cmd-crypto/pktool/gencert.c

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys/*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER START
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * The contents of this file are subject to the terms of the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Common Development and Distribution License (the "License").
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You may not use this file except in compliance with the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * or http://www.opensolaris.org/os/licensing.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * See the License for the specific language governing permissions
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * and limitations under the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * When distributing Covered Code, include this CDDL HEADER in each
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If applicable, add the following below this CDDL HEADER, with the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * fields enclosed by brackets "[]" replaced with your own identifying
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * information: Portions Copyright [yyyy] [name of copyright owner]
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER END
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll *
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <stdio.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <string.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <ctype.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <malloc.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <libgen.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <errno.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <cryptoutil.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <security/cryptoki.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include "common.h"
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <kmfapi.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define SET_VALUE(f, s) \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = f; \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) { \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            gettext("Failed to set %s: 0x%02x\n"), \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            s, kmfrv); \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup; \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic int
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencert_pkcs11(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *token, char *subject, char *altname,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype, int altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *certlabel, KMF_KEY_ALG keyAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen, uint32_t ltime, KMF_BIGINT *serial,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    uint16_t kubits, int kucrit, KMF_CREDENTIAL *tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    EKU_LIST *ekulist, KMF_OID *curveoid)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv = KMF_OK;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_CERTIFICATE signedCert;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certIssuer;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA x509DER;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[16];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEY_ALG keytype;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    uint32_t keylength;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&signedCert, 0, sizeof (signedCert));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certSubject, 0, sizeof (certSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certIssuer, 0, sizeof (certIssuer));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&x509DER, 0, sizeof (x509DER));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* For a self-signed cert, the issuser and subject are the same */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    keylength = keylen; /* bits */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    keytype = keyAlg;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* Select a PKCS11 token */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = select_token(kmfhandle, token, FALSE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    /*
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll     * Share the "genkeypair" routine for creating the keypair.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll     */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    kmfrv = genkeypair_pkcs11(kmfhandle, token, certlabel,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        keytype, keylength, tokencred, curveoid, &prik, &pubk);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (kmfrv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "keypair");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "serial number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "validity time");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "signature algorithm");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "subject name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "issuer name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype, altname), "subjectAltName");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits != 0)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "KeyUsage");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_cert_eku(&signedCert,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i], ekulist->critlist[i]),
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /*
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE_ATTR));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &signedCert, sizeof (KMF_X509_CERTIFICATE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll        &sigAlg, sizeof (sigAlg));
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    numattr++;
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * Store the cert in the DB.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (certlabel != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, strlen(certlabel));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_data(&x509DER);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certSubject);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certIssuer);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee    /*
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee     * If kmf_sign_cert or kmf_store_cert failed, then we need to clean up
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee     * the key pair from the token.
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee     */
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee    if (kmfrv != KMF_OK) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        /* delete the public key */
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr = 0;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            KMF_KEY_HANDLE_ATTR, &pubk, sizeof (KMF_KEY_HANDLE));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee                KMF_CREDENTIAL_ATTR, tokencred,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee                sizeof (KMF_CREDENTIAL));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        }
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            attrlist);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        /* delete the private key */
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr = 0;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            KMF_KEY_HANDLE_ATTR, &prik, sizeof (KMF_KEY_HANDLE));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            kmf_set_attr_at_index(attrlist, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee                KMF_CREDENTIAL_ATTR, tokencred,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee                sizeof (KMF_CREDENTIAL));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            numattr++;
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        }
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee        (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee            attrlist);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee    }
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic int
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencert_file(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg, KMF_ALGORITHM_INDEX sigAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen, KMF_ENCODE_FORMAT fmt,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint32_t ltime, char *subject, char *altname,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype, int altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_BIGINT *serial, uint16_t kubits, int kucrit,
448b8615fe9e8af757530284920a235430ead7e8wyllys    char *outcert, char *outkey,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    EKU_LIST *ekulist)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_CERTIFICATE signedCert;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certIssuer;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA x509DER;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *fullcertpath = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *fullkeypath = NULL;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[10];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&signedCert, 0, sizeof (signedCert));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certSubject, 0, sizeof (certSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certIssuer, 0, sizeof (certIssuer));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&x509DER, 0, sizeof (x509DER));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (EMPTYSTRING(outcert) || EMPTYSTRING(outkey)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("No output file was specified for "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "the cert or key\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
448b8615fe9e8af757530284920a235430ead7e8wyllys    fullcertpath = strdup(outcert);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (verify_file(fullcertpath)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Cannot write the indicated output "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "certificate file (%s).\n"), fullcertpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullcertpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
448b8615fe9e8af757530284920a235430ead7e8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed (%s)\n"), subject);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* For a self-signed cert, the issuser and subject are the same */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed (%s)\n"), subject);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_free_dn(&certSubject);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    /*
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll     * Share the "genkeypair" routine for creating the keypair.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll     */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    kmfrv = genkeypair_file(kmfhandle, keyAlg, keylen,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        fmt, outkey, &prik, &pubk);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (kmfrv != KMF_OK)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "keypair");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "serial number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "validity time");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "signature algorithm");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "subject name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "issuer name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype, altname), "subjectAltName");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits != 0)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "KeyUsage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_cert_eku(&signedCert,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i],
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekulist->critlist[i]), "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /*
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE_ATTR));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &signedCert, sizeof (KMF_X509_CERTIFICATE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll        &sigAlg, sizeof (sigAlg));
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    numattr++;
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * Store the cert in the DB.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_FILENAME_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        fullcertpath, strlen(fullcertpath));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &fmt, sizeof (fmt));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (fullkeypath != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullkeypath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (fullcertpath != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullcertpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_data(&x509DER);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certSubject);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certIssuer);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencert_nss(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *token, char *subject, char *altname,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype, int altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *nickname, char *dir, char *prefix,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen, char *trust,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint32_t ltime, KMF_BIGINT *serial, uint16_t kubits,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    int kucrit, KMF_CREDENTIAL *tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    EKU_LIST *ekulist, KMF_OID *curveoid)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_CERTIFICATE signedCert;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   certIssuer;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA x509DER;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[16];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (token == NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        token = DEFAULT_NSS_TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = configure_nss(kmfhandle, dir, prefix);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&signedCert, 0, sizeof (signedCert));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certSubject, 0, sizeof (certSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&certIssuer, 0, sizeof (certIssuer));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&x509DER, 0, sizeof (x509DER));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* For a self-signed cert, the issuser and subject are the same */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Subject name cannot be parsed.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    kmfrv = genkeypair_nss(kmfhandle, token, nickname, dir,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        prefix, keyAlg, keylen, tokencred, curveoid,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        &prik, &pubk);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (kmfrv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "keypair");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "serial number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "validity time");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "signature algorithm");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "subject name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "issuer name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype, altname), "subjectAltName");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits)
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "subjectAltName");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_cert_eku(&signedCert,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i],
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekulist->critlist[i]), "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /*
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE_ATTR));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &signedCert, sizeof (KMF_X509_CERTIFICATE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll        &sigAlg, sizeof (sigAlg));
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll    numattr++;
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * Store the cert in the DB.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &x509DER, sizeof (KMF_DATA));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (nickname != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            nickname, strlen(nickname));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (trust != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_TRUSTFLAG_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            trust, strlen(trust));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (token != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            token, strlen(token));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_data(&x509DER);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certSubject);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_dn(&certIssuer);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysint
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyspk_gencert(int argc, char *argv[])
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int rv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int opt;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    extern int  optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    extern char *optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEYSTORE_TYPE kstype = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *subject = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *tokenname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *dir = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *prefix = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *keytype = PK_DEFAULT_KEYTYPE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen = PK_DEFAULT_KEYLENGTH;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *trust = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *lifetime = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *certlabel = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *outcert = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *outkey = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *format = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *serstr = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *altname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *keyusagestr = NULL;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    char *ekustr = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    char *hashname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_BIGINT serial = { NULL, 0 };
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint32_t ltime;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_HANDLE_T kmfhandle = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg = KMF_RSA;
4165f46543b20d435f7ef0aced6239f7e97b12ffWyllys Ingersoll    KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_SHA1WithRSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    boolean_t interactive = B_FALSE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *subname = NULL;
6b35cb3cf158584a9408d44b9b6796564e8e1882Richard PALO    KMF_CREDENTIAL tokencred = { NULL, 0 };
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint16_t kubits = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int altcrit = 0, kucrit = 0;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    EKU_LIST *ekulist = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    KMF_OID *curveoid = NULL; /* ECC */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    KMF_OID *hashoid = NULL;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    int y_flag = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    while ((opt = getopt_av(argc, argv,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        "r:(trust)L:(lifetime)l:(label)c:(outcert)e:(eku)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        "K:(outkey)S:(serial)F:(format)u:(keyusage)C:(curve)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        "E(listcurves)h:(hash)")) != EOF) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        if (opt != 'i' && opt != 'E' && EMPTYSTRING(optarg_av))
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        switch (opt) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'A':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                altname = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'i':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (interactive || subject)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    interactive = B_TRUE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'k':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                kstype = KS2Int(optarg_av);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (kstype == 0)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 's':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (interactive || subject)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    subject = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'l':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'n':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (certlabel)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                certlabel = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'T':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (tokenname)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'd':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (dir)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                dir = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'p':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (prefix)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                prefix = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 't':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                keytype = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'u':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                keyusagestr = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'y':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (sscanf(optarg_av, "%d",
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                    &keylen) != 1) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                        gettext("key length must be"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                        "a numeric value (%s)\n"),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                        optarg_av);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                y_flag++;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'r':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (trust)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                trust = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'L':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (lifetime)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                lifetime = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'c':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (outcert)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                outcert = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'K':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (outkey)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                outkey = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'S':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                serstr = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'F':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (format)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                format = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            case 'e':
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekustr = optarg_av;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            case 'C':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                curveoid = ecc_name_to_oid(optarg_av);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                if (curveoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                        gettext("Unrecognized ECC "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                        "curve.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                break;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            case 'E':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                /*
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                 * This argument is only to be used
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                 * by itself, no other options should
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                 * be present.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                 */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                if (argc != 2) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                        gettext("listcurves has no other "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                        "options.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                show_ecc_curves();
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                return (0);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            case 'h':
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                hashname = optarg_av;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                hashoid = ecc_name_to_oid(optarg_av);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                if (hashoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                        gettext("Unrecognized hash.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                    return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            default:
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* No additional args allowed. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    argc -= optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    argv += optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (argc) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* Assume keystore = PKCS#11 if not specified. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == 0)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        kstype = KMF_KEYSTORE_PK11TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
2cbed7292737821015ab481353eb10e8346b2c05wyllys    if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (interactive && EMPTYSTRING(certlabel)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys            (void) get_certlabel(&certlabel);
2cbed7292737821015ab481353eb10e8346b2c05wyllys        }
2cbed7292737821015ab481353eb10e8346b2c05wyllys        /* It better not be empty now */
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (EMPTYSTRING(certlabel)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys            cryptoerror(LOG_STDERR, gettext("A label must be "
2cbed7292737821015ab481353eb10e8346b2c05wyllys                "specified to create a self-signed certificate."
2cbed7292737821015ab481353eb10e8346b2c05wyllys                "\n"));
2cbed7292737821015ab481353eb10e8346b2c05wyllys            return (PK_ERR_USAGE);
2cbed7292737821015ab481353eb10e8346b2c05wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else if (kstype == KMF_KEYSTORE_OPENSSL && EMPTYSTRING(outcert)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, gettext("A certificate filename must "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            "be specified to create a self-signed certificate.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
577f4726f2ea5aeaa2cf3dd65aca52869834b137wyllys    DIR_OPTION_CHECK(kstype, dir);
577f4726f2ea5aeaa2cf3dd65aca52869834b137wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            gettext("Error parsing format string (%s).\n"),
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            format);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (Str2Lifetime(lifetime, &ltime) != 0) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Error parsing lifetime string\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (Str2KeyType(keytype, hashoid, &keyAlg, &sigAlg) != 0) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        cryptoerror(LOG_STDERR,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            gettext("Unsupported key/hash combination (%s/%s).\n"),
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            keytype, (hashname ? hashname : "none"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (curveoid != NULL && keyAlg != KMF_ECDSA) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        cryptoerror(LOG_STDERR, gettext("EC curves are only "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            "valid for EC keytypes.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        return (PK_ERR_USAGE);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (keyAlg == KMF_ECDSA && curveoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        cryptoerror(LOG_STDERR, gettext("A curve must be "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            "specifed when using EC keys.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    /* Adjust default keylength for NSS and DSA */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (keyAlg == KMF_DSA && !y_flag && kstype == KMF_KEYSTORE_NSS)
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        keylen = 1024;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * Check the subject name.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * If interactive is true, get it now interactively.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (interactive) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        subname = NULL;
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (get_subname(&subname) != KMF_OK || subname == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("Failed to get the "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "subject name interactively.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (serstr == NULL) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys            (void) get_serial(&serstr);
2cbed7292737821015ab481353eb10e8346b2c05wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (EMPTYSTRING(subject)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("A subject name or "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "-i must be specified to create a self-signed "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "certificate.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            subname = strdup(subject);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (subname == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                cryptoerror(LOG_STDERR,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    gettext("Out of memory.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                return (PK_ERR_SYSTEM);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (serstr == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        (void) fprintf(stderr, gettext("A serial number "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "must be specified as a hex number when creating"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            " a self-signed certificate "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "(ex: serial=0x0102030405feedface)\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = PK_ERR_USAGE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        uchar_t *bytes = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        size_t bytelen;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (rv != KMF_OK || bytes == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            (void) fprintf(stderr, gettext("serial number "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "must be specified as a hex number "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "(ex: 0x0102030405ffeeddee)\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            rv = PK_ERR_USAGE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        serial.val = bytes;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        serial.len = bytelen;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = verify_altname(altname, &alttype, &altcrit);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (rv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            (void) fprintf(stderr, gettext("Subject AltName "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "must be specified as a name=value pair. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "See the man page for details.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            rv = PK_ERR_USAGE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            /* advance the altname past the '=' sign */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            char *p = strchr(altname, '=');
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (p != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                altname = p + 1;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (keyusagestr != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = verify_keyusage(keyusagestr, &kubits, &kucrit);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (rv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            (void) fprintf(stderr, gettext("KeyUsage "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "must be specified as a comma-separated list. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "See the man page for details.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            rv = PK_ERR_USAGE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekustr != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        rv = verify_ekunames(ekustr, &ekulist);
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        if (rv != KMF_OK) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            (void) fprintf(stderr, gettext("EKUs must "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "be specified as a comma-separated list. "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "See the man page for details.\n"));
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            rv = PK_ERR_USAGE;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            goto end;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        (void) fprintf(stderr, gettext("ECC certificates are"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            "only supported with the pkcs11 and nss keystores\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        rv = PK_ERR_USAGE;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll        goto end;
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (tokenname == NULL || !strlen(tokenname)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (kstype == KMF_KEYSTORE_NSS) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = "internal";
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            } else  {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = PK_DEFAULT_PK11TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        (void) get_token_password(kstype, tokenname, &tokencred);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == KMF_KEYSTORE_NSS) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (dir == NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            dir = PK_DEFAULT_DIRECTORY;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencert_nss(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokenname, subname, altname, alttype, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, dir, prefix, keyAlg, sigAlg, keylen,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            trust, ltime, &serial, kubits, kucrit, &tokencred,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            ekulist, curveoid);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencert_pkcs11(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokenname, subname, altname, alttype, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, keyAlg, sigAlg, keylen, ltime,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            &serial, kubits, kucrit, &tokencred, ekulist,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll            curveoid);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else if (kstype == KMF_KEYSTORE_OPENSSL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencert_file(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            keyAlg, sigAlg, keylen, fmt,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            ltime, subname, altname, alttype, altcrit,
448b8615fe9e8af757530284920a235430ead7e8wyllys            &serial, kubits, kucrit, outcert, outkey,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            ekulist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (rv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        display_error(kmfhandle, rv,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Error creating certificate and keypair"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysend:
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL)
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        free_eku_list(ekulist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (subname)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(subname);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (tokencred.cred != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(tokencred.cred);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (serial.val != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(serial.val);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_finalize(kmfhandle);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (rv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}