enable debug level setting
[strongswan.git] / src / pki / commands / issue.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <debug.h>
21 #include <utils/linked_list.h>
22 #include <utils/optionsfrom.h>
23 #include <credentials/certificates/certificate.h>
24 #include <credentials/certificates/x509.h>
25 #include <credentials/certificates/pkcs10.h>
26
27 /**
28 * Issue a certificate using a CA certificate and key
29 */
30 static int issue(int argc, char *argv[])
31 {
32 hash_algorithm_t digest = HASH_SHA1;
33 certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
34 private_key_t *private = NULL;
35 public_key_t *public = NULL;
36 bool pkcs10 = FALSE;
37 char *file = NULL, *dn = NULL, *hex = NULL, *cacert = NULL, *cakey = NULL;
38 char *error = NULL;
39 identification_t *id = NULL;
40 linked_list_t *san, *cdps, *ocsp;
41 int lifetime = 1080;
42 chunk_t serial = chunk_empty;
43 chunk_t encoding = chunk_empty;
44 time_t not_before, not_after;
45 x509_flag_t flags = 0;
46 x509_t *x509;
47 options_t *options;
48
49 options = options_create();
50 san = linked_list_create();
51 cdps = linked_list_create();
52 ocsp = linked_list_create();
53
54 while (TRUE)
55 {
56 switch (getopt_long(argc, argv, "", command_opts, NULL))
57 {
58 case 'h':
59 goto usage;
60 case 'v':
61 dbg_level = atoi(optarg);
62 continue;
63 case '+':
64 if (!options->from(options, optarg, &argc, &argv, optind))
65 {
66 error = "invalid options file";
67 goto usage;
68 }
69 continue;
70 case 't':
71 if (streq(optarg, "pkcs10"))
72 {
73 pkcs10 = TRUE;
74 }
75 else if (!streq(optarg, "pub"))
76 {
77 error = "invalid input type";
78 goto usage;
79 }
80 continue;
81 case 'g':
82 digest = get_digest(optarg);
83 if (digest == HASH_UNKNOWN)
84 {
85 error = "invalid --digest type";
86 goto usage;
87 }
88 continue;
89 case 'i':
90 file = optarg;
91 continue;
92 case 'c':
93 cacert = optarg;
94 continue;
95 case 'k':
96 cakey = optarg;
97 continue;
98 case 'd':
99 dn = optarg;
100 continue;
101 case 'a':
102 san->insert_last(san, identification_create_from_string(optarg));
103 continue;
104 case 'l':
105 lifetime = atoi(optarg);
106 if (!lifetime)
107 {
108 error = "invalid --lifetime value";
109 goto usage;
110 }
111 continue;
112 case 's':
113 hex = optarg;
114 continue;
115 case 'b':
116 flags |= X509_CA;
117 continue;
118 case 'u':
119 cdps->insert_last(cdps, optarg);
120 continue;
121 case 'o':
122 ocsp->insert_last(ocsp, optarg);
123 continue;
124 case EOF:
125 break;
126 default:
127 error = "invalid --issue option";
128 goto usage;
129 }
130 break;
131 }
132
133 if (!pkcs10 && !dn)
134 {
135 error = "--dn is required";
136 goto usage;
137 }
138 if (!cacert)
139 {
140 error = "--cacert is required";
141 goto usage;
142 }
143 if (!cakey)
144 {
145 error = "--cakey is required";
146 goto usage;
147 }
148 if (dn)
149 {
150 id = identification_create_from_string(dn);
151 if (id->get_type(id) != ID_DER_ASN1_DN)
152 {
153 error = "supplied --dn is not a distinguished name";
154 goto end;
155 }
156 }
157
158 DBG2("Reading ca certificate:");
159 ca = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
160 BUILD_FROM_FILE, cacert, BUILD_END);
161 if (!ca)
162 {
163 error = "parsing CA certificate failed";
164 goto end;
165 }
166 x509 = (x509_t*)ca;
167 if (!(x509->get_flags(x509) & X509_CA))
168 {
169 error = "CA certificate misses CA basicConstraint";
170 goto end;
171 }
172 public = ca->get_public_key(ca);
173 if (!public)
174 {
175 error = "extracting CA certificate public key failed";
176 goto end;
177 }
178
179 DBG2("Reading ca private key:");
180 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
181 public->get_type(public),
182 BUILD_FROM_FILE, cakey, BUILD_END);
183 if (!private)
184 {
185 error = "parsing CA private key failed";
186 goto end;
187 }
188 if (!private->belongs_to(private, public))
189 {
190 error = "CA private key does not match CA certificate";
191 goto end;
192 }
193 public->destroy(public);
194
195 if (hex)
196 {
197 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
198 }
199 else
200 {
201 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
202
203 if (!rng)
204 {
205 error = "no random number generator found";
206 goto end;
207 }
208 rng->allocate_bytes(rng, 8, &serial);
209 rng->destroy(rng);
210 }
211
212 if (pkcs10)
213 {
214 enumerator_t *enumerator;
215 identification_t *subjectAltName;
216 pkcs10_t *req;
217
218 DBG2("Reading certificate request");
219 if (file)
220 {
221 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
222 CERT_PKCS10_REQUEST,
223 BUILD_FROM_FILE, file, BUILD_END);
224 }
225 else
226 {
227 cert_req = lib->creds->create(lib->creds, CRED_CERTIFICATE,
228 CERT_PKCS10_REQUEST,
229 BUILD_FROM_FD, 0, BUILD_END);
230 }
231 if (!cert_req)
232 {
233 error = "parsing certificate request failed";
234 goto end;
235 }
236
237 /* If not set yet use subject from PKCS#10 certificate request as DN */
238 if (!id)
239 {
240 id = cert_req->get_subject(cert_req);
241 id = id->clone(id);
242 }
243
244 /* Add subjectAltNames from PKCS#10 certificate request */
245 req = (pkcs10_t*)cert_req;
246 enumerator = req->create_subjectAltName_enumerator(req);
247 while (enumerator->enumerate(enumerator, &subjectAltName))
248 {
249 san->insert_last(san, subjectAltName->clone(subjectAltName));
250 }
251 enumerator->destroy(enumerator);
252
253 /* Use public key from PKCS#10 certificate request */
254 public = cert_req->get_public_key(cert_req);
255 }
256 else
257 {
258 DBG2("Reading public key:");
259 if (file)
260 {
261 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
262 BUILD_FROM_FILE, file, BUILD_END);
263 }
264 else
265 {
266 public = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
267 BUILD_FROM_FD, 0, BUILD_END);
268 }
269 }
270 if (!public)
271 {
272 error = "parsing public key failed";
273 goto end;
274 }
275
276 not_before = time(NULL);
277 not_after = not_before + lifetime * 24 * 60 * 60;
278
279 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
280 BUILD_SIGNING_KEY, private, BUILD_SIGNING_CERT, ca,
281 BUILD_PUBLIC_KEY, public, BUILD_SUBJECT, id,
282 BUILD_NOT_BEFORE_TIME, not_before, BUILD_DIGEST_ALG, digest,
283 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
284 BUILD_SUBJECT_ALTNAMES, san, BUILD_X509_FLAG, flags,
285 BUILD_CRL_DISTRIBUTION_POINTS, cdps,
286 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
287 if (!cert)
288 {
289 error = "generating certificate failed";
290 goto end;
291 }
292 encoding = cert->get_encoding(cert);
293 if (!encoding.ptr)
294 {
295 error = "encoding certificate failed";
296 goto end;
297 }
298 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
299 {
300 error = "writing certificate key failed";
301 goto end;
302 }
303
304 end:
305 DESTROY_IF(id);
306 DESTROY_IF(cert_req);
307 DESTROY_IF(cert);
308 DESTROY_IF(ca);
309 DESTROY_IF(public);
310 DESTROY_IF(private);
311 san->destroy_offset(san, offsetof(identification_t, destroy));
312 cdps->destroy(cdps);
313 ocsp->destroy(ocsp);
314 options->destroy(options);
315 free(encoding.ptr);
316 free(serial.ptr);
317
318 if (error)
319 {
320 fprintf(stderr, "%s\n", error);
321 return 1;
322 }
323 return 0;
324
325 usage:
326 san->destroy_offset(san, offsetof(identification_t, destroy));
327 cdps->destroy(cdps);
328 ocsp->destroy(ocsp);
329 options->destroy(options);
330 return command_usage(error);
331 }
332
333 /**
334 * Register the command.
335 */
336 static void __attribute__ ((constructor))reg()
337 {
338 command_register((command_t) {
339 issue, 'i', "issue",
340 "issue a certificate using a CA certificate and key",
341 {"[--in file] [--type pub|pkcs10]",
342 " --cacert file --cakey file --dn subject-dn [--san subjectAltName]+",
343 "[--lifetime days] [--serial hex] [--ca] [--crl uri]+ [--ocsp uri]+",
344 "[--digest md5|sha1|sha224|sha256|sha384|sha512]",
345 "[--options file]"},
346 {
347 {"help", 'h', 0, "show usage information"},
348 {"in", 'i', 1, "public key/request file to issue, default: stdin"},
349 {"type", 't', 1, "type of input, default: pub"},
350 {"cacert", 'c', 1, "CA certificate file"},
351 {"cakey", 'k', 1, "CA private key file"},
352 {"dn", 'd', 1, "distinguished name to include as subject"},
353 {"san", 'a', 1, "subjectAltName to include in certificate"},
354 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
355 {"serial", 's', 1, "serial number in hex, default: random"},
356 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
357 {"crl", 'u', 1, "CRL distribution point URI to include"},
358 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
359 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
360 {"debug", 'v', 1, "set debug level, default: 1"},
361 {"options", '+', 1, "read command line options from file"},
362 }
363 });
364 }
365