x509.c 32.4 KB
Newer Older
1
/* apps/x509.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

59
#include <assert.h>
60 61 62
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
63
#ifdef OPENSSL_NO_STDIO
64 65 66
#define APPS_WIN16
#endif
#include "apps.h"
67 68 69 70 71 72 73 74 75
#include <openssl/bio.h>
#include <openssl/asn1.h>
#include <openssl/err.h>
#include <openssl/bn.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include <openssl/pem.h>
76 77 78 79 80 81 82 83 84 85 86

#undef PROG
#define PROG x509_main

#undef POSTFIX
#define	POSTFIX	".srl"
#define DEF_DAYS	30

static char *x509_usage[]={
"usage: x509 args\n",
" -inform arg     - input format - default PEM (one of DER, NET or PEM)\n",
87
" -outform arg    - output format - default PEM (one of DER, NET or PEM)\n",
88 89 90 91 92
" -keyform arg    - private key format - default PEM\n",
" -CAform arg     - CA format - default PEM\n",
" -CAkeyform arg  - CA key format - default PEM\n",
" -in arg         - input file - default stdin\n",
" -out arg        - output file - default stdout\n",
D
Dr. Stephen Henson 已提交
93
" -passin arg     - private key password source\n",
94 95 96 97
" -serial         - print serial number value\n",
" -hash           - print hash value\n",
" -subject        - print subject DN\n",
" -issuer         - print issuer DN\n",
98
" -email          - print email address(es)\n",
99 100
" -startdate      - notBefore field\n",
" -enddate        - notAfter field\n",
101
" -purpose        - print out certificate purposes\n",
102 103
" -dates          - both Before and After dates\n",
" -modulus        - print the RSA key modulus\n",
104
" -pubkey         - output the public key\n",
105
" -fingerprint    - print the certificate fingerprint\n",
106
" -alias          - output certificate alias\n",
107
" -noout          - no certificate output\n",
108
" -ocspid         - print OCSP hash values for the subject name and public key\n",
109 110
" -trustout       - output a \"trusted\" certificate\n",
" -clrtrust       - clear all trusted purposes\n",
111 112 113
" -clrreject      - clear all rejected purposes\n",
" -addtrust arg   - trust certificate for a given purpose\n",
" -addreject arg  - reject certificate for a given purpose\n",
114
" -setalias arg   - set certificate alias\n",
115
" -days arg       - How long till expiry of a signed certificate - def 30 days\n",
116 117
" -checkend arg   - check whether the cert expires in the next arg seconds\n",
"                   exit 1 if so, 0 if not\n",
118 119 120 121 122
" -signkey arg    - self sign cert with arg\n",
" -x509toreq      - output a certification request object\n",
" -req            - input is a certificate request, sign and output.\n",
" -CA arg         - set the CA certificate, must be PEM format.\n",
" -CAkey arg      - set the CA key, must be PEM format\n",
U
Ulf Möller 已提交
123
"                   missing, it is assumed to be in the CA file.\n",
124 125
" -CAcreateserial - create serial number file if it does not exist\n",
" -CAserial       - serial file\n",
126
" -set_serial     - serial number to use\n",
127
" -text           - print the certificate in text form\n",
128
" -C              - print out C code forms\n",
129
" -md2/-md5/-sha1/-mdc2 - digest to use\n",
130
" -extfile        - configuration file with X509V3 extensions to add\n",
131
" -extensions     - section from config file with X509V3 extensions to add\n",
132
" -clrext         - delete extensions before signing and input certificate\n",
D
 
Dr. Stephen Henson 已提交
133
" -nameopt arg    - various certificate name options\n",
134
" -engine e       - use engine e, possibly a hardware device.\n",
135
" -certopt arg    - various certificate text options\n",
136 137 138 139
NULL
};

static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx);
140
static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest,
D
 
Dr. Stephen Henson 已提交
141
						CONF *conf, char *section);
B
Ben Laurie 已提交
142 143
static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,
			 X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,
D
 
Dr. Stephen Henson 已提交
144
			 int create,int days, int clrext, CONF *conf, char *section,
145
						ASN1_INTEGER *sno);
146
static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
147 148
static int reqfile=0;

149 150
int MAIN(int, char **);

U
Ulf Möller 已提交
151
int MAIN(int argc, char **argv)
152
	{
153
	ENGINE *e = NULL;
154 155 156
	int ret=1;
	X509_REQ *req=NULL;
	X509 *x=NULL,*xca=NULL;
157
	ASN1_OBJECT *objtmp;
158
	EVP_PKEY *Upkey=NULL,*CApkey=NULL;
159
	ASN1_INTEGER *sno = NULL;
160 161 162
	int i,num,badops=0;
	BIO *out=NULL;
	BIO *STDout=NULL;
163
	STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
164 165 166
	int informat,outformat,keyformat,CAformat,CAkeyformat;
	char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;
	char *CAkeyfile=NULL,*CAserial=NULL;
167
	char *alias=NULL;
168
	int text=0,serial=0,hash=0,subject=0,issuer=0,startdate=0,enddate=0;
169
	int ocspid=0;
170
	int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0;
171
	int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;
172
	int C=0;
173
	int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;
174
	int pprint = 0;
175 176 177 178 179
	char **pp;
	X509_STORE *ctx=NULL;
	X509_REQ *rq=NULL;
	int fingerprint=0;
	char buf[256];
B
Ben Laurie 已提交
180
	const EVP_MD *md_alg,*digest=EVP_md5();
D
 
Dr. Stephen Henson 已提交
181
	CONF *extconf = NULL;
D
Dr. Stephen Henson 已提交
182
	char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
183
	int need_rand = 0;
184
	int checkend=0,checkoffset=0;
185
	unsigned long nmflag = 0, certflag = 0;
186
	char *engine=NULL;
187 188 189 190 191 192 193

	reqfile=0;

	apps_startup();

	if (bio_err == NULL)
		bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
D
Dr. Stephen Henson 已提交
194 195 196

	if (!load_config(bio_err, NULL))
		goto end;
197
	STDout=BIO_new_fp(stdout,BIO_NOCLOSE);
198
#ifdef OPENSSL_SYS_VMS
199 200 201 202 203
	{
	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
	STDout = BIO_push(tmpbio, STDout);
	}
#endif
204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235

	informat=FORMAT_PEM;
	outformat=FORMAT_PEM;
	keyformat=FORMAT_PEM;
	CAformat=FORMAT_PEM;
	CAkeyformat=FORMAT_PEM;

	ctx=X509_STORE_new();
	if (ctx == NULL) goto end;
	X509_STORE_set_verify_cb_func(ctx,callb);

	argc--;
	argv++;
	num=0;
	while (argc >= 1)
		{
		if 	(strcmp(*argv,"-inform") == 0)
			{
			if (--argc < 1) goto bad;
			informat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-outform") == 0)
			{
			if (--argc < 1) goto bad;
			outformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-keyform") == 0)
			{
			if (--argc < 1) goto bad;
			keyformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-req") == 0)
236
			{
237
			reqfile=1;
238 239
			need_rand = 1;
			}
240 241 242 243 244 245 246 247
		else if (strcmp(*argv,"-CAform") == 0)
			{
			if (--argc < 1) goto bad;
			CAformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-CAkeyform") == 0)
			{
			if (--argc < 1) goto bad;
248
			CAkeyformat=str2fmt(*(++argv));
249 250 251 252 253 254 255
			}
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days=atoi(*(++argv));
			if (days == 0)
				{
256
				BIO_printf(STDout,"bad number of days\n");
257 258 259
				goto bad;
				}
			}
260 261 262
		else if (strcmp(*argv,"-passin") == 0)
			{
			if (--argc < 1) goto bad;
D
Dr. Stephen Henson 已提交
263
			passargin= *(++argv);
264
			}
265
		else if (strcmp(*argv,"-extfile") == 0)
266 267 268 269
			{
			if (--argc < 1) goto bad;
			extfile= *(++argv);
			}
270 271 272 273 274
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extsect= *(++argv);
			}
275 276 277 278 279 280 281 282 283 284 285 286 287 288 289
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-signkey") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			sign_flag= ++num;
290
			need_rand = 1;
291 292 293 294 295 296
			}
		else if (strcmp(*argv,"-CA") == 0)
			{
			if (--argc < 1) goto bad;
			CAfile= *(++argv);
			CA_flag= ++num;
297
			need_rand = 1;
298 299 300 301 302 303 304 305 306 307 308
			}
		else if (strcmp(*argv,"-CAkey") == 0)
			{
			if (--argc < 1) goto bad;
			CAkeyfile= *(++argv);
			}
		else if (strcmp(*argv,"-CAserial") == 0)
			{
			if (--argc < 1) goto bad;
			CAserial= *(++argv);
			}
309 310 311 312 313 314
		else if (strcmp(*argv,"-set_serial") == 0)
			{
			if (--argc < 1) goto bad;
			if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv))))
				goto bad;
			}
315 316 317
		else if (strcmp(*argv,"-addtrust") == 0)
			{
			if (--argc < 1) goto bad;
318 319
			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))
				{
320
				BIO_printf(bio_err,
321
					"Invalid trust object value %s\n", *argv);
322
				goto bad;
323 324
				}
			if (!trust) trust = sk_ASN1_OBJECT_new_null();
325
			sk_ASN1_OBJECT_push(trust, objtmp);
326 327
			trustout = 1;
			}
328
		else if (strcmp(*argv,"-addreject") == 0)
329 330
			{
			if (--argc < 1) goto bad;
331 332
			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))
				{
333
				BIO_printf(bio_err,
334
					"Invalid reject object value %s\n", *argv);
335
				goto bad;
336 337
				}
			if (!reject) reject = sk_ASN1_OBJECT_new_null();
338
			sk_ASN1_OBJECT_push(reject, objtmp);
339 340 341 342 343 344 345 346
			trustout = 1;
			}
		else if (strcmp(*argv,"-setalias") == 0)
			{
			if (--argc < 1) goto bad;
			alias= *(++argv);
			trustout = 1;
			}
347 348 349 350 351
		else if (strcmp(*argv,"-certopt") == 0)
			{
			if (--argc < 1) goto bad;
			if (!set_cert_ex(&certflag, *(++argv))) goto bad;
			}
D
 
Dr. Stephen Henson 已提交
352 353 354
		else if (strcmp(*argv,"-nameopt") == 0)
			{
			if (--argc < 1) goto bad;
355
			if (!set_name_ex(&nmflag, *(++argv))) goto bad;
D
 
Dr. Stephen Henson 已提交
356
			}
357 358 359 360 361 362
		else if (strcmp(*argv,"-setalias") == 0)
			{
			if (--argc < 1) goto bad;
			alias= *(++argv);
			trustout = 1;
			}
363 364 365 366 367
		else if (strcmp(*argv,"-engine") == 0)
			{
			if (--argc < 1) goto bad;
			engine= *(++argv);
			}
368 369
		else if (strcmp(*argv,"-C") == 0)
			C= ++num;
370 371
		else if (strcmp(*argv,"-email") == 0)
			email= ++num;
372 373 374 375
		else if (strcmp(*argv,"-serial") == 0)
			serial= ++num;
		else if (strcmp(*argv,"-modulus") == 0)
			modulus= ++num;
376 377
		else if (strcmp(*argv,"-pubkey") == 0)
			pubkey= ++num;
378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394
		else if (strcmp(*argv,"-x509toreq") == 0)
			x509req= ++num;
		else if (strcmp(*argv,"-text") == 0)
			text= ++num;
		else if (strcmp(*argv,"-hash") == 0)
			hash= ++num;
		else if (strcmp(*argv,"-subject") == 0)
			subject= ++num;
		else if (strcmp(*argv,"-issuer") == 0)
			issuer= ++num;
		else if (strcmp(*argv,"-fingerprint") == 0)
			fingerprint= ++num;
		else if (strcmp(*argv,"-dates") == 0)
			{
			startdate= ++num;
			enddate= ++num;
			}
395 396
		else if (strcmp(*argv,"-purpose") == 0)
			pprint= ++num;
397 398 399 400
		else if (strcmp(*argv,"-startdate") == 0)
			startdate= ++num;
		else if (strcmp(*argv,"-enddate") == 0)
			enddate= ++num;
401 402 403 404 405 406
		else if (strcmp(*argv,"-checkend") == 0)
			{
			if (--argc < 1) goto bad;
			checkoffset=atoi(*(++argv));
			checkend=1;
			}
407 408
		else if (strcmp(*argv,"-noout") == 0)
			noout= ++num;
409 410 411 412
		else if (strcmp(*argv,"-trustout") == 0)
			trustout= 1;
		else if (strcmp(*argv,"-clrtrust") == 0)
			clrtrust= ++num;
413 414
		else if (strcmp(*argv,"-clrreject") == 0)
			clrreject= ++num;
415 416
		else if (strcmp(*argv,"-alias") == 0)
			aliasout= ++num;
417 418
		else if (strcmp(*argv,"-CAcreateserial") == 0)
			CA_createserial= ++num;
419 420 421
		else if (strcmp(*argv,"-clrext") == 0)
			clrext = 1;
#if 1 /* stay backwards-compatible with 0.9.5; this should go away soon */
422
		else if (strcmp(*argv,"-crlext") == 0)
423 424
			{
			BIO_printf(bio_err,"use -clrext instead of -crlext\n");
425
			clrext = 1;
426 427
			}
#endif
428 429
		else if (strcmp(*argv,"-ocspid") == 0)
			ocspid= ++num;
430
		else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
			{
			/* ok */
			digest=md_alg;
			}
		else
			{
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}

	if (badops)
		{
bad:
		for (pp=x509_usage; (*pp != NULL); pp++)
U
Ulf Möller 已提交
449
			BIO_printf(bio_err,"%s",*pp);
450 451 452
		goto end;
		}

453
        e = setup_engine(bio_err, engine, 0);
454

455 456 457
	if (need_rand)
		app_RAND_load_file(NULL, bio_err, 0);

458 459
	ERR_load_crypto_strings();

460 461
	if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
		{
D
Dr. Stephen Henson 已提交
462 463
		BIO_printf(bio_err, "Error getting password\n");
		goto end;
464
		}
D
Dr. Stephen Henson 已提交
465

466 467 468 469 470 471 472 473 474 475 476 477 478 479
	if (!X509_STORE_set_default_paths(ctx))
		{
		ERR_print_errors(bio_err);
		goto end;
		}

	if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM))
		{ CAkeyfile=CAfile; }
	else if ((CA_flag) && (CAkeyfile == NULL))
		{
		BIO_printf(bio_err,"need to specify a CAkey if using the CA command\n");
		goto end;
		}

480 481
	if (extfile)
		{
482
		long errorline;
B
Ben Laurie 已提交
483
		X509V3_CTX ctx2;
D
 
Dr. Stephen Henson 已提交
484 485
		extconf = NCONF_new(NULL);
		if (!NCONF_load(extconf, extfile,&errorline))
486
			{
487 488 489 490 491 492 493 494 495
			if (errorline <= 0)
				BIO_printf(bio_err,
					"error loading the config file '%s'\n",
								extfile);
                	else
                        	BIO_printf(bio_err,
				       "error on line %ld of config file '%s'\n"
							,errorline,extfile);
			goto end;
496
			}
497 498
		if (!extsect)
			{
D
 
Dr. Stephen Henson 已提交
499
			extsect = NCONF_get_string(extconf, "default", "extensions");
500 501 502 503 504 505
			if (!extsect)
				{
				ERR_clear_error();
				extsect = "default";
				}
			}
B
Ben Laurie 已提交
506
		X509V3_set_ctx_test(&ctx2);
D
 
Dr. Stephen Henson 已提交
507 508
		X509V3_set_nconf(&ctx2, extconf);
		if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))
509
			{
510 511 512 513 514
			BIO_printf(bio_err,
				"Error Loading extension section %s\n",
								 extsect);
			ERR_print_errors(bio_err);
			goto end;
515 516
			}
		}
517 518


519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537
	if (reqfile)
		{
		EVP_PKEY *pkey;
		X509_CINF *ci;
		BIO *in;

		if (!sign_flag && !CA_flag)
			{
			BIO_printf(bio_err,"We need a private key to sign with\n");
			goto end;
			}
		in=BIO_new(BIO_s_file());
		if (in == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}

		if (infile == NULL)
538
			BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);
539 540 541 542 543
		else
			{
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
544
				BIO_free(in);
545 546 547
				goto end;
				}
			}
548
		req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);
549 550
		BIO_free(in);

551 552 553 554 555
		if (req == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}
556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571

		if (	(req->req_info == NULL) ||
			(req->req_info->pubkey == NULL) ||
			(req->req_info->pubkey->public_key == NULL) ||
			(req->req_info->pubkey->public_key->data == NULL))
			{
			BIO_printf(bio_err,"The certificate request appears to corrupted\n");
			BIO_printf(bio_err,"It does not contain a public key\n");
			goto end;
			}
		if ((pkey=X509_REQ_get_pubkey(req)) == NULL)
	                {
	                BIO_printf(bio_err,"error unpacking public key\n");
	                goto end;
	                }
		i=X509_REQ_verify(req,pkey);
572
		EVP_PKEY_free(pkey);
573 574 575 576 577 578 579 580 581 582 583 584 585
		if (i < 0)
			{
			BIO_printf(bio_err,"Signature verification error\n");
			ERR_print_errors(bio_err);
			goto end;
			}
	        if (i == 0)
			{
			BIO_printf(bio_err,"Signature did not match the certificate request\n");
			goto end;
			}
		else
			BIO_printf(bio_err,"Signature ok\n");
D
 
Dr. Stephen Henson 已提交
586 587

		print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag);
588 589 590 591

		if ((x=X509_new()) == NULL) goto end;
		ci=x->cert_info;

592 593 594 595 596 597
		if (sno)
			{
			if (!X509_set_serialNumber(x, sno))
				goto end;
			}
		else if (!ASN1_INTEGER_set(X509_get_serialNumber(x),0)) goto end;
598 599 600 601 602 603
		if (!X509_set_issuer_name(x,req->req_info->subject)) goto end;
		if (!X509_set_subject_name(x,req->req_info->subject)) goto end;

		X509_gmtime_adj(X509_get_notBefore(x),0);
	        X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);

604 605 606
		pkey = X509_REQ_get_pubkey(req);
		X509_set_pubkey(x,pkey);
		EVP_PKEY_free(pkey);
607 608
		}
	else
609
		x=load_cert(bio_err,infile,informat,NULL,e,"Certificate");
610 611 612 613

	if (x == NULL) goto end;
	if (CA_flag)
		{
614
		xca=load_cert(bio_err,CAfile,CAformat,NULL,e,"CA Certificate");
615 616 617 618 619
		if (xca == NULL) goto end;
		}

	if (!noout || text)
		{
620
		OBJ_create("2.99999.3",
621 622 623 624 625 626 627 628 629
			"SET.ex3","SET x509v3 extension 3");

		out=BIO_new(BIO_s_file());
		if (out == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}
		if (outfile == NULL)
630
			{
631
			BIO_set_fp(out,stdout,BIO_NOCLOSE);
632
#ifdef OPENSSL_SYS_VMS
633 634 635 636 637 638
			{
			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
			out = BIO_push(tmpbio, out);
			}
#endif
			}
639 640 641 642 643 644 645 646 647 648
		else
			{
			if (BIO_write_filename(out,outfile) <= 0)
				{
				perror(outfile);
				goto end;
				}
			}
		}

649
	if (alias) X509_alias_set1(x, (unsigned char *)alias, -1);
650

651 652
	if (clrtrust) X509_trust_clear(x);
	if (clrreject) X509_reject_clear(x);
653

654 655 656 657
	if (trust)
		{
		for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++)
			{
658
			objtmp = sk_ASN1_OBJECT_value(trust, i);
659
			X509_add1_trust_object(x, objtmp);
660
			}
661 662
		}

663 664 665 666
	if (reject)
		{
		for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++)
			{
667
			objtmp = sk_ASN1_OBJECT_value(reject, i);
668
			X509_add1_reject_object(x, objtmp);
669
			}
670 671
		}

672 673 674 675 676 677
	if (num)
		{
		for (i=1; i<=num; i++)
			{
			if (issuer == i)
				{
D
 
Dr. Stephen Henson 已提交
678 679
				print_name(STDout, "issuer= ",
					X509_get_issuer_name(x), nmflag);
680 681 682
				}
			else if (subject == i) 
				{
683
				print_name(STDout, "subject= ",
D
 
Dr. Stephen Henson 已提交
684
					X509_get_subject_name(x), nmflag);
685 686 687
				}
			else if (serial == i)
				{
688
				BIO_printf(STDout,"serial=");
689
				i2a_ASN1_INTEGER(STDout,x->cert_info->serialNumber);
690
				BIO_printf(STDout,"\n");
691
				}
692 693 694 695 696
			else if (email == i) 
				{
				int j;
				STACK *emlst;
				emlst = X509_get1_email(x);
697
				for (j = 0; j < sk_num(emlst); j++)
698 699 700
					BIO_printf(STDout, "%s\n", sk_value(emlst, j));
				X509_email_free(emlst);
				}
701 702 703
			else if (aliasout == i)
				{
				unsigned char *alstr;
704
				alstr = X509_alias_get0(x, NULL);
705
				if (alstr) BIO_printf(STDout,"%s\n", alstr);
706 707
				else BIO_puts(STDout,"<No Alias>\n");
				}
708 709
			else if (hash == i)
				{
710
				BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
711
				}
712 713
			else if (pprint == i)
				{
714 715
				X509_PURPOSE *ptmp;
				int j;
716
				BIO_printf(STDout, "Certificate purposes:\n");
717
				for (j = 0; j < X509_PURPOSE_get_count(); j++)
718
					{
719
					ptmp = X509_PURPOSE_get0(j);
720 721
					purpose_print(STDout, x, ptmp);
					}
722
				}
723 724 725 726 727 728 729 730
			else
				if (modulus == i)
				{
				EVP_PKEY *pkey;

				pkey=X509_get_pubkey(x);
				if (pkey == NULL)
					{
731
					BIO_printf(bio_err,"Modulus=unavailable\n");
732 733 734
					ERR_print_errors(bio_err);
					goto end;
					}
735
				BIO_printf(STDout,"Modulus=");
736
#ifndef OPENSSL_NO_RSA
737 738 739
				if (pkey->type == EVP_PKEY_RSA)
					BN_print(STDout,pkey->pkey.rsa->n);
				else
740
#endif
741
#ifndef OPENSSL_NO_DSA
742 743 744 745
				if (pkey->type == EVP_PKEY_DSA)
					BN_print(STDout,pkey->pkey.dsa->pub_key);
				else
#endif
746 747
					BIO_printf(STDout,"Wrong Algorithm type");
				BIO_printf(STDout,"\n");
748
				EVP_PKEY_free(pkey);
749
				}
750 751 752 753 754 755 756 757 758 759 760 761 762 763 764
			else
				if (pubkey == i)
				{
				EVP_PKEY *pkey;

				pkey=X509_get_pubkey(x);
				if (pkey == NULL)
					{
					BIO_printf(bio_err,"Error getting public key\n");
					ERR_print_errors(bio_err);
					goto end;
					}
				PEM_write_bio_PUBKEY(STDout, pkey);
				EVP_PKEY_free(pkey);
				}
765 766 767 768 769 770 771 772 773
			else
				if (C == i)
				{
				unsigned char *d;
				char *m;
				int y,z;

				X509_NAME_oneline(X509_get_subject_name(x),
					buf,256);
774
				BIO_printf(STDout,"/* subject:%s */\n",buf);
775 776
				m=X509_NAME_oneline(
					X509_get_issuer_name(x),buf,256);
777
				BIO_printf(STDout,"/* issuer :%s */\n",buf);
778 779

				z=i2d_X509(x,NULL);
780
				m=OPENSSL_malloc(z);
781 782 783

				d=(unsigned char *)m;
				z=i2d_X509_NAME(X509_get_subject_name(x),&d);
784
				BIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\n",z);
785 786 787
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
788 789
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\n");
790
					}
791 792
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
793 794

				z=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d);
795
				BIO_printf(STDout,"unsigned char XXX_public_key[%d]={\n",z);
796 797 798
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
799 800 801
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
802
					}
803 804
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
805 806

				z=i2d_X509(x,&d);
807
				BIO_printf(STDout,"unsigned char XXX_certificate[%d]={\n",z);
808 809 810
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
811 812 813
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
814
					}
815 816
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
817

818
				OPENSSL_free(m);
819 820 821
				}
			else if (text == i)
				{
822
				X509_print_ex(out,x,nmflag, certflag);
823 824 825 826
				}
			else if (startdate == i)
				{
				BIO_puts(STDout,"notBefore=");
827
				ASN1_TIME_print(STDout,X509_get_notBefore(x));
828 829 830 831 832
				BIO_puts(STDout,"\n");
				}
			else if (enddate == i)
				{
				BIO_puts(STDout,"notAfter=");
833
				ASN1_TIME_print(STDout,X509_get_notAfter(x));
834 835 836 837 838 839 840 841
				BIO_puts(STDout,"\n");
				}
			else if (fingerprint == i)
				{
				int j;
				unsigned int n;
				unsigned char md[EVP_MAX_MD_SIZE];

842
				if (!X509_digest(x,digest,md,&n))
843 844 845 846
					{
					BIO_printf(bio_err,"out of memory\n");
					goto end;
					}
847 848
				BIO_printf(STDout,"%s Fingerprint=",
						OBJ_nid2sn(EVP_MD_type(digest)));
849 850
				for (j=0; j<(int)n; j++)
					{
851
					BIO_printf(STDout,"%02X%c",md[j],
852 853 854 855 856 857 858 859 860 861 862
						(j+1 == (int)n)
						?'\n':':');
					}
				}

			/* should be in the library */
			else if ((sign_flag == i) && (x509req == 0))
				{
				BIO_printf(bio_err,"Getting Private key\n");
				if (Upkey == NULL)
					{
863
					Upkey=load_key(bio_err,
864 865
						keyfile,keyformat, passin, e,
						"Private key");
866 867
					if (Upkey == NULL) goto end;
					}
868
#ifndef OPENSSL_NO_DSA
869 870 871
		                if (Upkey->type == EVP_PKEY_DSA)
		                        digest=EVP_dss1();
#endif
B
Bodo Möller 已提交
872 873 874 875
#ifndef OPENSSL_NO_ECDSA
				if (Upkey->type == EVP_PKEY_ECDSA)
					digest=EVP_ecdsa();
#endif
876

877
				assert(need_rand);
878
				if (!sign(x,Upkey,days,clrext,digest,
879
						 extconf, extsect)) goto end;
880 881 882 883 884 885
				}
			else if (CA_flag == i)
				{
				BIO_printf(bio_err,"Getting CA Private Key\n");
				if (CAkeyfile != NULL)
					{
886
					CApkey=load_key(bio_err,
887
						CAkeyfile,CAkeyformat, passin,
888
						e, "CA Private Key");
889 890
					if (CApkey == NULL) goto end;
					}
891
#ifndef OPENSSL_NO_DSA
892 893 894
		                if (CApkey->type == EVP_PKEY_DSA)
		                        digest=EVP_dss1();
#endif
B
Bodo Möller 已提交
895 896 897 898
#ifndef OPENSSL_NO_ECDSA
				if (CApkey->type == EVP_PKEY_ECDSA)
					digest = EVP_ecdsa();
#endif
899
				
900
				assert(need_rand);
901
				if (!x509_certify(ctx,CAfile,digest,x,xca,
902
					CApkey, CAserial,CA_createserial,days, clrext,
903
					extconf, extsect, sno))
904 905 906 907 908 909 910 911 912 913 914 915 916 917
					goto end;
				}
			else if (x509req == i)
				{
				EVP_PKEY *pk;

				BIO_printf(bio_err,"Getting request Private Key\n");
				if (keyfile == NULL)
					{
					BIO_printf(bio_err,"no request key file specified\n");
					goto end;
					}
				else
					{
918
					pk=load_key(bio_err,
919 920
						keyfile,FORMAT_PEM, passin, e,
						"request key");
921 922 923 924 925
					if (pk == NULL) goto end;
					}

				BIO_printf(bio_err,"Generating certificate request\n");

926
#ifndef OPENSSL_NO_DSA
927 928
		                if (pk->type == EVP_PKEY_DSA)
		                        digest=EVP_dss1();
929 930 931
#endif
#ifndef OPENSSL_NO_ECDSA
				if (pk->type == EVP_PKEY_ECDSA)
B
Bodo Möller 已提交
932
					digest=EVP_ecdsa();
933
#endif
934 935

				rq=X509_to_X509_REQ(x,pk,digest);
936 937 938 939 940 941 942 943 944 945 946 947 948
				EVP_PKEY_free(pk);
				if (rq == NULL)
					{
					ERR_print_errors(bio_err);
					goto end;
					}
				if (!noout)
					{
					X509_REQ_print(out,rq);
					PEM_write_bio_X509_REQ(out,rq);
					}
				noout=1;
				}
949 950 951 952
			else if (ocspid == i)
				{
				X509_ocspid_print(out, x);
				}
953 954 955
			}
		}

956
	if (checkend)
957 958 959
		{
		time_t tnow=time(NULL);

960
		if (ASN1_UTCTIME_cmp_time_t(X509_get_notAfter(x), tnow+checkoffset) == -1)
961 962 963 964 965 966 967 968 969 970 971 972
			{
			BIO_printf(out,"Certificate will expire\n");
			ret=1;
			}
		else
			{
			BIO_printf(out,"Certificate will not expire\n");
			ret=0;
			}
		goto end;
		}

973 974 975 976 977 978 979 980
	if (noout)
		{
		ret=0;
		goto end;
		}

	if 	(outformat == FORMAT_ASN1)
		i=i2d_X509_bio(out,x);
981 982 983
	else if (outformat == FORMAT_PEM)
		{
		if (trustout) i=PEM_write_bio_X509_AUX(out,x);
984
		else i=PEM_write_bio_X509(out,x);
985 986
		}
	else if (outformat == FORMAT_NETSCAPE)
987 988 989 990
		{
		ASN1_HEADER ah;
		ASN1_OCTET_STRING os;

991 992
		os.data=(unsigned char *)NETSCAPE_CERT_HDR;
		os.length=strlen(NETSCAPE_CERT_HDR);
993 994 995 996 997 998 999 1000 1001 1002 1003
		ah.header= &os;
		ah.data=(char *)x;
		ah.meth=X509_asn1_meth();

		/* no macro for this one yet */
		i=ASN1_i2d_bio(i2d_ASN1_HEADER,out,(unsigned char *)&ah);
		}
	else	{
		BIO_printf(bio_err,"bad output format specified for outfile\n");
		goto end;
		}
1004 1005
	if (!i)
		{
1006 1007 1008 1009 1010 1011
		BIO_printf(bio_err,"unable to write certificate\n");
		ERR_print_errors(bio_err);
		goto end;
		}
	ret=0;
end:
1012 1013
	if (need_rand)
		app_RAND_write_file(NULL, bio_err);
1014
	OBJ_cleanup();
D
 
Dr. Stephen Henson 已提交
1015
	NCONF_free(extconf);
1016 1017
	BIO_free_all(out);
	BIO_free_all(STDout);
1018 1019 1020 1021 1022 1023 1024
	X509_STORE_free(ctx);
	X509_REQ_free(req);
	X509_free(x);
	X509_free(xca);
	EVP_PKEY_free(Upkey);
	EVP_PKEY_free(CApkey);
	X509_REQ_free(rq);
1025
	ASN1_INTEGER_free(sno);
1026 1027
	sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
	sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
1028
	if (passin) OPENSSL_free(passin);
1029
	apps_shutdown();
1030 1031 1032
	EXIT(ret);
	}

1033
static ASN1_INTEGER *load_serial(char *CAfile, char *serialfile, int create)
1034
	{
1035
	char *buf = NULL, *p;
1036
	MS_STATIC char buf2[1024];
1037
	ASN1_INTEGER *bs = NULL, *bs2 = NULL;
1038
	BIO *io = NULL;
U
Ulf Möller 已提交
1039
	BIGNUM *serial = NULL;
1040

1041
	buf=OPENSSL_malloc( ((serialfile == NULL)
1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081
			?(strlen(CAfile)+strlen(POSTFIX)+1)
			:(strlen(serialfile)))+1);
	if (buf == NULL) { BIO_printf(bio_err,"out of mem\n"); goto end; }
	if (serialfile == NULL)
		{
		strcpy(buf,CAfile);
		for (p=buf; *p; p++)
			if (*p == '.')
				{
				*p='\0';
				break;
				}
		strcat(buf,POSTFIX);
		}
	else
		strcpy(buf,serialfile);
	serial=BN_new();
	bs=ASN1_INTEGER_new();
	if ((serial == NULL) || (bs == NULL))
		{
		ERR_print_errors(bio_err);
		goto end;
		}

	io=BIO_new(BIO_s_file());
	if (io == NULL)
		{
		ERR_print_errors(bio_err);
		goto end;
		}
	
	if (BIO_read_filename(io,buf) <= 0)
		{
		if (!create)
			{
			perror(buf);
			goto end;
			}
		else
			{
1082 1083
			ASN1_INTEGER_set(bs,1);
			BN_one(serial);
1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106
			}
		}
	else 
		{
		if (!a2i_ASN1_INTEGER(io,bs,buf2,1024))
			{
			BIO_printf(bio_err,"unable to load serial number from %s\n",buf);
			ERR_print_errors(bio_err);
			goto end;
			}
		else
			{
			serial=BN_bin2bn(bs->data,bs->length,serial);
			if (serial == NULL)
				{
				BIO_printf(bio_err,"error converting bin 2 bn");
				goto end;
				}
			}
		}

	if (!BN_add_word(serial,1))
		{ BIO_printf(bio_err,"add_word failure\n"); goto end; }
1107 1108
	if (!(bs2 = BN_to_ASN1_INTEGER(serial, NULL)))
		{ BIO_printf(bio_err,"error converting bn 2 asn1_integer\n"); goto end; }
1109 1110 1111 1112 1113 1114
	if (BIO_write_filename(io,buf) <= 0)
		{
		BIO_printf(bio_err,"error attempting to write serial number file\n");
		perror(buf);
		goto end;
		}
1115
	i2a_ASN1_INTEGER(io,bs2);
1116
	BIO_puts(io,"\n");
1117

1118
	BIO_free(io);
1119 1120 1121
	if (buf) OPENSSL_free(buf);
	ASN1_INTEGER_free(bs2);
	BN_free(serial);
1122
	io=NULL;
1123 1124 1125
	return bs;

	end:
1126
	if (buf) OPENSSL_free(buf);
1127 1128 1129 1130 1131 1132 1133 1134 1135
	BIO_free(io);
	ASN1_INTEGER_free(bs);
	BN_free(serial);
	return NULL;

	}

static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
D
 
Dr. Stephen Henson 已提交
1136
	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)
1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
	{
	int ret=0;
	ASN1_INTEGER *bs=NULL;
	X509_STORE_CTX xsc;
	EVP_PKEY *upkey;

	upkey = X509_get_pubkey(xca);
	EVP_PKEY_copy_parameters(upkey,pkey);
	EVP_PKEY_free(upkey);

1147 1148 1149 1150 1151
	if(!X509_STORE_CTX_init(&xsc,ctx,x,NULL))
		{
		BIO_printf(bio_err,"Error initialising X509 store\n");
		goto end;
		}
1152 1153 1154 1155
	if (sno) bs = sno;
	else if (!(bs = load_serial(CAfile, serialfile, create)))
		goto end;

1156 1157 1158 1159 1160 1161 1162 1163
	if (!X509_STORE_add_cert(ctx,x)) goto end;

	/* NOTE: this certificate can/should be self signed, unless it was
	 * a certificate request in which case it is not. */
	X509_STORE_CTX_set_cert(&xsc,x);
	if (!reqfile && !X509_verify_cert(&xsc))
		goto end;

1164 1165 1166 1167 1168 1169
	if (!X509_check_private_key(xca,pkey))
		{
		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
		goto end;
		}

1170 1171 1172 1173 1174 1175 1176 1177 1178 1179
	if (!X509_set_issuer_name(x,X509_get_subject_name(xca))) goto end;
	if (!X509_set_serialNumber(x,bs)) goto end;

	if (X509_gmtime_adj(X509_get_notBefore(x),0L) == NULL)
		goto end;

	/* hardwired expired */
	if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)
		goto end;

1180 1181 1182 1183
	if (clrext)
		{
		while (X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);
		}
1184

1185 1186
	if (conf)
		{
B
Ben Laurie 已提交
1187
		X509V3_CTX ctx2;
1188
		X509_set_version(x,2); /* version 3 certificate */
B
Ben Laurie 已提交
1189
                X509V3_set_ctx(&ctx2, xca, x, NULL, NULL, 0);
D
 
Dr. Stephen Henson 已提交
1190 1191
                X509V3_set_nconf(&ctx2, conf);
                if (!X509V3_EXT_add_nconf(conf, &ctx2, section, x)) goto end;
1192
		}
1193

1194 1195 1196 1197 1198 1199
	if (!X509_sign(x,pkey,digest)) goto end;
	ret=1;
end:
	X509_STORE_CTX_cleanup(&xsc);
	if (!ret)
		ERR_print_errors(bio_err);
1200
	if (!sno) ASN1_INTEGER_free(bs);
1201
	return ret;
1202 1203
	}

U
Ulf Möller 已提交
1204
static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx)
1205 1206 1207 1208 1209 1210 1211 1212 1213
	{
	int err;
	X509 *err_cert;

	/* it is ok to use a self signed certificate
	 * This case will catch both the initial ok == 0 and the
	 * final ok == 1 calls to this function */
	err=X509_STORE_CTX_get_error(ctx);
	if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
1214
		return 1;
1215 1216 1217 1218 1219 1220

	/* BAD we should have gotten an error.  Normally if everything
	 * worked X509_STORE_CTX_get_error(ctx) will still be set to
	 * DEPTH_ZERO_SELF_.... */
	if (ok)
		{
1221
		BIO_printf(bio_err,"error with certificate to be certified - should be self signed\n");
1222
		return 0;
1223 1224 1225 1226
		}
	else
		{
		err_cert=X509_STORE_CTX_get_current_cert(ctx);
D
 
Dr. Stephen Henson 已提交
1227
		print_name(bio_err, NULL, X509_get_subject_name(err_cert),0);
1228
		BIO_printf(bio_err,"error with certificate - error %d at depth %d\n%s\n",
1229 1230
			err,X509_STORE_CTX_get_error_depth(ctx),
			X509_verify_cert_error_string(err));
1231
		return 1;
1232 1233 1234 1235
		}
	}

/* self sign */
1236
static int sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest, 
D
 
Dr. Stephen Henson 已提交
1237
						CONF *conf, char *section)
1238 1239
	{

1240 1241 1242 1243 1244 1245
	EVP_PKEY *pktmp;

	pktmp = X509_get_pubkey(x);
	EVP_PKEY_copy_parameters(pktmp,pkey);
	EVP_PKEY_save_parameters(pktmp,1);
	EVP_PKEY_free(pktmp);
1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257

	if (!X509_set_issuer_name(x,X509_get_subject_name(x))) goto err;
	if (X509_gmtime_adj(X509_get_notBefore(x),0) == NULL) goto err;

	/* Lets just make it 12:00am GMT, Jan 1 1970 */
	/* memcpy(x->cert_info->validity->notBefore,"700101120000Z",13); */
	/* 28 days to be certified */

	if (X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days) == NULL)
		goto err;

	if (!X509_set_pubkey(x,pkey)) goto err;
1258 1259 1260 1261 1262 1263
	if (clrext)
		{
		while (X509_get_ext_count(x) > 0) X509_delete_ext(x, 0);
		}
	if (conf)
		{
1264 1265 1266
		X509V3_CTX ctx;
		X509_set_version(x,2); /* version 3 certificate */
                X509V3_set_ctx(&ctx, x, x, NULL, NULL, 0);
D
 
Dr. Stephen Henson 已提交
1267 1268
                X509V3_set_nconf(&ctx, conf);
                if (!X509V3_EXT_add_nconf(conf, &ctx, section, x)) goto err;
1269
		}
1270
	if (!X509_sign(x,pkey,digest)) goto err;
1271
	return 1;
1272 1273
err:
	ERR_print_errors(bio_err);
1274
	return 0;
1275
	}
1276

1277
static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
1278 1279 1280 1281
{
	int id, i, idret;
	char *pname;
	id = X509_PURPOSE_get_id(pt);
1282
	pname = X509_PURPOSE_get0_name(pt);
1283 1284
	for (i = 0; i < 2; i++)
		{
1285 1286
		idret = X509_check_purpose(cert, id, i);
		BIO_printf(bio, "%s%s : ", pname, i ? " CA" : ""); 
1287
		if (idret == 1) BIO_printf(bio, "Yes\n");
1288 1289
		else if (idret == 0) BIO_printf(bio, "No\n");
		else BIO_printf(bio, "Yes (WARNING code=%d)\n", idret);
1290
		}
1291 1292
	return 1;
}