Main Page | Class List | Directories | File List | Class Members | File Members
apps

ca.c File Reference

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <openssl/conf.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/bn.h>
#include <openssl/txt_db.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/objects.h>
#include <openssl/ocsp.h>
#include <openssl/pem.h>
#include <sys/file.h>
#include "apps.h"

Go to the source code of this file.

Defines

#define F_OK   0
#define X_OK   1
#define W_OK   2
#define R_OK   4
#define PROG   ca_main
#define BASE_SECTION   "ca"
#define CONFIG_FILE   "openssl.cnf"
#define ENV_DEFAULT_CA   "default_ca"
#define STRING_MASK   "string_mask"
#define UTF8_IN   "utf8"
#define ENV_DIR   "dir"
#define ENV_CERTS   "certs"
#define ENV_CRL_DIR   "crl_dir"
#define ENV_CA_DB   "CA_DB"
#define ENV_NEW_CERTS_DIR   "new_certs_dir"
#define ENV_CERTIFICATE   "certificate"
#define ENV_SERIAL   "serial"
#define ENV_CRLNUMBER   "crlnumber"
#define ENV_CRL   "crl"
#define ENV_PRIVATE_KEY   "private_key"
#define ENV_RANDFILE   "RANDFILE"
#define ENV_DEFAULT_DAYS   "default_days"
#define ENV_DEFAULT_STARTDATE   "default_startdate"
#define ENV_DEFAULT_ENDDATE   "default_enddate"
#define ENV_DEFAULT_CRL_DAYS   "default_crl_days"
#define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
#define ENV_DEFAULT_MD   "default_md"
#define ENV_DEFAULT_EMAIL_DN   "email_in_dn"
#define ENV_PRESERVE   "preserve"
#define ENV_POLICY   "policy"
#define ENV_EXTENSIONS   "x509_extensions"
#define ENV_CRLEXT   "crl_extensions"
#define ENV_MSIE_HACK   "msie_hack"
#define ENV_NAMEOPT   "name_opt"
#define ENV_CERTOPT   "cert_opt"
#define ENV_EXTCOPY   "copy_extensions"
#define ENV_UNIQUE_SUBJECT   "unique_subject"
#define ENV_DATABASE   "database"
#define REV_NONE   0
#define REV_CRL_REASON   1
#define REV_HOLD   2
#define REV_KEY_COMPROMISE   3
#define REV_CA_COMPROMISE   4
#define BSIZE   256
#define NUM_REASONS   (sizeof(crl_reasons) / sizeof(char *))

Functions

static void lookup_fail (const char *name, const char *tag)
static int certify (X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(CONF_VALUE)*policy, CA_DB *db, BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate, long days, int batch, char *ext_sect, CONF *conf, int verbose, unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy, int selfsign)
static int certify_cert (X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(CONF_VALUE)*policy, CA_DB *db, BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate, long days, int batch, char *ext_sect, CONF *conf, int verbose, unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy, ENGINE *e)
static int certify_spkac (X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(CONF_VALUE)*policy, CA_DB *db, BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate, long days, char *ext_sect, CONF *conf, int verbose, unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy)
static int fix_data (int nid, int *type)
static void write_new_certificate (BIO *bp, X509 *x, int output_der, int notext)
static int do_body (X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst, STACK_OF(CONF_VALUE)*policy, CA_DB *db, BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate, long days, int batch, int verbose, X509_REQ *req, char *ext_sect, CONF *conf, unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy, int selfsign)
static int do_revoke (X509 *x509, CA_DB *db, int ext, char *extval)
static int get_certificate_status (const char *ser_status, CA_DB *db)
static int do_updatedb (CA_DB *db)
static int check_time_format (char *str)
char * make_revocation_str (int rev_type, char *rev_arg)
int make_revoked (X509_REVOKED *rev, const char *str)
int old_entry_print (BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
int MAIN (int, char **)
int unpack_revinfo (ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)

Variables

static const char * ca_usage []
static CONF * conf = NULL
static CONF * extconf = NULL
static char * section = NULL
static int preserve = 0
static int msie_hack = 0
static const char * crl_reasons []

Define Documentation

#define BASE_SECTION   "ca"
 

Definition at line 103 of file ca.c.

#define BSIZE   256
 

#define CONFIG_FILE   "openssl.cnf"
 

Definition at line 104 of file ca.c.

#define ENV_CA_DB   "CA_DB"
 

Definition at line 114 of file ca.c.

#define ENV_CERTIFICATE   "certificate"
 

Definition at line 116 of file ca.c.

#define ENV_CERTOPT   "cert_opt"
 

Definition at line 135 of file ca.c.

#define ENV_CERTS   "certs"
 

Definition at line 112 of file ca.c.

#define ENV_CRL   "crl"
 

Definition at line 119 of file ca.c.

#define ENV_CRL_DIR   "crl_dir"
 

Definition at line 113 of file ca.c.

#define ENV_CRLEXT   "crl_extensions"
 

Definition at line 132 of file ca.c.

#define ENV_CRLNUMBER   "crlnumber"
 

Definition at line 118 of file ca.c.

#define ENV_DATABASE   "database"
 

Definition at line 139 of file ca.c.

#define ENV_DEFAULT_CA   "default_ca"
 

Definition at line 106 of file ca.c.

#define ENV_DEFAULT_CRL_DAYS   "default_crl_days"
 

Definition at line 125 of file ca.c.

#define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 

Definition at line 126 of file ca.c.

#define ENV_DEFAULT_DAYS   "default_days"
 

Definition at line 122 of file ca.c.

#define ENV_DEFAULT_EMAIL_DN   "email_in_dn"
 

Definition at line 128 of file ca.c.

#define ENV_DEFAULT_ENDDATE   "default_enddate"
 

Definition at line 124 of file ca.c.

#define ENV_DEFAULT_MD   "default_md"
 

Definition at line 127 of file ca.c.

#define ENV_DEFAULT_STARTDATE   "default_startdate"
 

Definition at line 123 of file ca.c.

#define ENV_DIR   "dir"
 

Definition at line 111 of file ca.c.

#define ENV_EXTCOPY   "copy_extensions"
 

Definition at line 136 of file ca.c.

#define ENV_EXTENSIONS   "x509_extensions"
 

Definition at line 131 of file ca.c.

#define ENV_MSIE_HACK   "msie_hack"
 

Definition at line 133 of file ca.c.

#define ENV_NAMEOPT   "name_opt"
 

Definition at line 134 of file ca.c.

#define ENV_NEW_CERTS_DIR   "new_certs_dir"
 

Definition at line 115 of file ca.c.

#define ENV_POLICY   "policy"
 

Definition at line 130 of file ca.c.

#define ENV_PRESERVE   "preserve"
 

Definition at line 129 of file ca.c.

#define ENV_PRIVATE_KEY   "private_key"
 

Definition at line 120 of file ca.c.

#define ENV_RANDFILE   "RANDFILE"
 

Definition at line 121 of file ca.c.

#define ENV_SERIAL   "serial"
 

Definition at line 117 of file ca.c.

#define ENV_UNIQUE_SUBJECT   "unique_subject"
 

Definition at line 137 of file ca.c.

#define F_OK   0
 

Definition at line 94 of file ca.c.

#define NUM_REASONS   (sizeof(crl_reasons) / sizeof(char *))
 

Definition at line 2697 of file ca.c.

Referenced by unpack_revinfo().

#define PROG   ca_main
 

Definition at line 101 of file ca.c.

#define R_OK   4
 

Definition at line 97 of file ca.c.

#define REV_CA_COMPROMISE   4
 

Definition at line 147 of file ca.c.

Referenced by make_revocation_str().

#define REV_CRL_REASON   1
 

Definition at line 144 of file ca.c.

Referenced by make_revocation_str().

#define REV_HOLD   2
 

Definition at line 145 of file ca.c.

Referenced by make_revocation_str().

#define REV_KEY_COMPROMISE   3
 

Definition at line 146 of file ca.c.

Referenced by make_revocation_str().

#define REV_NONE   0
 

Definition at line 143 of file ca.c.

Referenced by make_revocation_str().

#define STRING_MASK   "string_mask"
 

Definition at line 108 of file ca.c.

#define UTF8_IN   "utf8"
 

Definition at line 109 of file ca.c.

#define W_OK   2
 

Definition at line 96 of file ca.c.

#define X_OK   1
 

Definition at line 95 of file ca.c.

Function Documentation

static int certify (  X509 **  xret,
char *  infile,
EVP_PKEY *  pkey,
X509 *  x509,
const EVP_MD *  dgst,
STACK_OF(CONF_VALUE)*  policy,
CA_DB *  db,
BIGNUM *  serial,
char *  subj,
unsigned long  chtype,
int  multirdn,
int  email_dn,
char *  startdate,
char *  enddate,
long  days,
int  batch,
char *  ext_sect,
CONF *  conf,
int  verbose,
unsigned long  certopt,
unsigned long  nameopt,
int  default_op,
int  ext_copy,
int  selfsign
)  [static]
 

Definition at line 1533 of file ca.c.

References BIO_free(), BIO_new(), BIO_printf(), BIO_read_filename, BIO_s_file(), do_body(), EVP_PKEY_free(), X509_REQ_check_private_key(), X509_REQ_get_pubkey(), X509_REQ_print(), and X509_REQ_verify().

01539         {
01540         X509_REQ *req=NULL;
01541         BIO *in=NULL;
01542         EVP_PKEY *pktmp=NULL;
01543         int ok= -1,i;
01544 
01545         in=BIO_new(BIO_s_file());
01546 
01547         if (BIO_read_filename(in,infile) <= 0)
01548                 {
01549                 perror(infile);
01550                 goto err;
01551                 }
01552         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
01553                 {
01554                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
01555                         infile);
01556                 goto err;
01557                 }
01558         if (verbose)
01559                 X509_REQ_print(bio_err,req);
01560 
01561         BIO_printf(bio_err,"Check that the request matches the signature\n");
01562 
01563         if (selfsign && !X509_REQ_check_private_key(req,pkey))
01564                 {
01565                 BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
01566                 ok=0;
01567                 goto err;
01568                 }
01569         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
01570                 {
01571                 BIO_printf(bio_err,"error unpacking public key\n");
01572                 goto err;
01573                 }
01574         i=X509_REQ_verify(req,pktmp);
01575         EVP_PKEY_free(pktmp);
01576         if (i < 0)
01577                 {
01578                 ok=0;
01579                 BIO_printf(bio_err,"Signature verification problems....\n");
01580                 goto err;
01581                 }
01582         if (i == 0)
01583                 {
01584                 ok=0;
01585                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
01586                 goto err;
01587                 }
01588         else
01589                 BIO_printf(bio_err,"Signature ok\n");
01590 
01591         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
01592                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
01593                 certopt, nameopt, default_op, ext_copy, selfsign);
01594 
01595 err:
01596         if (req != NULL) X509_REQ_free(req);
01597         if (in != NULL) BIO_free(in);
01598         return(ok);
01599         }

static int certify_cert (  X509 **  xret,
char *  infile,
EVP_PKEY *  pkey,
X509 *  x509,
const EVP_MD *  dgst,
STACK_OF(CONF_VALUE)*  policy,
CA_DB *  db,
BIGNUM *  serial,
char *  subj,
unsigned long  chtype,
int  multirdn,
int  email_dn,
char *  startdate,
char *  enddate,
long  days,
int  batch,
char *  ext_sect,
CONF *  conf,
int  verbose,
unsigned long  certopt,
unsigned long  nameopt,
int  default_op,
int  ext_copy,
ENGINE *  e
)  [static]
 

Definition at line 1601 of file ca.c.

References BIO_printf(), do_body(), EVP_md5(), EVP_PKEY_free(), FORMAT_PEM, load_cert(), X509_get_pubkey(), X509_print(), X509_to_X509_REQ(), and X509_verify().

01607         {
01608         X509 *req=NULL;
01609         X509_REQ *rreq=NULL;
01610         EVP_PKEY *pktmp=NULL;
01611         int ok= -1,i;
01612 
01613         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
01614                 goto err;
01615         if (verbose)
01616                 X509_print(bio_err,req);
01617 
01618         BIO_printf(bio_err,"Check that the request matches the signature\n");
01619 
01620         if ((pktmp=X509_get_pubkey(req)) == NULL)
01621                 {
01622                 BIO_printf(bio_err,"error unpacking public key\n");
01623                 goto err;
01624                 }
01625         i=X509_verify(req,pktmp);
01626         EVP_PKEY_free(pktmp);
01627         if (i < 0)
01628                 {
01629                 ok=0;
01630                 BIO_printf(bio_err,"Signature verification problems....\n");
01631                 goto err;
01632                 }
01633         if (i == 0)
01634                 {
01635                 ok=0;
01636                 BIO_printf(bio_err,"Signature did not match the certificate\n");
01637                 goto err;
01638                 }
01639         else
01640                 BIO_printf(bio_err,"Signature ok\n");
01641 
01642         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
01643                 goto err;
01644 
01645         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
01646                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
01647                 ext_copy, 0);
01648 
01649 err:
01650         if (rreq != NULL) X509_REQ_free(rreq);
01651         if (req != NULL) X509_free(req);
01652         return(ok);
01653         }

static int certify_spkac (  X509 **  xret,
char *  infile,
EVP_PKEY *  pkey,
X509 *  x509,
const EVP_MD *  dgst,
STACK_OF(CONF_VALUE)*  policy,
CA_DB *  db,
BIGNUM *  serial,
char *  subj,
unsigned long  chtype,
int  multirdn,
int  email_dn,
char *  startdate,
char *  enddate,
long  days,
char *  ext_sect,
CONF *  conf,
int  verbose,
unsigned long  certopt,
unsigned long  nameopt,
int  default_op,
int  ext_copy
)  [static]
 

Definition at line 2225 of file ca.c.

References ASN1_PRINTABLE_type(), BIO_printf(), CONF_free(), CONF_load(), do_body(), ERR_print_errors(), EVP_PKEY_free(), fix_data(), CONF_VALUE::name, NETSCAPE_SPKI_b64_decode(), NETSCAPE_SPKI_get_pubkey(), NETSCAPE_SPKI_verify(), nid, NID_undef, OBJ_txt2nid(), X509_req_st::req_info, sk_CONF_VALUE_num, sk_CONF_VALUE_value, STACK_OF, X509_req_info_st::subject, type, CONF_VALUE::value, X509_NAME_add_entry(), X509_NAME_ENTRY_create_by_NID(), and X509_REQ_set_pubkey().

02230         {
02231         STACK_OF(CONF_VALUE) *sk=NULL;
02232         LHASH *parms=NULL;
02233         X509_REQ *req=NULL;
02234         CONF_VALUE *cv=NULL;
02235         NETSCAPE_SPKI *spki = NULL;
02236         X509_REQ_INFO *ri;
02237         char *type,*buf;
02238         EVP_PKEY *pktmp=NULL;
02239         X509_NAME *n=NULL;
02240         X509_NAME_ENTRY *ne=NULL;
02241         int ok= -1,i,j;
02242         long errline;
02243         int nid;
02244 
02245         /*
02246          * Load input file into a hash table.  (This is just an easy
02247          * way to read and parse the file, then put it into a convenient
02248          * STACK format).
02249          */
02250         parms=CONF_load(NULL,infile,&errline);
02251         if (parms == NULL)
02252                 {
02253                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
02254                 ERR_print_errors(bio_err);
02255                 goto err;
02256                 }
02257 
02258         sk=CONF_get_section(parms, "default");
02259         if (sk_CONF_VALUE_num(sk) == 0)
02260                 {
02261                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
02262                 CONF_free(parms);
02263                 goto err;
02264                 }
02265 
02266         /*
02267          * Now create a dummy X509 request structure.  We don't actually
02268          * have an X509 request, but we have many of the components
02269          * (a public key, various DN components).  The idea is that we
02270          * put these components into the right X509 request structure
02271          * and we can use the same code as if you had a real X509 request.
02272          */
02273         req=X509_REQ_new();
02274         if (req == NULL)
02275                 {
02276                 ERR_print_errors(bio_err);
02277                 goto err;
02278                 }
02279 
02280         /*
02281          * Build up the subject name set.
02282          */
02283         ri=req->req_info;
02284         n = ri->subject;
02285 
02286         for (i = 0; ; i++)
02287                 {
02288                 if (sk_CONF_VALUE_num(sk) <= i) break;
02289 
02290                 cv=sk_CONF_VALUE_value(sk,i);
02291                 type=cv->name;
02292                 /* Skip past any leading X. X: X, etc to allow for
02293                  * multiple instances
02294                  */
02295                 for (buf = cv->name; *buf ; buf++)
02296                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
02297                                 {
02298                                 buf++;
02299                                 if (*buf) type = buf;
02300                                 break;
02301                                 }
02302 
02303                 buf=cv->value;
02304                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
02305                         {
02306                         if (strcmp(type, "SPKAC") == 0)
02307                                 {
02308                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
02309                                 if (spki == NULL)
02310                                         {
02311                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
02312                                         ERR_print_errors(bio_err);
02313                                         goto err;
02314                                         }
02315                                 }
02316                         continue;
02317                         }
02318 
02319                 /*
02320                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
02321                         continue;
02322                 */
02323                 
02324                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
02325                 if (fix_data(nid, &j) == 0)
02326                         {
02327                         BIO_printf(bio_err,
02328                                 "invalid characters in string %s\n",buf);
02329                         goto err;
02330                         }
02331 
02332                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
02333                         (unsigned char *)buf,
02334                         strlen(buf))) == NULL)
02335                         goto err;
02336 
02337                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
02338                 }
02339         if (spki == NULL)
02340                 {
02341                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
02342                         infile);
02343                 goto err;
02344                 }
02345 
02346         /*
02347          * Now extract the key from the SPKI structure.
02348          */
02349 
02350         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
02351 
02352         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
02353                 {
02354                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
02355                 goto err;
02356                 }
02357 
02358         j = NETSCAPE_SPKI_verify(spki, pktmp);
02359         if (j <= 0)
02360                 {
02361                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
02362                 goto err;
02363                 }
02364         BIO_printf(bio_err,"Signature ok\n");
02365 
02366         X509_REQ_set_pubkey(req,pktmp);
02367         EVP_PKEY_free(pktmp);
02368         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
02369                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
02370                         ext_copy, 0);
02371 err:
02372         if (req != NULL) X509_REQ_free(req);
02373         if (parms != NULL) CONF_free(parms);
02374         if (spki != NULL) NETSCAPE_SPKI_free(spki);
02375         if (ne != NULL) X509_NAME_ENTRY_free(ne);
02376 
02377         return(ok);
02378         }

static int check_time_format (  char *  str  )  [static]
 

Definition at line 2395 of file ca.c.

References ASN1_UTCTIME_check(), asn1_string_st::data, asn1_string_st::length, asn1_string_st::type, and V_ASN1_UTCTIME.

02396         {
02397         ASN1_UTCTIME tm;
02398 
02399         tm.data=(unsigned char *)str;
02400         tm.length=strlen(str);
02401         tm.type=V_ASN1_UTCTIME;
02402         return(ASN1_UTCTIME_check(&tm));
02403         }

static int do_body (  X509 **  xret,
EVP_PKEY *  pkey,
X509 *  x509,
const EVP_MD *  dgst,
STACK_OF(CONF_VALUE)*  policy,
CA_DB *  db,
BIGNUM *  serial,
char *  subj,
unsigned long  chtype,
int  multirdn,
int  email_dn,
char *  startdate,
char *  enddate,
long  days,
int  batch,
int  verbose,
X509_REQ *  req,
char *  ext_sect,
CONF *  conf,
unsigned long  certopt,
unsigned long  nameopt,
int  default_op,
int  ext_copy,
int  selfsign
)  [static]
 

Definition at line 1655 of file ca.c.

References ASN1_INTEGER_set(), ASN1_PRINTABLE_type(), ASN1_STRING_cmp(), ASN1_UNIVERSALSTRING_to_string(), ASN1_UTCTIME_print(), ASN1_UTCTIME_set_string(), ca_db_st::attributes, BIO_flush, BIO_printf(), BN_bn2hex(), BN_is_zero, BN_to_ASN1_INTEGER(), BUF_strdup(), BUF_strlcpy(), x509_st::cert_info, copy_extensions(), asn1_string_st::data, ca_db_st::db, DB_file, DB_name, DB_NUMBER, DB_serial, DB_type, X509_req_info_st::enc, ERR_print_errors(), txt_db_st::error, EVP_dss1(), EVP_ecdsa(), EVP_PKEY_copy_parameters(), EVP_PKEY_DSA, EVP_PKEY_EC, EVP_PKEY_free(), EVP_PKEY_missing_parameters(), asn1_string_st::length, ASN1_ENCODING_st::modified, CONF_VALUE::name, nid, NID_pkcs9_emailAddress, NID_undef, obj, OBJ_nid2obj(), OBJ_obj2nid(), OBJ_txt2nid(), X509_name_entry_st::object, old_entry_print(), OPENSSL_free, OPENSSL_malloc, parse_name(), X509_req_st::req_info, x509_cinf_st::serialNumber, sk_CONF_VALUE_num, sk_CONF_VALUE_value, sk_X509_EXTENSION_pop_free, x509_cinf_st::subject, TXT_DB_get_by_index(), TXT_DB_insert(), evp_pkey_st::type, asn1_string_st::type, db_attr_st::unique_subject, V_ASN1_BMPSTRING, V_ASN1_IA5STRING, V_ASN1_PRINTABLESTRING, V_ASN1_T61STRING, V_ASN1_UNIVERSALSTRING, V_ASN1_UTF8STRING, CONF_VALUE::value, x509_cinf_st::version, void(), X509_FLAG_NO_SIGDUMP, X509_FLAG_NO_SIGNAME, X509_get_notAfter, X509_get_notBefore, X509_get_pubkey(), X509_get_subject_name(), X509_gmtime_adj(), X509_NAME_add_entry(), X509_NAME_delete_entry(), X509_NAME_dup(), X509_NAME_entry_count(), X509_NAME_ENTRY_get_data(), X509_NAME_ENTRY_get_object(), X509_NAME_get_entry(), X509_NAME_get_index_by_NID(), X509_NAME_get_index_by_OBJ(), X509_NAME_oneline(), X509_print_ex(), X509_REQ_get_pubkey(), X509_REQ_get_subject_name, X509_REQ_set_subject_name(), X509_set_issuer_name(), X509_set_pubkey(), X509_set_subject_name(), X509_set_version(), X509_sign(), X509V3_EXT_add_nconf(), X509V3_set_ctx(), and X509V3_set_nconf().

Referenced by certify(), certify_cert(), and certify_spkac().

01662         {
01663         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
01664         ASN1_UTCTIME *tm,*tmptm;
01665         ASN1_STRING *str,*str2;
01666         ASN1_OBJECT *obj;
01667         X509 *ret=NULL;
01668         X509_CINF *ci;
01669         X509_NAME_ENTRY *ne;
01670         X509_NAME_ENTRY *tne,*push;
01671         EVP_PKEY *pktmp;
01672         int ok= -1,i,j,last,nid;
01673         const char *p;
01674         CONF_VALUE *cv;
01675         char *row[DB_NUMBER],**rrow=NULL,**irow=NULL;
01676         char buf[25];
01677 
01678         tmptm=ASN1_UTCTIME_new();
01679         if (tmptm == NULL)
01680                 {
01681                 BIO_printf(bio_err,"malloc error\n");
01682                 return(0);
01683                 }
01684 
01685         for (i=0; i<DB_NUMBER; i++)
01686                 row[i]=NULL;
01687 
01688         if (subj)
01689                 {
01690                 X509_NAME *n = parse_name(subj, chtype, multirdn);
01691 
01692                 if (!n)
01693                         {
01694                         ERR_print_errors(bio_err);
01695                         goto err;
01696                         }
01697                 X509_REQ_set_subject_name(req,n);
01698                 req->req_info->enc.modified = 1;
01699                 X509_NAME_free(n);
01700                 }
01701 
01702         if (default_op)
01703                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
01704 
01705         name=X509_REQ_get_subject_name(req);
01706         for (i=0; i<X509_NAME_entry_count(name); i++)
01707                 {
01708                 ne= X509_NAME_get_entry(name,i);
01709                 str=X509_NAME_ENTRY_get_data(ne);
01710                 obj=X509_NAME_ENTRY_get_object(ne);
01711 
01712                 if (msie_hack)
01713                         {
01714                         /* assume all type should be strings */
01715                         nid=OBJ_obj2nid(ne->object);
01716 
01717                         if (str->type == V_ASN1_UNIVERSALSTRING)
01718                                 ASN1_UNIVERSALSTRING_to_string(str);
01719 
01720                         if ((str->type == V_ASN1_IA5STRING) &&
01721                                 (nid != NID_pkcs9_emailAddress))
01722                                 str->type=V_ASN1_T61STRING;
01723 
01724                         if ((nid == NID_pkcs9_emailAddress) &&
01725                                 (str->type == V_ASN1_PRINTABLESTRING))
01726                                 str->type=V_ASN1_IA5STRING;
01727                         }
01728 
01729                 /* If no EMAIL is wanted in the subject */
01730                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
01731                         continue;
01732 
01733                 /* check some things */
01734                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
01735                         (str->type != V_ASN1_IA5STRING))
01736                         {
01737                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
01738                         goto err;
01739                         }
01740                 if (