2 * px5g - Embedded x509 key and certificate generator based on PolarSSL
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
5 * Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License, version 2.1 as published by the Free Software Foundation.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
22 #include <sys/types.h>
33 #include <mbedtls/bignum.h>
34 #include <mbedtls/x509_crt.h>
35 #include <mbedtls/ecp.h>
36 #include <mbedtls/rsa.h>
37 #include <mbedtls/pk.h>
39 #define PX5G_VERSION "0.2"
40 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
41 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
43 static int urandom_fd;
44 static char buf[16384];
46 static int _urandom(void *ctx, unsigned char *out, size_t len)
48 read(urandom_fd, out, len);
52 static void write_file(const char *path, int len, bool pem)
55 const char *buf_start = buf;
58 buf_start += sizeof(buf) - len;
61 fprintf(stderr, "No data to write\n");
66 fprintf(stderr, "error: I/O error\n");
73 fwrite(buf_start, 1, len, f);
77 static mbedtls_ecp_group_id ecp_curve(const char *name)
79 const mbedtls_ecp_curve_info *curve_info;
81 if (!strcmp(name, "P-256"))
82 return MBEDTLS_ECP_DP_SECP256R1;
83 else if (!strcmp(name, "P-384"))
84 return MBEDTLS_ECP_DP_SECP384R1;
85 else if (!strcmp(name, "P-521"))
86 return MBEDTLS_ECP_DP_SECP521R1;
87 curve_info = mbedtls_ecp_curve_info_from_name(name);
88 if (curve_info == NULL)
89 return MBEDTLS_ECP_DP_NONE;
91 return curve_info->grp_id;
94 static void write_key(mbedtls_pk_context *key, const char *path, bool pem)
99 if (mbedtls_pk_write_key_pem(key, (void *) buf, sizeof(buf)) == 0)
102 len = mbedtls_pk_write_key_der(key, (void *) buf, sizeof(buf));
107 write_file(path, len, pem);
110 static void gen_key(mbedtls_pk_context *key, bool rsa, int ksize, int exp,
111 mbedtls_ecp_group_id curve, bool pem)
113 mbedtls_pk_init(key);
115 fprintf(stderr, "Generating RSA private key, %i bit long modulus\n", ksize);
116 mbedtls_pk_setup(key, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
117 if (!mbedtls_rsa_gen_key(mbedtls_pk_rsa(*key), _urandom, NULL, ksize, exp))
120 fprintf(stderr, "Generating EC private key\n");
121 mbedtls_pk_setup(key, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY));
122 if (!mbedtls_ecp_gen_key(curve, mbedtls_pk_ec(*key), _urandom, NULL))
125 fprintf(stderr, "error: key generation failed\n");
129 int dokey(bool rsa, char **arg)
131 mbedtls_pk_context key;
132 unsigned int ksize = 512;
136 mbedtls_ecp_group_id curve = MBEDTLS_ECP_DP_SECP256R1;
138 while (*arg && **arg == '-') {
139 if (!strcmp(*arg, "-out") && arg[1]) {
142 } else if (!strcmp(*arg, "-3")) {
144 } else if (!strcmp(*arg, "-der")) {
151 ksize = (unsigned int)atoi(*arg);
153 curve = ecp_curve((const char *)*arg);
154 if (curve == MBEDTLS_ECP_DP_NONE) {
155 fprintf(stderr, "error: invalid curve name: %s\n", *arg);
160 gen_key(&key, rsa, ksize, exp, curve, pem);
161 write_key(&key, path, pem);
163 mbedtls_pk_free(&key);
168 int selfsigned(char **arg)
170 mbedtls_pk_context key;
171 mbedtls_x509write_cert cert;
175 unsigned int ksize = 512;
177 unsigned int days = 30;
178 char *keypath = NULL, *certpath = NULL;
180 time_t from = time(NULL), to;
181 char fstr[20], tstr[20], sstr[17];
184 mbedtls_ecp_group_id curve = MBEDTLS_ECP_DP_SECP256R1;
186 while (*arg && **arg == '-') {
187 if (!strcmp(*arg, "-der")) {
189 } else if (!strcmp(*arg, "-newkey") && arg[1]) {
190 if (!strncmp(arg[1], "rsa:", 4)) {
192 ksize = (unsigned int)atoi(arg[1] + 4);
193 } else if (!strcmp(arg[1], "ec")) {
196 fprintf(stderr, "error: invalid algorithm\n");
200 } else if (!strcmp(*arg, "-days") && arg[1]) {
201 days = (unsigned int)atoi(arg[1]);
203 } else if (!strcmp(*arg, "-pkeyopt") && arg[1]) {
204 if (strncmp(arg[1], "ec_paramgen_curve:", 18)) {
205 fprintf(stderr, "error: invalid pkey option: %s\n", arg[1]);
208 curve = ecp_curve((const char *)(arg[1] + 18));
209 if (curve == MBEDTLS_ECP_DP_NONE) {
210 fprintf(stderr, "error: invalid curve name: %s\n", arg[1] + 18);
214 } else if (!strcmp(*arg, "-keyout") && arg[1]) {
217 } else if (!strcmp(*arg, "-out") && arg[1]) {
220 } else if (!strcmp(*arg, "-subj") && arg[1]) {
221 if (arg[1][0] != '/' || strchr(arg[1], ';')) {
222 fprintf(stderr, "error: invalid subject");
225 subject = calloc(strlen(arg[1]) + 1, 1);
226 char *oldc = arg[1] + 1, *newc = subject, *delim;
228 delim = strchr(oldc, '=');
230 fprintf(stderr, "error: invalid subject");
233 memcpy(newc, oldc, delim - oldc + 1);
234 newc += delim - oldc + 1;
237 delim = strchr(oldc, '/');
239 delim = arg[1] + strlen(arg[1]);
241 memcpy(newc, oldc, delim - oldc);
242 newc += delim - oldc;
250 gen_key(&key, rsa, ksize, exp, curve, pem);
253 write_key(&key, keypath, pem);
255 from = (from < 1000000000) ? 1000000000 : from;
256 strftime(fstr, sizeof(fstr), "%Y%m%d%H%M%S", gmtime(&from));
257 to = from + 60 * 60 * 24 * days;
260 strftime(tstr, sizeof(tstr), "%Y%m%d%H%M%S", gmtime(&to));
262 fprintf(stderr, "Generating selfsigned certificate with subject '%s'"
263 " and validity %s-%s\n", subject, fstr, tstr);
265 mbedtls_x509write_crt_init(&cert);
266 mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA256);
267 mbedtls_x509write_crt_set_issuer_key(&cert, &key);
268 mbedtls_x509write_crt_set_subject_key(&cert, &key);
269 mbedtls_x509write_crt_set_subject_name(&cert, subject);
270 mbedtls_x509write_crt_set_issuer_name(&cert, subject);
271 mbedtls_x509write_crt_set_validity(&cert, fstr, tstr);
272 mbedtls_x509write_crt_set_basic_constraints(&cert, 0, -1);
273 mbedtls_x509write_crt_set_subject_key_identifier(&cert);
274 mbedtls_x509write_crt_set_authority_key_identifier(&cert);
276 _urandom(NULL, (void *) buf, 8);
277 for (len = 0; len < 8; len++)
278 sprintf(sstr + len*2, "%02x", (unsigned char) buf[len]);
280 mbedtls_mpi_init(&serial);
281 mbedtls_mpi_read_string(&serial, 16, sstr);
282 mbedtls_x509write_crt_set_serial(&cert, &serial);
285 if (mbedtls_x509write_crt_pem(&cert, (void *) buf, sizeof(buf), _urandom, NULL) < 0) {
286 fprintf(stderr, "Failed to generate certificate\n");
292 len = mbedtls_x509write_crt_der(&cert, (void *) buf, sizeof(buf), _urandom, NULL);
294 fprintf(stderr, "Failed to generate certificate: %d\n", len);
298 write_file(certpath, len, pem);
300 mbedtls_x509write_crt_free(&cert);
301 mbedtls_mpi_free(&serial);
302 mbedtls_pk_free(&key);
307 int main(int argc, char *argv[])
309 urandom_fd = open("/dev/urandom", O_RDONLY);
313 } else if (!strcmp(argv[1], "eckey")) {
314 return dokey(false, argv+2);
315 } else if (!strcmp(argv[1], "rsakey")) {
316 return dokey(true, argv+2);
317 } else if (!strcmp(argv[1], "selfsigned")) {
318 return selfsigned(argv+2);
322 "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION "\n" PX5G_COPY
323 "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
324 fprintf(stderr, "Usage: %s [eckey|rsakey|selfsigned]\n", *argv);