From 9d5aca655323d795ad8c28fa6be47250a08c18c7 Mon Sep 17 00:00:00 2001 From: David von Oheimb Date: Fri, 15 Dec 2017 20:50:37 +0100 Subject: [PATCH] Add function load_csr(file,format,desc) to apps/lib/apps.c Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/4940) --- apps/ca.c | 59 +++++++++++++++------------ apps/crl.c | 4 +- apps/include/apps.h | 13 +++--- apps/lib/apps.c | 83 ++++++++++++++++++++++++++------------ apps/req.c | 18 ++------- apps/s_client.c | 7 +--- apps/s_server.c | 7 +--- apps/x509.c | 8 +--- doc/man1/openssl-ca.pod.in | 12 ++++++ test/recipes/80-test_ca.t | 8 ++-- 10 files changed, 125 insertions(+), 94 deletions(-) diff --git a/apps/ca.c b/apps/ca.c index e2fb43fd7e..a18ff0998e 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -93,7 +93,8 @@ typedef enum { static char *lookup_conf(const CONF *conf, const char *group, const char *tag); -static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, +static int certify(X509 **xret, const char *infile, int informat, + EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(OPENSSL_STRING) *vfyopts, @@ -104,7 +105,8 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, long days, int batch, const char *ext_sect, CONF *conf, int verbose, unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy, int selfsign); -static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, +static int certify_cert(X509 **xret, const char *infile, int informat, + EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(OPENSSL_STRING) *vfyopts, @@ -150,7 +152,8 @@ typedef enum OPTION_choice { OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8, OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE, OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN, - OPT_KEY, OPT_CERT, OPT_SELFSIGN, OPT_IN, OPT_OUT, OPT_OUTDIR, OPT_VFYOPT, + OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN, + OPT_IN, OPT_INFORM, OPT_OUT, OPT_OUTDIR, OPT_VFYOPT, OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN, OPT_GENCRL, OPT_MSIE_HACK, OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC, OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID, @@ -168,7 +171,8 @@ const OPTIONS ca_options[] = { {"help", OPT_HELP, '-', "Display this summary"}, {"verbose", OPT_VERBOSE, '-', "Verbose output during processing"}, {"outdir", OPT_OUTDIR, '/', "Where to put output cert"}, - {"in", OPT_IN, '<', "The input PEM encoded cert request(s)"}, + {"in", OPT_IN, '<', "The input cert request(s)"}, + {"inform", OPT_INFORM, 'F', "CSR input format (DER or PEM); default PEM"}, {"infiles", OPT_INFILES, '-', "The last argument, requests to process"}, {"out", OPT_OUT, '>', "Where to put the output file(s)"}, {"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"}, @@ -190,7 +194,7 @@ const OPTIONS ca_options[] = { OPT_SECTION("Certificate"), {"subj", OPT_SUBJ, 's', "Use arg instead of request's subject"}, - {"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"}, + {"utf8", OPT_UTF8, '-', "Input characters are UTF8; default ASCII"}, {"create_serial", OPT_CREATE_SERIAL, '-', "If reading serial fails, create a new random serial"}, {"rand_serial", OPT_RAND_SERIAL, '-', @@ -215,6 +219,8 @@ const OPTIONS ca_options[] = { {"passin", OPT_PASSIN, 's', "Input file pass phrase source"}, {"key", OPT_KEY, 's', "Key to decode the private key if it is encrypted"}, {"cert", OPT_CERT, '<', "The CA cert"}, + {"certform", OPT_CERTFORM, 'F', + "certificate input format (DER or PEM); default PEM"}, {"selfsign", OPT_SELFSIGN, '-', "Sign a cert with the key associated with it"}, {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"}, @@ -267,6 +273,7 @@ int ca_main(int argc, char **argv) char *configfile = default_config_file, *section = NULL; char *md = NULL, *policy = NULL, *keyfile = NULL; char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL, *key = NULL; + int certformat = FORMAT_PEM, informat = FORMAT_PEM; const char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL; const char *extensions = NULL, *extfile = NULL, *passinarg = NULL; char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL; @@ -306,6 +313,10 @@ opthelp: req = 1; infile = opt_arg(); break; + case OPT_INFORM: + if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat)) + goto opthelp; + break; case OPT_OUT: outfile = opt_arg(); break; @@ -373,6 +384,10 @@ opthelp: case OPT_CERT: certfile = opt_arg(); break; + case OPT_CERTFORM: + if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &certformat)) + goto opthelp; + break; case OPT_SELFSIGN: selfsign = 1; break; @@ -571,7 +586,7 @@ end_of_options: && (certfile = lookup_conf(conf, section, ENV_CERTIFICATE)) == NULL) goto end; - x509 = load_cert(certfile, FORMAT_PEM, "CA certificate"); + x509 = load_cert(certfile, certformat, "CA certificate"); if (x509 == NULL) goto end; @@ -926,7 +941,7 @@ end_of_options: } if (ss_cert_file != NULL) { total++; - j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, + j = certify_cert(&x, ss_cert_file, certformat, pkey, x509, dgst, sigopts, vfyopts, attribs, db, serial, subj, chtype, multirdn, email_dn, startdate, enddate, days, batch, extensions, @@ -947,8 +962,8 @@ end_of_options: } if (infile != NULL) { total++; - j = certify(&x, infile, pkey, x509p, dgst, sigopts, vfyopts, - attribs, db, + j = certify(&x, infile, informat, pkey, x509p, dgst, + sigopts, vfyopts, attribs, db, serial, subj, chtype, multirdn, email_dn, startdate, enddate, days, batch, extensions, conf, verbose, certopt, get_nameopt(), default_op, ext_copy, selfsign); @@ -967,7 +982,8 @@ end_of_options: } for (i = 0; i < argc; i++) { total++; - j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, vfyopts, + j = certify(&x, argv[i], informat, pkey, x509p, dgst, + sigopts, vfyopts, attribs, db, serial, subj, chtype, multirdn, email_dn, startdate, enddate, days, batch, extensions, conf, verbose, @@ -1247,7 +1263,7 @@ end_of_options: goto end; } else { X509 *revcert; - revcert = load_cert(infile, FORMAT_PEM, infile); + revcert = load_cert(infile, certformat, infile); if (revcert == NULL) goto end; if (dorevoke == 2) @@ -1300,7 +1316,8 @@ static char *lookup_conf(const CONF *conf, const char *section, const char *tag) return entry; } -static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, +static int certify(X509 **xret, const char *infile, int informat, + EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(OPENSSL_STRING) *vfyopts, @@ -1313,20 +1330,12 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, int default_op, int ext_copy, int selfsign) { X509_REQ *req = NULL; - BIO *in = NULL; EVP_PKEY *pktmp = NULL; int ok = -1, i; - in = BIO_new_file(infile, "r"); - if (in == NULL) { - ERR_print_errors(bio_err); + req = load_csr(infile, informat, "certificate request"); + if (req == NULL) goto end; - } - if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) { - BIO_printf(bio_err, "Error reading certificate request in %s\n", - infile); - goto end; - } if (verbose) X509_REQ_print_ex(bio_err, req, nameopt, X509_FLAG_COMPAT); @@ -1367,11 +1376,11 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, end: X509_REQ_free(req); - BIO_free(in); return ok; } -static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509, +static int certify_cert(X509 **xret, const char *infile, int certformat, + EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts, STACK_OF(OPENSSL_STRING) *vfyopts, @@ -1387,7 +1396,7 @@ static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x EVP_PKEY *pktmp = NULL; int ok = -1, i; - if ((req = load_cert(infile, FORMAT_PEM, infile)) == NULL) + if ((req = load_cert(infile, certformat, infile)) == NULL) goto end; if (verbose) X509_print(bio_err, req); diff --git a/apps/crl.c b/apps/crl.c index 8b5a36322a..8028fef5de 100644 --- a/apps/crl.c +++ b/apps/crl.c @@ -205,7 +205,7 @@ int crl_main(int argc, char **argv) if (argc != 0) goto opthelp; - x = load_crl(infile, informat); + x = load_crl(infile, informat, "CRL"); if (x == NULL) goto end; @@ -250,7 +250,7 @@ int crl_main(int argc, char **argv) BIO_puts(bio_err, "Missing CRL signing key\n"); goto end; } - newcrl = load_crl(crldiff, informat); + newcrl = load_crl(crldiff, informat, "other CRL"); if (!newcrl) goto end; pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key"); diff --git a/apps/include/apps.h b/apps/include/apps.h index f9049f060f..e168942e19 100644 --- a/apps/include/apps.h +++ b/apps/include/apps.h @@ -104,16 +104,17 @@ int set_ext_copy(int *copy_type, const char *arg); int copy_extensions(X509 *x, X509_REQ *req, int copy_type); int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2); int add_oid_section(CONF *conf); -X509 *load_cert(const char *file, int format, const char *cert_descrip); -X509_CRL *load_crl(const char *infile, int format); +X509_REQ *load_csr(const char *file, int format, const char *desc); +X509 *load_cert(const char *file, int format, const char *desc); +X509_CRL *load_crl(const char *infile, int format, const char *desc); EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *key_descrip); + const char *pass, ENGINE *e, const char *desc); EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *key_descrip); + const char *pass, ENGINE *e, const char *desc); int load_certs(const char *file, STACK_OF(X509) **certs, int format, - const char *pass, const char *cert_descrip); + const char *pass, const char *desc); int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format, - const char *pass, const char *cert_descrip); + const char *pass, const char *desc); X509_STORE *setup_verify(const char *CAfile, int noCAfile, const char *CApath, int noCApath, const char *CAstore, int noCAstore); diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 5395d842eb..d175e687ba 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -421,7 +421,7 @@ static int load_pkcs12(BIO *in, const char *desc, int len, ret = 0; PKCS12 *p12; p12 = d2i_PKCS12_bio(in, NULL); - if (p12 == NULL) { + if (p12 == NULL && desc != NULL) { BIO_printf(bio_err, "Error loading PKCS12 file for %s\n", desc); goto die; } @@ -433,7 +433,8 @@ static int load_pkcs12(BIO *in, const char *desc, pem_cb = (pem_password_cb *)password_callback; len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data); if (len < 0) { - BIO_printf(bio_err, "Passphrase callback error for %s\n", desc); + BIO_printf(bio_err, "Passphrase callback error for %s\n", + desc != NULL ? desc : "PKCS12 input"); goto die; } if (len < PEM_BUFSIZE) @@ -441,7 +442,7 @@ static int load_pkcs12(BIO *in, const char *desc, if (!PKCS12_verify_mac(p12, tpass, len)) { BIO_printf(bio_err, "Mac verify error (wrong password?) in PKCS12 file for %s\n", - desc); + desc != NULL ? desc : "PKCS12 input"); goto die; } pass = tpass; @@ -452,7 +453,7 @@ static int load_pkcs12(BIO *in, const char *desc, return ret; } -X509 *load_cert(const char *file, int format, const char *cert_descrip) +X509 *load_cert(const char *file, int format, const char *desc) { X509 *x = NULL; BIO *cert; @@ -479,22 +480,22 @@ X509 *load_cert(const char *file, int format, const char *cert_descrip) x = PEM_read_bio_X509_AUX(cert, NULL, (pem_password_cb *)password_callback, NULL); } else if (format == FORMAT_PKCS12) { - if (!load_pkcs12(cert, cert_descrip, NULL, NULL, NULL, &x, NULL)) + if (!load_pkcs12(cert, desc, NULL, NULL, NULL, &x, NULL)) goto end; } else { BIO_printf(bio_err, "bad input format specified for %s\n", cert_descrip); goto end; } end: - if (x == NULL) { - BIO_printf(bio_err, "unable to load certificate\n"); + if (x == NULL && desc != NULL) { + BIO_printf(bio_err, "unable to load %s\n", desc); ERR_print_errors(bio_err); } BIO_free(cert); return x; } -X509_CRL *load_crl(const char *infile, int format) +X509_CRL *load_crl(const char *infile, int format, const char *desc) { X509_CRL *x = NULL; BIO *in = NULL; @@ -517,19 +518,44 @@ X509_CRL *load_crl(const char *infile, int format) BIO_printf(bio_err, "bad input format specified for input crl\n"); goto end; } - if (x == NULL) { - BIO_printf(bio_err, "unable to load CRL\n"); + + end: + if (x == NULL && desc != NULL) { + BIO_printf(bio_err, "unable to load %s\n", desc); ERR_print_errors(bio_err); goto end; } + BIO_free(in); + return x; +} + +X509_REQ *load_csr(const char *file, int format, const char *desc) +{ + X509_REQ *req = NULL; + BIO *in; + + in = bio_open_default(file, 'r', format); + if (in == NULL) + goto end; + + if (format == FORMAT_ASN1) + req = d2i_X509_REQ_bio(in, NULL); + else if (format == FORMAT_PEM) + req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL); + else if (desc) + BIO_printf(bio_err, "unsupported format for loading %s\n", desc); end: + if (req == NULL && desc != NULL) { + BIO_printf(bio_err, "unable to load %s\n", desc); + ERR_print_errors(bio_err); + } BIO_free(in); - return x; + return req; } EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *key_descrip) + const char *pass, ENGINE *e, const char *desc) { BIO *key = NULL; EVP_PKEY *pkey = NULL; @@ -553,8 +579,8 @@ EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, &cb_data); ENGINE_finish(e); } - if (pkey == NULL) { - BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip); + if (pkey == NULL && desc != NULL) { + BIO_printf(bio_err, "cannot load %s from engine\n", desc); ERR_print_errors(bio_err); } #else @@ -576,7 +602,8 @@ EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, } else if (format == FORMAT_PEM) { pkey = PEM_read_bio_PrivateKey(key, NULL, wrap_password_callback, &cb_data); } else if (format == FORMAT_PKCS12) { - if (!load_pkcs12(key, key_descrip, wrap_password_callback, &cb_data, + if (!load_pkcs12(key, desc, + (pem_password_cb *)password_callback, &cb_data, &pkey, NULL, NULL)) goto end; #if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4) @@ -591,15 +618,15 @@ EVP_PKEY *load_key(const char *file, int format, int maybe_stdin, } end: BIO_free(key); - if (pkey == NULL) { - BIO_printf(bio_err, "unable to load %s\n", key_descrip); + if (pkey == NULL && desc != NULL) { + BIO_printf(bio_err, "unable to load %s\n", desc); ERR_print_errors(bio_err); } return pkey; } EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin, - const char *pass, ENGINE *e, const char *key_descrip) + const char *pass, ENGINE *e, const char *desc) { BIO *key = NULL; EVP_PKEY *pkey = NULL; @@ -619,8 +646,8 @@ EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin, #ifndef OPENSSL_NO_ENGINE pkey = ENGINE_load_public_key(e, file, (UI_METHOD *)get_ui_method(), &cb_data); - if (pkey == NULL) { - BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip); + if (pkey == NULL && desc != NULL) { + BIO_printf(bio_err, "cannot load %s from engine\n", desc); ERR_print_errors(bio_err); } #else @@ -680,8 +707,10 @@ EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin, } end: BIO_free(key); - if (pkey == NULL) - BIO_printf(bio_err, "unable to load %s\n", key_descrip); + if (pkey == NULL && desc != NULL) { + BIO_printf(bio_err, "unable to load %s\n", desc); + ERR_print_errors(bio_err); + } return pkey; } @@ -760,9 +789,11 @@ static int load_certs_crls(const char *file, int format, sk_X509_CRL_pop_free(*pcrls, X509_CRL_free); *pcrls = NULL; } - BIO_printf(bio_err, "unable to load %s\n", - pcerts ? "certificates" : "CRLs"); - ERR_print_errors(bio_err); + if (desc != NULL) { + BIO_printf(bio_err, "unable to load %s for %s\n", + pcerts ? "certificates" : "CRLs", desc); + ERR_print_errors(bio_err); + } } return rv; } @@ -1900,7 +1931,7 @@ static X509_CRL *load_crl_crldp(STACK_OF(DIST_POINT) *crldp) DIST_POINT *dp = sk_DIST_POINT_value(crldp, i); urlptr = get_dp_url(dp); if (urlptr) - return load_crl(urlptr, FORMAT_HTTP); + return load_crl(urlptr, FORMAT_HTTP, "CRL via CDP"); } return NULL; } diff --git a/apps/req.c b/apps/req.c index 9ab120c34f..6740f21c35 100644 --- a/apps/req.c +++ b/apps/req.c @@ -230,7 +230,7 @@ static int duplicated(LHASH_OF(OPENSSL_STRING) *addexts, char *kv) int req_main(int argc, char **argv) { ASN1_INTEGER *serial = NULL; - BIO *in = NULL, *out = NULL; + BIO *out = NULL; ENGINE *e = NULL, *gen_eng = NULL; EVP_PKEY *pkey = NULL; EVP_PKEY_CTX *genctx = NULL; @@ -469,7 +469,7 @@ int req_main(int argc, char **argv) BIO_printf(bio_err, "Using configuration from %s\n", template); if ((req_conf = app_load_config(template)) == NULL) goto end; - if (addext_bio) { + if (addext_bio != NULL) { if (verbose) BIO_printf(bio_err, "Using additional configuration from command line\n"); @@ -715,18 +715,9 @@ int req_main(int argc, char **argv) } if (!newreq) { - in = bio_open_default(infile, 'r', informat); - if (in == NULL) + req = load_csr(infile, informat, "X509 request"); + if (req == NULL) goto end; - - if (informat == FORMAT_ASN1) - req = d2i_X509_REQ_bio(in, NULL); - else - req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL); - if (req == NULL) { - BIO_printf(bio_err, "unable to load X509 request\n"); - goto end; - } } if (newreq || x509) { @@ -992,7 +983,6 @@ int req_main(int argc, char **argv) NCONF_free(req_conf); NCONF_free(addext_conf); BIO_free(addext_bio); - BIO_free(in); BIO_free_all(out); EVP_PKEY_free(pkey); EVP_PKEY_CTX_free(genctx); diff --git a/apps/s_client.c b/apps/s_client.c index a28b2867a3..1596cb2f1e 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -1736,12 +1736,9 @@ int s_client_main(int argc, char **argv) if (crl_file != NULL) { X509_CRL *crl; - crl = load_crl(crl_file, crl_format); - if (crl == NULL) { - BIO_puts(bio_err, "Error loading CRL\n"); - ERR_print_errors(bio_err); + crl = load_crl(crl_file, crl_format, "CRL"); + if (crl == NULL) goto end; - } crls = sk_X509_CRL_new_null(); if (crls == NULL || !sk_X509_CRL_push(crls, crl)) { BIO_puts(bio_err, "Error adding CRL\n"); diff --git a/apps/s_server.c b/apps/s_server.c index 14550aebc2..8e2d73e622 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -1787,12 +1787,9 @@ int s_server_main(int argc, char *argv[]) if (crl_file != NULL) { X509_CRL *crl; - crl = load_crl(crl_file, crl_format); - if (crl == NULL) { - BIO_puts(bio_err, "Error loading CRL\n"); - ERR_print_errors(bio_err); + crl = load_crl(crl_file, crl_format, "CRL"); + if (crl == NULL) goto end; - } crls = sk_X509_CRL_new_null(); if (crls == NULL || !sk_X509_CRL_push(crls, crl)) { BIO_puts(bio_err, "Error adding CRL\n"); diff --git a/apps/x509.c b/apps/x509.c index 16c1f95754..d891b42f92 100644 --- a/apps/x509.c +++ b/apps/x509.c @@ -572,14 +572,8 @@ int x509_main(int argc, char **argv) if (reqfile) { EVP_PKEY *pkey; - BIO *in; - - in = bio_open_default(infile, 'r', informat); - if (in == NULL) - goto end; - req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL); - BIO_free(in); + req = load_csr(infile, informat, "certificate request input"); if (req == NULL) { ERR_print_errors(bio_err); goto end; diff --git a/doc/man1/openssl-ca.pod.in b/doc/man1/openssl-ca.pod.in index d561101d80..0202661845 100644 --- a/doc/man1/openssl-ca.pod.in +++ b/doc/man1/openssl-ca.pod.in @@ -36,8 +36,10 @@ B B [B<-key> I] [B<-passin> I] [B<-cert> I] +[B<-certform> B|] [B<-selfsign>] [B<-in> I] +[B<-inform> B|] [B<-out> I] [B<-notext>] [B<-outdir> I] @@ -104,6 +106,11 @@ B in the B section). An input filename containing a single certificate request to be signed by the CA. +=item B<-inform> B|B + +The format of the data in CSR input files. +The default is PEM. + =item B<-ss_cert> I A single self-signed certificate to be signed by the CA. @@ -135,6 +142,11 @@ F<.pem> appended. The CA certificate file. +=item B<-certform> B|B + +The format of the data in certificate input files. +The default is PEM. + =item B<-keyfile> I The private key to sign requests with. diff --git a/test/recipes/80-test_ca.t b/test/recipes/80-test_ca.t index 3b36a2bfd9..3d4dfcd060 100644 --- a/test/recipes/80-test_ca.t +++ b/test/recipes/80-test_ca.t @@ -32,12 +32,12 @@ plan tests => 6; $ENV{OPENSSL_CONFIG} = '-config "'.srctop_file("test", "Uss.cnf").'"'; skip "failed creating new certificate request", 3 - if !ok(run(perlapp(["CA.pl","-newreq"])), + if !ok(run(perlapp(["CA.pl","-newreq", + "-extra-req","-outform DER"])), 'creating certificate request'); - - $ENV{OPENSSL_CONFIG} = '-rand_serial -config "'.$std_openssl_cnf.'"'; + $ENV{OPENSSL_CONFIG} = '-rand_serial -inform DER -config "'.$std_openssl_cnf.'"'; skip "failed to sign certificate request", 2 - if !is(yes(cmdstr(perlapp(["CA.pl", "-sign"]))), 0, + if !is(yes(cmdstr(perlapp(["CA.pl", "-sign", "-extra-ca"]))), 0, 'signing certificate request'); ok(run(perlapp(["CA.pl", "-verify", "newcert.pem"])), -- 2.25.1