aa62a07b83a4423c1020d76c6485dc4f060b0025
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <debug.h>
21 #include <asn1/asn1.h>
22 #include <utils/linked_list.h>
23 #include <credentials/certificates/certificate.h>
24 #include <credentials/certificates/x509.h>
25 #include <credentials/certificates/pkcs10.h>
26
27 /**
28 * Free cert policy with OID
29 */
30 static void destroy_cert_policy(x509_cert_policy_t *policy)
31 {
32 free(policy->oid.ptr);
33 free(policy);
34 }
35
36 /**
37 * Issue a certificate using a CA certificate and key
38 */
39 static int issue()
40 {
41 cred_encoding_type_t form = CERT_ASN1_DER;
42 hash_algorithm_t digest = HASH_SHA1;
43 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
44 private_key_t *private = NULL;
45 public_key_t *public = NULL;
46 bool pkcs10 = FALSE;
47 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
48 char *error = NULL, *keyid = NULL;
49 identification_t *id = NULL, *crl_issuer = NULL;;
50 linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies;
51 int lifetime = 1095;
52 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
53 chunk_t serial = chunk_empty;
54 chunk_t encoding = chunk_empty;
55 time_t not_before, not_after;
56 x509_flag_t flags = 0;
57 x509_t *x509;
58 x509_cert_policy_t *policy = NULL;
59 char *arg;
60
61 san = linked_list_create();
62 cdps = linked_list_create();
63 ocsp = linked_list_create();
64 permitted = linked_list_create();
65 excluded = linked_list_create();
66 policies = linked_list_create();
67
68 while (TRUE)
69 {
70 switch (command_getopt(&arg))
71 {
72 case 'h':
73 goto usage;
74 case 't':
75 if (streq(arg, "pkcs10"))
76 {
77 pkcs10 = TRUE;
78 }
79 else if (!streq(arg, "pub"))
80 {
81 error = "invalid input type";
82 goto usage;
83 }
84 continue;
85 case 'g':
86 digest = get_digest(arg);
87 if (digest == HASH_UNKNOWN)
88 {
89 error = "invalid --digest type";
90 goto usage;
91 }
92 continue;
93 case 'i':
94 file = arg;
95 continue;
96 case 'c':
97 cacert = arg;
98 continue;
99 case 'k':
100 cakey = arg;
101 continue;
102 case 'x':
103 keyid = arg;
104 continue;
105 case 'd':
106 dn = arg;
107 continue;
108 case 'a':
109 san->insert_last(san, identification_create_from_string(arg));
110 continue;
111 case 'l':
112 lifetime = atoi(arg);
113 if (!lifetime)
114 {
115 error = "invalid --lifetime value";
116 goto usage;
117 }
118 continue;
119 case 's':
120 hex = arg;
121 continue;
122 case 'b':
123 flags |= X509_CA;
124 continue;
125 case 'p':
126 pathlen = atoi(arg);
127 continue;
128 case 'n':
129 permitted->insert_last(permitted,
130 identification_create_from_string(arg));
131 continue;
132 case 'N':
133 excluded->insert_last(excluded,
134 identification_create_from_string(arg));
135 continue;
136 case 'P':
137 {
138 chunk_t oid;
139
140 oid = asn1_oid_from_string(arg);
141 if (!oid.len)
142 {
143 return command_usage("--cert-policy OID invalid");
144 }
145 INIT(policy,
146 .oid = oid,
147 );
148 policies->insert_last(policies, policy);
149 continue;
150 }
151 case 'C':
152 if (!policy)
153 {
154 return command_usage("--cps-uri must follow a --cert-policy");
155 }
156 policy->cps_uri = arg;
157 continue;
158 case 'U':
159 if (!policy)
160 {
161 return command_usage("--user-notice must follow a --cert-policy");
162 }
163 policy->unotice_text = arg;
164 continue;
165 case 'e':
166 if (streq(arg, "serverAuth"))
167 {
168 flags |= X509_SERVER_AUTH;
169 }
170 else if (streq(arg, "clientAuth"))
171 {
172 flags |= X509_CLIENT_AUTH;
173 }
174 else if (streq(arg, "crlSign"))
175 {
176 flags |= X509_CRL_SIGN;
177 }
178 else if (streq(arg, "ocspSigning"))
179 {
180 flags |= X509_OCSP_SIGNER;
181 }
182 continue;
183 case 'f':
184 if (!get_form(arg, &form, CRED_CERTIFICATE))
185 {
186 return command_usage("invalid output format");
187 }
188 continue;
189 case 'u':
190 cdps->insert_last(cdps, arg);
191 continue;
192 case 'I':
193 crl_issuer = identification_create_from_string(arg);
194 continue;
195 case 'o':
196 ocsp->insert_last(ocsp, arg);
197 continue;
198 case EOF:
199 break;
200 default:
201 error = "invalid --issue option";
202 goto usage;
203 }
204 break;
205 }
206
207 if (!pkcs10 && !dn)
208 {
209 error = "--dn is required";
210 goto usage;
211 }
212 if (!cacert)
213 {
214 error = "--cacert is required";
215 goto usage;
216 }
217 if (!cakey && !keyid)
218 {
219 error = "--cakey or --keyid is required";
220 goto usage;
221 }
222 if (dn)
223 {
224 id = identification_create_from_string(dn);
225 if (id->get_type(id) != ID_DER_ASN1_DN)
226 {
227 error = "supplied --dn is not a distinguished name";
228 goto end;
229 }
230 }
231
232 DBG2(DBG_LIB, "Reading ca certificate:");
233 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
234 BUILD_FROM_FILE, cacert, BUILD_END);
235 if (!ca)
236 {
237 error = "parsing CA certificate failed";
238 goto end;
239 }
240 x509 = (x509_t*)ca;
241 if (!(x509->get_flags(x509) & X509_CA))
242 {
243 error = "CA certificate misses CA basicConstraint";
244 goto end;
245 }
246 public = ca->get_public_key(ca);
247 if (!public)
248 {
249 error = "extracting CA certificate public key failed";
250 goto end;
251 }
252
253 DBG2(DBG_LIB, "Reading ca private key:");
254 if (cakey)
255 {
256 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
257 public->get_type(public),
258 BUILD_FROM_FILE, cakey, BUILD_END);
259 }
260 else
261 {
262 chunk_t chunk;
263
264 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
265 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
266 BUILD_PKCS11_KEYID, chunk, BUILD_END);
267 free(chunk.ptr);
268 }
269 if (!private)
270 {
271 error = "loading CA private key failed";
272 goto end;
273 }
274 if (!private->belongs_to(private, public))
275 {
276 error = "CA private key does not match CA certificate";
277 goto end;
278 }
279 public->destroy(public);
280
281 if (hex)
282 {
283 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
284 }
285 else
286 {
287 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
288
289 if (!rng)
290 {
291 error = "no random number generator found";
292 goto end;
293 }
294 rng->allocate_bytes(rng, 8, &serial);
295 while (*serial.ptr == 0x00)
296 {
297 /* we don't accept a serial number with leading zeroes */
298 rng->get_bytes(rng, 1, serial.ptr);
299 }
300 rng->destroy(rng);
301 }
302
303 if (pkcs10)
304 {
305 enumerator_t *enumerator;
306 identification_t *subjectAltName;
307 pkcs10_t *req;
308
309 DBG2(DBG_LIB, "Reading certificate request");
310 if (file)
311 {
312 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
313 CERT_PKCS10_REQUEST,
314 BUILD_FROM_FILE, file, BUILD_END);
315 }
316 else
317 {
318 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
319 CERT_PKCS10_REQUEST,
320 BUILD_FROM_FD, 0, BUILD_END);
321 }
322 if (!cert_req)
323 {
324 error = "parsing certificate request failed";
325 goto end;
326 }
327
328 /* If not set yet use subject from PKCS#10 certificate request as DN */
329 if (!id)
330 {
331 id = cert_req->get_subject(cert_req);
332 id = id->clone(id);
333 }
334
335 /* Add subjectAltNames from PKCS#10 certificate request */
336 req = (pkcs10_t*)cert_req;
337 enumerator = req->create_subjectAltName_enumerator(req);
338 while (enumerator->enumerate(enumerator, &subjectAltName))
339 {
340 san->insert_last(san, subjectAltName->clone(subjectAltName));
341 }
342 enumerator->destroy(enumerator);
343
344 /* Use public key from PKCS#10 certificate request */
345 public = cert_req->get_public_key(cert_req);
346 }
347 else
348 {
349 DBG2(DBG_LIB, "Reading public key:");
350 if (file)
351 {
352 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
353 BUILD_FROM_FILE, file, BUILD_END);
354 }
355 else
356 {
357 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
358 BUILD_FROM_FD, 0, BUILD_END);
359 }
360 }
361 if (!public)
362 {
363 error = "parsing public key failed";
364 goto end;
365 }
366
367 not_before = time(NULL);
368 not_after = not_before + lifetime * 24 * 60 * 60;
369
370 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
371 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
372 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
373 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
374 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
375 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
376 BUILD_PATHLEN, pathlen,
377 BUILD_CRL_ISSUER, crl_issuer,
378 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
379 BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
380 BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
381 BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
382 BUILD_CERTIFICATE_POLICIES, policies, BUILD_END);
383 if (!cert)
384 {
385 error = "generating certificate failed";
386 goto end;
387 }
388 if (!cert->get_encoding(cert, form, &encoding))
389 {
390 error = "encoding certificate failed";
391 goto end;
392 }
393 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
394 {
395 error = "writing certificate key failed";
396 goto end;
397 }
398
399 end:
400 DESTROY_IF(id);
401 DESTROY_IF(cert_req);
402 DESTROY_IF(cert);
403 DESTROY_IF(ca);
404 DESTROY_IF(public);
405 DESTROY_IF(private);
406 san->destroy_offset(san, offsetof(identification_t, destroy));
407 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
408 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
409 policies->destroy_function(policies, (void*)destroy_cert_policy);
410 cdps->destroy(cdps);
411 ocsp->destroy(ocsp);
412 DESTROY_IF(crl_issuer);
413 free(encoding.ptr);
414 free(serial.ptr);
415
416 if (error)
417 {
418 fprintf(stderr, "%s\n", error);
419 return 1;
420 }
421 return 0;
422
423 usage:
424 san->destroy_offset(san, offsetof(identification_t, destroy));
425 permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
426 excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
427 policies->destroy_function(policies, (void*)destroy_cert_policy);
428 cdps->destroy(cdps);
429 ocsp->destroy(ocsp);
430 DESTROY_IF(crl_issuer);
431 return command_usage(error);
432 }
433
434 /**
435 * Register the command.
436 */
437 static void __attribute__ ((constructor))reg()
438 {
439 command_register((command_t) {
440 issue, 'i', "issue",
441 "issue a certificate using a CA certificate and key",
442 {"[--in file] [--type pub|pkcs10] --cakey file | --cakeyid hex",
443 " --cacert file --dn subject-dn [--san subjectAltName]+",
444 "[--lifetime days] [--serial hex] [--crl uri]+ [--ocsp uri]+",
445 "[--ca] [--pathlen len] [--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
446 "[--nc-permitted name] [--nc-excluded name]",
447 "[--cert-policy oid [--cps-uri uri] [--user-notice text] ]+",
448 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
449 {
450 {"help", 'h', 0, "show usage information"},
451 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
452 {"type", 't', 1, "type of input, default: pub"},
453 {"cacert", 'c', 1, "CA certificate file"},
454 {"cakey", 'k', 1, "CA private key file"},
455 {"cakeyid", 'x', 1, "keyid on smartcard of CA private key"},
456 {"dn", 'd', 1, "distinguished name to include as subject"},
457 {"san", 'a', 1, "subjectAltName to include in certificate"},
458 {"lifetime", 'l', 1, "days the certificate is valid, default: 1095"},
459 {"serial", 's', 1, "serial number in hex, default: random"},
460 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
461 {"pathlen", 'p', 1, "set path length constraint"},
462 {"nc-permitted",'n', 1, "add permitted NameConstraint"},
463 {"nc-excluded", 'N', 1, "add excluded NameConstraint"},
464 {"cert-policy", 'P', 1, "certificatePolicy OID to include"},
465 {"cps-uri", 'C', 1, "Certification Practice statement URI for certificatePolicy"},
466 {"user-notice", 'U', 1, "user notice for certificatePolicy"},
467 {"flag", 'e', 1, "include extendedKeyUsage flag"},
468 {"crl", 'u', 1, "CRL distribution point URI to include"},
469 {"crlissuer", 'I', 1, "CRL Issuer for CRL at distribution point"},
470 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
471 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
472 {"outform", 'f', 1, "encoding of generated cert, default: der"},
473 }
474 });
475 }
476