUE *cv=NULL;
2333 NETSCAPE_SPKI *spki = NULL;
2336 EVP_PKEY *pktmp=NULL;
2338 X509_NAME_ENTRY *ne=NULL;
2344 * Load input file into a hash table. (This is just an easy
2345 * way to read and parse the file, then put it into a convenient
2348 parms=CONF_load(NULL,infile,&errline);
2351 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2352 ERR_print_errors(bio_err);
2356 sk=CONF_get_section(parms, "default");
2357 if (sk_CONF_VALUE_num(sk) == 0)
2359 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2365 * Now create a dummy X509 request structure. We don't actually
2366 * have an X509 request, but we have many of the components
2367 * (a public key, various DN components). The idea is that we
2368 * put these components into the right X509 request structure
2369 * and we can use the same code as if you had a real X509 request.
2374 ERR_print_errors(bio_err);
2379 * Build up the subject name set.
2386 if (sk_CONF_VALUE_num(sk) <= i) break;
2388 cv=sk_CONF_VALUE_value(sk,i);
2390 /* Skip past any leading X. X: X, etc to allow for
2391 * multiple instances
2393 for (buf = cv->name; *buf ; buf++)
2394 if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2397 if (*buf) type = buf;
2402 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2404 if (strcmp(type, "SPKAC") == 0)
2406 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2409 BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2410 ERR_print_errors(bio_err);
2417 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2418 if (fix_data(nid, &j) == 0)
2421 "invalid characters in string %s\n",buf);
2425 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2426 (unsigned char *)buf,
2427 strlen(buf))) == NULL)
2430 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2434 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2440 * Now extract the key from the SPKI structure.
2443 BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2445 if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2447 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2451 j = NETSCAPE_SPKI_verify(spki, pktmp);
2454 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2457 BIO_printf(bio_err,"Signature ok\n");
2459 X509_REQ_set_pubkey(req,pktmp);
2460 EVP_PKEY_free(pktmp);
2461 ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,startdate,enddate,
2462 days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2465 if (req != NULL) X509_REQ_free(req);
2466 if (parms != NULL) CONF_free(parms);
2467 if (spki != NULL) NETSCAPE_SPKI_free(spki);
2468 if (ne != NULL) X509_NAME_ENTRY_free(ne);
2473 static int fix_data(int nid, int *type)
2475 if (nid == NID_pkcs9_emailAddress)
2476 *type=V_ASN1_IA5STRING;
2477 if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2478 *type=V_ASN1_T61STRING;
2479 if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2480 *type=V_ASN1_T61STRING;
2481 if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2483 if (nid == NID_pkcs9_unstructuredName)
2484 *type=V_ASN1_IA5STRING;
2488 static int check_time_format(char *str)
2492 tm.data=(unsigned char *)str;
2493 tm.length=strlen(str);
2494 tm.type=V_ASN1_UTCTIME;
2495 return(ASN1_UTCTIME_check(&tm));
2498 static int do_revoke(X509 *x509, TXT_DB *db, int type, char *value)
2500 ASN1_UTCTIME *tm=NULL;
2501 char *row[DB_NUMBER],**rrow,**irow;
2502 char *rev_str = NULL;
2506 for (i=0; i<DB_NUMBER; i++)
2508 row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2509 bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2510 row[DB_serial]=BN_bn2hex(bn);
2512 if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2514 BIO_printf(bio_err,"Memory allocation failure\n");
2517 /* We have to lookup by serial number because name lookup
2518 * skips revoked certs
2520 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2523 BIO_printf(bio_err,"Adding Entry to DB for %s\n", row[DB_name]);
2525 /* We now just add it to the database */
2526 row[DB_type]=(char *)OPENSSL_malloc(2);
2528 tm=X509_get_notAfter(x509);
2529 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2530 memcpy(row[DB_exp_date],tm->data,tm->length);
2531 row[DB_exp_date][tm->length]='\0';
2533 row[DB_rev_date]=NULL;
2535 /* row[DB_serial] done already */
2536 row[DB_file]=(char *)OPENSSL_malloc(8);
2538 /* row[DB_name] done already */
2540 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2541 (row[DB_file] == NULL))
2543 BIO_printf(bio_err,"Memory allocation failure\n");
2546 strcpy(row[DB_file],"unknown");
2547 row[DB_type][0]='V';
2548 row[DB_type][1]='\0';
2550 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2552 BIO_printf(bio_err,"Memory allocation failure\n");
2556 for (i=0; i<DB_NUMBER; i++)
2561 irow[DB_NUMBER]=NULL;
2563 if (!TXT_DB_insert(db,irow))
2565 BIO_printf(bio_err,"failed to update database\n");
2566 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->error);
2570 /* Revoke Certificate */
2571 ok = do_revoke(x509,db, type, value);
2576 else if (index_name_cmp((const char **)row,(const char **)rrow))
2578 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2582 else if (rrow[DB_type][0]=='R')
2584 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2590 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2591 rev_str = make_revocation_str(type, value);
2594 BIO_printf(bio_err, "Error in revocation arguments\n");
2597 rrow[DB_type][0]='R';
2598 rrow[DB_type][1]='\0';
2599 rrow[DB_rev_date] = rev_str;
2603 for (i=0; i<DB_NUMBER; i++)
2606 OPENSSL_free(row[i]);
2611 static int get_certificate_status(const char *serial, TXT_DB *db)
2613 char *row[DB_NUMBER],**rrow;
2616 /* Free Resources */
2617 for (i=0; i<DB_NUMBER; i++)
2620 /* Malloc needed char spaces */
2621 row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2622 if (row[DB_serial] == NULL)
2624 BIO_printf(bio_err,"Malloc failure\n");
2628 if (strlen(serial) % 2)
2630 /* Set the first char to 0 */;
2631 row[DB_serial][0]='0';
2633 /* Copy String from serial to row[DB_serial] */
2634 memcpy(row[DB_serial]+1, serial, strlen(serial));
2635 row[DB_serial][strlen(serial)+1]='\0';
2639 /* Copy String from serial to row[DB_serial] */
2640 memcpy(row[DB_serial], serial, strlen(serial));
2641 row[DB_serial][strlen(serial)]='\0';
2644 /* Make it Upper Case */
2645 for (i=0; row[DB_serial][i] != '\0'; i++)
2646 row[DB_serial][i] = toupper(row[DB_serial][i]);
2651 /* Search for the certificate */
2652 rrow=TXT_DB_get_by_index(db,DB_serial,row);
2655 BIO_printf(bio_err,"Serial %s not present in db.\n",
2660 else if (rrow[DB_type][0]=='V')
2662 BIO_printf(bio_err,"%s=Valid (%c)\n",
2663 row[DB_serial], rrow[DB_type][0]);
2666 else if (rrow[DB_type][0]=='R')
2668 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2669 row[DB_serial], rrow[DB_type][0]);
2672 else if (rrow[DB_type][0]=='E')
2674 BIO_printf(bio_err,"%s=Expired (%c)\n",
2675 row[DB_serial], rrow[DB_type][0]);
2678 else if (rrow[DB_type][0]=='S')
2680 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2681 row[DB_serial], rrow[DB_type][0]);
2686 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2687 row[DB_serial], rrow[DB_type][0]);
2691 for (i=0; i<DB_NUMBER; i++)
2694 OPENSSL_free(row[i]);
2699 static int do_updatedb (TXT_DB *db)
2701 ASN1_UTCTIME *a_tm = NULL;
2703 int db_y2k, a_y2k; /* flags = 1 if y >= 2000 */
2704 char **rrow, *a_tm_s;
2706 a_tm = ASN1_UTCTIME_new();
2708 /* get actual time and make a string */
2709 a_tm = X509_gmtime_adj(a_tm, 0);
2710 a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2717 memcpy(a_tm_s, a_tm->data, a_tm->length);
2718 a_tm_s[a_tm->length] = '\0';
2720 if (strncmp(a_tm_s, "49", 2) <= 0)
2725 for (i = 0; i < sk_num(db->data); i++)
2727 rrow = (char **) sk_value(db->data, i);
2729 if (rrow[DB_type][0] == 'V')
2731 /* ignore entries that are not valid */
2732 if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2737 if (db_y2k == a_y2k)
2739 /* all on the same y2k side */
2740 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2742 rrow[DB_type][0] = 'E';
2743 rrow[DB_type][1] = '\0';
2746 BIO_printf(bio_err, "%s=Expired\n",
2750 else if (db_y2k < a_y2k)
2752 rrow[DB_type][0] = 'E';
2753 rrow[DB_type][1] = '\0';
2756 BIO_printf(bio_err, "%s=Expired\n",
2765 ASN1_UTCTIME_free(a_tm);
2766 OPENSSL_free(a_tm_s);
2771 static char *crl_reasons[] = {
2772 /* CRL reason strings */
2776 "affiliationChanged",
2778 "cessationOfOperation",
2781 /* Additional pseudo reasons */
2787 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2789 /* Given revocation information convert to a DB string.
2790 * The format of the string is:
2791 * revtime[,reason,extra]. Where 'revtime' is the
2792 * revocation time (the current time). 'reason' is the
2793 * optional CRL reason and 'extra' is any additional
2797 char *make_revocation_str(int rev_type, char *rev_arg)
2799 char *reason = NULL, *other = NULL, *str;
2801 ASN1_UTCTIME *revtm = NULL;
2808 case REV_CRL_REASON:
2809 for (i = 0; i < 8; i++)
2811 if (!strcasecmp(rev_arg, crl_reasons[i]))
2813 reason = crl_reasons[i];
2819 BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2825 /* Argument is an OID */
2827 otmp = OBJ_txt2obj(rev_arg, 0);
2828 ASN1_OBJECT_free(otmp);
2832 BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2836 reason = "holdInstruction";
2840 case REV_KEY_COMPROMISE:
2841 case REV_CA_COMPROMISE:
2843 /* Argument is the key compromise time */
2844 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2846 BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2850 if (rev_type == REV_KEY_COMPROMISE)
2853 reason = "CAkeyTime";
2859 revtm = X509_gmtime_adj(NULL, 0);
2861 i = revtm->length + 1;
2863 if (reason) i += strlen(reason) + 1;
2864 if (other) i += strlen(other) + 1;
2866 str = OPENSSL_malloc(i);
2868 if (!str) return NULL;
2870 strcpy(str, (char *)revtm->data);
2874 strcat(str, reason);
2881 ASN1_UTCTIME_free(revtm);
2885 /* Convert revocation field to X509_REVOKED entry
2889 * 2 OK and some extensions added (i.e. V2 CRL)
2892 int make_revoked(X509_REVOKED *rev, char *str)
2895 char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2896 int reason_code = -1;
2898 ASN1_OBJECT *hold = NULL;
2899 ASN1_GENERALIZEDTIME *comp_time = NULL;
2900 ASN1_ENUMERATED *rtmp = NULL;
2901 tmp = BUF_strdup(str);
2903 p = strchr(tmp, ',');
2920 if (rev && !ASN1_UTCTIME_set_string(rev->revocationDate, rtime_str))
2922 BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
2927 for (i = 0; i < NUM_REASONS; i++)
2929 if(!strcasecmp(reason_str, crl_reasons[i]))
2935 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
2937 BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
2941 if (reason_code == 7)
2942 reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2943 else if (reason_code == 8) /* Hold instruction */
2947 BIO_printf(bio_err, "missing hold instruction\n");
2950 reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2951 hold = OBJ_txt2obj(arg_str, 0);
2955 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
2959 else if ((reason_code == 9) || (reason_code == 10))
2963 BIO_printf(bio_err, "missing compromised time\n");
2966 comp_time = ASN1_GENERALIZEDTIME_new();
2967 if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
2969 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
2972 if (reason_code == 9)
2973 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
2975 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
2979 if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2981 rtmp = ASN1_ENUMERATED_new();
2982 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2984 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2988 if (rev && comp_time)
2990 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2995 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2999 if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
3005 if (tmp) OPENSSL_free(tmp);
3006 ASN1_OBJECT_free(hold);
3007 ASN1_GENERALIZEDTIME_free(comp_time);
3008 ASN1_ENUMERATED_free(rtmp);
3013 static X509_NAME *do_subject(char *subject)
3015 X509_NAME *n = NULL;
3017 int i, nid, ne_num=0;
3019 char *ne_name = NULL;
3020 char *ne_value = NULL;
3025 char *str_list[256];
3030 n = X509_NAME_new();
3032 tmp = strtok(subject, p[0]);
3033 while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list)))
3037 while (token[0] == ' ')
3039 str_list[ne_num] = token;
3041 tmp = strtok(NULL, p[0]);
3045 for (i = 0; i < ne_num; i++)
3047 ne_name = strtok(str_list[i], p[1]);
3048 ne_value = strtok(NULL, p[1]);
3050 if ((nid=OBJ_txt2nid(ne_name)) == NID_undef)
3052 BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name);
3056 if (ne_value == NULL)
3058 BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name);
3062 if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0))
3073 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
3075 char buf[25],*pbuf, *p;
3077 j=i2a_ASN1_OBJECT(bp,obj);
3079 for (j=22-j; j>0; j--)
3085 if (str->type == V_ASN1_PRINTABLESTRING)
3086 BIO_printf(bp,"PRINTABLE:'");
3087 else if (str->type == V_ASN1_T61STRING)
3088 BIO_printf(bp,"T61STRING:'");
3089 else if (str->type == V_ASN1_IA5STRING)
3090 BIO_printf(bp,"IA5STRING:'");
3091 else if (str->type == V_ASN1_UNIVERSALSTRING)
3092 BIO_printf(bp,"UNIVERSALSTRING:'");
3094 BIO_printf(bp,"ASN.1 %2d:'",str->type);
3096 p=(char *)str->data;
3097 for (j=str->length; j>0; j--)
3099 if ((*p >= ' ') && (*p <= '~'))
3100 BIO_printf(bp,"%c",*p);
3102 BIO_printf(bp,"\\0x%02X",*p);
3103 else if ((unsigned char)*p == 0xf7)
3104 BIO_printf(bp,"^?");
3105 else BIO_printf(bp,"^%c",*p+'@');
3108 BIO_printf(bp,"'\n");