cmd-crypto/pktool/gencsr.c

	gencsr.c revision d00756ccb34596a328f8a15d1965da5412d366d0
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys/*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER START
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * The contents of this file are subject to the terms of the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Common Development and Distribution License (the "License").
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You may not use this file except in compliance with the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * or http://www.opensolaris.org/os/licensing.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * See the License for the specific language governing permissions
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * and limitations under the License.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * When distributing Covered Code, include this CDDL HEADER in each
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * If applicable, add the following below this CDDL HEADER, with the
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * fields enclosed by brackets "[]" replaced with your own identifying
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * information: Portions Copyright [yyyy] [name of copyright owner]
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * CDDL HEADER END
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *
d00756ccb34596a328f8a15d1965da5412d366d0wyllys * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys * Use is subject to license terms.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#pragma ident   "%Z%%M% %I% %E% SMI"
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <stdio.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <string.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <ctype.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <malloc.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <libgen.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <errno.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <cryptoutil.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <security/cryptoki.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include "common.h"
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <kmfapi.h>
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define SET_VALUE(f, s) \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = f; \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) { \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            gettext("Failed to %s: 0x%02\n"), \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            s, kmfrv); \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup; \
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencsr_pkcs11(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *token, char *subject, char *altname,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype, int altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *certlabel, KMF_KEY_ALG keyAlg,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    int keylen, uint16_t kubits, int kucrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ENCODE_FORMAT fmt, char *csrfile,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    KMF_CREDENTIAL *tokencred, EKU_LIST *ekulist)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv = KMF_OK;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   csrSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_CSR_DATA    csr;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA signedCsr = {NULL, 0};
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[16];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    boolean_t storekey = TRUE;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csr, 0, sizeof (csr));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csrSubject, 0, sizeof (csrSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (keyAlg == KMF_DSA)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_SHA1WithDSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_MD5WithRSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* Select a PKCS11 token */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = select_token(kmfhandle, token, FALSE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (certlabel != NULL && strlen(certlabel)) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, strlen(certlabel));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keylen, sizeof (keylen));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keyAlg, sizeof (keyAlg));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        tokencred, sizeof (KMF_CREDENTIAL));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (token && strlen(token)) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            token, strlen(token));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &pubk, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &storekey, sizeof (storekey));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr), "keypair");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_version(&csr, 2), "version number");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject), "subject name");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "SignatureAlgorithm");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype), "SetCSRSubjectAltName");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits != 0) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "SetCSRKeyUsage");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_csr_eku(&csr,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i],
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekulist->critlist[i]),
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_data(&signedCsr);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_kmf_key(kmfhandle, &prik);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* delete the key */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &pubk, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_signed_csr(&csr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencsr_file(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen, KMF_ENCODE_FORMAT fmt,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *subject, char *altname, KMF_GENERALNAMECHOICES alttype,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int altcrit, uint16_t kubits, int kucrit,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    char *dir, char *outcsr, char *outkey, EKU_LIST *ekulist)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   csrSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_CSR_DATA    csr;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA signedCsr = {NULL, 0};
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *fullcsrpath = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *fullkeypath = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[16];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    boolean_t   storekey = TRUE;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csr, 0, sizeof (csr));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csrSubject, 0, sizeof (csrSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (EMPTYSTRING(outcsr) || EMPTYSTRING(outkey)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("No output file was specified for "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "the csr or key\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (KMF_ERR_BAD_PARAMETER);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (dir != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        fullcsrpath = get_fullpath(dir, outcsr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (fullcsrpath == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                gettext("Cannot create file %s in "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "directory %s\n"), dir, outcsr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        fullcsrpath = strdup(outcsr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (verify_file(fullcsrpath)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Cannot write the indicated output "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "certificate file (%s).\n"), fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (dir != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        fullkeypath = get_fullpath(dir, outkey);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (fullkeypath == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                gettext("Cannot create file %s in "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "directory %s\n"), dir, outkey);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            free(fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        fullkeypath = strdup(outkey);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (verify_file(fullcsrpath)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Cannot write the indicated output "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "key file (%s).\n"), fullkeypath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (keyAlg == KMF_DSA)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_SHA1WithDSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_MD5WithRSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        fullkeypath, strlen(fullkeypath));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keylen, sizeof (keylen));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keyAlg, sizeof (keyAlg));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &fmt, sizeof (fmt));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) memset(&prik, 0, sizeof (prik));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) memset(&pubk, 0, sizeof (pubk));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &pubk, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &storekey, sizeof (storekey));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "SetCSRPubKey");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_version(&csr, 2), "SetCSRVersion");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "kmf_set_csr_subject");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype), "kmf_set_csr_subject_altname");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "kmf_set_csr_ku");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_csr_eku(&csr,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i],
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekulist->critlist[i]),
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmfrv = kmf_create_csr_file(&signedCsr, fmt, fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (fullkeypath)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullkeypath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (fullcsrpath)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(fullcsrpath);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_data(&signedCsr);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_kmf_key(kmfhandle, &prik);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_free_signed_csr(&csr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysgencsr_nss(KMF_HANDLE_T kmfhandle,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *token, char *subject, char *altname,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype, int altcrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *nickname, char *dir, char *prefix,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg, int keylen,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint16_t kubits, int kucrit,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ENCODE_FORMAT fmt, char *csrfile,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    KMF_CREDENTIAL *tokencred, EKU_LIST *ekulist)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN kmfrv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_HANDLE pubk, prik;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_X509_NAME   csrSubject;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_CSR_DATA    csr;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_DATA signedCsr = {NULL, 0};
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    int numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    KMF_ATTRIBUTE attrlist[16];
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    boolean_t storekey = TRUE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (token == NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        token = DEFAULT_NSS_TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (keyAlg == KMF_DSA)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_SHA1WithDSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        sigAlg = KMF_ALGID_MD5WithRSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    kmfrv = configure_nss(kmfhandle, dir, prefix);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csr, 0, sizeof (csr));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    (void) memset(&csrSubject, 0, sizeof (csrSubject));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* If the subject name cannot be parsed, flag it now and exit */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_dn_parser(subject, &csrSubject)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (nickname != NULL && strlen(nickname)) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            nickname, strlen(nickname));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLENGTH_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keylen, sizeof (keylen));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYALG_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &keyAlg, sizeof (keyAlg));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (tokencred != NULL && tokencred->credlen > 0) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokencred, sizeof (KMF_CREDENTIAL));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (token && strlen(token)) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            token, strlen(token));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &pubk, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &prik, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_STOREKEY_BOOL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &storekey, sizeof (storekey));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmfrv = kmf_create_keypair(kmfhandle, numattr, attrlist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kmfrv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto cleanup;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_pubkey(kmfhandle, &pubk, &csr),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "kmf_set_csr_pubkey");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_version(&csr, 2), "kmf_set_csr_version");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_subject(&csr, &csrSubject),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "kmf_set_csr_subject");
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    SET_VALUE(kmf_set_csr_sig_alg(&csr, sigAlg), "kmf_set_csr_sig_alg");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_subject_altname(&csr, altname, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype), "kmf_set_csr_subject_altname");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kubits != NULL) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        SET_VALUE(kmf_set_csr_ku(&csr, kucrit, kubits),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "kmf_set_csr_ku");
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        int i;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            SET_VALUE(kmf_add_csr_eku(&csr,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                &ekulist->ekulist[i],
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekulist->critlist[i]),
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "Extended Key Usage");
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((kmfrv = kmf_sign_csr(kmfhandle, &csr, &prik, &signedCsr)) ==
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        KMF_OK) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmfrv = kmf_create_csr_file(&signedCsr, fmt, csrfile);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_data(&signedCsr);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_kmf_key(kmfhandle, &prik);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* delete the key */
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr = 0;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &kstype, sizeof (kstype));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    kmf_set_attr_at_index(attrlist, numattr, KMF_PUBKEY_HANDLE_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        &pubk, sizeof (KMF_KEY_HANDLE));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (tokencred != NULL && tokencred->credlen > 0) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokencred, sizeof (KMF_CREDENTIAL));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if (token && strlen(token)) {
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            token, strlen(token));
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        numattr++;
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    }
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_delete_key_from_keystore(kmfhandle, numattr, attrlist);
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_free_signed_csr(&csr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (kmfrv);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysint
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyspk_gencsr(int argc, char *argv[])
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_RETURN rv;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int opt;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    extern int  optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    extern char *optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEYSTORE_TYPE kstype = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *subject = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *tokenname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *dir = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *prefix = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int keylen = PK_DEFAULT_KEYLENGTH;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *certlabel = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *outcsr = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *outkey = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *format = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *altname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *kustr = NULL;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    char *ekustr = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    uint16_t kubits = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *keytype = PK_DEFAULT_KEYTYPE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_HANDLE_T kmfhandle = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_KEY_ALG keyAlg = KMF_RSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_MD5WithRSA;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    boolean_t interactive = B_FALSE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    char *subname = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_CREDENTIAL tokencred = {NULL, 0};
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    KMF_GENERALNAMECHOICES alttype = 0;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    int altcrit = 0, kucrit = 0;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    EKU_LIST *ekulist = NULL;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    while ((opt = getopt_av(argc, argv,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "u:(keyusage)T:(token)d:(dir)p:(prefix)t:(keytype)"
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        "y:(keylen)l:(label)c:(outcsr)e:(eku)"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys        "K:(outkey)F:(format)")) != EOF) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (opt != 'i' && EMPTYSTRING(optarg_av))
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        switch (opt) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'A':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                altname = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'i':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (interactive || subject)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    interactive = B_TRUE;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'k':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                kstype = KS2Int(optarg_av);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (kstype == 0)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 's':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (interactive || subject)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                else
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    subject = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'l':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'n':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (certlabel)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                certlabel = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'T':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (tokenname)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'd':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                dir = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'p':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (prefix)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                prefix = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 't':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                keytype = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'u':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                kustr = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'y':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (sscanf(optarg_av, "%d",
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                    &keylen) != 1) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                        gettext("Unrecognized "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                        "key length (%s)\n"), optarg_av);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'c':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (outcsr)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                outcsr = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'K':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (outkey)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                outkey = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            case 'F':
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                if (format)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                format = optarg_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                break;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            case 'e':
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                ekustr = optarg_av;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                break;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            default:
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                cryptoerror(LOG_STDERR, gettext(
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                    "unrecognized gencsr option '%s'\n"),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                    argv[optind_av]);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* No additional args allowed. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    argc -= optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    argv += optind_av;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (argc) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /* Assume keystore = PKCS#11 if not specified. */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == 0)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        kstype = KMF_KEYSTORE_PK11TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
2cbed7292737821015ab481353eb10e8346b2c05wyllys    if (EMPTYSTRING(outcsr) && interactive) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        (void) get_filename("CSR", &outcsr);
2cbed7292737821015ab481353eb10e8346b2c05wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (EMPTYSTRING(outcsr)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        (void) printf(gettext("A filename must be specified to hold"
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            "the final certificate request data.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
2cbed7292737821015ab481353eb10e8346b2c05wyllys    /*
2cbed7292737821015ab481353eb10e8346b2c05wyllys     * verify that the outcsr file does not already exist
2cbed7292737821015ab481353eb10e8346b2c05wyllys     * and that it can be created.
2cbed7292737821015ab481353eb10e8346b2c05wyllys     */
2cbed7292737821015ab481353eb10e8346b2c05wyllys    rv = verify_file(outcsr);
2cbed7292737821015ab481353eb10e8346b2c05wyllys    if (rv != KMF_OK) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        cryptoerror(LOG_STDERR, gettext("output file (%s) "
2cbed7292737821015ab481353eb10e8346b2c05wyllys            "cannot be created.\n"), outcsr);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
2cbed7292737821015ab481353eb10e8346b2c05wyllys    if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (EMPTYSTRING(certlabel) && interactive)
2cbed7292737821015ab481353eb10e8346b2c05wyllys            (void) get_certlabel(&certlabel);
2cbed7292737821015ab481353eb10e8346b2c05wyllys
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (EMPTYSTRING(certlabel)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys            cryptoerror(LOG_STDERR, gettext("A label must be "
2cbed7292737821015ab481353eb10e8346b2c05wyllys                "specified to create a certificate request.\n"));
2cbed7292737821015ab481353eb10e8346b2c05wyllys            return (PK_ERR_USAGE);
2cbed7292737821015ab481353eb10e8346b2c05wyllys        }
2cbed7292737821015ab481353eb10e8346b2c05wyllys    } else if (kstype == KMF_KEYSTORE_OPENSSL) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (EMPTYSTRING(outkey) && interactive)
2cbed7292737821015ab481353eb10e8346b2c05wyllys            (void) get_filename("private key", &outkey);
2cbed7292737821015ab481353eb10e8346b2c05wyllys
2cbed7292737821015ab481353eb10e8346b2c05wyllys        if (EMPTYSTRING(outkey)) {
2cbed7292737821015ab481353eb10e8346b2c05wyllys            cryptoerror(LOG_STDERR, gettext("A key filename "
2cbed7292737821015ab481353eb10e8346b2c05wyllys                "must be specified to create a certificate "
2cbed7292737821015ab481353eb10e8346b2c05wyllys                "request.\n"));
2cbed7292737821015ab481353eb10e8346b2c05wyllys            return (PK_ERR_USAGE);
2cbed7292737821015ab481353eb10e8346b2c05wyllys        }
2cbed7292737821015ab481353eb10e8346b2c05wyllys    }
2cbed7292737821015ab481353eb10e8346b2c05wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Error parsing format string (%s).\n"), format);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (format && fmt != KMF_FORMAT_ASN1 && fmt != KMF_FORMAT_PEM) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("CSR must be DER or PEM format.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    /*
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * Check the subject name.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     * If interactive is true, get it now interactively.
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys     */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (interactive) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (get_subname(&subname) != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("Failed to get the "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "subject name interactively.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (EMPTYSTRING(subject)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("A subject name or "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "-i must be specified to create a certificate "
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                "request.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            subname = strdup(subject);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (subname == NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                cryptoerror(LOG_STDERR,
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                    gettext("Out of memory.\n"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                return (PK_ERR_SYSTEM);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (altname != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = verify_altname(altname, &alttype, &altcrit);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (rv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("Subject AltName "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "must be specified as a name=value pair. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "See the man page for details."));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        } else {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            /* advance the altname past the '=' sign */
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            char *p = strchr(altname, '=');
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (p != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                altname = p + 1;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kustr != NULL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = verify_keyusage(kustr, &kubits, &kucrit);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (rv != KMF_OK) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            cryptoerror(LOG_STDERR, gettext("KeyUsage "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "must be specified as a comma-separated list. "
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys                "See the man page for details."));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekustr != NULL) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        rv = verify_ekunames(ekustr, &ekulist);
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        if (rv != KMF_OK) {
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            (void) fprintf(stderr, gettext("EKUs must "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "be specified as a comma-separated list. "
d00756ccb34596a328f8a15d1965da5412d366d0wyllys                "See the man page for details.\n"));
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            rv = PK_ERR_USAGE;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            goto end;
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    }
d00756ccb34596a328f8a15d1965da5412d366d0wyllys
d00756ccb34596a328f8a15d1965da5412d366d0wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if ((rv = Str2KeyType(keytype, &keyAlg, &sigAlg)) != 0) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        cryptoerror(LOG_STDERR, gettext("Unrecognized keytype (%s).\n"),
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            keytype);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        goto end;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (tokenname == NULL || !strlen(tokenname)) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            if (kstype == KMF_KEYSTORE_NSS) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = "internal";
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            } else  {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys                tokenname = PK_DEFAULT_PK11TOKEN;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        (void) get_token_password(kstype, tokenname, &tokencred);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (kstype == KMF_KEYSTORE_NSS) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        if (dir == NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys            dir = PK_DEFAULT_DIRECTORY;
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencsr_nss(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokenname, subname, altname, alttype, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, dir, prefix,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            keyAlg, keylen, kubits, kucrit,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            fmt, outcsr, &tokencred, ekulist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencsr_pkcs11(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            tokenname, subname, altname, alttype, altcrit,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            certlabel, keyAlg, keylen,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            kubits, kucrit, fmt, outcsr, &tokencred, ekulist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    } else if (kstype == KMF_KEYSTORE_OPENSSL) {
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        rv = gencsr_file(kmfhandle,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            keyAlg, keylen, fmt, subname, altname,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            alttype, altcrit, kubits, kucrit,
d00756ccb34596a328f8a15d1965da5412d366d0wyllys            dir, outcsr, outkey, ekulist);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    }
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysend:
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (rv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        display_error(kmfhandle, rv,
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys            gettext("Error creating CSR or keypair"));
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
d00756ccb34596a328f8a15d1965da5412d366d0wyllys    if (ekulist != NULL)
d00756ccb34596a328f8a15d1965da5412d366d0wyllys        free_eku_list(ekulist);
d00756ccb34596a328f8a15d1965da5412d366d0wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (subname)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(subname);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (tokencred.cred != NULL)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        free(tokencred.cred);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys    (void) kmf_finalize(kmfhandle);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    if (rv != KMF_OK)
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys        return (PK_ERR_USAGE);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys    return (0);
99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}