gencert.c revision 4165f46543b20d435f7ef0aced6239f7e97b12ff
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER START
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * The contents of this file are subject to the terms of the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Common Development and Distribution License (the "License").
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You may not use this file except in compliance with the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * See the License for the specific language governing permissions
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * and limitations under the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * When distributing Covered Code, include this CDDL HEADER in each
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If applicable, add the following below this CDDL HEADER, with the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * fields enclosed by brackets "[]" replaced with your own identifying
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * information: Portions Copyright [yyyy] [name of copyright owner]
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER END
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Use is subject to license terms.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define SET_VALUE(f, s) \
d00756ccb34596a328f8a15d1965da5412d366d0wyllys uint16_t kubits, int kucrit, KMF_CREDENTIAL *tokencred,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memset(&certSubject, 0, sizeof (certSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* For a self-signed cert, the issuser and subject are the same */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Select a PKCS11 token */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "keypair");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "serial number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "validity time");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "signature algorithm");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "subject name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "issuer name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "KeyUsage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "Extended Key Usage");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Store the cert in the DB.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee * If kmf_sign_cert or kmf_store_cert failed, then we need to clean up
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee * the key pair from the token.
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee /* delete the public key */
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEY_HANDLE_ATTR, &pubk, sizeof (KMF_KEY_HANDLE));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee /* delete the private key */
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEY_HANDLE_ATTR, &prik, sizeof (KMF_KEY_HANDLE));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memset(&certSubject, 0, sizeof (certSubject));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "the cert or key\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys gettext("Subject name cannot be parsed (%s)\n"), subject);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* For a self-signed cert, the issuser and subject are the same */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys gettext("Subject name cannot be parsed (%s)\n"), subject);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "keypair");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "serial number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "validity time");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "signature algorithm");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "subject name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "issuer name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "KeyUsage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Store the cert in the DB.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_FILENAME_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memset(&certSubject, 0, sizeof (certSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* For a self-signed cert, the issuser and subject are the same */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "keypair");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "serial number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "validity time");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "signature algorithm");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "subject name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "issuer name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "subjectAltName");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys * Construct attributes for the kmf_sign_cert operation.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* cert data that is to be signed */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* output buffer for the signed cert */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Store the cert in the DB.
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TRUSTFLAG_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys extern char *optarg_av;
4165f46543b20d435f7ef0aced6239f7e97b12ffWyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_SHA1WithRSA;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "r:(trust)L:(lifetime)l:(label)c:(outcert)e:(eku)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "K:(outkey)S:(serial)F:(format)u:(keyusage)")) != EOF) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "a numeric value (%s)\n"),
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* No additional args allowed. */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Assume keystore = PKCS#11 if not specified. */
2cbed7292737821015ab481353eb10e8346b2c05wyllys if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys /* It better not be empty now */
2cbed7292737821015ab481353eb10e8346b2c05wyllys "specified to create a self-signed certificate."
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (kstype == KMF_KEYSTORE_OPENSSL && EMPTYSTRING(outcert)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cryptoerror(LOG_STDERR, gettext("A certificate filename must "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "be specified to create a self-signed certificate.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cryptoerror(LOG_STDERR, gettext("Unrecognized keytype (%s).\n"),
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Check the subject name.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If interactive is true, get it now interactively.
2cbed7292737821015ab481353eb10e8346b2c05wyllys if (get_subname(&subname) != KMF_OK || subname == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "subject name interactively.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "-i must be specified to create a self-signed "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "certificate.\n"));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a hex number when creating"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys " a self-signed certificate "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "(ex: serial=0x0102030405feedface)\n"));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a hex number "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "(ex: 0x0102030405ffeeddee)\n"));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a name=value pair. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "See the man page for details.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* advance the altname past the '=' sign */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a comma-separated list. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "See the man page for details.\n"));
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "be specified as a comma-separated list. "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "See the man page for details.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {