support of PKCS#10 certificate request parsing
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <utils/optionsfrom.h>
22 #include <credentials/certificates/certificate.h>
23 #include <credentials/certificates/x509.h>
24 #include <credentials/certificates/pkcs10.h>
25
26 /**
27 * Issue a certificate using a CA certificate and key
28 */
29 static int issue(int argc, char *argv[])
30 {
31 hash_algorithm_t digest = HASH_SHA1;
32 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
33 private_key_t *private = NULL;
34 public_key_t *public = NULL;
35 bool pkcs10 = FALSE;
36 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
37 char *error = NULL;
38 identification_t *id = NULL;
39 linked_list_t *san, *cdps, *ocsp;
40 int lifetime = 1080;
41 chunk_t serial = chunk_empty;
42 chunk_t encoding = chunk_empty;
43 time_t not_before, not_after;
44 x509_flag_t flags = 0;
45 x509_t *x509;
46 options_t *options;
47
48 options = options_create();
49 san = linked_list_create();
50 cdps = linked_list_create();
51 ocsp = linked_list_create();
52
53 while (TRUE)
54 {
55 switch (getopt_long(argc, argv, "", command_opts, NULL))
56 {
57 case 'h':
58 goto usage;
59 case '+':
60 if (!options->from(options, optarg, &argc, &argv, optind))
61 {
62 error = "invalid options file";
63 goto usage;
64 }
65 continue;
66 case 't':
67 if (streq(optarg, "pkcs10"))
68 {
69 pkcs10 = TRUE;
70 }
71 else if (!streq(optarg, "pub"))
72 {
73 error = "invalid input type";
74 goto usage;
75 }
76 continue;
77 case 'g':
78 digest = get_digest(optarg);
79 if (digest == HASH_UNKNOWN)
80 {
81 error = "invalid --digest type";
82 goto usage;
83 }
84 continue;
85 case 'i':
86 file = optarg;
87 continue;
88 case 'c':
89 cacert = optarg;
90 continue;
91 case 'k':
92 cakey = optarg;
93 continue;
94 case 'd':
95 dn = optarg;
96 continue;
97 case 'a':
98 san->insert_last(san, identification_create_from_string(optarg));
99 continue;
100 case 'l':
101 lifetime = atoi(optarg);
102 if (!lifetime)
103 {
104 error = "invalid --lifetime value";
105 goto usage;
106 }
107 continue;
108 case 's':
109 hex = optarg;
110 continue;
111 case 'b':
112 flags |= X509_CA;
113 continue;
114 case 'u':
115 cdps->insert_last(cdps, optarg);
116 continue;
117 case 'o':
118 ocsp->insert_last(ocsp, optarg);
119 continue;
120 case EOF:
121 break;
122 default:
123 error = "invalid --issue option";
124 goto usage;
125 }
126 break;
127 }
128
129 if (!pkcs10 && !dn)
130 {
131 error = "--dn is required";
132 goto usage;
133 }
134 if (!cacert)
135 {
136 error = "--cacert is required";
137 goto usage;
138 }
139 if (!cakey)
140 {
141 error = "--cakey is required";
142 goto usage;
143 }
144 if (dn)
145 {
146 id = identification_create_from_string(dn);
147 if (id->get_type(id) != ID_DER_ASN1_DN)
148 {
149 error = "supplied --dn is not a distinguished name";
150 goto end;
151 }
152 }
153 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
154 BUILD_FROM_FILE, cacert, BUILD_END);
155 if (!ca)
156 {
157 error = "parsing CA certificate failed";
158 goto end;
159 }
160 x509 = (x509_t*)ca;
161 if (!(x509->get_flags(x509) & X509_CA))
162 {
163 error = "CA certificate misses CA basicConstraint";
164 goto end;
165 }
166
167 public = ca->get_public_key(ca);
168 if (!public)
169 {
170 error = "extracting CA certificate public key failed";
171 goto end;
172 }
173 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
174 public->get_type(public),
175 BUILD_FROM_FILE, cakey, BUILD_END);
176 if (!private)
177 {
178 error = "parsing CA private key failed";
179 goto end;
180 }
181 if (!private->belongs_to(private, public))
182 {
183 error = "CA private key does not match CA certificate";
184 goto end;
185 }
186 public->destroy(public);
187
188 if (hex)
189 {
190 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
191 }
192 else
193 {
194 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
195
196 if (!rng)
197 {
198 error = "no random number generator found";
199 goto end;
200 }
201 rng->allocate_bytes(rng, 8, &serial);
202 rng->destroy(rng);
203 }
204
205 if (pkcs10)
206 {
207 enumerator_t *enumerator;
208 identification_t *subjectAltName;
209 pkcs10_t *req;
210
211 if (file)
212 {
213 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
214 CERT_PKCS10_REQUEST,
215 BUILD_FROM_FILE, file, BUILD_END);
216 }
217 else
218 {
219 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
220 CERT_PKCS10_REQUEST,
221 BUILD_FROM_FD, 0, BUILD_END);
222 }
223 if (!cert_req)
224 {
225 error = "parsing certificate request failed";
226 goto end;
227 }
228
229 /* If not set yet use subject from PKCS#10 certificate request as DN */
230 if (!id)
231 {
232 id = cert_req->get_subject(cert_req);
233 id = id->clone(id);
234 }
235
236 /* Add subjectAltNames from PKCS#10 certificate request */
237 req = (pkcs10_t*)cert_req;
238 enumerator = req->create_subjectAltName_enumerator(req);
239 while (enumerator->enumerate(enumerator, &subjectAltName))
240 {
241 san->insert_last(san, subjectAltName->clone(subjectAltName));
242 }
243 enumerator->destroy(enumerator);
244
245 /* Use public key from PKCS#10 certificate request */
246 public = cert_req->get_public_key(cert_req);
247 }
248 else
249 {
250 if (file)
251 {
252 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
253 BUILD_FROM_FILE, file, BUILD_END);
254 }
255 else
256 {
257 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
258 BUILD_FROM_FD, 0, BUILD_END);
259 }
260 }
261 if (!public)
262 {
263 error = "parsing public key failed";
264 goto end;
265 }
266
267 not_before = time(NULL);
268 not_after = not_before + lifetime * 24 * 60 * 60;
269
270 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
271 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
272 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
273 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
274 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
275 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
276 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
277 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
278 if (!cert)
279 {
280 error = "generating certificate failed";
281 goto end;
282 }
283 encoding = cert->get_encoding(cert);
284 if (!encoding.ptr)
285 {
286 error = "encoding certificate failed";
287 goto end;
288 }
289 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
290 {
291 error = "writing certificate key failed";
292 goto end;
293 }
294
295 end:
296 DESTROY_IF(id);
297 DESTROY_IF(cert_req);
298 DESTROY_IF(cert);
299 DESTROY_IF(ca);
300 DESTROY_IF(public);
301 DESTROY_IF(private);
302 san->destroy_offset(san, offsetof(identification_t, destroy));
303 cdps->destroy(cdps);
304 ocsp->destroy(ocsp);
305 options->destroy(options);
306 free(encoding.ptr);
307 free(serial.ptr);
308
309 if (error)
310 {
311 fprintf(stderr, "%s\n", error);
312 return 1;
313 }
314 return 0;
315
316 usage:
317 san->destroy_offset(san, offsetof(identification_t, destroy));
318 cdps->destroy(cdps);
319 ocsp->destroy(ocsp);
320 options->destroy(options);
321 return command_usage(error);
322 }
323
324 /**
325 * Register the command.
326 */
327 static void __attribute__ ((constructor))reg()
328 {
329 command_register((command_t) {
330 issue, 'i', "issue",
331 "issue a certificate using a CA certificate and key",
332 {"[--in file] [--type pub|pkcs10]",
333 " --cacert file --cakey file --dn subject-dn [--san subjectAltName]+",
334 "[--lifetime days] [--serial hex] [--ca] [--crl uri]+ [--ocsp uri]+",
335 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
336 "[--options file]"},
337 {
338 {"help", 'h', 0, "show usage information"},
339 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
340 {"type", 't', 1, "type of input, default: pub"},
341 {"cacert", 'c', 1, "CA certificate file"},
342 {"cakey", 'k', 1, "CA private key file"},
343 {"dn", 'd', 1, "distinguished name to include as subject"},
344 {"san", 'a', 1, "subjectAltName to include in certificate"},
345 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
346 {"serial", 's', 1, "serial number in hex, default: random"},
347 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
348 {"crl", 'u', 1, "CRL distribution point URI to include"},
349 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
350 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
351 {"options", '+', 1, "read command line options from file"},
352 }
353 });
354 }
355