1 /*
2 * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <string.h>
13 #include "apps.h"
14 #include "progs.h"
15 #include <openssl/bio.h>
16 #include <openssl/asn1.h>
17 #include <openssl/err.h>
18 #include <openssl/bn.h>
19 #include <openssl/evp.h>
20 #include <openssl/x509.h>
21 #include <openssl/x509v3.h>
22 #include <openssl/objects.h>
23 #include <openssl/pem.h>
24 #include <openssl/rsa.h>
25 #ifndef OPENSSL_NO_DSA
26 #include <openssl/dsa.h>
27 #endif
28 #include "internal/e_os.h" /* For isatty() */
29
30 #undef POSTFIX
31 #define POSTFIX ".srl"
32 #define DEFAULT_DAYS 30 /* default certificate validity period in days */
33 #define UNSET_DAYS -2 /* -1 may be used for testing expiration checks */
34 #define EXT_COPY_UNSET -1
35
36 static int callb(int ok, X509_STORE_CTX *ctx);
37 static ASN1_INTEGER *x509_load_serial(const char *CAfile,
38 const char *serialfile, int create);
39 static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
40 static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names);
41
42 typedef enum OPTION_choice {
43 OPT_COMMON,
44 OPT_INFORM,
45 OPT_OUTFORM,
46 OPT_KEYFORM,
47 OPT_REQ,
48 OPT_CAFORM,
49 OPT_CAKEYFORM,
50 OPT_VFYOPT,
51 OPT_SIGOPT,
52 OPT_DAYS,
53 OPT_PASSIN,
54 OPT_EXTFILE,
55 OPT_EXTENSIONS,
56 OPT_IN,
57 OPT_OUT,
58 OPT_KEY,
59 OPT_SIGNKEY,
60 OPT_CA,
61 OPT_CAKEY,
62 OPT_CASERIAL,
63 OPT_SET_SERIAL,
64 OPT_NEW,
65 OPT_FORCE_PUBKEY,
66 OPT_ISSU,
67 OPT_SUBJ,
68 OPT_ADDTRUST,
69 OPT_ADDREJECT,
70 OPT_SETALIAS,
71 OPT_CERTOPT,
72 OPT_DATEOPT,
73 OPT_NAMEOPT,
74 OPT_EMAIL,
75 OPT_OCSP_URI,
76 OPT_SERIAL,
77 OPT_NEXT_SERIAL,
78 OPT_MODULUS,
79 OPT_PUBKEY,
80 OPT_X509TOREQ,
81 OPT_TEXT,
82 OPT_HASH,
83 OPT_ISSUER_HASH,
84 OPT_SUBJECT,
85 OPT_ISSUER,
86 OPT_FINGERPRINT,
87 OPT_DATES,
88 OPT_PURPOSE,
89 OPT_STARTDATE,
90 OPT_ENDDATE,
91 OPT_CHECKEND,
92 OPT_CHECKHOST,
93 OPT_CHECKEMAIL,
94 OPT_CHECKIP,
95 OPT_NOOUT,
96 OPT_TRUSTOUT,
97 OPT_CLRTRUST,
98 OPT_CLRREJECT,
99 OPT_ALIAS,
100 OPT_CACREATESERIAL,
101 OPT_CLREXT,
102 OPT_OCSPID,
103 OPT_SUBJECT_HASH_OLD,
104 OPT_ISSUER_HASH_OLD,
105 OPT_COPY_EXTENSIONS,
106 OPT_BADSIG,
107 OPT_MD,
108 OPT_ENGINE,
109 OPT_NOCERT,
110 OPT_PRESERVE_DATES,
111 OPT_NOT_BEFORE,
112 OPT_NOT_AFTER,
113 OPT_R_ENUM,
114 OPT_PROV_ENUM,
115 OPT_EXT
116 } OPTION_CHOICE;
117
118 const OPTIONS x509_options[] = {
119 OPT_SECTION("General"),
120 { "help", OPT_HELP, '-', "Display this summary" },
121
122 { "in", OPT_IN, '<',
123 "Certificate input, or CSR input file with -req (default stdin)" },
124 { "passin", OPT_PASSIN, 's', "Private key and cert file pass-phrase source" },
125 { "new", OPT_NEW, '-', "Generate a certificate from scratch" },
126 { "x509toreq", OPT_X509TOREQ, '-',
127 "Output a certification request (rather than a certificate)" },
128 { "req", OPT_REQ, '-', "Input is a CSR file (rather than a certificate)" },
129 { "copy_extensions", OPT_COPY_EXTENSIONS, 's',
130 "copy extensions when converting from CSR to x509 or vice versa" },
131 { "inform", OPT_INFORM, 'f',
132 "CSR input format to use (PEM or DER; by default try PEM first)" },
133 { "vfyopt", OPT_VFYOPT, 's', "CSR verification parameter in n:v form" },
134 { "key", OPT_KEY, 's',
135 "Key for signing, and to include unless using -force_pubkey" },
136 { "signkey", OPT_SIGNKEY, 's',
137 "Same as -key" },
138 { "keyform", OPT_KEYFORM, 'E',
139 "Key input format (ENGINE, other values ignored)" },
140 { "out", OPT_OUT, '>', "Output file - default stdout" },
141 { "outform", OPT_OUTFORM, 'f',
142 "Output format (DER or PEM) - default PEM" },
143 { "nocert", OPT_NOCERT, '-',
144 "No cert output (except for requested printing)" },
145 { "noout", OPT_NOOUT, '-', "No output (except for requested printing)" },
146
147 OPT_SECTION("Certificate printing"),
148 { "text", OPT_TEXT, '-', "Print the certificate in text form" },
149 { "dateopt", OPT_DATEOPT, 's',
150 "Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822." },
151 { "certopt", OPT_CERTOPT, 's', "Various certificate text printing options" },
152 { "fingerprint", OPT_FINGERPRINT, '-', "Print the certificate fingerprint" },
153 { "alias", OPT_ALIAS, '-', "Print certificate alias" },
154 { "serial", OPT_SERIAL, '-', "Print serial number value" },
155 { "startdate", OPT_STARTDATE, '-', "Print the notBefore field" },
156 { "enddate", OPT_ENDDATE, '-', "Print the notAfter field" },
157 { "dates", OPT_DATES, '-', "Print both notBefore and notAfter fields" },
158 { "subject", OPT_SUBJECT, '-', "Print subject DN" },
159 { "issuer", OPT_ISSUER, '-', "Print issuer DN" },
160 { "nameopt", OPT_NAMEOPT, 's',
161 "Certificate subject/issuer name printing options" },
162 { "email", OPT_EMAIL, '-', "Print email address(es)" },
163 { "hash", OPT_HASH, '-', "Synonym for -subject_hash (for backward compat)" },
164 { "subject_hash", OPT_HASH, '-', "Print subject hash value" },
165 #ifndef OPENSSL_NO_MD5
166 { "subject_hash_old", OPT_SUBJECT_HASH_OLD, '-',
167 "Print old-style (MD5) subject hash value" },
168 #endif
169 { "issuer_hash", OPT_ISSUER_HASH, '-', "Print issuer hash value" },
170 #ifndef OPENSSL_NO_MD5
171 { "issuer_hash_old", OPT_ISSUER_HASH_OLD, '-',
172 "Print old-style (MD5) issuer hash value" },
173 #endif
174 { "ext", OPT_EXT, 's',
175 "Restrict which X.509 extensions to print and/or copy" },
176 { "ocspid", OPT_OCSPID, '-',
177 "Print OCSP hash values for the subject name and public key" },
178 { "ocsp_uri", OPT_OCSP_URI, '-', "Print OCSP Responder URL(s)" },
179 { "purpose", OPT_PURPOSE, '-', "Print out certificate purposes" },
180 { "pubkey", OPT_PUBKEY, '-', "Print the public key in PEM format" },
181 { "modulus", OPT_MODULUS, '-', "Print the RSA key modulus" },
182
183 OPT_SECTION("Certificate checking"),
184 { "checkend", OPT_CHECKEND, 'M',
185 "Check whether cert expires in the next arg seconds" },
186 { OPT_MORE_STR, 1, 1, "Exit 1 (failure) if so, 0 if not" },
187 { "checkhost", OPT_CHECKHOST, 's', "Check certificate matches host" },
188 { "checkemail", OPT_CHECKEMAIL, 's', "Check certificate matches email" },
189 { "checkip", OPT_CHECKIP, 's', "Check certificate matches ipaddr" },
190
191 OPT_SECTION("Certificate output"),
192 { "set_serial", OPT_SET_SERIAL, 's',
193 "Serial number to use, overrides -CAserial" },
194 { "next_serial", OPT_NEXT_SERIAL, '-',
195 "Increment current certificate serial number" },
196 { "not_before", OPT_NOT_BEFORE, 's',
197 "[CC]YYMMDDHHMMSSZ value for notBefore certificate field" },
198 { "not_after", OPT_NOT_AFTER, 's',
199 "[CC]YYMMDDHHMMSSZ value for notAfter certificate field, overrides -days" },
200 { "days", OPT_DAYS, 'n',
201 "Number of days until newly generated certificate expires - default 30" },
202 { "preserve_dates", OPT_PRESERVE_DATES, '-',
203 "Preserve existing validity dates" },
204 { "set_issuer", OPT_ISSU, 's', "Set or override certificate issuer" },
205 { "set_subject", OPT_SUBJ, 's', "Set or override certificate subject (and issuer)" },
206 { "subj", OPT_SUBJ, 's', "Alias for -set_subject" },
207 { "force_pubkey", OPT_FORCE_PUBKEY, '<',
208 "Key to be placed in new certificate or certificate request" },
209 { "clrext", OPT_CLREXT, '-',
210 "Do not take over any extensions from the source certificate or request" },
211 { "extfile", OPT_EXTFILE, '<', "Config file with X509V3 extensions to add" },
212 { "extensions", OPT_EXTENSIONS, 's',
213 "Section of extfile to use - default: unnamed section" },
214 { "sigopt", OPT_SIGOPT, 's', "Signature parameter, in n:v form" },
215 { "badsig", OPT_BADSIG, '-',
216 "Corrupt last byte of certificate signature (for test)" },
217 { "", OPT_MD, '-', "Any supported digest, used for signing and printing" },
218
219 OPT_SECTION("Micro-CA"),
220 { "CA", OPT_CA, '<',
221 "Use the given CA certificate, conflicts with -key" },
222 { "CAform", OPT_CAFORM, 'F', "CA cert format (PEM/DER/P12); has no effect" },
223 { "CAkey", OPT_CAKEY, 's', "The corresponding CA key; default is -CA arg" },
224 { "CAkeyform", OPT_CAKEYFORM, 'E',
225 "CA key format (ENGINE, other values ignored)" },
226 { "CAserial", OPT_CASERIAL, 's',
227 "File that keeps track of CA-generated serial number" },
228 { "CAcreateserial", OPT_CACREATESERIAL, '-',
229 "Create CA serial number file if it does not exist" },
230
231 OPT_SECTION("Certificate trust output"),
232 { "trustout", OPT_TRUSTOUT, '-', "Mark certificate PEM output as trusted" },
233 { "setalias", OPT_SETALIAS, 's', "Set certificate alias (nickname)" },
234 { "clrtrust", OPT_CLRTRUST, '-', "Clear all trusted purposes" },
235 { "addtrust", OPT_ADDTRUST, 's', "Trust certificate for a given purpose" },
236 { "clrreject", OPT_CLRREJECT, '-',
237 "Clears all the prohibited or rejected uses of the certificate" },
238 { "addreject", OPT_ADDREJECT, 's',
239 "Reject certificate for a given purpose" },
240
241 OPT_R_OPTIONS,
242 #ifndef OPENSSL_NO_ENGINE
243 { "engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device" },
244 #endif
245 OPT_PROV_OPTIONS,
246 { NULL }
247 };
248
warn_copying(ASN1_OBJECT * excluded,const char * names)249 static void warn_copying(ASN1_OBJECT *excluded, const char *names)
250 {
251 const char *sn = OBJ_nid2sn(OBJ_obj2nid(excluded));
252
253 if (names != NULL && strstr(names, sn) != NULL)
254 BIO_printf(bio_err,
255 "Warning: -ext should not specify copying %s extension to CSR; ignoring this\n",
256 sn);
257 }
258
x509_to_req(X509 * cert,int ext_copy,const char * names)259 static X509_REQ *x509_to_req(X509 *cert, int ext_copy, const char *names)
260 {
261 const STACK_OF(X509_EXTENSION) *cert_exts = X509_get0_extensions(cert);
262 int i, n = sk_X509_EXTENSION_num(cert_exts /* may be NULL */);
263 ASN1_OBJECT *skid = OBJ_nid2obj(NID_subject_key_identifier);
264 ASN1_OBJECT *akid = OBJ_nid2obj(NID_authority_key_identifier);
265 STACK_OF(X509_EXTENSION) *exts;
266 X509_REQ *req = X509_to_X509_REQ(cert, NULL, NULL);
267
268 if (req == NULL)
269 return NULL;
270
271 /*
272 * Filter out SKID and AKID extensions, which make no sense in a CSR.
273 * If names is not NULL, copy only those extensions listed there.
274 */
275 warn_copying(skid, names);
276 warn_copying(akid, names);
277 if ((exts = sk_X509_EXTENSION_new_reserve(NULL, n)) == NULL)
278 goto err;
279 for (i = 0; i < n; i++) {
280 X509_EXTENSION *ex = sk_X509_EXTENSION_value(cert_exts, i);
281 ASN1_OBJECT *obj = X509_EXTENSION_get_object(ex);
282
283 if (OBJ_cmp(obj, skid) != 0 && OBJ_cmp(obj, akid) != 0
284 && !sk_X509_EXTENSION_push(exts, ex))
285 goto err;
286 }
287
288 if (sk_X509_EXTENSION_num(exts) > 0) {
289 if (ext_copy != EXT_COPY_UNSET && ext_copy != EXT_COPY_NONE
290 && !X509_REQ_add_extensions(req, exts)) {
291 BIO_printf(bio_err, "Error copying extensions from certificate\n");
292 goto err;
293 }
294 }
295 sk_X509_EXTENSION_free(exts);
296 return req;
297
298 err:
299 sk_X509_EXTENSION_free(exts);
300 X509_REQ_free(req);
301 return NULL;
302 }
303
self_signed(X509_STORE * ctx,X509 * cert)304 static int self_signed(X509_STORE *ctx, X509 *cert)
305 {
306 X509_STORE_CTX *xsc = X509_STORE_CTX_new();
307 int ret = 0;
308
309 if (xsc == NULL || !X509_STORE_CTX_init(xsc, ctx, cert, NULL)) {
310 BIO_printf(bio_err, "Error initialising X509 store\n");
311 } else {
312 X509_STORE_CTX_set_flags(xsc, X509_V_FLAG_CHECK_SS_SIGNATURE);
313 ret = X509_verify_cert(xsc) > 0;
314 }
315 X509_STORE_CTX_free(xsc);
316 return ret;
317 }
318
x509_main(int argc,char ** argv)319 int x509_main(int argc, char **argv)
320 {
321 ASN1_INTEGER *sno = NULL;
322 ASN1_OBJECT *objtmp = NULL;
323 BIO *out = NULL;
324 CONF *extconf = NULL;
325 int ext_copy = EXT_COPY_UNSET;
326 X509V3_CTX ext_ctx;
327 EVP_PKEY *privkey = NULL, *CAkey = NULL, *pubkey = NULL;
328 EVP_PKEY *pkey;
329 int newcert = 0;
330 char *issu = NULL, *subj = NULL, *digest = NULL;
331 X509_NAME *fissu = NULL, *fsubj = NULL;
332 const unsigned long chtype = MBSTRING_ASC;
333 const int multirdn = 1;
334 STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
335 STACK_OF(OPENSSL_STRING) *sigopts = NULL, *vfyopts = NULL;
336 X509 *x = NULL, *xca = NULL, *issuer_cert;
337 X509_REQ *req = NULL, *rq = NULL;
338 X509_STORE *ctx = NULL;
339 char *CAkeyfile = NULL, *CAserial = NULL, *pubkeyfile = NULL, *alias = NULL;
340 char *checkhost = NULL, *checkemail = NULL, *checkip = NULL;
341 char *ext_names = NULL;
342 char *extsect = NULL, *extfile = NULL, *passin = NULL, *passinarg = NULL;
343 char *infile = NULL, *outfile = NULL, *privkeyfile = NULL, *CAfile = NULL;
344 char *prog, *not_before = NULL, *not_after = NULL;
345 int days = UNSET_DAYS; /* not explicitly set */
346 int x509toreq = 0, modulus = 0, print_pubkey = 0, pprint = 0;
347 int CAformat = FORMAT_UNDEF, CAkeyformat = FORMAT_UNDEF;
348 unsigned long dateopt = ASN1_DTFLGS_RFC822;
349 int fingerprint = 0, reqfile = 0, checkend = 0;
350 int informat = FORMAT_UNDEF, outformat = FORMAT_PEM, keyformat = FORMAT_UNDEF;
351 int next_serial = 0, subject_hash = 0, issuer_hash = 0, ocspid = 0;
352 int noout = 0, CA_createserial = 0, email = 0;
353 int ocsp_uri = 0, trustout = 0, clrtrust = 0, clrreject = 0, aliasout = 0;
354 int ret = 1, i, j, num = 0, badsig = 0, clrext = 0, nocert = 0;
355 int text = 0, serial = 0, subject = 0, issuer = 0, startdate = 0, ext = 0;
356 int enddate = 0;
357 time_t checkoffset = 0;
358 unsigned long certflag = 0;
359 int preserve_dates = 0;
360 OPTION_CHOICE o;
361 ENGINE *e = NULL;
362 #ifndef OPENSSL_NO_MD5
363 int subject_hash_old = 0, issuer_hash_old = 0;
364 #endif
365
366 ctx = X509_STORE_new();
367 if (ctx == NULL)
368 goto err;
369 X509_STORE_set_verify_cb(ctx, callb);
370
371 opt_set_unknown_name("digest");
372 prog = opt_init(argc, argv, x509_options);
373 while ((o = opt_next()) != OPT_EOF) {
374 switch (o) {
375 case OPT_EOF:
376 case OPT_ERR:
377 opthelp:
378 BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
379 goto err;
380 case OPT_HELP:
381 opt_help(x509_options);
382 ret = 0;
383 goto end;
384 case OPT_INFORM:
385 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
386 goto opthelp;
387 break;
388 case OPT_IN:
389 infile = opt_arg();
390 break;
391 case OPT_OUTFORM:
392 if (!opt_format(opt_arg(), OPT_FMT_ANY, &outformat))
393 goto opthelp;
394 break;
395 case OPT_KEYFORM:
396 if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
397 goto opthelp;
398 break;
399 case OPT_CAFORM:
400 if (!opt_format(opt_arg(), OPT_FMT_ANY, &CAformat))
401 goto opthelp;
402 break;
403 case OPT_CAKEYFORM:
404 if (!opt_format(opt_arg(), OPT_FMT_ANY, &CAkeyformat))
405 goto opthelp;
406 break;
407 case OPT_OUT:
408 outfile = opt_arg();
409 break;
410 case OPT_REQ:
411 reqfile = 1;
412 break;
413
414 case OPT_DATEOPT:
415 if (!set_dateopt(&dateopt, opt_arg())) {
416 BIO_printf(bio_err,
417 "Invalid date format: %s\n", opt_arg());
418 goto err;
419 }
420 break;
421 case OPT_COPY_EXTENSIONS:
422 if (!set_ext_copy(&ext_copy, opt_arg())) {
423 BIO_printf(bio_err,
424 "Invalid extension copy option: %s\n", opt_arg());
425 goto err;
426 }
427 break;
428
429 case OPT_SIGOPT:
430 if (!sigopts)
431 sigopts = sk_OPENSSL_STRING_new_null();
432 if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
433 goto opthelp;
434 break;
435 case OPT_VFYOPT:
436 if (!vfyopts)
437 vfyopts = sk_OPENSSL_STRING_new_null();
438 if (!vfyopts || !sk_OPENSSL_STRING_push(vfyopts, opt_arg()))
439 goto opthelp;
440 break;
441 case OPT_NOT_BEFORE:
442 not_before = opt_arg();
443 break;
444 case OPT_NOT_AFTER:
445 not_after = opt_arg();
446 break;
447 case OPT_DAYS:
448 days = atoi(opt_arg());
449 if (days <= UNSET_DAYS) {
450 BIO_printf(bio_err, "%s: -days parameter arg must be >= -1\n",
451 prog);
452 goto err;
453 }
454 break;
455 case OPT_PASSIN:
456 passinarg = opt_arg();
457 break;
458 case OPT_EXTFILE:
459 extfile = opt_arg();
460 break;
461 case OPT_R_CASES:
462 if (!opt_rand(o))
463 goto end;
464 break;
465 case OPT_PROV_CASES:
466 if (!opt_provider(o))
467 goto end;
468 break;
469 case OPT_EXTENSIONS:
470 extsect = opt_arg();
471 break;
472 case OPT_KEY:
473 case OPT_SIGNKEY:
474 privkeyfile = opt_arg();
475 break;
476 case OPT_CA:
477 CAfile = opt_arg();
478 break;
479 case OPT_CAKEY:
480 CAkeyfile = opt_arg();
481 break;
482 case OPT_CASERIAL:
483 CAserial = opt_arg();
484 break;
485 case OPT_SET_SERIAL:
486 if (sno != NULL) {
487 BIO_printf(bio_err, "Serial number supplied twice\n");
488 goto opthelp;
489 }
490 if ((sno = s2i_ASN1_INTEGER(NULL, opt_arg())) == NULL)
491 goto opthelp;
492 break;
493 case OPT_NEW:
494 newcert = 1;
495 break;
496 case OPT_FORCE_PUBKEY:
497 pubkeyfile = opt_arg();
498 break;
499 case OPT_ISSU:
500 issu = opt_arg();
501 break;
502 case OPT_SUBJ:
503 subj = opt_arg();
504 break;
505 case OPT_ADDTRUST:
506 if (trust == NULL && (trust = sk_ASN1_OBJECT_new_null()) == NULL)
507 goto err;
508 if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
509 BIO_printf(bio_err, "%s: Invalid trust object value %s\n",
510 prog, opt_arg());
511 goto opthelp;
512 }
513 if (!sk_ASN1_OBJECT_push(trust, objtmp))
514 goto err;
515 trustout = 1;
516 break;
517 case OPT_ADDREJECT:
518 if (reject == NULL && (reject = sk_ASN1_OBJECT_new_null()) == NULL)
519 goto err;
520 if ((objtmp = OBJ_txt2obj(opt_arg(), 0)) == NULL) {
521 BIO_printf(bio_err, "%s: Invalid reject object value %s\n",
522 prog, opt_arg());
523 goto opthelp;
524 }
525 if (!sk_ASN1_OBJECT_push(reject, objtmp))
526 goto err;
527 trustout = 1;
528 break;
529 case OPT_SETALIAS:
530 alias = opt_arg();
531 trustout = 1;
532 break;
533 case OPT_CERTOPT:
534 if (!set_cert_ex(&certflag, opt_arg()))
535 goto opthelp;
536 break;
537 case OPT_NAMEOPT:
538 if (!set_nameopt(opt_arg()))
539 goto opthelp;
540 break;
541 case OPT_ENGINE:
542 e = setup_engine(opt_arg(), 0);
543 break;
544 case OPT_EMAIL:
545 email = ++num;
546 break;
547 case OPT_OCSP_URI:
548 ocsp_uri = ++num;
549 break;
550 case OPT_SERIAL:
551 serial = ++num;
552 break;
553 case OPT_NEXT_SERIAL:
554 next_serial = ++num;
555 break;
556 case OPT_MODULUS:
557 modulus = ++num;
558 break;
559 case OPT_PUBKEY:
560 print_pubkey = ++num;
561 break;
562 case OPT_X509TOREQ:
563 x509toreq = 1;
564 break;
565 case OPT_TEXT:
566 text = ++num;
567 break;
568 case OPT_SUBJECT:
569 subject = ++num;
570 break;
571 case OPT_ISSUER:
572 issuer = ++num;
573 break;
574 case OPT_FINGERPRINT:
575 fingerprint = ++num;
576 break;
577 case OPT_HASH:
578 subject_hash = ++num;
579 break;
580 case OPT_ISSUER_HASH:
581 issuer_hash = ++num;
582 break;
583 case OPT_PURPOSE:
584 pprint = ++num;
585 break;
586 case OPT_STARTDATE:
587 startdate = ++num;
588 break;
589 case OPT_ENDDATE:
590 enddate = ++num;
591 break;
592 case OPT_NOOUT:
593 noout = ++num;
594 break;
595 case OPT_EXT:
596 ext = ++num;
597 ext_names = opt_arg();
598 break;
599 case OPT_NOCERT:
600 nocert = 1;
601 break;
602 case OPT_TRUSTOUT:
603 trustout = 1;
604 break;
605 case OPT_CLRTRUST:
606 clrtrust = ++num;
607 break;
608 case OPT_CLRREJECT:
609 clrreject = ++num;
610 break;
611 case OPT_ALIAS:
612 aliasout = ++num;
613 break;
614 case OPT_CACREATESERIAL:
615 CA_createserial = 1;
616 break;
617 case OPT_CLREXT:
618 clrext = 1;
619 break;
620 case OPT_OCSPID:
621 ocspid = ++num;
622 break;
623 case OPT_BADSIG:
624 badsig = 1;
625 break;
626 #ifndef OPENSSL_NO_MD5
627 case OPT_SUBJECT_HASH_OLD:
628 subject_hash_old = ++num;
629 break;
630 case OPT_ISSUER_HASH_OLD:
631 issuer_hash_old = ++num;
632 break;
633 #else
634 case OPT_SUBJECT_HASH_OLD:
635 case OPT_ISSUER_HASH_OLD:
636 break;
637 #endif
638 case OPT_DATES:
639 startdate = ++num;
640 enddate = ++num;
641 break;
642 case OPT_CHECKEND:
643 checkend = 1;
644 {
645 ossl_intmax_t temp = 0;
646 if (!opt_intmax(opt_arg(), &temp))
647 goto opthelp;
648 checkoffset = (time_t)temp;
649 if ((ossl_intmax_t)checkoffset != temp) {
650 BIO_printf(bio_err, "%s: Checkend time out of range %s\n",
651 prog, opt_arg());
652 goto opthelp;
653 }
654 }
655 break;
656 case OPT_CHECKHOST:
657 checkhost = opt_arg();
658 break;
659 case OPT_CHECKEMAIL:
660 checkemail = opt_arg();
661 break;
662 case OPT_CHECKIP:
663 checkip = opt_arg();
664 break;
665 case OPT_PRESERVE_DATES:
666 preserve_dates = 1;
667 break;
668 case OPT_MD:
669 digest = opt_unknown();
670 break;
671 }
672 }
673 /* No extra arguments. */
674 if (!opt_check_rest_arg(NULL))
675 goto opthelp;
676
677 if (!app_RAND_load())
678 goto err;
679
680 if (!opt_check_md(digest))
681 goto opthelp;
682
683 if (preserve_dates && not_before != NULL) {
684 BIO_printf(bio_err, "Cannot use -preserve_dates with -not_before option\n");
685 goto err;
686 }
687 if (preserve_dates && not_after != NULL) {
688 BIO_printf(bio_err, "Cannot use -preserve_dates with -not_after option\n");
689 goto err;
690 }
691 if (preserve_dates && days != UNSET_DAYS) {
692 BIO_printf(bio_err, "Cannot use -preserve_dates with -days option\n");
693 goto err;
694 }
695 if (days == UNSET_DAYS)
696 days = DEFAULT_DAYS;
697 else if (not_after != NULL)
698 BIO_printf(bio_err, "Warning: -not_after option overriding -days option\n");
699
700 if (!app_passwd(passinarg, NULL, &passin, NULL)) {
701 BIO_printf(bio_err, "Error getting password\n");
702 goto err;
703 }
704
705 if (!X509_STORE_set_default_paths_ex(ctx, app_get0_libctx(),
706 app_get0_propq()))
707 goto err;
708
709 if (newcert && infile != NULL) {
710 BIO_printf(bio_err, "The -in option cannot be used with -new\n");
711 goto err;
712 }
713 if (newcert && reqfile) {
714 BIO_printf(bio_err, "The -req option cannot be used with -new\n");
715 goto err;
716 }
717 if (privkeyfile != NULL) {
718 privkey = load_key(privkeyfile, keyformat, 0, passin, e, "private key");
719 if (privkey == NULL)
720 goto err;
721 }
722 if (pubkeyfile != NULL) {
723 if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL, e,
724 "explicitly set public key"))
725 == NULL)
726 goto err;
727 }
728
729 if (newcert) {
730 if (subj == NULL) {
731 BIO_printf(bio_err,
732 "The -new option requires a subject to be set using -subj\n");
733 goto err;
734 }
735 if (privkeyfile == NULL && pubkeyfile == NULL) {
736 BIO_printf(bio_err,
737 "The -new option requires using the -key or -force_pubkey option\n");
738 goto err;
739 }
740 }
741 if (issu != NULL
742 && (fissu = parse_name(issu, chtype, multirdn, "issuer")) == NULL)
743 goto err;
744 if (subj != NULL
745 && (fsubj = parse_name(subj, chtype, multirdn, "subject")) == NULL)
746 goto err;
747
748 if (CAkeyfile == NULL)
749 CAkeyfile = CAfile;
750 if (CAfile != NULL) {
751 if (privkeyfile != NULL) {
752 BIO_printf(bio_err, "Cannot use both -key/-signkey and -CA option\n");
753 goto err;
754 }
755 } else {
756 #define WARN_NO_CA(opt) BIO_printf(bio_err, \
757 "Warning: ignoring " opt " option since -CA option is not given\n");
758 if (CAkeyfile != NULL)
759 WARN_NO_CA("-CAkey");
760 if (CAkeyformat != FORMAT_UNDEF)
761 WARN_NO_CA("-CAkeyform");
762 if (CAformat != FORMAT_UNDEF)
763 WARN_NO_CA("-CAform");
764 if (CAserial != NULL)
765 WARN_NO_CA("-CAserial");
766 if (CA_createserial)
767 WARN_NO_CA("-CAcreateserial");
768 }
769
770 if (extfile == NULL) {
771 if (extsect != NULL)
772 BIO_printf(bio_err,
773 "Warning: ignoring -extensions option without -extfile\n");
774 } else {
775 X509V3_CTX ctx2;
776
777 if ((extconf = app_load_config(extfile)) == NULL)
778 goto err;
779 if (extsect == NULL) {
780 extsect = app_conf_try_string(extconf, "default", "extensions");
781 if (extsect == NULL)
782 extsect = "default";
783 }
784 X509V3_set_ctx_test(&ctx2);
785 X509V3_set_nconf(&ctx2, extconf);
786 if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL)) {
787 BIO_printf(bio_err,
788 "Error checking extension section %s\n", extsect);
789 goto err;
790 }
791 }
792
793 if (reqfile) {
794 if (infile == NULL && isatty(fileno_stdin()))
795 BIO_printf(bio_err,
796 "Warning: Reading cert request from stdin since no -in option is given\n");
797 req = load_csr_autofmt(infile, informat, vfyopts,
798 "certificate request input");
799 if (req == NULL)
800 goto err;
801
802 if ((pkey = X509_REQ_get0_pubkey(req)) == NULL) {
803 BIO_printf(bio_err, "Error unpacking public key from CSR\n");
804 goto err;
805 }
806 i = do_X509_REQ_verify(req, pkey, vfyopts);
807 if (i <= 0) {
808 BIO_printf(bio_err, i < 0 ? "Error while verifying certificate request self-signature\n" : "Certificate request self-signature did not match the contents\n");
809 goto err;
810 }
811 BIO_printf(bio_err, "Certificate request self-signature ok\n");
812
813 print_name(bio_err, "subject=", X509_REQ_get_subject_name(req));
814 } else if (!x509toreq && ext_copy != EXT_COPY_UNSET) {
815 BIO_printf(bio_err, "Warning: ignoring -copy_extensions since neither -x509toreq nor -req is given\n");
816 }
817
818 if (reqfile || newcert) {
819 if (preserve_dates)
820 BIO_printf(bio_err,
821 "Warning: ignoring -preserve_dates option with -req or -new\n");
822 preserve_dates = 0;
823 if (privkeyfile == NULL && CAkeyfile == NULL) {
824 BIO_printf(bio_err,
825 "We need a private key to sign with, use -key or -CAkey or -CA with private key\n");
826 goto err;
827 }
828 if ((x = X509_new_ex(app_get0_libctx(), app_get0_propq())) == NULL)
829 goto err;
830 if (CAfile == NULL && sno == NULL) {
831 sno = ASN1_INTEGER_new();
832 if (sno == NULL || !rand_serial(NULL, sno))
833 goto err;
834 }
835 if (req != NULL && ext_copy != EXT_COPY_UNSET) {
836 if (clrext && ext_copy != EXT_COPY_NONE) {
837 BIO_printf(bio_err, "Must not use -clrext together with -copy_extensions\n");
838 goto err;
839 } else if (!copy_extensions(x, req, ext_copy)) {
840 BIO_printf(bio_err, "Error copying extensions from request\n");
841 goto err;
842 }
843 }
844 } else {
845 if (infile == NULL && isatty(fileno_stdin()))
846 BIO_printf(bio_err,
847 "Warning: Reading certificate from stdin since no -in or -new option is given\n");
848 x = load_cert_pass(infile, informat, 1, passin, "certificate");
849 if (x == NULL)
850 goto err;
851 }
852 if ((fsubj != NULL || req != NULL)
853 && !X509_set_subject_name(x, fsubj != NULL ? fsubj : X509_REQ_get_subject_name(req)))
854 goto err;
855 if ((pubkey != NULL || privkey != NULL || req != NULL)
856 && !X509_set_pubkey(x, pubkey != NULL ? pubkey : privkey != NULL ? privkey
857 : X509_REQ_get0_pubkey(req)))
858 goto err;
859
860 if (CAfile != NULL) {
861 xca = load_cert_pass(CAfile, CAformat, 1, passin, "CA certificate");
862 if (xca == NULL)
863 goto err;
864 }
865
866 out = bio_open_default(outfile, 'w', outformat);
867 if (out == NULL)
868 goto err;
869
870 if (alias)
871 X509_alias_set1(x, (unsigned char *)alias, -1);
872
873 if (clrtrust)
874 X509_trust_clear(x);
875 if (clrreject)
876 X509_reject_clear(x);
877
878 if (trust != NULL) {
879 for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++)
880 X509_add1_trust_object(x, sk_ASN1_OBJECT_value(trust, i));
881 }
882
883 if (reject != NULL) {
884 for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++)
885 X509_add1_reject_object(x, sk_ASN1_OBJECT_value(reject, i));
886 }
887
888 if (clrext && ext_names != NULL)
889 BIO_printf(bio_err, "Warning: Ignoring -ext since -clrext is given\n");
890 for (i = X509_get_ext_count(x) - 1; i >= 0; i--) {
891 X509_EXTENSION *ex = X509_get_ext(x, i);
892 const char *sn = OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(ex)));
893
894 if (clrext || (ext_names != NULL && strstr(ext_names, sn) == NULL))
895 X509_EXTENSION_free(X509_delete_ext(x, i));
896 }
897
898 issuer_cert = x;
899 if (CAfile != NULL) {
900 issuer_cert = xca;
901 if (sno == NULL)
902 sno = x509_load_serial(CAfile, CAserial, CA_createserial);
903 if (sno == NULL)
904 goto err;
905 if (!x509toreq && !reqfile && !newcert && !self_signed(ctx, x))
906 goto err;
907 } else {
908 if (privkey != NULL && !cert_matches_key(x, privkey))
909 BIO_printf(bio_err,
910 "Warning: Signature key and public key of cert do not match\n");
911 }
912
913 if (sno != NULL && !X509_set_serialNumber(x, sno))
914 goto err;
915
916 if (reqfile || newcert || privkey != NULL || CAfile != NULL) {
917 if (!preserve_dates && !set_cert_times(x, not_before, not_after, days, 1))
918 goto err;
919 if (fissu != NULL) {
920 if (!X509_set_issuer_name(x, fissu))
921 goto err;
922 } else {
923 if (!X509_set_issuer_name(x, X509_get_subject_name(issuer_cert)))
924 goto err;
925 }
926 }
927
928 X509V3_set_ctx(&ext_ctx, issuer_cert, x, NULL, NULL, X509V3_CTX_REPLACE);
929 /* prepare fallback for AKID, but only if issuer cert equals subject cert */
930 if (CAfile == NULL) {
931 if (!X509V3_set_issuer_pkey(&ext_ctx, privkey))
932 goto err;
933 }
934 if (extconf != NULL && !x509toreq) {
935 X509V3_set_nconf(&ext_ctx, extconf);
936 if (!X509V3_EXT_add_nconf(extconf, &ext_ctx, extsect, x)) {
937 BIO_printf(bio_err,
938 "Error adding extensions from section %s\n", extsect);
939 goto err;
940 }
941 }
942
943 /* At this point the contents of the certificate x have been finished. */
944
945 pkey = X509_get0_pubkey(x);
946 if ((print_pubkey != 0 || modulus != 0) && pkey == NULL) {
947 BIO_printf(bio_err, "Error getting public key\n");
948 goto err;
949 }
950
951 if (x509toreq) { /* also works in conjunction with -req */
952 if (privkey == NULL) {
953 BIO_printf(bio_err, "Must specify request signing key using -key\n");
954 goto err;
955 }
956 if (clrext && ext_copy != EXT_COPY_NONE) {
957 BIO_printf(bio_err, "Must not use -clrext together with -copy_extensions\n");
958 goto err;
959 }
960 if ((rq = x509_to_req(x, ext_copy, ext_names)) == NULL)
961 goto err;
962 if (extconf != NULL) {
963 X509V3_set_nconf(&ext_ctx, extconf);
964 if (!X509V3_EXT_REQ_add_nconf(extconf, &ext_ctx, extsect, rq)) {
965 BIO_printf(bio_err,
966 "Error adding request extensions from section %s\n", extsect);
967 goto err;
968 }
969 }
970 if (!do_X509_REQ_sign(rq, privkey, digest, sigopts))
971 goto err;
972 if (!noout) {
973 if (outformat == FORMAT_ASN1) {
974 X509_REQ_print_ex(out, rq, get_nameopt(), X509_FLAG_COMPAT);
975 i = i2d_X509_bio(out, x);
976 } else {
977 i = PEM_write_bio_X509_REQ(out, rq);
978 }
979 if (!i) {
980 BIO_printf(bio_err,
981 "Unable to write certificate request\n");
982 goto err;
983 }
984 }
985 noout = 1;
986 } else if (CAfile != NULL) {
987 if ((CAkey = load_key(CAkeyfile, CAkeyformat,
988 0, passin, e, "CA private key"))
989 == NULL)
990 goto err;
991 if (!X509_check_private_key(xca, CAkey)) {
992 BIO_printf(bio_err,
993 "CA certificate and CA private key do not match\n");
994 goto err;
995 }
996
997 if (!do_X509_sign(x, 0, CAkey, digest, sigopts, &ext_ctx))
998 goto err;
999 } else if (privkey != NULL) {
1000 if (!do_X509_sign(x, 0, privkey, digest, sigopts, &ext_ctx))
1001 goto err;
1002 }
1003 if (badsig) {
1004 const ASN1_BIT_STRING *signature;
1005
1006 X509_get0_signature(&signature, NULL, x);
1007 corrupt_signature(signature);
1008 }
1009
1010 /* Process print options in the given order, as indicated by index i */
1011 for (i = 1; i <= num; i++) {
1012 if (i == issuer) {
1013 print_name(out, "issuer=", X509_get_issuer_name(x));
1014 } else if (i == subject) {
1015 print_name(out, "subject=", X509_get_subject_name(x));
1016 } else if (i == serial) {
1017 BIO_printf(out, "serial=");
1018 i2a_ASN1_INTEGER(out, X509_get0_serialNumber(x));
1019 BIO_printf(out, "\n");
1020 } else if (i == next_serial) {
1021 ASN1_INTEGER *ser;
1022 BIGNUM *bnser = ASN1_INTEGER_to_BN(X509_get0_serialNumber(x), NULL);
1023
1024 if (bnser == NULL)
1025 goto err;
1026 if (!BN_add_word(bnser, 1)
1027 || (ser = BN_to_ASN1_INTEGER(bnser, NULL)) == NULL) {
1028 BN_free(bnser);
1029 goto err;
1030 }
1031 BN_free(bnser);
1032 i2a_ASN1_INTEGER(out, ser);
1033 ASN1_INTEGER_free(ser);
1034 BIO_puts(out, "\n");
1035 } else if (i == email || i == ocsp_uri) {
1036 STACK_OF(OPENSSL_STRING) *emlst = i == email ? X509_get1_email(x) : X509_get1_ocsp(x);
1037
1038 for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
1039 BIO_printf(out, "%s\n", sk_OPENSSL_STRING_value(emlst, j));
1040 X509_email_free(emlst);
1041 } else if (i == aliasout) {
1042 unsigned char *alstr = X509_alias_get0(x, NULL);
1043
1044 if (alstr)
1045 BIO_printf(out, "%s\n", alstr);
1046 else
1047 BIO_puts(out, "<No Alias>\n");
1048 } else if (i == subject_hash) {
1049 BIO_printf(out, "%08lx\n", X509_subject_name_hash(x));
1050 #ifndef OPENSSL_NO_MD5
1051 } else if (i == subject_hash_old) {
1052 BIO_printf(out, "%08lx\n", X509_subject_name_hash_old(x));
1053 #endif
1054 } else if (i == issuer_hash) {
1055 BIO_printf(out, "%08lx\n", X509_issuer_name_hash(x));
1056 #ifndef OPENSSL_NO_MD5
1057 } else if (i == issuer_hash_old) {
1058 BIO_printf(out, "%08lx\n", X509_issuer_name_hash_old(x));
1059 #endif
1060 } else if (i == pprint) {
1061 BIO_printf(out, "Certificate purposes:\n");
1062 for (j = 0; j < X509_PURPOSE_get_count(); j++)
1063 purpose_print(out, x, X509_PURPOSE_get0(j));
1064 } else if (i == modulus) {
1065 BIO_printf(out, "Modulus=");
1066 if (EVP_PKEY_is_a(pkey, "RSA") || EVP_PKEY_is_a(pkey, "RSA-PSS")) {
1067 BIGNUM *n = NULL;
1068
1069 /* Every RSA key has an 'n' */
1070 EVP_PKEY_get_bn_param(pkey, "n", &n);
1071 BN_print(out, n);
1072 BN_free(n);
1073 } else if (EVP_PKEY_is_a(pkey, "DSA")) {
1074 BIGNUM *dsapub = NULL;
1075
1076 /* Every DSA key has a 'pub' */
1077 EVP_PKEY_get_bn_param(pkey, "pub", &dsapub);
1078 BN_print(out, dsapub);
1079 BN_free(dsapub);
1080 } else {
1081 BIO_printf(out, "No modulus for this public key type");
1082 }
1083 BIO_printf(out, "\n");
1084 } else if (i == print_pubkey) {
1085 PEM_write_bio_PUBKEY(out, pkey);
1086 } else if (i == text) {
1087 X509_print_ex(out, x, get_nameopt(), certflag);
1088 } else if (i == startdate) {
1089 BIO_puts(out, "notBefore=");
1090 ASN1_TIME_print_ex(out, X509_get0_notBefore(x), dateopt);
1091 BIO_puts(out, "\n");
1092 } else if (i == enddate) {
1093 BIO_puts(out, "notAfter=");
1094 ASN1_TIME_print_ex(out, X509_get0_notAfter(x), dateopt);
1095 BIO_puts(out, "\n");
1096 } else if (i == fingerprint) {
1097 unsigned int n;
1098 unsigned char md[EVP_MAX_MD_SIZE];
1099 const char *fdigname = digest;
1100 EVP_MD *fdig;
1101 int digres;
1102
1103 if (fdigname == NULL)
1104 fdigname = "SHA1";
1105
1106 if ((fdig = EVP_MD_fetch(app_get0_libctx(), fdigname,
1107 app_get0_propq()))
1108 == NULL) {
1109 BIO_printf(bio_err, "Unknown digest\n");
1110 goto err;
1111 }
1112 digres = X509_digest(x, fdig, md, &n);
1113 EVP_MD_free(fdig);
1114 if (!digres) {
1115 BIO_printf(bio_err, "Out of memory\n");
1116 goto err;
1117 }
1118
1119 BIO_printf(out, "%s Fingerprint=", fdigname);
1120 for (j = 0; j < (int)n; j++)
1121 BIO_printf(out, "%02X%c", md[j], (j + 1 == (int)n) ? '\n' : ':');
1122 } else if (i == ocspid) {
1123 X509_ocspid_print(out, x);
1124 } else if (i == ext) {
1125 print_x509v3_exts(out, x, ext_names);
1126 }
1127 }
1128
1129 if (checkend) {
1130 time_t tcheck = time(NULL) + checkoffset;
1131
1132 ret = X509_cmp_time(X509_get0_notAfter(x), &tcheck) < 0;
1133 if (ret)
1134 BIO_printf(out, "Certificate will expire\n");
1135 else
1136 BIO_printf(out, "Certificate will not expire\n");
1137 goto end;
1138 }
1139
1140 if (!check_cert_attributes(out, x, checkhost, checkemail, checkip, 1))
1141 goto err;
1142
1143 if (noout || nocert) {
1144 ret = 0;
1145 goto end;
1146 }
1147
1148 if (outformat == FORMAT_ASN1) {
1149 i = i2d_X509_bio(out, x);
1150 } else if (outformat == FORMAT_PEM) {
1151 if (trustout)
1152 i = PEM_write_bio_X509_AUX(out, x);
1153 else
1154 i = PEM_write_bio_X509(out, x);
1155 } else {
1156 BIO_printf(bio_err, "Bad output format specified for outfile\n");
1157 goto err;
1158 }
1159 if (!i) {
1160 BIO_printf(bio_err, "Unable to write certificate\n");
1161 goto err;
1162 }
1163
1164 ret = 0;
1165 goto end;
1166
1167 err:
1168 ERR_print_errors(bio_err);
1169
1170 end:
1171 NCONF_free(extconf);
1172 BIO_free_all(out);
1173 X509_STORE_free(ctx);
1174 X509_NAME_free(fissu);
1175 X509_NAME_free(fsubj);
1176 X509_REQ_free(req);
1177 X509_free(x);
1178 X509_free(xca);
1179 EVP_PKEY_free(privkey);
1180 EVP_PKEY_free(CAkey);
1181 EVP_PKEY_free(pubkey);
1182 sk_OPENSSL_STRING_free(sigopts);
1183 sk_OPENSSL_STRING_free(vfyopts);
1184 X509_REQ_free(rq);
1185 ASN1_INTEGER_free(sno);
1186 sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
1187 sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
1188 release_engine(e);
1189 clear_free(passin);
1190 return ret;
1191 }
1192
x509_load_serial(const char * CAfile,const char * serialfile,int create)1193 static ASN1_INTEGER *x509_load_serial(const char *CAfile,
1194 const char *serialfile, int create)
1195 {
1196 char *buf = NULL;
1197 ASN1_INTEGER *bs = NULL;
1198 BIGNUM *serial = NULL;
1199 int defaultfile = 0, file_exists;
1200
1201 if (serialfile == NULL) {
1202 const char *p = strrchr(CAfile, '.');
1203 size_t len = p != NULL ? (size_t)(p - CAfile) : strlen(CAfile);
1204
1205 buf = app_malloc(len + sizeof(POSTFIX), "serial# buffer");
1206 memcpy(buf, CAfile, len);
1207 memcpy(buf + len, POSTFIX, sizeof(POSTFIX));
1208 serialfile = buf;
1209 defaultfile = 1;
1210 }
1211
1212 serial = load_serial(serialfile, &file_exists, create || defaultfile, NULL);
1213 if (serial == NULL)
1214 goto end;
1215
1216 if (!BN_add_word(serial, 1)) {
1217 BIO_printf(bio_err, "Serial number increment failure\n");
1218 goto end;
1219 }
1220
1221 if (file_exists || create)
1222 save_serial(serialfile, NULL, serial, &bs);
1223 else
1224 bs = BN_to_ASN1_INTEGER(serial, NULL);
1225
1226 end:
1227 OPENSSL_free(buf);
1228 BN_free(serial);
1229 return bs;
1230 }
1231
callb(int ok,X509_STORE_CTX * ctx)1232 static int callb(int ok, X509_STORE_CTX *ctx)
1233 {
1234 int err;
1235 X509 *err_cert;
1236
1237 /*
1238 * It is ok to use a self-signed certificate. This case will catch both
1239 * the initial ok == 0 and the final ok == 1 calls to this function.
1240 */
1241 err = X509_STORE_CTX_get_error(ctx);
1242 if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
1243 return 1;
1244
1245 if (!ok) {
1246 err_cert = X509_STORE_CTX_get_current_cert(ctx);
1247 print_name(bio_err, "subject=", X509_get_subject_name(err_cert));
1248 BIO_printf(bio_err,
1249 "Error with certificate - error %d at depth %d\n%s\n", err,
1250 X509_STORE_CTX_get_error_depth(ctx),
1251 X509_verify_cert_error_string(err));
1252 return 1;
1253 }
1254
1255 return 1;
1256 }
1257
purpose_print(BIO * bio,X509 * cert,X509_PURPOSE * pt)1258 static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
1259 {
1260 int id, i, idret;
1261 const char *pname;
1262 id = X509_PURPOSE_get_id(pt);
1263 pname = X509_PURPOSE_get0_name(pt);
1264 for (i = 0; i < 2; i++) {
1265 idret = X509_check_purpose(cert, id, i);
1266 BIO_printf(bio, "%s%s : ", pname, i ? " CA" : "");
1267 if (idret == 1)
1268 BIO_printf(bio, "Yes\n");
1269 else if (idret == 0)
1270 BIO_printf(bio, "No\n");
1271 else
1272 BIO_printf(bio, "Yes (WARNING code=%d)\n", idret);
1273 }
1274 return 1;
1275 }
1276
parse_ext_names(char * names,const char ** result)1277 static int parse_ext_names(char *names, const char **result)
1278 {
1279 char *p, *q;
1280 int cnt = 0, len = 0;
1281
1282 p = q = names;
1283 len = strlen(names);
1284
1285 while (q - names <= len) {
1286 if (*q != ',' && *q != '\0') {
1287 q++;
1288 continue;
1289 }
1290 if (p != q) {
1291 /* found */
1292 if (result != NULL) {
1293 result[cnt] = p;
1294 *q = '\0';
1295 }
1296 cnt++;
1297 }
1298 p = ++q;
1299 }
1300
1301 return cnt;
1302 }
1303
print_x509v3_exts(BIO * bio,X509 * x,const char * ext_names)1304 static int print_x509v3_exts(BIO *bio, X509 *x, const char *ext_names)
1305 {
1306 const STACK_OF(X509_EXTENSION) *exts = NULL;
1307 STACK_OF(X509_EXTENSION) *exts2 = NULL;
1308 X509_EXTENSION *ext = NULL;
1309 ASN1_OBJECT *obj;
1310 int i, j, ret = 0, num, nn = 0;
1311 const char *sn, **names = NULL;
1312 char *tmp_ext_names = NULL;
1313
1314 exts = X509_get0_extensions(x);
1315 if ((num = sk_X509_EXTENSION_num(exts)) <= 0) {
1316 BIO_printf(bio_err, "No extensions in certificate\n");
1317 ret = 1;
1318 goto end;
1319 }
1320
1321 /* parse comma separated ext name string */
1322 if ((tmp_ext_names = OPENSSL_strdup(ext_names)) == NULL)
1323 goto end;
1324 if ((nn = parse_ext_names(tmp_ext_names, NULL)) == 0) {
1325 BIO_printf(bio, "Invalid extension names: %s\n", ext_names);
1326 goto end;
1327 }
1328 if ((names = OPENSSL_malloc(sizeof(char *) * nn)) == NULL)
1329 goto end;
1330 parse_ext_names(tmp_ext_names, names);
1331
1332 for (i = 0; i < num; i++) {
1333 ext = sk_X509_EXTENSION_value(exts, i);
1334
1335 /* check if this ext is what we want */
1336 obj = X509_EXTENSION_get_object(ext);
1337 sn = OBJ_nid2sn(OBJ_obj2nid(obj));
1338 if (sn == NULL || strcmp(sn, "UNDEF") == 0)
1339 continue;
1340
1341 for (j = 0; j < nn; j++) {
1342 if (strcmp(sn, names[j]) == 0) {
1343 /* push the extension into a new stack */
1344 if (exts2 == NULL
1345 && (exts2 = sk_X509_EXTENSION_new_null()) == NULL)
1346 goto end;
1347 if (!sk_X509_EXTENSION_push(exts2, ext))
1348 goto end;
1349 }
1350 }
1351 }
1352
1353 if (!sk_X509_EXTENSION_num(exts2)) {
1354 BIO_printf(bio, "No extensions matched with %s\n", ext_names);
1355 ret = 1;
1356 goto end;
1357 }
1358
1359 ret = X509V3_extensions_print(bio, NULL, exts2, 0, 0);
1360 end:
1361 sk_X509_EXTENSION_free(exts2);
1362 OPENSSL_free(names);
1363 OPENSSL_free(tmp_ext_names);
1364 return ret;
1365 }
1366