99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER START
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * The contents of this file are subject to the terms of the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Common Development and Distribution License (the "License").
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You may not use this file except in compliance with the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * See the License for the specific language governing permissions
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * and limitations under the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * When distributing Covered Code, include this CDDL HEADER in each
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If applicable, add the following below this CDDL HEADER, with the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * fields enclosed by brackets "[]" replaced with your own identifying
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * information: Portions Copyright [yyyy] [name of copyright owner]
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER END
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_CREDENTIAL *tokencred, EKU_LIST *ekulist,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg, KMF_OID *curveoid)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Select a PKCS11 token */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * Share the "genkeypair" routine for creating the keypair.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = genkeypair_pkcs11(kmfhandle, token, certlabel,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll keyAlg, keylen, tokencred, curveoid, &prik, &pubk);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr), "keypair");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "version number");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject), "subject name");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "SignatureAlgorithm");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kubits != 0) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "SetCSRKeyUsage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "Extended Key Usage");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee /* delete the public key */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist);
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee * If there is an error, then we need to remove the private key
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee * from the token.
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee KMF_KEY_HANDLE_ATTR, &prik, sizeof (KMF_KEY_HANDLE));
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
a44b45c8fa54b3a79a2de076aa2d8c48cd75dee4Huie-Ying Lee (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *subject, char *altname, KMF_GENERALNAMECHOICES alttype,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll char *outcsr, char *outkey, EKU_LIST *ekulist,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "the csr or key\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * Share the "genkeypair" routine for creating the keypair.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = genkeypair_file(kmfhandle, keyAlg, keylen,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "SetCSRPubKey");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "SetCSRVersion");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "kmf_set_csr_subject");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "kmf_set_csr_ku");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "Extended Key Usage");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, fullcsrpath);
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_CREDENTIAL *tokencred, EKU_LIST *ekulist,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg, KMF_OID *curveoid)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll kmfrv = genkeypair_nss(kmfhandle, token, nickname, dir,
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll prefix, keyAlg, keylen, tokencred, curveoid,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "kmf_set_csr_pubkey");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_version(&csr, 2), "kmf_set_csr_version");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "kmf_set_csr_subject");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "kmf_set_csr_ku");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "Extended Key Usage");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* delete the key */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys extern char *optarg_av;
4165f46543b20d435f7ef0aced6239f7e97b12ffWyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_SHA1WithRSA;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "u:(keyusage)T:(token)d:(dir)p:(prefix)t:(keytype)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "y:(keylen)l:(label)c:(outcsr)e:(eku)C:(curve)"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "K:(outkey)F:(format)E(listcurves)h:(hash)")) != EOF) {
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll "subject options are mutually "
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll "exclusive.\n"));
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll "subject options are mutually "
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll "exclusive.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "curve.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * This argument is only to be used
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * by itself, no other options should
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll * be present.
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "options.\n"));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "unrecognized gencsr option '%s'\n"),
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* No additional args allowed. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Assume keystore = PKCS#11 if not specified. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) printf(gettext("A filename must be specified to hold"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "the final certificate request data.\n"));
2cbed7292737821015ab481353eb10e8346b2c05wyllys * verify that the outcsr file does not already exist
2cbed7292737821015ab481353eb10e8346b2c05wyllys * and that it can be created.
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll if (yesno(gettext("Continue with gencsr? "),
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll gettext("Respond with yes or no.\n"), B_FALSE) == B_FALSE) {
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll /* remove the file */
2c9a247fb01631b3eb3b85a1127e72f0b60ae108Wyllys Ingersoll gettext("Warning: error accessing \"%s\""), outcsr);
2cbed7292737821015ab481353eb10e8346b2c05wyllys if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys "specified to create a certificate request.\n"));
2cbed7292737821015ab481353eb10e8346b2c05wyllys "must be specified to create a certificate "
2cbed7292737821015ab481353eb10e8346b2c05wyllys "request.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys gettext("Error parsing format string (%s).\n"), format);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format && fmt != KMF_FORMAT_ASN1 && fmt != KMF_FORMAT_PEM) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Check the subject name.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If interactive is true, get it now interactively.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "subject name interactively.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "-i must be specified to create a certificate "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys "request.\n"));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a name=value pair. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "See the man page for details."));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* advance the altname past the '=' sign */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "must be specified as a comma-separated list. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys "See the man page for details."));
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "be specified as a comma-separated list. "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys "See the man page for details.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if ((rv = Str2KeyType(keytype, hashoid, &keyAlg, &sigAlg)) != 0) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll gettext("Unsupported key/hash combination (%s/%s).\n"),
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (curveoid != NULL && keyAlg != KMF_ECDSA) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("EC curves are only "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "valid for EC keytypes.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_ECDSA && curveoid == NULL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("A curve must be "
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "specifed when using EC keys.\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) fprintf(stderr, gettext("ECC certificates are"
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll "only supported with the pkcs11 and nss keystores\n"));
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll /* Adjust default keylength for NSS and DSA */
e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (keyAlg == KMF_DSA && !y_flag && kstype == KMF_KEYSTORE_NSS)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) get_token_password(kstype, tokenname, &tokencred);
577f4726f2ea5aeaa2cf3dd65aca52869834b137wyllys if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
577f4726f2ea5aeaa2cf3dd65aca52869834b137wyllys cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll cryptoerror(LOG_STDERR, gettext("subject or "
592106a23e99a1790d339bab84de7fa3474964a4Wyllys Ingersoll "issuer name must be in proper DN format.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (0);