pki tool shows and builds crlSign keyUsage
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <credentials/certificates/certificate.h>
22 #include <credentials/certificates/x509.h>
23
24 /**
25 * Create a self signed certificate.
26 */
27 static int self()
28 {
29 cred_encoding_type_t form = CERT_ASN1_DER;
30 key_type_t type = KEY_RSA;
31 hash_algorithm_t digest = HASH_SHA1;
32 certificate_t *cert = NULL;
33 private_key_t *private = NULL;
34 public_key_t *public = NULL;
35 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL, *keyid = NULL;
36 identification_t *id = NULL;
37 linked_list_t *san, *ocsp;
38 int lifetime = 1095;
39 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
40 chunk_t serial = chunk_empty;
41 chunk_t encoding = chunk_empty;
42 time_t not_before, not_after;
43 x509_flag_t flags = 0;
44 char *arg;
45
46 san = linked_list_create();
47 ocsp = linked_list_create();
48
49 while (TRUE)
50 {
51 switch (command_getopt(&arg))
52 {
53 case 'h':
54 goto usage;
55 case 't':
56 if (streq(arg, "rsa"))
57 {
58 type = KEY_RSA;
59 }
60 else if (streq(arg, "ecdsa"))
61 {
62 type = KEY_ECDSA;
63 }
64 else
65 {
66 error = "invalid input type";
67 goto usage;
68 }
69 continue;
70 case 'g':
71 digest = get_digest(arg);
72 if (digest == HASH_UNKNOWN)
73 {
74 error = "invalid --digest type";
75 goto usage;
76 }
77 continue;
78 case 'i':
79 file = arg;
80 continue;
81 case 'x':
82 keyid = arg;
83 continue;
84 case 'd':
85 dn = arg;
86 continue;
87 case 'a':
88 san->insert_last(san, identification_create_from_string(arg));
89 continue;
90 case 'l':
91 lifetime = atoi(arg);
92 if (!lifetime)
93 {
94 error = "invalid --lifetime value";
95 goto usage;
96 }
97 continue;
98 case 's':
99 hex = arg;
100 continue;
101 case 'b':
102 flags |= X509_CA;
103 continue;
104 case 'p':
105 pathlen = atoi(arg);
106 continue;
107 case 'e':
108 if (streq(arg, "serverAuth"))
109 {
110 flags |= X509_SERVER_AUTH;
111 }
112 else if (streq(arg, "clientAuth"))
113 {
114 flags |= X509_CLIENT_AUTH;
115 }
116 else if (streq(arg, "crlSign"))
117 {
118 flags |= X509_CRL_SIGN;
119 }
120 else if (streq(arg, "ocspSigning"))
121 {
122 flags |= X509_OCSP_SIGNER;
123 }
124 continue;
125 case 'f':
126 if (!get_form(arg, &form, CRED_CERTIFICATE))
127 {
128 return command_usage("invalid output format");
129 }
130 continue;
131 case 'o':
132 ocsp->insert_last(ocsp, arg);
133 continue;
134 case EOF:
135 break;
136 default:
137 error = "invalid --self option";
138 goto usage;
139 }
140 break;
141 }
142
143 if (!dn)
144 {
145 error = "--dn is required";
146 goto usage;
147 }
148 id = identification_create_from_string(dn);
149 if (id->get_type(id) != ID_DER_ASN1_DN)
150 {
151 error = "supplied --dn is not a distinguished name";
152 goto end;
153 }
154 if (file)
155 {
156 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
157 BUILD_FROM_FILE, file, BUILD_END);
158 }
159 else if (keyid)
160 {
161 chunk_t chunk;
162
163 chunk = chunk_from_hex(chunk_create(keyid, strlen(keyid)), NULL);
164 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_ANY,
165 BUILD_PKCS11_KEYID, chunk, BUILD_END);
166 free(chunk.ptr);
167 }
168 else
169 {
170 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
171 BUILD_FROM_FD, 0, BUILD_END);
172 }
173 if (!private)
174 {
175 error = "loading private key failed";
176 goto end;
177 }
178 public = private->get_public_key(private);
179 if (!public)
180 {
181 error = "extracting public key failed";
182 goto end;
183 }
184 if (hex)
185 {
186 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
187 }
188 else
189 {
190 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
191
192 if (!rng)
193 {
194 error = "no random number generator found";
195 goto end;
196 }
197 rng->allocate_bytes(rng, 8, &serial);
198 while (*serial.ptr == 0x00)
199 {
200 /* we don't accept a serial number with leading zeroes */
201 rng->get_bytes(rng, 1, serial.ptr);
202 }
203 rng->destroy(rng);
204 }
205 not_before = time(NULL);
206 not_after = not_before + lifetime * 24 * 60 * 60;
207 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
208 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
209 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
210 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
211 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
212 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
213 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
214 if (!cert)
215 {
216 error = "generating certificate failed";
217 goto end;
218 }
219 if (!cert->get_encoding(cert, form, &encoding))
220 {
221 error = "encoding certificate failed";
222 goto end;
223 }
224 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
225 {
226 error = "writing certificate key failed";
227 goto end;
228 }
229
230 end:
231 DESTROY_IF(id);
232 DESTROY_IF(cert);
233 DESTROY_IF(public);
234 DESTROY_IF(private);
235 san->destroy_offset(san, offsetof(identification_t, destroy));
236 ocsp->destroy(ocsp);
237 free(encoding.ptr);
238 free(serial.ptr);
239
240 if (error)
241 {
242 fprintf(stderr, "%s\n", error);
243 return 1;
244 }
245 return 0;
246
247 usage:
248 san->destroy_offset(san, offsetof(identification_t, destroy));
249 ocsp->destroy(ocsp);
250 return command_usage(error);
251 }
252
253 /**
254 * Register the command.
255 */
256 static void __attribute__ ((constructor))reg()
257 {
258 command_register((command_t) {
259 self, 's', "self",
260 "create a self signed certificate",
261 {"[--in file | --keyid hex] [--type rsa|ecdsa]",
262 " --dn distinguished-name [--san subjectAltName]+",
263 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
264 "[--flag serverAuth|clientAuth|crlSign|ocspSigning]+",
265 "[--digest md5|sha1|sha224|sha256|sha384|sha512] [--outform der|pem]"},
266 {
267 {"help", 'h', 0, "show usage information"},
268 {"in", 'i', 1, "private key input file, default: stdin"},
269 {"keyid", 'x', 1, "keyid on smartcard of private key"},
270 {"type", 't', 1, "type of input key, default: rsa"},
271 {"dn", 'd', 1, "subject and issuer distinguished name"},
272 {"san", 'a', 1, "subjectAltName to include in certificate"},
273 {"lifetime",'l', 1, "days the certificate is valid, default: 1095"},
274 {"serial", 's', 1, "serial number in hex, default: random"},
275 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
276 {"pathlen", 'p', 1, "set path length constraint"},
277 {"flag", 'e', 1, "include extendedKeyUsage flag"},
278 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
279 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
280 {"outform", 'f', 1, "encoding of generated cert, default: der"},
281 }
282 });
283 }