1 /* apps/x509.c */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 

    59 #include <assert.h>

    60 #include <stdio.h>

    61 #include <stdlib.h>

    62 #include <string.h>

    63 #ifdef OPENSSL_NO_STDIO

    64 #define APPS_WIN16

    65 #endif

    66 #include "apps.h"

    67 #include <openssl/bio.h>

    68 #include <openssl/asn1.h>

    69 #include <openssl/err.h>

    70 #include <openssl/bn.h>

    71 #include <openssl/evp.h>

    72 #include <openssl/x509.h>

    73 #include <openssl/x509v3.h>

    74 #include <openssl/objects.h>

    75 #include <openssl/pem.h>

    76 #ifndef OPENSSL_NO_RSA

    77 #include <openssl/rsa.h>

    78 #endif

    79 #ifndef OPENSSL_NO_DSA

    80 #include <openssl/dsa.h>

    81 #endif

    82 

    83 #undef PROG

    84 #define PROG x509_main

    85 

    86 #undef POSTFIX

    87 #define	POSTFIX	".srl"

    88 #define DEF_DAYS	30

    89 

    90 static const char *x509_usage[]={

    91 "usage: x509 args\n",

    92 " -inform arg     - input format - default PEM (one of DER, NET or PEM)\n",

    93 " -outform arg    - output format - default PEM (one of DER, NET or PEM)\n",

    94 " -keyform arg    - private key format - default PEM\n",

    95 " -CAform arg     - CA format - default PEM\n",

    96 " -CAkeyform arg  - CA key format - default PEM\n",

    97 " -in arg         - input file - default stdin\n",

    98 " -out arg        - output file - default stdout\n",

    99 " -passin arg     - private key password source\n",

   100 " -serial         - print serial number value\n",

   101 " -subject_hash   - print subject hash value\n",

   102 " -issuer_hash    - print issuer hash value\n",

   103 " -hash           - synonym for -subject_hash\n",

   104 " -subject        - print subject DN\n",

   105 " -issuer         - print issuer DN\n",

   106 " -email          - print email address(es)\n",

   107 " -startdate      - notBefore field\n",

   108 " -enddate        - notAfter field\n",

   109 " -purpose        - print out certificate purposes\n",

   110 " -dates          - both Before and After dates\n",

   111 " -modulus        - print the RSA key modulus\n",

   112 " -pubkey         - output the public key\n",

   113 " -fingerprint    - print the certificate fingerprint\n",

   114 " -alias          - output certificate alias\n",

   115 " -noout          - no certificate output\n",

   116 " -ocspid         - print OCSP hash values for the subject name and public key\n",

   117 " -trustout       - output a \"trusted\" certificate\n",

   118 " -clrtrust       - clear all trusted purposes\n",

   119 " -clrreject      - clear all rejected purposes\n",

   120 " -addtrust arg   - trust certificate for a given purpose\n",

   121 " -addreject arg  - reject certificate for a given purpose\n",

   122 " -setalias arg   - set certificate alias\n",

   123 " -days arg       - How long till expiry of a signed certificate - def 30 days\n",

   124 " -checkend arg   - check whether the cert expires in the next arg seconds\n",

   125 "                   exit 1 if so, 0 if not\n",

   126 " -signkey arg    - self sign cert with arg\n",

   127 " -x509toreq      - output a certification request object\n",

   128 " -req            - input is a certificate request, sign and output.\n",

   129 " -CA arg         - set the CA certificate, must be PEM format.\n",

   130 " -CAkey arg      - set the CA key, must be PEM format\n",

   131 "                   missing, it is assumed to be in the CA file.\n",

   132 " -CAcreateserial - create serial number file if it does not exist\n",

   133 " -CAserial arg   - serial file\n",

   134 " -set_serial     - serial number to use\n",

   135 " -text           - print the certificate in text form\n",

   136 " -C              - print out C code forms\n",

   137 " -md2/-md5/-sha1/-mdc2 - digest to use\n",

   138 " -extfile        - configuration file with X509V3 extensions to add\n",

   139 " -extensions     - section from config file with X509V3 extensions to add\n",

   140 " -clrext         - delete extensions before signing and input certificate\n",

   141 " -nameopt arg    - various certificate name options\n",

   142 #ifndef OPENSSL_NO_ENGINE

   143 " -engine e       - use engine e, possibly a hardware device.\n",

   144 #endif

   145 " -certopt arg    - various certificate text options\n",

   146 NULL

   147 };

   148 

   149 static int MS_CALLBACK callb(int ok, X509_STORE_CTX *ctx);

   150 static int sign (X509 *x, EVP_PKEY *pkey,int days,int clrext, const EVP_MD *digest,

   151 						CONF *conf, char *section);

   152 static int x509_certify (X509_STORE *ctx,char *CAfile,const EVP_MD *digest,

   153 			 X509 *x,X509 *xca,EVP_PKEY *pkey,char *serial,

   154 			 int create,int days, int clrext, CONF *conf, char *section,

   155 						ASN1_INTEGER *sno);

   156 static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);

   157 static int reqfile=0;

   158 

   159 

   160 int MAIN(int, char **);

   161 

   162 int MAIN(int argc, char **argv)

   163 	{

   164 	ENGINE *e = NULL;

   165 	int ret=1;

   166 	X509_REQ *req=NULL;

   167 	X509 *x=NULL,*xca=NULL;

   168 	ASN1_OBJECT *objtmp;

   169 	EVP_PKEY *Upkey=NULL,*CApkey=NULL;

   170 	ASN1_INTEGER *sno = NULL;

   171 	int i,num,badops=0;

   172 	BIO *out=NULL;

   173 	BIO *STDout=NULL;

   174 	STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;

   175 	int informat,outformat,keyformat,CAformat,CAkeyformat;

   176 	char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;

   177 	char *CAkeyfile=NULL,*CAserial=NULL;

   178 	char *alias=NULL;

   179 	int text=0,serial=0,subject=0,issuer=0,startdate=0,enddate=0;

   180 	int next_serial=0;

   181 	int subject_hash=0,issuer_hash=0,ocspid=0;

   182 	int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0;

   183 	int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;

   184 	int C=0;

   185 	int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;

   186 	int pprint = 0;

   187 	const char **pp;

   188 	X509_STORE *ctx=NULL;

   189 	X509_REQ *rq=NULL;

   190 	int fingerprint=0;

   191 	char buf[256];

   192 	const EVP_MD *md_alg,*digest=EVP_sha1();

   193 	CONF *extconf = NULL;

   194 	char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;

   195 	int need_rand = 0;

   196 	int checkend=0,checkoffset=0;

   197 	unsigned long nmflag = 0, certflag = 0;

   198 #ifndef OPENSSL_NO_ENGINE

   199 	char *engine=NULL;

   200 #endif

   201 

   202 	reqfile=0;

   203 

   204 	apps_startup();

   205 

   206 	if (bio_err == NULL)

   207 

   208 		bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);

   209 	if (!load_config(bio_err, NULL))

   210 		goto end;

   211 	STDout=BIO_new_fp(stdout,BIO_NOCLOSE);

   212 #ifdef OPENSSL_SYS_VMS

   213 	{

   214 	BIO *tmpbio = BIO_new(BIO_f_linebuffer());

   215 	STDout = BIO_push(tmpbio, STDout);

   216 	}

   217 #endif

   218 

   219 	informat=FORMAT_PEM;

   220 	outformat=FORMAT_PEM;

   221 	keyformat=FORMAT_PEM;

   222 	CAformat=FORMAT_PEM;

   223 	CAkeyformat=FORMAT_PEM;

   224 

   225 	ctx=X509_STORE_new();

   226 	if (ctx == NULL) goto end;

   227 	X509_STORE_set_verify_cb_func(ctx,callb);

   228 

   229 	argc--;

   230 	argv++;

   231 	num=0;

   232 	while (argc >= 1)

   233 		{

   234 		if 	(strcmp(*argv,"-inform") == 0)

   235 			{

   236 			if (--argc < 1) goto bad;

   237 			informat=str2fmt(*(++argv));

   238 			}

   239 		else if (strcmp(*argv,"-outform") == 0)

   240 			{

   241 			if (--argc < 1) goto bad;

   242 			outformat=str2fmt(*(++argv));

   243 			}

   244 		else if (strcmp(*argv,"-keyform") == 0)

   245 			{

   246 			if (--argc < 1) goto bad;

   247 			keyformat=str2fmt(*(++argv));

   248 			}

   249 		else if (strcmp(*argv,"-req") == 0)

   250 			{

   251 			reqfile=1;

   252 			need_rand = 1;

   253 			}

   254 		else if (strcmp(*argv,"-CAform") == 0)

   255 			{

   256 			if (--argc < 1) goto bad;

   257 			CAformat=str2fmt(*(++argv));

   258 			}

   259 		else if (strcmp(*argv,"-CAkeyform") == 0)

   260 			{

   261 			if (--argc < 1) goto bad;

   262 			CAkeyformat=str2fmt(*(++argv));

   263 			}

   264 		else if (strcmp(*argv,"-days") == 0)

   265 			{

   266 			if (--argc < 1) goto bad;

   267 			days=atoi(*(++argv));

   268 			if (days == 0)

   269 				{

   270 				BIO_printf(STDout,"bad number of days\n");

   271 				goto bad;

   272 				}

   273 			}

   274 		else if (strcmp(*argv,"-passin") == 0)

   275 			{

   276 			if (--argc < 1) goto bad;

   277 			passargin= *(++argv);

   278 			}

   279 		else if (strcmp(*argv,"-extfile") == 0)

   280 			{

   281 			if (--argc < 1) goto bad;

   282 			extfile= *(++argv);

   283 			}

   284 		else if (strcmp(*argv,"-extensions") == 0)

   285 			{

   286 			if (--argc < 1) goto bad;

   287 			extsect= *(++argv);

   288 			}

   289 		else if (strcmp(*argv,"-in") == 0)

   290 			{

   291 			if (--argc < 1) goto bad;

   292 			infile= *(++argv);

   293 			}

   294 		else if (strcmp(*argv,"-out") == 0)

   295 			{

   296 			if (--argc < 1) goto bad;

   297 			outfile= *(++argv);

   298 			}

   299 		else if (strcmp(*argv,"-signkey") == 0)

   300 			{

   301 			if (--argc < 1) goto bad;

   302 			keyfile= *(++argv);

   303 			sign_flag= ++num;

   304 			need_rand = 1;

   305 			}

   306 		else if (strcmp(*argv,"-CA") == 0)

   307 			{

   308 			if (--argc < 1) goto bad;

   309 			CAfile= *(++argv);

   310 			CA_flag= ++num;

   311 			need_rand = 1;

   312 			}

   313 		else if (strcmp(*argv,"-CAkey") == 0)

   314 			{

   315 			if (--argc < 1) goto bad;

   316 			CAkeyfile= *(++argv);

   317 			}

   318 		else if (strcmp(*argv,"-CAserial") == 0)

   319 			{

   320 			if (--argc < 1) goto bad;

   321 			CAserial= *(++argv);

   322 			}

   323 		else if (strcmp(*argv,"-set_serial") == 0)

   324 			{

   325 			if (--argc < 1) goto bad;

   326 			if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv))))

   327 				goto bad;

   328 			}

   329 		else if (strcmp(*argv,"-addtrust") == 0)

   330 			{

   331 			if (--argc < 1) goto bad;

   332 			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))

   333 				{

   334 				BIO_printf(bio_err,

   335 					"Invalid trust object value %s\n", *argv);

   336 				goto bad;

   337 				}

   338 			if (!trust) trust = sk_ASN1_OBJECT_new_null();

   339 			sk_ASN1_OBJECT_push(trust, objtmp);

   340 			trustout = 1;

   341 			}

   342 		else if (strcmp(*argv,"-addreject") == 0)

   343 			{

   344 			if (--argc < 1) goto bad;

   345 			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))

   346 				{

   347 				BIO_printf(bio_err,

   348 					"Invalid reject object value %s\n", *argv);

   349 				goto bad;

   350 				}

   351 			if (!reject) reject = sk_ASN1_OBJECT_new_null();

   352 			sk_ASN1_OBJECT_push(reject, objtmp);

   353 			trustout = 1;

   354 			}

   355 		else if (strcmp(*argv,"-setalias") == 0)

   356 			{

   357 			if (--argc < 1) goto bad;

   358 			alias= *(++argv);

   359 			trustout = 1;

   360 			}

   361 		else if (strcmp(*argv,"-certopt") == 0)

   362 			{

   363 			if (--argc < 1) goto bad;

   364 			if (!set_cert_ex(&certflag, *(++argv))) goto bad;

   365 			}

   366 		else if (strcmp(*argv,"-nameopt") == 0)

   367 			{

   368 			if (--argc < 1) goto bad;

   369 			if (!set_name_ex(&nmflag, *(++argv))) goto bad;

   370 			}

   371 #ifndef OPENSSL_NO_ENGINE

   372 		else if (strcmp(*argv,"-engine") == 0)

   373 			{

   374 			if (--argc < 1) goto bad;

   375 			engine= *(++argv);

   376 			}

   377 #endif

   378 		else if (strcmp(*argv,"-C") == 0)

   379 			C= ++num;

   380 		else if (strcmp(*argv,"-email") == 0)

   381 			email= ++num;

   382 		else if (strcmp(*argv,"-serial") == 0)

   383 			serial= ++num;

   384 		else if (strcmp(*argv,"-next_serial") == 0)

   385 			next_serial= ++num;

   386 		else if (strcmp(*argv,"-modulus") == 0)

   387 			modulus= ++num;

   388 		else if (strcmp(*argv,"-pubkey") == 0)

   389 			pubkey= ++num;

   390 		else if (strcmp(*argv,"-x509toreq") == 0)

   391 			x509req= ++num;

   392 		else if (strcmp(*argv,"-text") == 0)

   393 			text= ++num;

   394 		else if (strcmp(*argv,"-hash") == 0

   395 			|| strcmp(*argv,"-subject_hash") == 0)

   396 			subject_hash= ++num;

   397 		else if (strcmp(*argv,"-issuer_hash") == 0)

   398 			issuer_hash= ++num;

   399 		else if (strcmp(*argv,"-subject") == 0)

   400 			subject= ++num;

   401 		else if (strcmp(*argv,"-issuer") == 0)

   402 			issuer= ++num;

   403 		else if (strcmp(*argv,"-fingerprint") == 0)

   404 			fingerprint= ++num;

   405 		else if (strcmp(*argv,"-dates") == 0)

   406 			{

   407 			startdate= ++num;

   408 			enddate= ++num;

   409 			}

   410 		else if (strcmp(*argv,"-purpose") == 0)

   411 			pprint= ++num;

   412 		else if (strcmp(*argv,"-startdate") == 0)

   413 			startdate= ++num;

   414 		else if (strcmp(*argv,"-enddate") == 0)

   415 			enddate= ++num;

   416 		else if (strcmp(*argv,"-checkend") == 0)

   417 			{

   418 			if (--argc < 1) goto bad;

   419 			checkoffset=atoi(*(++argv));

   420 			checkend=1;

   421 			}

   422 		else if (strcmp(*argv,"-noout") == 0)

   423 			noout= ++num;

   424 		else if (strcmp(*argv,"-trustout") == 0)

   425 			trustout= 1;

   426 		else if (strcmp(*argv,"-clrtrust") == 0)

   427 			clrtrust= ++num;

   428 		else if (strcmp(*argv,"-clrreject") == 0)

   429 			clrreject= ++num;

   430 		else if (strcmp(*argv,"-alias") == 0)

   431 			aliasout= ++num;

   432 		else if (strcmp(*argv,"-CAcreateserial") == 0)

   433 			CA_createserial= ++num;

   434 		else if (strcmp(*argv,"-clrext") == 0)

   435 			clrext = 1;

   436 #if 1 /* stay backwards-compatible with 0.9.5; this should go away soon */

   437 		else if (strcmp(*argv,"-crlext") == 0)

   438 			{

   439 			BIO_printf(bio_err,"use -clrext instead of -crlext\n");

   440 			clrext = 1;

   441 			}

   442 #endif

   443 		else if (strcmp(*argv,"-ocspid") == 0)

   444 			ocspid= ++num;

   445 		else if ((md_alg=EVP_get_digestbyname(*argv + 1)))

   446 			{

   447 			/* ok */

   448 			digest=md_alg;

   449 			}

   450 		else

   451 			{

   452 			BIO_printf(bio_err,"unknown option %s\n",*argv);

   453 			badops=1;

   454 			break;

   455 			}

   456 		argc--;

   457 		argv++;

   458 		}

   459 

   460 	if (badops)

   461 		{

   462 bad:

   463 		for (pp=x509_usage; (*pp != NULL); pp++)

   464 			BIO_printf(bio_err,"%s",*pp);

   465 		goto end;

   466 		}

   467 

   468 #ifndef OPENSSL_NO_ENGINE

   469         e = setup_engine(bio_err, engine, 0);

   470 #endif

   471 

   472 	if (need_rand)

   473 		app_RAND_load_file(NULL, bio_err, 0);

   474 

   475 	ERR_load_crypto_strings();

   476 

   477 	if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))

   478 		{

   479 		BIO_printf(bio_err, "Error getting password\n");

   480 		goto end;

   481 		}

   482 

   483 	if (!X509_STORE_set_default_paths(ctx))

   484 		{

   485 		ERR_print_errors(bio_err);

   486 		goto end;

   487 		}

   488 

   489 	if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM))

   490 		{ CAkeyfile=CAfile; }

   491 	else if ((CA_flag) && (CAkeyfile == NULL))

   492 		{

   493 		BIO_printf(bio_err,"need to specify a CAkey if using the CA command\n");

   494 		goto end;

   495 		}

   496 

   497 	if (extfile)

   498 		{

   499 		long errorline = -1;

   500 		X509V3_CTX ctx2;

   501 		extconf = NCONF_new(NULL);

   502 		if (!NCONF_load(extconf, extfile,&errorline))

   503 			{

   504 			if (errorline <= 0)

   505 				BIO_printf(bio_err,

   506 					"error loading the config file '%s'\n",

   507 								extfile);

   508                 	else

   509                         	BIO_printf(bio_err,

   510 				       "error on line %ld of config file '%s'\n"

   511 							,errorline,extfile);

   512 			goto end;

   513 			}

   514 		if (!extsect)

   515 			{

   516 			extsect = NCONF_get_string(extconf, "default", "extensions");

   517 			if (!extsect)

   518 				{

   519 				ERR_clear_error();

   520 				extsect = "default";

   521 				}

   522 			}

   523 		X509V3_set_ctx_test(&ctx2);

   524 		X509V3_set_nconf(&ctx2, extconf);

   525 		if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))

   526 			{

   527 			BIO_printf(bio_err,

   528 				"Error Loading extension section %s\n",

   529 								 extsect);

   530 			ERR_print_errors(bio_err);

   531 			goto end;

   532 			}

   533 		}

   534 

   535 

   536 	if (reqfile)

   537 		{

   538 		EVP_PKEY *pkey;

   539 		X509_CINF *ci;

   540 		BIO *in;

   541 

   542 		if (!sign_flag && !CA_flag)

   543 			{

   544 			BIO_printf(bio_err,"We need a private key to sign with\n");

   545 			goto end;

   546 			}

   547 		in=BIO_new(BIO_s_file());

   548 		if (in == NULL)

   549 			{

   550 			ERR_print_errors(bio_err);

   551 			goto end;

   552 			}

   553 

   554 		if (infile == NULL)

   555 			BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);

   556 		else

   557 			{

   558 			if (BIO_read_filename(in,infile) <= 0)

   559 				{

   560 				perror(infile);

   561 				BIO_free(in);

   562 				goto end;

   563 				}

   564 			}

   565 		req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);

   566 		BIO_free(in);

   567 

   568 		if (req == NULL)

   569 			{

   570 			ERR_print_errors(bio_err);

   571 			goto end;

   572 			}

   573 

   574 		if (	(req->req_info == NULL) ||

   575 			(req->req_info->pubkey == NULL) ||

   576 			(req->req_info->pubkey->public_key == NULL) ||

   577 			(req->req_info->pubkey->public_key->data == NULL))

   578 			{

   579 			BIO_printf(bio_err,"The certificate request appears to corrupted\n");

   580 			BIO_printf(bio_err,"It does not contain a public key\n");

   581 			goto end;

   582 			}

   583 		if ((pkey=X509_REQ_get_pubkey(req)) == NULL)

   584 	                {

   585 	                BIO_printf(bio_err,"error unpacking public key\n");

   586 	                goto end;

   587 	                }

   588 		i=X509_REQ_verify(req,pkey);

   589 		EVP_PKEY_free(pkey);

   590 		if (i < 0)

   591 			{

   592 			BIO_printf(bio_err,"Signature verification error\n");

   593 			ERR_print_errors(bio_err);

   594 			goto end;

   595 			}

   596 	        if (i == 0)

   597 			{

   598 			BIO_printf(bio_err,"Signature did not match the certificate request\n");

   599 			goto end;

   600 			}

   601 		else

   602 			BIO_printf(bio_err,"Signature ok\n");

   603 

   604 		print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag);

   605 

   606 		if ((x=X509_new()) == NULL) goto end;

   607 		ci=x->cert_info;

   608 

   609 		if (sno == NULL)

   610 			{

   611 			sno = ASN1_INTEGER_new();

   612 			if (!sno || !rand_serial(NULL, sno))

   613 				goto end;

   614 			if (!X509_set_serialNumber(x, sno)) 

   615 				goto end;

   616 			ASN1_INTEGER_free(sno);

   617 			sno = NULL;

   618 			}

   619 		else if (!X509_set_serialNumber(x, sno)) 

   620 			goto end;

   621 

   622 		if (!X509_set_issuer_name(x,req->req_info->subject)) goto end;

   623 		if (!X509_set_subject_name(x,req->req_info->subject)) goto end;

   624 

   625 		X509_gmtime_adj(X509_get_notBefore(x),0);

   626 	        X509_gmtime_adj(X509_get_notAfter(x),(long)60*60*24*days);

   627 

   628 		pkey = X509_REQ_get_pubkey(req);

   629 		X509_set_pubkey(x,pkey);

   630 		EVP_PKEY_free(pkey);

   631 		}

   632 	else

   633 		x=load_cert(bio_err,infile,informat,NULL,e,"Certificate");

   634 

   635 	if (x == NULL) goto end;

   636 	if (CA_flag)

   637 		{

   638 		xca=load_cert(bio_err,CAfile,CAformat,NULL,e,"CA Certificate");

   639 		if (xca == NULL) goto end;

   640 		}

   641 

   642 	if (!noout || text || next_serial)

   643 		{

   644 		OBJ_create("2.99999.3",

   645 			"SET.ex3","SET x509v3 extension 3");

   646 

   647 		out=BIO_new(BIO_s_file());

   648 		if (out == NULL)

   649 			{

   650 			ERR_print_errors(bio_err);

   651 			goto end;

   652 			}

   653 		if (outfile == NULL)

   654 			{

   655 			BIO_set_fp(out,stdout,BIO_NOCLOSE);

   656 #ifdef OPENSSL_SYS_VMS

   657 			{

   658 			BIO *tmpbio = BIO_new(BIO_f_linebuffer());

   659 			out = BIO_push(tmpbio, out);

   660 			}

   661 #endif

   662 			}

   663 		else

   664 			{

   665 			if (BIO_write_filename(out,outfile) <= 0)

   666 				{

   667 				perror(outfile);

   668 				goto end;

   669 				}

   670 			}

   671 		}

   672 

   673 	if (alias) X509_alias_set1(x, (unsigned char *)alias, -1);

   674 

   675 	if (clrtrust) X509_trust_clear(x);

   676 	if (clrreject) X509_reject_clear(x);

   677 

   678 	if (trust)

   679 		{

   680 		for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++)

   681 			{

   682 			objtmp = sk_ASN1_OBJECT_value(trust, i);

   683 			X509_add1_trust_object(x, objtmp);

   684 			}

   685 		}

   686 

   687 	if (reject)

   688 		{

   689 		for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++)

   690 			{

   691 			objtmp = sk_ASN1_OBJECT_value(reject, i);

   692 			X509_add1_reject_object(x, objtmp);

   693 			}

   694 		}

   695 

   696 	if (num)

   697 		{

   698 		for (i=1; i<=num; i++)

   699 			{

   700 			if (issuer == i)

   701 				{

   702 				print_name(STDout, "issuer= ",

   703 					X509_get_issuer_name(x), nmflag);

   704 				}

   705 			else if (subject == i) 

   706 				{

   707 				print_name(STDout, "subject= ",

   708 					X509_get_subject_name(x), nmflag);

   709 				}

   710 			else if (serial == i)

   711 				{

   712 				BIO_printf(STDout,"serial=");

   713 				i2a_ASN1_INTEGER(STDout,

   714 					X509_get_serialNumber(x));

   715 				BIO_printf(STDout,"\n");

   716 				}

   717 			else if (next_serial == i)

   718 				{

   719 				BIGNUM *bnser;

   720 				ASN1_INTEGER *ser;

   721 				ser = X509_get_serialNumber(x);

   722 				bnser = ASN1_INTEGER_to_BN(ser, NULL);

   723 				if (!bnser)

   724 					goto end;

   725 				if (!BN_add_word(bnser, 1))

   726 					goto end;

   727 				ser = BN_to_ASN1_INTEGER(bnser, NULL);

   728 				if (!ser)

   729 					goto end;

   730 				BN_free(bnser);

   731 				i2a_ASN1_INTEGER(out, ser);

   732 				ASN1_INTEGER_free(ser);

   733 				BIO_puts(out, "\n");

   734 				}

   735 			else if (email == i) 

   736 				{

   737 				int j;

   738 				STACK *emlst;

   739 				emlst = X509_get1_email(x);

   740 				for (j = 0; j < sk_num(emlst); j++)

   741 					BIO_printf(STDout, "%s\n", sk_value(emlst, j));

   742 				X509_email_free(emlst);

   743 				}

   744 			else if (aliasout == i)

   745 				{

   746 				unsigned char *alstr;

   747 				alstr = X509_alias_get0(x, NULL);

   748 				if (alstr) BIO_printf(STDout,"%s\n", alstr);

   749 				else BIO_puts(STDout,"<No Alias>\n");

   750 				}

   751 			else if (subject_hash == i)

   752 				{

   753 				BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));

   754 				}

   755 			else if (issuer_hash == i)

   756 				{

   757 				BIO_printf(STDout,"%08lx\n",X509_issuer_name_hash(x));

   758 				}

   759 			else if (pprint == i)

   760 				{

   761 				X509_PURPOSE *ptmp;

   762 				int j;

   763 				BIO_printf(STDout, "Certificate purposes:\n");

   764 				for (j = 0; j < X509_PURPOSE_get_count(); j++)

   765 					{

   766 					ptmp = X509_PURPOSE_get0(j);

   767 					purpose_print(STDout, x, ptmp);

   768 					}

   769 				}

   770 			else

   771 				if (modulus == i)

   772 				{

   773 				EVP_PKEY *pkey;

   774 

   775 				pkey=X509_get_pubkey(x);

   776 				if (pkey == NULL)

   777 					{

   778 					BIO_printf(bio_err,"Modulus=unavailable\n");

   779 					ERR_print_errors(bio_err);

   780 					goto end;

   781 					}

   782 				BIO_printf(STDout,"Modulus=");

   783 #ifndef OPENSSL_NO_RSA

   784 				if (pkey->type == EVP_PKEY_RSA)

   785 					BN_print(STDout,pkey->pkey.rsa->n);

   786 				else

   787 #endif

   788 #ifndef OPENSSL_NO_DSA

   789 				if (pkey->type == EVP_PKEY_DSA)

   790 					BN_print(STDout,pkey->pkey.dsa->pub_key);

   791 				else

   792 #endif

   793 					BIO_printf(STDout,"Wrong Algorithm type");

   794 				BIO_printf(STDout,"\n");

   795 				EVP_PKEY_free(pkey);

   796 				}

   797 			else

   798 				if (pubkey == i)

   799 				{

   800 				EVP_PKEY *pkey;

   801 

   802 				pkey=X509_get_pubkey(x);

   803 				if (pkey == NULL)

   804 					{

   805 					BIO_printf(bio_err,"Error getting public key\n");

   806 					ERR_print_errors(bio_err);

   807 					goto end;

   808 					}

   809 				PEM_write_bio_PUBKEY(STDout, pkey);

   810 				EVP_PKEY_free(pkey);

   811 				}

   812 			else

   813 				if (C == i)

   814 				{

   815 				unsigned char *d;

   816 				char *m;

   817 				int y,z;

   818 

   819 				X509_NAME_oneline(X509_get_subject_name(x),

   820 					buf,sizeof buf);

   821 				BIO_printf(STDout,"/* subject:%s */\n",buf);

   822 				m=X509_NAME_oneline(

   823 					X509_get_issuer_name(x),buf,

   824 					sizeof buf);

   825 				BIO_printf(STDout,"/* issuer :%s */\n",buf);

   826 

   827 				z=i2d_X509(x,NULL);

   828 				m=OPENSSL_malloc(z);

   829 

   830 				d=(unsigned char *)m;

   831 				z=i2d_X509_NAME(X509_get_subject_name(x),&d);

   832 				BIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\n",z);

   833 				d=(unsigned char *)m;

   834 				for (y=0; y<z; y++)

   835 					{

   836 					BIO_printf(STDout,"0x%02X,",d[y]);

   837 					if ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\n");

   838 					}

   839 				if (y%16 != 0) BIO_printf(STDout,"\n");

   840 				BIO_printf(STDout,"};\n");

   841 

   842 				z=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d);

   843 				BIO_printf(STDout,"unsigned char XXX_public_key[%d]={\n",z);

   844 				d=(unsigned char *)m;

   845 				for (y=0; y<z; y++)

   846 					{

   847 					BIO_printf(STDout,"0x%02X,",d[y]);

   848 					if ((y & 0x0f) == 0x0f)

   849 						BIO_printf(STDout,"\n");

   850 					}

   851 				if (y%16 != 0) BIO_printf(STDout,"\n");

   852 				BIO_printf(STDout,"};\n");

   853 

   854 				z=i2d_X509(x,&d);

   855 				BIO_printf(STDout,"unsigned char XXX_certificate[%d]={\n",z);

   856 				d=(unsigned char *)m;

   857 				for (y=0; y<z; y++)

   858 					{

   859 					BIO_printf(STDout,"0x%02X,",d[y]);

   860 					if ((y & 0x0f) == 0x0f)

   861 						BIO_printf(STDout,"\n");

   862 					}

   863 				if (y%16 != 0) BIO_printf(STDout,"\n");

   864 				BIO_printf(STDout,"};\n");

   865 

   866 				OPENSSL_free(m);

   867 				}

   868 			else if (text == i)

   869 				{

   870 				X509_print_ex(out,x,nmflag, certflag);

   871 				}

   872 			else if (startdate == i)

   873 				{

   874 				BIO_puts(STDout,"notBefore=");

   875 				ASN1_TIME_print(STDout,X509_get_notBefore(x));

   876 				BIO_puts(STDout,"\n");

   877 				}

   878 			else if (enddate == i)

   879 				{

   880 				BIO_puts(STDout,"notAfter=");

   881 				ASN1_TIME_print(STDout,X509_get_notAfter(x));

   882 				BIO_puts(STDout,"\n");

   883 				}

   884 			else if (fingerprint == i)

   885 				{

   886 				int j;

   887 				unsigned int n;

   888 				unsigned char md[EVP_MAX_MD_SIZE];

   889 

   890 				if (!X509_digest(x,digest,md,&n))

   891 					{

   892 					BIO_printf(bio_err,"out of memory\n");

   893 					goto end;

   894 					}

   895 				BIO_printf(STDout,"%s Fingerprint=",

   896 						OBJ_nid2sn(EVP_MD_type(digest)));

   897 				for (j=0; j<(int)n; j++)

   898 					{

   899 					BIO_printf(STDout,"%02X%c",md[j],

   900 						(j+1 == (int)n)

   901 						?'\n':':');

   902 					}

   903 				}

   904 

   905 			/* should be in the library */

   906 			else if ((sign_flag == i) && (x509req == 0))

   907 				{

   908 				BIO_printf(bio_err,"Getting Private key\n");

   909 				if (Upkey == NULL)

   910 					{

   911 					Upkey=load_key(bio_err,

   912 						keyfile, keyformat, 0,

   913 						passin, e, "Private key");

   914 					if (Upkey == NULL) goto end;

   915 					}

   916 #ifndef OPENSSL_NO_DSA

   917 		                if (Upkey->type == EVP_PKEY_DSA)

   918 		                        digest=EVP_dss1();

   919 #endif

   920 #ifndef OPENSSL_NO_ECDSA

   921 				if (Upkey->type == EVP_PKEY_EC)

   922 					digest=EVP_ecdsa();

   923 #endif

   924 

   925 				assert(need_rand);

   926 				if (!sign(x,Upkey,days,clrext,digest,

   927 						 extconf, extsect)) goto end;

   928 				}

   929 			else if (CA_flag == i)

   930 				{

   931 				BIO_printf(bio_err,"Getting CA Private Key\n");

   932 				if (CAkeyfile != NULL)

   933 					{

   934 					CApkey=load_key(bio_err,

   935 						CAkeyfile, CAkeyformat,

   936 						0, passin, e,

   937 						"CA Private Key");

   938 					if (CApkey == NULL) goto end;

   939 					}

   940 #ifndef OPENSSL_NO_DSA

   941 		                if (CApkey->type == EVP_PKEY_DSA)

   942 		                        digest=EVP_dss1();

   943 #endif

   944 #ifndef OPENSSL_NO_ECDSA

   945 				if (CApkey->type == EVP_PKEY_EC)

   946 					digest = EVP_ecdsa();

   947 #endif

   948 				

   949 				assert(need_rand);

   950 				if (!x509_certify(ctx,CAfile,digest,x,xca,

   951 					CApkey, CAserial,CA_createserial,days, clrext,

   952 					extconf, extsect, sno))

   953 					goto end;

   954 				}

   955 			else if (x509req == i)

   956 				{

   957 				EVP_PKEY *pk;

   958 

   959 				BIO_printf(bio_err,"Getting request Private Key\n");

   960 				if (keyfile == NULL)

   961 					{

   962 					BIO_printf(bio_err,"no request key file specified\n");

   963 					goto end;

   964 					}

   965 				else

   966 					{

   967 					pk=load_key(bio_err,

   968 						keyfile, FORMAT_PEM, 0,

   969 						passin, e, "request key");

   970 					if (pk == NULL) goto end;

   971 					}

   972 

   973 				BIO_printf(bio_err,"Generating certificate request\n");

   974 

   975 #ifndef OPENSSL_NO_DSA

   976 		                if (pk->type == EVP_PKEY_DSA)

   977 		                        digest=EVP_dss1();

   978 #endif

   979 #ifndef OPENSSL_NO_ECDSA

   980 				if (pk->type == EVP_PKEY_EC)

   981 					digest=EVP_ecdsa();

   982 #endif

   983 

   984 				rq=X509_to_X509_REQ(x,pk,digest);

   985 				EVP_PKEY_free(pk);

   986 				if (rq == NULL)

   987 					{

   988 					ERR_print_errors(bio_err);

   989 					goto end;

   990 					}

   991 				if (!noout)

   992 					{

   993 					X509_REQ_print(out,rq);

   994 					PEM_write_bio_X509_REQ(out,rq);

   995 					}

   996 				noout=1;

   997 				}

   998 			else if (ocspid == i)

   999 				{

  1000 				X509_ocspid_print(out, x);

  1001 				}

  1002 			}

  1003 		}

  1004 

  1005 	if (checkend)

  1006 		{

  1007 		time_t tcheck=time(NULL) + checkoffset;

  1008 

  1009 		if (X509_cmp_time(X509_get_notAfter(x), &tcheck) < 0)

  1010 			{

  1011 			BIO_printf(out,"Certificate will expire\n");

  1012 			ret=1;

  1013 			}

  1014 		else

  1015 			{

  1016 			BIO_printf(out,"Certificate will not expire\n");

  1017 			ret=0;

  1018 			}

  1019 		goto end;

  1020 		}

  1021 

  1022 	if (noout)

  1023 		{

  1024 		ret=0;

  1025 		goto end;

  1026 		}

  1027 

  1028 	if 	(outformat == FORMAT_ASN1)

  1029 		i=i2d_X509_bio(out,x);

  1030 	else if (outformat == FORMAT_PEM)

  1031 		{

  1032 		if (trustout) i=PEM_write_bio_X509_AUX(out,x);

  1033 		else i=PEM_write_bio_X509(out,x);

  1034 		}

  1035 	else if (outformat == FORMAT_NETSCAPE)

  1036 		{

  1037 		ASN1_HEADER ah;

  1038 		ASN1_OCTET_STRING os;

  1039 

  1040 		os.data=(unsigned char *)NETSCAPE_CERT_HDR;

  1041 		os.length=strlen(NETSCAPE_CERT_HDR);

  1042 		ah.header= &os;

  1043 		ah.data=(char *)x;

  1044 		ah.meth=X509_asn1_meth();

  1045 

  1046 		i=ASN1_i2d_bio_of(ASN1_HEADER,i2d_ASN1_HEADER,out,&ah);

  1047 		}

  1048 	else	{

  1049 		BIO_printf(bio_err,"bad output format specified for outfile\n");

  1050 		goto end;

  1051 		}

  1052 	if (!i)

  1053 		{

  1054 		BIO_printf(bio_err,"unable to write certificate\n");

  1055 		ERR_print_errors(bio_err);

  1056 		goto end;

  1057 		}

  1058 	ret=0;

  1059 end:

  1060 	if (need_rand)

  1061 		app_RAND_write_file(NULL, bio_err);

  1062 	OBJ_cleanup();

  1063 	NCONF_free(extconf);

  1064 	BIO_free_all(out);

  1065 	BIO_free_all(STDout);

  1066 	X509_STORE_free(ctx);

  1067 	X509_REQ_free(req);

  1068 	X509_free(x);

  1069 	X509_free(xca);

  1070 	EVP_PKEY_free(Upkey);

  1071 	EVP_PKEY_free(CApkey);

  1072 	X509_REQ_free(rq);

  1073 	ASN1_INTEGER_free(sno);

  1074 	sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);

  1075 	sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);

  1076 	if (passin) OPENSSL_free(passin);

  1077 	apps_shutdown();

  1078 	OPENSSL_EXIT(ret);

  1079 	}

  1080 

  1081 static ASN1_INTEGER *x509_load_serial(char *CAfile, char *serialfile, int create)

  1082 	{

  1083 	char *buf = NULL, *p;

  1084 	ASN1_INTEGER *bs = NULL;

  1085 	BIGNUM *serial = NULL;

  1086 	size_t len;

  1087 

  1088 	len = ((serialfile == NULL)

  1089 		?(strlen(CAfile)+strlen(POSTFIX)+1)

  1090 		:(strlen(serialfile)))+1;

  1091 	buf=OPENSSL_malloc(len);

  1092 	if (buf == NULL) { BIO_printf(bio_err,"out of mem\n"); goto end; }

  1093 	if (serialfile == NULL)

  1094 		{

  1095 		BUF_strlcpy(buf,CAfile,len);

  1096 		for (p=buf; *p; p++)

  1097 			if (*p == '.')

  1098 				{

  1099 				*p='\0';

  1100 				break;

  1101 				}

  1102 		BUF_strlcat(buf,POSTFIX,len);

  1103 		}

  1104 	else

  1105 		BUF_strlcpy(buf,serialfile,len);

  1106 

  1107 	serial = load_serial(buf, create, NULL);

  1108 	if (serial == NULL) goto end;

  1109 

  1110 	if (!BN_add_word(serial,1))

  1111 		{ BIO_printf(bio_err,"add_word failure\n"); goto end; }

  1112 

  1113 	if (!save_serial(buf, NULL, serial, &bs)) goto end;

  1114 

  1115  end:

  1116 	if (buf) OPENSSL_free(buf);

  1117 	BN_free(serial);

  1118 	return bs;

  1119 	}

  1120 

  1121 static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,

  1122 	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,

  1123 	     int days, int clrext, CONF *conf, char *section, ASN1_INTEGER *sno)

  1124 	{

  1125 	int ret=0;

  1126 	ASN1_INTEGER *bs=NULL;

  1127 	X509_STORE_CTX xsc;

  1128 	EVP_PKEY *upkey;

  1129 

  1130 	upkey = X509_get_pubkey(xca);

  1131 	EVP_PKEY_copy_parameters(upkey,pkey);

  1132 	EVP_PKEY_free(upkey);

  1133 

  1134 	if(!X509_STORE_CTX_init(&xsc,ctx,x,NULL))

  1135 		{