src/pki/commands/issue.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Copyright (C) 2015-2017 Andreas Steffen
   4  * HSR Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <time.h>
  18 #include <errno.h>
  19
  20 #include "pki.h"
  21
  22 #include <utils/debug.h>
  23 #include <asn1/asn1.h>
  24 #include <collections/linked_list.h>
  25 #include <credentials/certificates/certificate.h>
  26 #include <credentials/certificates/x509.h>
  27 #include <credentials/certificates/pkcs10.h>
  28
  29 /**
  30  * Free cert policy with OID
  31  */
  32 static void destroy_cert_policy(x509_cert_policy_t *policy)
  33 {
  34         free(policy->oid.ptr);
  35         free(policy);
  36 }
  37
  38 /**
  39  * Free policy mapping
  40  */
  41 static void destroy_policy_mapping(x509_policy_mapping_t *mapping)
  42 {
  43         free(mapping->issuer.ptr);
  44         free(mapping->subject.ptr);
  45         free(mapping);
  46 }
  47
  48 /**
  49  * Free a CRL DistributionPoint
  50  */
  51 static void destroy_cdp(x509_cdp_t *this)
  52 {
  53         DESTROY_IF(this->issuer);
  54         free(this);
  55 }
  56
  57 /**
  58  * Issue a certificate using a CA certificate and key
  59  */
  60 static int issue()
  61 {
  62         cred_encoding_type_t form = CERT_ASN1_DER;
  63         hash_algorithm_t digest = HASH_UNKNOWN;
  64         signature_params_t *scheme = NULL;
  65         certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
  66         private_key_t *private = NULL;
  67         public_key_t *public = NULL;
  68         credential_type_t type = CRED_PUBLIC_KEY;
  69         key_type_t subtype = KEY_ANY;
  70         bool pkcs10 = FALSE, pss = FALSE;
  71         char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
  72         char *error = NULL, *keyid = NULL;
  73         identification_t *id = NULL;
  74         linked_list_t *san, *cdps, *ocsp, *permitted, *excluded, *policies, *mappings;
  75         linked_list_t *addrblocks;
  76         int pathlen = X509_NO_CONSTRAINT, inhibit_any = X509_NO_CONSTRAINT;
  77         int inhibit_mapping = X509_NO_CONSTRAINT, require_explicit = X509_NO_CONSTRAINT;
  78         chunk_t serial = chunk_empty;
  79         chunk_t encoding = chunk_empty;
  80         time_t not_before, not_after, lifetime = 1095 * 24 * 60 * 60;
  81         char *datenb = NULL, *datena = NULL, *dateform = NULL;
  82         x509_flag_t flags = 0;
  83         x509_t *x509;
  84         x509_cdp_t *cdp = NULL;
  85         x509_cert_policy_t *policy = NULL;
  86         traffic_selector_t *ts;
  87         char *arg;
  88
  89         san = linked_list_create();
  90         cdps = linked_list_create();
  91         ocsp = linked_list_create();
  92         permitted = linked_list_create();
  93         excluded = linked_list_create();
  94         policies = linked_list_create();
  95         mappings = linked_list_create();
  96         addrblocks = linked_list_create();
  97
  98         while (TRUE)
  99         {
 100                 switch (command_getopt(&arg))
 101                 {
 102                         case 'h':
 103                                 goto usage;
 104                         case 't':
 105                                 if (streq(arg, "pkcs10"))
 106                                 {
 107                                         pkcs10 = TRUE;
 108                                 }
 109                                 else if (streq(arg, "rsa"))
 110                                 {
 111                                         type = CRED_PRIVATE_KEY;
 112                                         subtype = KEY_RSA;
 113                                 }
 114                                 else if (streq(arg, "ecdsa"))
 115                                 {
 116                                         type = CRED_PRIVATE_KEY;
 117                                         subtype = KEY_ECDSA;
 118                                 }
 119                                 else if (streq(arg, "ed25519"))
 120                                 {
 121                                         type = CRED_PRIVATE_KEY;
 122                                         subtype = KEY_ED25519;
 123                                 }
 124                                 else if (streq(arg, "bliss"))
 125                                 {
 126                                         type = CRED_PRIVATE_KEY;
 127                                         subtype = KEY_BLISS;
 128                                 }
 129                                 else if (streq(arg, "priv"))
 130                                 {
 131                                         type = CRED_PRIVATE_KEY;
 132                                         subtype = KEY_ANY;
 133                                 }
 134                                 else if (!streq(arg, "pub"))
 135                                 {
 136                                         error = "invalid input type";
 137                                         goto usage;
 138                                 }
 139                                 continue;
 140                         case 'g':
 141                                 if (!enum_from_name(hash_algorithm_short_names, arg, &digest))
 142                                 {
 143                                         error = "invalid --digest type";
 144                                         goto usage;
 145                                 }
 146                                 continue;
 147                         case 'R':
 148                                 if (streq(arg, "pss"))
 149                                 {
 150                                         pss = TRUE;
 151                                 }
 152                                 else if (!streq(arg, "pkcs1"))
 153                                 {
 154                                         error = "invalid RSA padding";
 155                                         goto usage;
 156                                 }
 157                                 continue;
 158                         case 'i':
 159                                 file = arg;
 160                                 continue;
 161                         case 'c':
 162                                 cacert = arg;
 163                                 continue;
 164                         case 'k':
 165                                 cakey = arg;
 166                                 continue;
 167                         case 'x':
 168                                 keyid = arg;
 169                                 continue;
 170                         case 'd':
 171                                 dn = arg;
 172                                 continue;
 173                         case 'a':
 174                                 san->insert_last(san, identification_create_from_string(arg));
 175                                 continue;
 176                         case 'l':
 177                                 lifetime = atoi(arg) * 24 * 60 * 60;
 178                                 if (!lifetime)
 179                                 {
 180                                         error = "invalid --lifetime value";
 181                                         goto usage;
 182                                 }
 183                                 continue;
 184                         case 'D':
 185                                 dateform = arg;
 186                                 continue;
 187                         case 'F':
 188                                 datenb = arg;
 189                                 continue;
 190                         case 'T':
 191                                 datena = arg;
 192                                 continue;
 193                         case 's':
 194                                 hex = arg;
 195                                 continue;
 196                         case 'b':
 197                                 flags |= X509_CA;
 198                                 continue;
 199                         case 'p':
 200                                 pathlen = atoi(arg);
 201                                 continue;
 202                         case 'B':
 203                                 ts = parse_ts(arg);
 204                                 if (!ts)
 205                                 {
 206                                         error = "invalid addressBlock";
 207                                         goto usage;
 208                                 }
 209                                 addrblocks->insert_last(addrblocks, ts);
 210                                 continue;
 211                         case 'n':
 212                                 permitted->insert_last(permitted,
 213                                                                            identification_create_from_string(arg));
 214                                 continue;
 215                         case 'N':
 216                                 excluded->insert_last(excluded,
 217                                                                           identification_create_from_string(arg));
 218                                 continue;
 219                         case 'P':
 220                         {
 221                                 chunk_t oid;
 222
 223                                 oid = asn1_oid_from_string(arg);
 224                                 if (!oid.len)
 225                                 {
 226                                         error = "--cert-policy OID invalid";
 227                                         goto usage;
 228                                 }
 229                                 INIT(policy,
 230                                         .oid = oid,
 231                                 );
 232                                 policies->insert_last(policies, policy);
 233                                 continue;
 234                         }
 235                         case 'C':
 236                                 if (!policy)
 237                                 {
 238                                         error = "--cps-uri must follow a --cert-policy";
 239                                         goto usage;
 240                                 }
 241                                 policy->cps_uri = arg;
 242                                 continue;
 243                         case 'U':
 244                                 if (!policy)
 245                                 {
 246                                         error = "--user-notice must follow a --cert-policy";
 247                                         goto usage;
 248                                 }
 249                                 policy->unotice_text = arg;
 250                                 continue;
 251                         case 'M':
 252                         {
 253                                 char *pos = strchr(arg, ':');
 254                                 x509_policy_mapping_t *mapping;
 255                                 chunk_t subject_oid, issuer_oid;
 256
 257                                 if (pos)
 258                                 {
 259                                         *pos++ = '\0';
 260                                         issuer_oid = asn1_oid_from_string(arg);
 261                                         subject_oid = asn1_oid_from_string(pos);
 262                                 }
 263                                 if (!pos || !issuer_oid.len || !subject_oid.len)
 264                                 {
 265                                         error = "--policy-map OIDs invalid";
 266                                         goto usage;
 267                                 }
 268                                 INIT(mapping,
 269                                         .issuer = issuer_oid,
 270                                         .subject = subject_oid,
 271                                 );
 272                                 mappings->insert_last(mappings, mapping);
 273                                 continue;
 274                         }
 275                         case 'E':
 276                                 require_explicit = atoi(arg);
 277                                 continue;
 278                         case 'H':
 279                                 inhibit_mapping = atoi(arg);
 280                                 continue;
 281                         case 'A':
 282                                 inhibit_any = atoi(arg);
 283                                 continue;
 284                         case 'e':
 285                                 if (streq(arg, "serverAuth"))
 286                                 {
 287                                         flags |= X509_SERVER_AUTH;
 288                                 }
 289                                 else if (streq(arg, "clientAuth"))
 290                                 {
 291                                         flags |= X509_CLIENT_AUTH;
 292                                 }
 293                                 else if (streq(arg, "ikeIntermediate"))
 294                                 {
 295                                         flags |= X509_IKE_INTERMEDIATE;
 296                                 }
 297                                 else if (streq(arg, "crlSign"))
 298                                 {
 299                                         flags |= X509_CRL_SIGN;
 300                                 }
 301                                 else if (streq(arg, "ocspSigning"))
 302                                 {
 303                                         flags |= X509_OCSP_SIGNER;
 304                                 }
 305                                 else if (streq(arg, "msSmartcardLogon"))
 306                                 {
 307                                         flags |= X509_MS_SMARTCARD_LOGON;
 308                                 }
 309                                 continue;
 310                         case 'f':
 311                                 if (!get_form(arg, &form, CRED_CERTIFICATE))
 312                                 {
 313                                         error = "invalid output format";
 314                                         goto usage;
 315                                 }
 316                                 continue;
 317                         case 'u':
 318                                 INIT(cdp,
 319                                         .uri = arg,
 320                                 );
 321                                 cdps->insert_last(cdps, cdp);
 322                                 continue;
 323                         case 'I':
 324                                 if (!cdp || cdp->issuer)
 325                                 {
 326                                         error = "--crlissuer must follow a --crl";
 327                                         goto usage;
 328                                 }
 329                                 cdp->issuer = identification_create_from_string(arg);
 330                                 continue;
 331                         case 'o':
 332                                 ocsp->insert_last(ocsp, arg);
 333                                 continue;
 334                         case EOF:
 335                                 break;
 336                         default:
 337                                 error = "invalid --issue option";
 338                                 goto usage;
 339                 }
 340                 break;
 341         }
 342
 343         if (!cacert)
 344         {
 345                 error = "--cacert is required";
 346                 goto usage;
 347         }
 348         if (!cakey && !keyid)
 349         {
 350                 error = "--cakey or --keyid is required";
 351                 goto usage;
 352         }
 353         if (!calculate_lifetime(dateform, datenb, datena, lifetime,
 354                                                         &not_before, &not_after))
 355         {
 356                 error = "invalid --not-before/after datetime";
 357                 goto usage;
 358         }
 359         if (dn && *dn)
 360         {
 361                 id = identification_create_from_string(dn);
 362                 if (id->get_type(id) != ID_DER_ASN1_DN)
 363                 {
 364                         error = "supplied --dn is not a distinguished name";
 365                         goto end;
 366                 }
 367         }
 368
 369         DBG2(DBG_LIB, "Reading ca certificate:");
 370         ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 371                                                         BUILD_FROM_FILE, cacert, BUILD_END);
 372         if (!ca)
 373         {
 374                 error = "parsing CA certificate failed";
 375                 goto end;
 376         }
 377         x509 = (x509_t*)ca;
 378         if (!(x509->get_flags(x509) & X509_CA))
 379         {
 380                 error = "CA certificate misses CA basicConstraint";
 381                 goto end;
 382         }
 383         public = ca->get_public_key(ca);
 384         if (!public)
 385         {
 386                 error = "extracting CA certificate public key failed";
 387                 goto end;
 388         }
 389
 390         DBG2(DBG_LIB, "Reading ca private key:");
 391         if (cakey)
 392         {
 393                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 394                                                                          public->get_type(public),
 395                                                                          BUILD_FROM_FILE, cakey, BUILD_END);
 396         }
 397         else
 398         {
 399                 chunk_t chunk;
 400
 401                 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
 402                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
 403                                                                          BUILD_PKCS11_KEYID, chunk, BUILD_END);
 404                 free(chunk.ptr);
 405         }
 406         if (!private)
 407         {
 408                 error = "loading CA private key failed";
 409                 goto end;
 410         }
 411         if (!private->belongs_to(private, public))
 412         {
 413                 error = "CA private key does not match CA certificate";
 414                 goto end;
 415         }
 416         public->destroy(public);
 417         public = NULL;
 418
 419         if (hex)
 420         {
 421                 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
 422         }
 423         else
 424         {
 425                 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 426
 427                 if (!rng)
 428                 {
 429                         error = "no random number generator found";
 430                         goto end;
 431                 }
 432                 if (!rng_allocate_bytes_not_zero(rng, 8, &serial, FALSE))
 433                 {
 434                         error = "failed to generate serial number";
 435                         rng->destroy(rng);
 436                         goto end;
 437                 }
 438                 serial.ptr[0] &= 0x7F;
 439                 rng->destroy(rng);
 440         }
 441
 442         if (pkcs10)
 443         {
 444                 enumerator_t *enumerator;
 445                 identification_t *subjectAltName;
 446                 pkcs10_t *req;
 447
 448                 DBG2(DBG_LIB, "Reading certificate request");
 449                 if (file)
 450                 {
 451                         cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 452                                                                                   CERT_PKCS10_REQUEST,
 453                                                                                   BUILD_FROM_FILE, file, BUILD_END);
 454                 }
 455                 else
 456                 {
 457                         chunk_t chunk;
 458
 459                         set_file_mode(stdin, CERT_ASN1_DER);
 460                         if (!chunk_from_fd(0, &chunk))
 461                         {
 462                                 fprintf(stderr, "%s: ", strerror(errno));
 463                                 error = "reading certificate request failed";
 464                                 goto end;
 465                         }
 466                         cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 467                                                                                   CERT_PKCS10_REQUEST,
 468                                                                                   BUILD_BLOB, chunk, BUILD_END);
 469                         free(chunk.ptr);
 470                 }
 471                 if (!cert_req)
 472                 {
 473                         error = "parsing certificate request failed";
 474                         goto end;
 475                 }
 476
 477                 /* If not set yet use subject from PKCS#10 certificate request as DN */
 478                 if (!id)
 479                 {
 480                         id = cert_req->get_subject(cert_req);
 481                         id = id->clone(id);
 482                 }
 483
 484                 /* Add subjectAltNames from PKCS#10 certificate request */
 485                 req = (pkcs10_t*)cert_req;
 486                 enumerator = req->create_subjectAltName_enumerator(req);
 487                 while (enumerator->enumerate(enumerator, &subjectAltName))
 488                 {
 489                         san->insert_last(san, subjectAltName->clone(subjectAltName));
 490                 }
 491                 enumerator->destroy(enumerator);
 492
 493                 /* Use public key from PKCS#10 certificate request */
 494                 public = cert_req->get_public_key(cert_req);
 495         }
 496         else
 497         {
 498                 DBG2(DBG_LIB, "Reading key:");
 499                 if (file)
 500                 {
 501                         public = lib->creds->create(lib->creds, type, subtype,
 502                                                                                 BUILD_FROM_FILE, file, BUILD_END);
 503                 }
 504                 else
 505                 {
 506                         chunk_t chunk;
 507
 508                         if (!chunk_from_fd(0, &chunk))
 509                         {
 510                                 fprintf(stderr, "%s: ", strerror(errno));
 511                                 error = "reading key failed";
 512                                 goto end;
 513                         }
 514                         public = lib->creds->create(lib->creds, type, subtype,
 515                                                                                  BUILD_BLOB, chunk, BUILD_END);
 516                         free(chunk.ptr);
 517                 }
 518                 if (public && type == CRED_PRIVATE_KEY)
 519                 {
 520                         private_key_t *priv = (private_key_t*)public;
 521                         public = priv->get_public_key(priv);
 522                         priv->destroy(priv);
 523                 }
 524         }
 525         if (!public)
 526         {
 527                 error = "parsing public key failed";
 528                 goto end;
 529         }
 530
 531         if (!id)
 532         {
 533                 id = identification_create_from_encoding(ID_DER_ASN1_DN,
 534                                                                                 chunk_from_chars(ASN1_SEQUENCE, 0));
 535         }
 536         scheme = get_signature_scheme(private, digest, pss);
 537
 538         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 539                                         BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
 540                                         BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
 541                                         BUILD_NOT_BEFORE_TIME, not_before,
 542                                         BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
 543                                         BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
 544                                         BUILD_PATHLEN, pathlen, BUILD_ADDRBLOCKS, addrblocks,
 545                                         BUILD_CRL_DISTRIBUTION_POINTS, cdps,
 546                                         BUILD_OCSP_ACCESS_LOCATIONS, ocsp,
 547                                         BUILD_PERMITTED_NAME_CONSTRAINTS, permitted,
 548                                         BUILD_EXCLUDED_NAME_CONSTRAINTS, excluded,
 549                                         BUILD_CERTIFICATE_POLICIES, policies,
 550                                         BUILD_POLICY_MAPPINGS, mappings,
 551                                         BUILD_POLICY_REQUIRE_EXPLICIT, require_explicit,
 552                                         BUILD_POLICY_INHIBIT_MAPPING, inhibit_mapping,
 553                                         BUILD_POLICY_INHIBIT_ANY, inhibit_any,
 554                                         BUILD_SIGNATURE_SCHEME, scheme,
 555                                         BUILD_END);
 556         if (!cert)
 557         {
 558                 error = "generating certificate failed";
 559                 goto end;
 560         }
 561         if (!cert->get_encoding(cert, form, &encoding))
 562         {
 563                 error = "encoding certificate failed";
 564                 goto end;
 565         }
 566         set_file_mode(stdout, form);
 567         if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
 568         {
 569                 error = "writing certificate key failed";
 570                 goto end;
 571         }
 572
 573 end:
 574         DESTROY_IF(id);
 575         DESTROY_IF(cert_req);
 576         DESTROY_IF(cert);
 577         DESTROY_IF(ca);
 578         DESTROY_IF(public);
 579         DESTROY_IF(private);
 580         san->destroy_offset(san, offsetof(identification_t, destroy));
 581         permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
 582         excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
 583         addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy));
 584         policies->destroy_function(policies, (void*)destroy_cert_policy);
 585         mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
 586         cdps->destroy_function(cdps, (void*)destroy_cdp);
 587         ocsp->destroy(ocsp);
 588         signature_params_destroy(scheme);
 589         free(encoding.ptr);
 590         free(serial.ptr);
 591
 592         if (error)
 593         {
 594                 fprintf(stderr, "%s\n", error);
 595                 return 1;
 596         }
 597         return 0;
 598
 599 usage:
 600         san->destroy_offset(san, offsetof(identification_t, destroy));
 601         permitted->destroy_offset(permitted, offsetof(identification_t, destroy));
 602         excluded->destroy_offset(excluded, offsetof(identification_t, destroy));
 603         addrblocks->destroy_offset(addrblocks, offsetof(traffic_selector_t, destroy));
 604         policies->destroy_function(policies, (void*)destroy_cert_policy);
 605         mappings->destroy_function(mappings, (void*)destroy_policy_mapping);
 606         cdps->destroy_function(cdps, (void*)destroy_cdp);
 607         ocsp->destroy(ocsp);
 608         return command_usage(error);
 609 }
 610
 611 /**
 612  * Register the command.
 613  */
 614 static void __attribute__ ((constructor))reg()
 615 {
 616         command_register((command_t) {
 617                 issue, 'i', "issue",
 618                 "issue a certificate using a CA certificate and key",
 619                 {"[--in file] [--type pub|pkcs10|priv|rsa|ecdsa|ed25519|bliss] --cakey file|--cakeyid hex",
 620                  " --cacert file [--dn subject-dn] [--san subjectAltName]+",
 621                  "[--lifetime days] [--serial hex] [--ca] [--pathlen len]",
 622                  "[--flag serverAuth|clientAuth|crlSign|ocspSigning|msSmartcardLogon]+",
 623                  "[--crl uri [--crlissuer i]]+ [--ocsp uri]+ [--nc-permitted name]",
 624                  "[--nc-excluded name] [--policy-mapping issuer-oid:subject-oid]",
 625                  "[--policy-explicit len] [--policy-inhibit len] [--policy-any len]",
 626                  "[--cert-policy oid [--cps-uri uri] [--user-notice text]]+",
 627                  "[--digest md5|sha1|sha224|sha256|sha384|sha512|sha3_224|sha3_256|sha3_384|sha3_512]",
 628                  "[--rsa-padding pkcs1|pss]",
 629                  "[--outform der|pem]"},
 630                 {
 631                         {"help",                        'h', 0, "show usage information"},
 632                         {"in",                          'i', 1, "key/request file to issue, default: stdin"},
 633                         {"type",                        't', 1, "type of input, default: pub"},
 634                         {"cacert",                      'c', 1, "CA certificate file"},
 635                         {"cakey",                       'k', 1, "CA private key file"},
 636                         {"cakeyid",                     'x', 1, "smartcard or TPM CA private key object handle"},
 637                         {"dn",                          'd', 1, "distinguished name to include as subject"},
 638                         {"san",                         'a', 1, "subjectAltName to include in certificate"},
 639                         {"lifetime",            'l', 1, "days the certificate is valid, default: 1095"},
 640                         {"not-before",          'F', 1, "date/time the validity of the cert starts"},
 641                         {"not-after",           'T', 1, "date/time the validity of the cert ends"},
 642                         {"dateform",            'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
 643                         {"serial",                      's', 1, "serial number in hex, default: random"},
 644                         {"ca",                          'b', 0, "include CA basicConstraint, default: no"},
 645                         {"pathlen",                     'p', 1, "set path length constraint"},
 646                         {"addrblock",           'B', 1, "RFC 3779 addrBlock to include"},
 647                         {"nc-permitted",        'n', 1, "add permitted NameConstraint"},
 648                         {"nc-excluded",         'N', 1, "add excluded NameConstraint"},
 649                         {"cert-policy",         'P', 1, "certificatePolicy OID to include"},
 650                         {"cps-uri",                     'C', 1, "Certification Practice statement URI for certificatePolicy"},
 651                         {"user-notice",         'U', 1, "user notice for certificatePolicy"},
 652                         {"policy-mapping",      'M', 1, "policyMapping from issuer to subject OID"},
 653                         {"policy-explicit",     'E', 1, "requireExplicitPolicy constraint"},
 654                         {"policy-inhibit",      'H', 1, "inhibitPolicyMapping constraint"},
 655                         {"policy-any",          'A', 1, "inhibitAnyPolicy constraint"},
 656                         {"flag",                        'e', 1, "include extendedKeyUsage flag"},
 657                         {"crl",                         'u', 1, "CRL distribution point URI to include"},
 658                         {"crlissuer",           'I', 1, "CRL Issuer for CRL at distribution point"},
 659                         {"ocsp",                        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
 660                         {"digest",                      'g', 1, "digest for signature creation, default: key-specific"},
 661                         {"rsa-padding",         'R', 1, "padding for RSA signatures, default: pkcs1"},
 662                         {"outform",                     'f', 1, "encoding of generated cert, default: der"},
 663                 }
 664         });
 665 }