Support extendedKeyUsage flags in self-signed certificates
[strongswan.git] / src / pki / commands / self.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include <time.h>
17
18 #include "pki.h"
19
20 #include <utils/linked_list.h>
21 #include <credentials/certificates/certificate.h>
22 #include <credentials/certificates/x509.h>
23
24 /**
25 * Create a self signed certificate.
26 */
27 static int self()
28 {
29 key_type_t type = KEY_RSA;
30 hash_algorithm_t digest = HASH_SHA1;
31 certificate_t *cert = NULL;
32 private_key_t *private = NULL;
33 public_key_t *public = NULL;
34 char *file = NULL, *dn = NULL, *hex = NULL, *error = NULL;
35 identification_t *id = NULL;
36 linked_list_t *san, *ocsp;
37 int lifetime = 1080;
38 int pathlen = X509_NO_PATH_LEN_CONSTRAINT;
39 chunk_t serial = chunk_empty;
40 chunk_t encoding = chunk_empty;
41 time_t not_before, not_after;
42 x509_flag_t flags = 0;
43 char *arg;
44
45 san = linked_list_create();
46 ocsp = linked_list_create();
47
48 while (TRUE)
49 {
50 switch (command_getopt(&arg))
51 {
52 case 'h':
53 goto usage;
54 case 't':
55 if (streq(arg, "rsa"))
56 {
57 type = KEY_RSA;
58 }
59 else if (streq(arg, "ecdsa"))
60 {
61 type = KEY_ECDSA;
62 }
63 else
64 {
65 error = "invalid input type";
66 goto usage;
67 }
68 continue;
69 case 'g':
70 digest = get_digest(arg);
71 if (digest == HASH_UNKNOWN)
72 {
73 error = "invalid --digest type";
74 goto usage;
75 }
76 continue;
77 case 'i':
78 file = arg;
79 continue;
80 case 'd':
81 dn = arg;
82 continue;
83 case 'a':
84 san->insert_last(san, identification_create_from_string(arg));
85 continue;
86 case 'l':
87 lifetime = atoi(arg);
88 if (!lifetime)
89 {
90 error = "invalid --lifetime value";
91 goto usage;
92 }
93 continue;
94 case 's':
95 hex = arg;
96 continue;
97 case 'b':
98 flags |= X509_CA;
99 continue;
100 case 'p':
101 pathlen = atoi(arg);
102 continue;
103 case 'f':
104 if (streq(arg, "serverAuth"))
105 {
106 flags |= X509_SERVER_AUTH;
107 }
108 else if (streq(arg, "clientAuth"))
109 {
110 flags |= X509_CLIENT_AUTH;
111 }
112 else if (streq(arg, "ocspSigning"))
113 {
114 flags |= X509_OCSP_SIGNER;
115 }
116 continue;
117 case 'o':
118 ocsp->insert_last(ocsp, arg);
119 continue;
120 case EOF:
121 break;
122 default:
123 error = "invalid --self option";
124 goto usage;
125 }
126 break;
127 }
128
129 if (!dn)
130 {
131 error = "--dn is required";
132 goto usage;
133 }
134 id = identification_create_from_string(dn);
135 if (id->get_type(id) != ID_DER_ASN1_DN)
136 {
137 error = "supplied --dn is not a distinguished name";
138 goto end;
139 }
140 if (file)
141 {
142 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
143 BUILD_FROM_FILE, file, BUILD_END);
144 }
145 else
146 {
147 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
148 BUILD_FROM_FD, 0, BUILD_END);
149 }
150 if (!private)
151 {
152 error = "parsing private key failed";
153 goto end;
154 }
155 public = private->get_public_key(private);
156 if (!public)
157 {
158 error = "extracting public key failed";
159 goto end;
160 }
161 if (hex)
162 {
163 serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
164 }
165 else
166 {
167 rng_t *rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
168
169 if (!rng)
170 {
171 error = "no random number generator found";
172 goto end;
173 }
174 rng->allocate_bytes(rng, 8, &serial);
175 while (*serial.ptr == 0x00)
176 {
177 /* we don't accept a serial number with leading zeroes */
178 rng->get_bytes(rng, 1, serial.ptr);
179 }
180 rng->destroy(rng);
181 }
182 not_before = time(NULL);
183 not_after = not_before + lifetime * 24 * 60 * 60;
184 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
185 BUILD_SIGNING_KEY, private, BUILD_PUBLIC_KEY, public,
186 BUILD_SUBJECT, id, BUILD_NOT_BEFORE_TIME, not_before,
187 BUILD_NOT_AFTER_TIME, not_after, BUILD_SERIAL, serial,
188 BUILD_DIGEST_ALG, digest, BUILD_X509_FLAG, flags,
189 BUILD_PATHLEN, pathlen, BUILD_SUBJECT_ALTNAMES, san,
190 BUILD_OCSP_ACCESS_LOCATIONS, ocsp, BUILD_END);
191 if (!cert)
192 {
193 error = "generating certificate failed";
194 goto end;
195 }
196 encoding = cert->get_encoding(cert);
197 if (!encoding.ptr)
198 {
199 error = "encoding certificate failed";
200 goto end;
201 }
202 if (fwrite(encoding.ptr, encoding.len, 1, stdout) != 1)
203 {
204 error = "writing certificate key failed";
205 goto end;
206 }
207
208 end:
209 DESTROY_IF(id);
210 DESTROY_IF(cert);
211 DESTROY_IF(public);
212 DESTROY_IF(private);
213 san->destroy_offset(san, offsetof(identification_t, destroy));
214 ocsp->destroy(ocsp);
215 free(encoding.ptr);
216 free(serial.ptr);
217
218 if (error)
219 {
220 fprintf(stderr, "%s\n", error);
221 return 1;
222 }
223 return 0;
224
225 usage:
226 san->destroy_offset(san, offsetof(identification_t, destroy));
227 ocsp->destroy(ocsp);
228 return command_usage(error);
229 }
230
231 /**
232 * Register the command.
233 */
234 static void __attribute__ ((constructor))reg()
235 {
236 command_register((command_t) {
237 self, 's', "self",
238 "create a self signed certificate",
239 {"[--in file] [--type rsa|ecdsa]",
240 " --dn distinguished-name [--san subjectAltName]+",
241 "[--lifetime days] [--serial hex] [--ca] [--ocsp uri]+",
242 "[--flag serverAuth|clientAuth|ocspSigning]+",
243 "[--digest md5|sha1|sha224|sha256|sha384|sha512]"},
244 {
245 {"help", 'h', 0, "show usage information"},
246 {"in", 'i', 1, "private key input file, default: stdin"},
247 {"type", 't', 1, "type of input key, default: rsa"},
248 {"dn", 'd', 1, "subject and issuer distinguished name"},
249 {"san", 'a', 1, "subjectAltName to include in certificate"},
250 {"lifetime",'l', 1, "days the certificate is valid, default: 1080"},
251 {"serial", 's', 1, "serial number in hex, default: random"},
252 {"ca", 'b', 0, "include CA basicConstraint, default: no"},
253 {"pathlen", 'p', 1, "set path length constraint"},
254 {"flag", 'f', 1, "include extendedKeyUsage flag"},
255 {"ocsp", 'o', 1, "OCSP AuthorityInfoAccess URI to include"},
256 {"digest", 'g', 1, "digest for signature creation, default: sha1"},
257 }
258 });
259 }