pki: Use SHA-256 as default for signatures
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Copyright (C) 2015 Andreas Steffen
4 * HSR Hochschule fuer Technik Rapperswil
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 *
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * for more details.
15 */
16
17 #include <time.h>
18 #include <errno.h>
19
20 #include "pki.h"
21
22 #include <utils/debug.h>
23 #include <asn1/asn1.h>
24 #include <collections/linked_list.h>
25 #include <credentials/certificates/certificate.h>
26 #include <credentials/certificates/x509.h>
27 #include <credentials/certificates/pkcs10.h>
28
29 /**
30 * Free cert policy with OID
31 */
32 static void destroy_cert_policy(x509_cert_policy_t *policy)
33 {
34 free(policy->oid.ptr);
35 free(policy);
36 }
37
38 /**
39 * Free policy mapping
40 */
41 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
42 {
43 free(mapping->issuer.ptr);
44 free(mapping->subject.ptr);
45 free(mapping);
46 }
47
48 /**
49 * Free a CRL DistributionPoint
50 */
51 static void destroy_cdp(x509_cdp_t *this)
52 {
53 DESTROY_IF(this->issuer);
54 free(this);
55 }
56
57 /**
58 * Issue a certificate using a CA certificate and key
59 */
60 static int issue()
61 {
62 cred_encoding_type_t form = CERT_ASN1_DER;
63 hash_algorithm_t digest = HASH_SHA256;
64 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
65 private_key_t *private = NULL;
66 public_key_t *public = NULL;
67 bool pkcs10 = FALSE;
68 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
69 char *error = NULL, *keyid = NULL;
70 identification_t *id = NULL;
71 linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
72 int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
73 int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
74 chunk_t serial = chunk_empty;
75 chunk_t encoding = chunk_empty;
76 time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
77 char *datenb = NULL, *datena = NULL, *dateform = NULL;
78 x509_flag_t flags = 0;
79 x509_t *x509;
80 x509_cdp_t *cdp = NULL;
81 x509_cert_policy_t *policy = NULL;
82 char *arg;
83
84 san = linked_list_create();
85 cdps = linked_list_create();
86 ocsp = linked_list_create();
87 permitted = linked_list_create();
88 excluded = linked_list_create();
89 policies = linked_list_create();
90 mappings = linked_list_create();
91
92 while (TRUE)
93 {
94 switch (command_getopt(&arg))
95 {
96 case 'h':
97 goto usage;
98 case 't':
99 if (streq(arg, "pkcs10"))
100 {
101 pkcs10 = TRUE;
102 }
103 else if (!streq(arg, "pub"))
104 {
105 error = "invalid input type";
106 goto usage;
107 }
108 continue;
109 case 'g':
110 if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
111 {
112 error = "invalid --digest type";
113 goto usage;
114 }
115 continue;
116 case 'i':
117 file = arg;
118 continue;
119 case 'c':
120 cacert = arg;
121 continue;
122 case 'k':
123 cakey = arg;
124 continue;
125 case 'x':
126 keyid = arg;
127 continue;
128 case 'd':
129 dn = arg;
130 continue;
131 case 'a':
132 san->insert_last(san, identification_create_from_string(arg));
133 continue;
134 case 'l':
135 lifetime = atoi(arg) * 24 * 60 * 60;
136 if (!lifetime)
137 {
138 error = "invalid --lifetime value";
139 goto usage;
140 }
141 continue;
142 case 'D':
143 dateform = arg;
144 continue;
145 case 'F':
146 datenb = arg;
147 continue;
148 case 'T':
149 datena = arg;
150 continue;
151 case 's':
152 hex = arg;
153 continue;
154 case 'b':
155 flags |= X509_CA;
156 continue;
157 case 'p':
158 pathlen = atoi(arg);
159 continue;
160 case 'n':
161 permitted->insert_last(permitted,
162 identification_create_from_string(arg));
163 continue;
164 case 'N':
165 excluded->insert_last(excluded,
166 identification_create_from_string(arg));
167 continue;
168 case 'P':
169 {
170 chunk_t oid;
171
172 oid = asn1_oid_from_string(arg);
173 if (!oid.len)
174 {
175 error = "--cert-policy OID invalid";
176 goto usage;
177 }
178 INIT(policy,
179 .oid = oid,
180 );
181 policies->insert_last(policies, policy);
182 continue;
183 }
184 case 'C':
185 if (!policy)
186 {
187 error = "--cps-uri must follow a --cert-policy";
188 goto usage;
189 }
190 policy->cps_uri = arg;
191 continue;
192 case 'U':
193 if (!policy)
194 {
195 error = "--user-notice must follow a --cert-policy";
196 goto usage;
197 }
198 policy->unotice_text = arg;
199 continue;
200 case 'M':
201 {
202 char *pos = strchr(arg, ':');
203 x509_policy_mapping_t *mapping;
204 chunk_t subject_oid, issuer_oid;
205
206 if (pos)
207 {
208 *pos++ = '\0';
209 issuer_oid = asn1_oid_from_string(arg);
210 subject_oid = asn1_oid_from_string(pos);
211 }
212 if (!pos || !issuer_oid.len || !subject_oid.len)
213 {
214 error = "--policy-map OIDs invalid";
215 goto usage;
216 }
217 INIT(mapping,
218 .issuer = issuer_oid,
219 .subject = subject_oid,
220 );
221 mappings->insert_last(mappings, mapping);
222 continue;
223 }
224 case 'E':
225 require_explicit = atoi(arg);
226 continue;
227 case 'H':
228 inhibit_mapping = atoi(arg);
229 continue;
230 case 'A':
231 inhibit_any = atoi(arg);
232 continue;
233 case 'e':
234 if (streq(arg, "serverAuth"))
235 {
236 flags |= X509_SERVER_AUTH;
237 }
238 else if (streq(arg, "clientAuth"))
239 {
240 flags |= X509_CLIENT_AUTH;
241 }
242 else if (streq(arg, "ikeIntermediate"))
243 {
244 flags |= X509_IKE_INTERMEDIATE;
245 }
246 else if (streq(arg, "crlSign"))
247 {
248 flags |= X509_CRL_SIGN;
249 }
250 else if (streq(arg, "ocspSigning"))
251 {
252 flags |= X509_OCSP_SIGNER;
253 }
254 else if (streq(arg, "msSmartcardLogon"))
255 {
256 flags |= X509_MS_SMARTCARD_LOGON;
257 }
258 continue;
259 case 'f':
260 if (!get_form(arg, &form, CRED_CERTIFICATE))
261 {
262 error = "invalid output format";
263 goto usage;
264 }
265 continue;
266 case 'u':
267 INIT(cdp,
268 .uri = arg,
269 );
270 cdps->insert_last(cdps, cdp);
271 continue;
272 case 'I':
273 if (!cdp || cdp->issuer)
274 {
275 error = "--crlissuer must follow a --crl";
276 goto usage;
277 }
278 cdp->issuer = identification_create_from_string(arg);
279 continue;
280 case 'o':
281 ocsp->insert_last(ocsp, arg);
282 continue;
283 case EOF:
284 break;
285 default:
286 error = "invalid --issue option";
287 goto usage;
288 }
289 break;
290 }
291
292 if (!cacert)
293 {
294 error = "--cacert is required";
295 goto usage;
296 }
297 if (!cakey && !keyid)
298 {
299 error = "--cakey or --keyid is required";
300 goto usage;
301 }
302 if (!calculate_lifetime(dateform, datenb, datena, lifetime,
303 &not_before, &not_after))
304 {
305 error = "invalid --not-before/after datetime";
306 goto usage;
307 }
308 if (dn && *dn)
309 {
310 id = identification_create_from_string(dn);
311 if (id->get_type(id) != ID_DER_ASN1_DN)
312 {
313 error = "supplied --dn is not a distinguished name";
314 goto end;
315 }
316 }
317
318 DBG2(DBG_LIB, "Reading ca certificate:");
319 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
320 BUILD_FROM_FILE, cacert, BUILD_END);
321 if (!ca)
322 {
323 error = "parsing CA certificate failed";
324 goto end;
325 }
326 x509 = (x509_t*)ca;
327 if (!(x509->get_flags(x509) & X509_CA))
328 {
329 error = "CA certificate misses CA basicConstraint";
330 goto end;
331 }
332 public = ca->get_public_key(ca);
333 if (!public)
334 {
335 error = "extracting CA certificate public key failed";
336 goto end;
337 }
338
339 DBG2(DBG_LIB, "Reading ca private key:");
340 if (cakey)
341 {
342 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
343 public->get_type(public),
344 BUILD_FROM_FILE, cakey, BUILD_END);
345 }
346 else
347 {
348 chunk_t chunk;
349
350 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
351 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
352 BUILD_PKCS11_KEYID, chunk, BUILD_END);
353 free(chunk.ptr);
354 }
355 if (!private)
356 {
357 error = "loading CA private key failed";
358 goto end;
359 }
360 if (!private->belongs_to(private, public))
361 {
362 error = "CA private key does not match CA certificate";
363 goto end;
364 }
365 public->destroy(public);
366
367 if (hex)
368 {
369 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
370 }
371 else
372 {
373 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
374
375 if (!rng)
376 {
377 error = "no random number generator found";
378 goto end;
379 }
380 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
381 {
382 error = "failed to generate serial number";
383 rng->destroy(rng);
384 goto end;
385 }
386 serial.ptr[0] &= 0x7F;
387 rng->destroy(rng);
388 }
389
390 if (pkcs10)
391 {
392 enumerator_t *enumerator;
393 identification_t *subjectAltName;
394 pkcs10_t *req;
395
396 DBG2(DBG_LIB, "Reading certificate request");
397 if (file)
398 {
399 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
400 CERT_PKCS10_REQUEST,
401 BUILD_FROM_FILE, file, BUILD_END);
402 }
403 else
404 {
405 chunk_t chunk;
406
407 set_file_mode(stdin, CERT_ASN1_DER);
408 if (!chunk_from_fd(0, &chunk))
409 {
410 fprintf(stderr, "%s: ", strerror(errno));
411 error = "reading certificate request failed";
412 goto end;
413 }
414 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
415 CERT_PKCS10_REQUEST,
416 BUILD_BLOB, chunk, BUILD_END);
417 free(chunk.ptr);
418 }
419 if (!cert_req)
420 {
421 error = "parsing certificate request failed";
422 goto end;
423 }
424
425 /* If not set yet use subject from PKCS#10 certificate request as DN */
426 if (!id)
427 {
428 id = cert_req->get_subject(cert_req);
429 id = id->clone(id);
430 }
431
432 /* Add subjectAltNames from PKCS#10 certificate request */
433 req = (pkcs10_t*)cert_req;
434 enumerator = req->create_subjectAltName_enumerator(req);
435 while (enumerator->enumerate(enumerator, &subjectAltName))
436 {
437 san->insert_last(san, subjectAltName->clone(subjectAltName));
438 }
439 enumerator->destroy(enumerator);
440
441 /* Use public key from PKCS#10 certificate request */
442 public = cert_req->get_public_key(cert_req);
443 }
444 else
445 {
446 DBG2(DBG_LIB, "Reading public key:");
447 if (file)
448 {
449 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
450 BUILD_FROM_FILE, file, BUILD_END);
451 }
452 else
453 {
454 chunk_t chunk;
455
456 if (!chunk_from_fd(0, &chunk))
457 {
458 fprintf(stderr, "%s: ", strerror(errno));
459 error = "reading public key failed";
460 goto end;
461 }
462 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
463 BUILD_BLOB, chunk, BUILD_END);
464 free(chunk.ptr);
465 }
466 }
467 if (!public)
468 {
469 error = "parsing public key failed";
470 goto end;
471 }
472
473 if (!id)
474 {
475 id = identification_create_from_encoding(ID_DER_ASN1_DN,
476 chunk_from_chars(ASN1_SEQUENCE, 0));
477 }
478
479 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
480 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
481 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
482 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
483 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
484 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
485 BUILD_PATHLEN, pathlen,
486 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
487 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
488 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
489 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
490 BUILD_CERTIFICATE_POLICIES, policies,
491 BUILD_POLICY_MAPPINGS, mappings,
492 BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
493 BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
494 BUILD_POLICY_INHIBIT_ANY, inhibit_any,
495 BUILD_END);
496 if (!cert)
497 {
498 error = "generating certificate failed";
499 goto end;
500 }
501 if (!cert->get_encoding(cert, form, &encoding))
502 {
503 error = "encoding certificate failed";
504 goto end;
505 }
506 set_file_mode(stdout, form);
507 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
508 {
509 error = "writing certificate key failed";
510 goto end;
511 }
512
513 end:
514 DESTROY_IF(id);
515 DESTROY_IF(cert_req);
516 DESTROY_IF(cert);
517 DESTROY_IF(ca);
518 DESTROY_IF(public);
519 DESTROY_IF(private);
520 san->destroy_offset(san, offsetof(identification_t, destroy));
521 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
522 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
523 policies->destroy_function(policies, (void*)destroy_cert_policy);
524 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
525 cdps->destroy_function(cdps, (void*)destroy_cdp);
526 ocsp->destroy(ocsp);
527 free(encoding.ptr);
528 free(serial.ptr);
529
530 if (error)
531 {
532 fprintf(stderr, "%s\n", error);
533 return 1;
534 }
535 return 0;
536
537 usage:
538 san->destroy_offset(san, offsetof(identification_t, destroy));
539 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
540 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
541 policies->destroy_function(policies, (void*)destroy_cert_policy);
542 mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
543 cdps->destroy_function(cdps, (void*)destroy_cdp);
544 ocsp->destroy(ocsp);
545 return command_usage(error);
546 }
547
548 /**
549 * Register the command.
550 */
551 static void __attribute__ ((constructor))reg()
552 {
553 command_register((command_t) {
554 issue, 'i', "issue",
555 "issue a certificate using a CA certificate and key",
556 {"[--in file] [--type pub|pkcs10] --cakey file|--cakeyid hex",
557 " --cacert file [--dn subject-dn] [--san subjectAltName]+",
558 "[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
559 "[--flag serverAuth|clientAuth|crlSign|ocspSigning|msSmartcardLogon]+",
560 "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
561 "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
562 "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
563 "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
564 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
565 {
566 {"help", 'h', 0, "show usage information"},
567 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
568 {"type", 't', 1, "type of input, default: pub"},
569 {"cacert", 'c', 1, "CA certificate file"},
570 {"cakey", 'k', 1, "CA private key file"},
571 {"cakeyid", 'x', 1, "keyid on smartcard of CA private key"},
572 {"dn", 'd', 1, "distinguished name to include as subject"},
573 {"san", 'a', 1, "subjectAltName to include in certificate"},
574 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
575 {"not-before", 'F', 1, "date/time the validity of the cert starts"},
576 {"not-after", 'T', 1, "date/time the validity of the cert ends"},
577 {"dateform", 'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
578 {"serial", 's', 1, "serial number in hex, default: random"},
579 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
580 {"pathlen", 'p', 1, "set path length constraint"},
581 {"nc-permitted", 'n', 1, "add permitted NameConstraint"},
582 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
583 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
584 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
585 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
586 {"policy-mapping", 'M', 1, "policyMapping from issuer to subject OID"},
587 {"policy-explicit", 'E', 1, "requireExplicitPolicy constraint"},
588 {"policy-inhibit", 'H', 1, "inhibitPolicyMapping constraint"},
589 {"policy-any", 'A', 1, "inhibitAnyPolicy constraint"},
590 {"flag", 'e', 1, "include extendedKeyUsage flag"},
591 {"crl", 'u', 1, "CRL distribution point URI to include"},
592 {"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
593 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
594 {"digest", 'g', 1, "digest for signature creation, default: sha256"},
595 {"outform", 'f', 1, "encoding of generated cert, default: der"},
596 }
597 });
598 }