signcsr.c revision 6b35cb3cf158584a9408d44b9b6796564e8e1882
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * CDDL HEADER START
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * The contents of this file are subject to the terms of the
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock * Common Development and Distribution License (the "License").
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock * You may not use this file except in compliance with the License.
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
fa9e4066f08beec538e775443c5be79dd423fcabahrens * or http://www.opensolaris.org/os/licensing.
fa9e4066f08beec538e775443c5be79dd423fcabahrens * See the License for the specific language governing permissions
fa9e4066f08beec538e775443c5be79dd423fcabahrens * and limitations under the License.
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * When distributing Covered Code, include this CDDL HEADER in each
fa9e4066f08beec538e775443c5be79dd423fcabahrens * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
fa9e4066f08beec538e775443c5be79dd423fcabahrens * If applicable, add the following below this CDDL HEADER, with the
fa9e4066f08beec538e775443c5be79dd423fcabahrens * fields enclosed by brackets "[]" replaced with your own identifying
fa9e4066f08beec538e775443c5be79dd423fcabahrens * information: Portions Copyright [yyyy] [name of copyright owner]
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * CDDL HEADER END
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
94d1a2100edbb6781ea1c047a6334bb3f15640f5Tim Haley
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden/*
ec5cf9d53a1d7280f3f1a6eadd7cdabdc99814ebAlexander Stetsenko * This file implements the sign CSR operation for this tool.
4e3c9f4489a18514e5e8caeb91d4e6db07c98415Bill Pijewski */
ec5cf9d53a1d7280f3f1a6eadd7cdabdc99814ebAlexander Stetsenko
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <stdio.h>
55da60b91d96984f12de050ce428373ea25c7f35Mark J Musante#include <errno.h>
55da60b91d96984f12de050ce428373ea25c7f35Mark J Musante#include <string.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <cryptoutil.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <security/cryptoki.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include "common.h"
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <kmfapi.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <kmfapiP.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens#define SET_VALUE(f, s) \
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = f; \
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) { \
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR, \
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Failed to set %s: 0x%02x\n"), s, rv); \
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto cleanup; \
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
ecd6cf800b63704be73fb264c3f5b6e0dafc068dmarks
71eb05381846ad14a2087631474e832d0f316654Chris Kirby
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrensstatic int
fa9e4066f08beec538e775443c5be79dd423fcabahrensread_csrdata(KMF_HANDLE_T handle, char *csrfile, KMF_CSR_DATA *csrdata)
fa9e4066f08beec538e775443c5be79dd423fcabahrens{
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_RETURN rv = KMF_OK;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_ENCODE_FORMAT csrfmt;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_DATA csrfiledata = { 0, NULL };
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_DATA rawcsr = { 0, NULL };
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States
44eda4d76a9383a159e44aa60b63a17644ddd5b1maybee rv = kmf_get_file_format(csrfile, &csrfmt);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_read_input_file(handle, csrfile, &csrfiledata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (csrfmt == KMF_FORMAT_PEM) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_pem_to_der(csrfiledata.Data, csrfiledata.Length,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &rawcsr.Data, (int *)&rawcsr.Length);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK)
44cd46cadd9aab751dae6a4023c1cb5bf316d274billm return (rv);
44cd46cadd9aab751dae6a4023c1cb5bf316d274billm
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens kmf_free_data(&csrfiledata);
2fdbea25c2ba89186b8a6b7c6840ebc9f4dff245Aleksandr Guzovskiy } else {
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick rawcsr.Data = csrfiledata.Data;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum rawcsr.Length = csrfiledata.Length;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_decode_csr(handle, &rawcsr, csrdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_free_data(&rawcsr);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden return (rv);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden}
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenstatic KMF_RETURN
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenfind_csr_extn(KMF_X509_EXTENSIONS *extnlist, KMF_OID *extoid,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_X509_EXTENSION *outextn)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden{
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden int i, found = 0;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_X509_EXTENSION *eptr;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_RETURN rv = KMF_OK;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden (void) memset(outextn, 0, sizeof (KMF_X509_EXTENSION));
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden for (i = 0; !found && i < extnlist->numberOfExtensions; i++) {
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden eptr = &extnlist->extensions[i];
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (IsEqualOid(extoid, &eptr->extnId)) {
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden rv = copy_extension_data(outextn, eptr);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden found++;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden }
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden }
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (found == 0 || rv != KMF_OK)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden return (1);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden else
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden return (rv);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden}
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenstatic int
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenbuild_cert_from_csr(KMF_CSR_DATA *csrdata,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_X509_CERTIFICATE *signedCert,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_BIGINT *serial,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden uint32_t ltime,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden char *issuer, char *subject,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden char *altname,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_GENERALNAMECHOICES alttype,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden int altcrit,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden uint16_t kubits,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden int kucrit,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden EKU_LIST *ekulist)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden{
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_RETURN rv = KMF_OK;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_X509_NAME issuerDN, subjectDN;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden /*
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden * If the CSR is ok, now we can generate the final certificate.
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden */
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden (void) memset(signedCert, 0, sizeof (KMF_X509_CERTIFICATE));
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden (void) memset(&issuerDN, 0, sizeof (issuerDN));
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden (void) memset(&subjectDN, 0, sizeof (subjectDN));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens SET_VALUE(kmf_set_cert_version(signedCert, 2), "version number");
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens SET_VALUE(kmf_set_cert_serial(signedCert, serial), "serial number");
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens SET_VALUE(kmf_set_cert_validity(signedCert, NULL, ltime),
fa9e4066f08beec538e775443c5be79dd423fcabahrens "validity time");
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens if (issuer) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (kmf_dn_parser(issuer, &issuerDN) != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Issuer name cannot be parsed\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens SET_VALUE(kmf_set_cert_issuer(signedCert, &issuerDN),
fa9e4066f08beec538e775443c5be79dd423fcabahrens "Issuer Name");
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (subject) {
1649cd4b1641110b549d9f70a902cafc2007bd77tabriz if (kmf_dn_parser(subject, &subjectDN) != KMF_OK) {
87e5029a3226958edab1512d6182bc74d8d80c9aahrens cryptoerror(LOG_STDERR,
87e5029a3226958edab1512d6182bc74d8d80c9aahrens gettext("Subject name cannot be parsed\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
1649cd4b1641110b549d9f70a902cafc2007bd77tabriz }
fa9e4066f08beec538e775443c5be79dd423fcabahrens SET_VALUE(kmf_set_cert_subject(signedCert, &subjectDN),
fa9e4066f08beec538e775443c5be79dd423fcabahrens "Subject Name");
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
fa9e4066f08beec538e775443c5be79dd423fcabahrens signedCert->certificate.subject = csrdata->csr.subject;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
893a6d32980d24be1349478f44169009d4801c25ahrens signedCert->certificate.subjectPublicKeyInfo =
fa9e4066f08beec538e775443c5be79dd423fcabahrens csrdata->csr.subjectPublicKeyInfo;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens signedCert->certificate.extensions = csrdata->csr.extensions;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens signedCert->certificate.signature =
fa9e4066f08beec538e775443c5be79dd423fcabahrens csrdata->signature.algorithmIdentifier;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock if (kubits != 0) {
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock KMF_X509_EXTENSION extn;
06eeb2ad640ce72d394ac521094bed7681044408ek uint16_t oldbits;
06eeb2ad640ce72d394ac521094bed7681044408ek /*
b1b8ab34de515a5e83206da22c3d7e563241b021lling * If the CSR already has KU, merge them.
ecd6cf800b63704be73fb264c3f5b6e0dafc068dmarks */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw rv = find_csr_extn(&csrdata->csr.extensions,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (KMF_OID *)&KMFOID_KeyUsage, &extn);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (rv == KMF_OK) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw extn.critical |= kucrit;
088f389458728c464569a5506b58070254fa4f7dahrens if (extn.value.tagAndValue->value.Length > 1) {
3f9d6ad73e45c6823b409f93b0c8d4f62861d2d5Lin Ling oldbits =
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens extn.value.tagAndValue->value.Data[1] << 8;
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens } else {
842727c2f41f01b380de4f5e787d905702870f23Chris Kirby oldbits =
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick extn.value.tagAndValue->value.Data[0];
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick }
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum oldbits |= kubits;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum } else {
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum SET_VALUE(kmf_set_cert_ku(signedCert, kucrit, kubits),
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum "KeyUsage");
3f9d6ad73e45c6823b409f93b0c8d4f62861d2d5Lin Ling }
3f9d6ad73e45c6823b409f93b0c8d4f62861d2d5Lin Ling }
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens if (altname != NULL) {
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens SET_VALUE(kmf_set_cert_subject_altname(signedCert,
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens altcrit, alttype, altname), "subjectAltName");
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens }
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (ekulist != NULL) {
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden int i;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden for (i = 0; rv == KMF_OK && i < ekulist->eku_count; i++) {
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden SET_VALUE(kmf_add_cert_eku(signedCert,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden &ekulist->ekulist[i],
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden ekulist->critlist[i]), "Extended Key Usage");
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden }
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden }
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidencleanup:
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (issuer != NULL)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden kmf_free_dn(&issuerDN);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (subject != NULL)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden kmf_free_dn(&subjectDN);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden return (rv);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden}
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenstatic int
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Sidenpk_sign_cert(KMF_HANDLE_T handle, KMF_X509_CERTIFICATE *cert,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_KEY_HANDLE *key, KMF_OID *sigoid, KMF_DATA *outdata)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden{
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_RETURN rv;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden int numattr;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden KMF_ATTRIBUTE attrlist[4];
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden numattr = 0;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYSTORE_TYPE_ATTR,
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden &key->kstype, sizeof (KMF_KEYSTORE_TYPE));
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr++, KMF_KEY_HANDLE_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens key, sizeof (KMF_KEY_HANDLE_ATTR));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* cert data that is to be signed */
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr++, KMF_X509_CERTIFICATE_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens cert, sizeof (KMF_X509_CERTIFICATE));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* output buffer for the signed cert */
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr++, KMF_CERT_DATA_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens outdata, sizeof (KMF_DATA));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
0b69c2f001a429251e2d38f25aca860396551214ahrens /* Set the signature OID value so KMF knows how to generate the sig */
0b69c2f001a429251e2d38f25aca860396551214ahrens if (sigoid) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr++, KMF_OID_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens sigoid, sizeof (KMF_OID));
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if ((rv = kmf_sign_cert(handle, numattr, attrlist)) != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR,
cdb0ab79ea1af7b8fc339a04d4bf7426dc77ec4emaybee gettext("Failed to sign certificate.\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens }
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick return (rv);
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens}
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaumstatic int
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaumpk_signcsr_files(KMF_HANDLE_T handle,
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum char *signkey,
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum char *csrfile,
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_BIGINT *serial,
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *certfile,
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *issuer,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens char *subject,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens char *altname,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens KMF_GENERALNAMECHOICES alttype,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens int altcrit,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens uint16_t kubits,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens int kucrit,
503ad85c168c7992ccc310af845a581cff3c72b5Matthew Ahrens EKU_LIST *ekulist,
1934e92fc930c49429ad71a8ca97340f33227e78maybee uint32_t ltime,
ae46e4c775f2becc5343ff90b60a95acb79735f9Matthew Ahrens KMF_ENCODE_FORMAT fmt)
ecd6cf800b63704be73fb264c3f5b6e0dafc068dmarks{
ae46e4c775f2becc5343ff90b60a95acb79735f9Matthew Ahrens KMF_RETURN rv = KMF_OK;
ae46e4c775f2becc5343ff90b60a95acb79735f9Matthew Ahrens KMF_CSR_DATA csrdata;
842727c2f41f01b380de4f5e787d905702870f23Chris Kirby KMF_ATTRIBUTE attrlist[16];
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens KMF_X509_CERTIFICATE signedCert;
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens KMF_KEY_CLASS keyclass = KMF_ASYM_PRI;
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens KMF_KEY_HANDLE cakey;
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens KMF_DATA certdata = { 0, NULL };
cdf5b4ca0fa5ca7622b06bcb271be9e8a8245fecmmusante int numattr, count;
cdf5b4ca0fa5ca7622b06bcb271be9e8a8245fecmmusante
fd1368791be99c4a6354fa81f08408c2dbf4b444Matthew Ahrens (void) memset(&cakey, 0, sizeof (cakey));
fa9e4066f08beec538e775443c5be79dd423fcabahrens (void) memset(&signedCert, 0, sizeof (signedCert));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = read_csrdata(handle, csrfile, &csrdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Error reading CSR data\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* verify the signature first */
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr = 0;
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_CSR_DATA_ATTR,
99653d4ee642c6528e88224f12409a5f23060994eschrock &csrdata, sizeof (csrdata));
99653d4ee642c6528e88224f12409a5f23060994eschrock numattr++;
99653d4ee642c6528e88224f12409a5f23060994eschrock
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_verify_csr(handle, numattr, attrlist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden cryptoerror(LOG_STDERR, gettext("CSR signature "
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden "verification failed.\n"));
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden goto cleanup;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock rv = build_cert_from_csr(&csrdata, &signedCert, serial, ltime,
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock issuer, subject, altname, alttype, altcrit, kubits,
99653d4ee642c6528e88224f12409a5f23060994eschrock kucrit, ekulist);
99653d4ee642c6528e88224f12409a5f23060994eschrock
06eeb2ad640ce72d394ac521094bed7681044408ek if (rv != KMF_OK)
b1b8ab34de515a5e83206da22c3d7e563241b021lling goto cleanup;
fa94a07fd0519b8abfd871ad8fe60e6bebe1e2bbbrendan
ca45db4129beff691dc46576c328149443788af2Chris Kirby /*
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick * Find the signing key.
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick */
3f9d6ad73e45c6823b409f93b0c8d4f62861d2d5Lin Ling (void) memset(&cakey, 0, sizeof (cakey));
3f9d6ad73e45c6823b409f93b0c8d4f62861d2d5Lin Ling
cde58dbc6a23d4d38db7c8866312be83221c765fMatthew Ahrens numattr = 0;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
f17457368189aa911f774c38c1f21875a568bdcaMatthew Ahrens &kstype, sizeof (kstype));
088f389458728c464569a5506b58070254fa4f7dahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens signkey, strlen(signkey));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &keyclass, sizeof (keyclass));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &cakey, sizeof (cakey));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens count = 1;
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &count, sizeof (count));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_find_key(handle, numattr, attrlist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
2bf405a25eb25f79638fc951ff8d8857ad384417Mark Maybee cryptoerror(LOG_STDERR, gettext(
fa9e4066f08beec538e775443c5be79dd423fcabahrens "Error finding CA signing key\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto cleanup;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = pk_sign_cert(handle, &signedCert, &cakey, NULL, &certdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR, gettext(
fa9e4066f08beec538e775443c5be79dd423fcabahrens "Error signing certificate.\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto cleanup;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_create_cert_file(&certdata, fmt, certfile);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrenscleanup:
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_free_signed_csr(&csrdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_free_data(&certdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_free_kmf_key(handle, &cakey);
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens}
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrensstatic int
fa9e4066f08beec538e775443c5be79dd423fcabahrenspk_signcsr_pk11_nss(KMF_HANDLE_T handle,
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_KEYSTORE_TYPE kstype,
6754306ec9a89fd28806908d10c76141e8fbba3fahrens char *dir, char *prefix,
6754306ec9a89fd28806908d10c76141e8fbba3fahrens char *token, KMF_CREDENTIAL *cred,
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *signkey, char *csrfile,
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_BIGINT *serial, char *certfile, char *issuer, char *subject,
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *altname, KMF_GENERALNAMECHOICES alttype, int altcrit,
fa9e4066f08beec538e775443c5be79dd423fcabahrens uint16_t kubits, int kucrit,
fa9e4066f08beec538e775443c5be79dd423fcabahrens EKU_LIST *ekulist, uint32_t ltime,
6754306ec9a89fd28806908d10c76141e8fbba3fahrens KMF_ENCODE_FORMAT fmt, int store, char *outlabel)
6754306ec9a89fd28806908d10c76141e8fbba3fahrens{
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_RETURN rv = KMF_OK;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_DATA outcert = { 0, NULL };
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_CSR_DATA csrdata = { 0, NULL };
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_KEY_HANDLE casignkey;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_KEY_CLASS keyclass = KMF_ASYM_PRI;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_ATTRIBUTE attrlist[16];
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_X509_CERTIFICATE signedCert;
fa9e4066f08beec538e775443c5be79dd423fcabahrens boolean_t token_bool = B_TRUE;
fa9e4066f08beec538e775443c5be79dd423fcabahrens boolean_t private_bool = B_TRUE;
fa9e4066f08beec538e775443c5be79dd423fcabahrens int numattr = 0;
fa9e4066f08beec538e775443c5be79dd423fcabahrens int keys = 1;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens (void) memset(&casignkey, 0, sizeof (KMF_KEY_HANDLE));
fa9e4066f08beec538e775443c5be79dd423fcabahrens (void) memset(&signedCert, 0, sizeof (signedCert));
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = read_csrdata(handle, csrfile, &csrdata);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Error reading CSR data\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (kstype == KMF_KEYSTORE_PK11TOKEN) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = select_token(handle, token, FALSE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens } else if (kstype == KMF_KEYSTORE_NSS) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = configure_nss(handle, dir, prefix);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* verify the signature first */
44cd46cadd9aab751dae6a4023c1cb5bf316d274billm kmf_set_attr_at_index(attrlist, numattr, KMF_CSR_DATA_ATTR,
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick &csrdata, sizeof (csrdata));
44cd46cadd9aab751dae6a4023c1cb5bf316d274billm numattr++;
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick rv = kmf_verify_csr(handle, numattr, attrlist);
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum if (rv != KMF_OK) {
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick cryptoerror(LOG_STDERR, gettext("CSR signature "
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick "verification failed.\n"));
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick goto cleanup;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = build_cert_from_csr(&csrdata,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &signedCert, serial, ltime,
fa9e4066f08beec538e775443c5be79dd423fcabahrens issuer, subject, altname,
fa9e4066f08beec538e775443c5be79dd423fcabahrens alttype, altcrit, kubits,
fa9e4066f08beec538e775443c5be79dd423fcabahrens kucrit, ekulist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK)
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto cleanup;
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock
fa9e4066f08beec538e775443c5be79dd423fcabahrens /*
1934e92fc930c49429ad71a8ca97340f33227e78maybee * Find the signing key.
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum */
744947dc83c634d985ed3ad79ac9c5e28d1865fdTom Erickson numattr = 0;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum &kstype, sizeof (kstype));
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum numattr++;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum if (kstype == KMF_KEYSTORE_NSS) {
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum token, strlen(token));
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum numattr++;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum }
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR, signkey,
fa9e4066f08beec538e775443c5be79dd423fcabahrens strlen(signkey));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_PRIVATE_BOOL_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &private_bool, sizeof (private_bool));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_BOOL_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &token_bool, sizeof (token_bool));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &keyclass, sizeof (keyclass));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
47cb52daa729f19e298c85a84e8df069365c5232Jeff Bonwick cred, sizeof (KMF_CREDENTIAL_ATTR));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &keys, sizeof (keys));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &casignkey, sizeof (casignkey));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_find_key(handle, numattr, attrlist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Failed to find signing key\n"));
13506d1eefbbc37e2f12a0528831d9f6d4c361d7maybee goto cleanup;
13506d1eefbbc37e2f12a0528831d9f6d4c361d7maybee }
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock /*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * If we found the key, now we can sign the cert.
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = pk_sign_cert(handle, &signedCert, &casignkey, NULL,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &outcert);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens cryptoerror(LOG_STDERR, gettext(
fa9e4066f08beec538e775443c5be79dd423fcabahrens "Error signing certificate.\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto cleanup;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * Store it on the token if the user asked for it.
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (store) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr = 0;
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &kstype, sizeof (kstype));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens &outcert, sizeof (KMF_DATA));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (outlabel != NULL) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr,
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_CERT_LABEL_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens outlabel, strlen(outlabel));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (kstype == KMF_KEYSTORE_NSS) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (token != NULL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_set_attr_at_index(attrlist, numattr,
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_TOKEN_LABEL_ATTR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens token, strlen(token));
fa9e4066f08beec538e775443c5be79dd423fcabahrens numattr++;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = kmf_store_cert(handle, numattr, attrlist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens display_error(handle, rv,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Failed to store cert "
fa9e4066f08beec538e775443c5be79dd423fcabahrens "on PKCS#11 token.\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = KMF_OK;
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Not fatal, we can still write it to a file. */
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
3d6926289465757c3da780cea696825b0d730283Sanjeev Bagewadi rv = kmf_create_cert_file(&outcert, fmt, certfile);
3d6926289465757c3da780cea696825b0d730283Sanjeev Bagewadi
3d6926289465757c3da780cea696825b0d730283Sanjeev Bagewadicleanup:
3d6926289465757c3da780cea696825b0d730283Sanjeev Bagewadi kmf_free_signed_csr(&csrdata);
3d6926289465757c3da780cea696825b0d730283Sanjeev Bagewadi kmf_free_data(&outcert);
fa9e4066f08beec538e775443c5be79dd423fcabahrens kmf_free_kmf_key(handle, &casignkey);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens}
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * sign a CSR and generate an x509v3 certificate file.
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrensint
fa9e4066f08beec538e775443c5be79dd423fcabahrenspk_signcsr(int argc, char *argv[])
fa9e4066f08beec538e775443c5be79dd423fcabahrens{
fa9e4066f08beec538e775443c5be79dd423fcabahrens int opt;
fa9e4066f08beec538e775443c5be79dd423fcabahrens extern int optind_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens extern char *optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *token_spec = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *subject = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *issuer = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *dir = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *prefix = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *csrfile = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *serstr = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *ekustr = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *kustr = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *format = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *storestr = NULL;
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens char *altname = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *certfile = NULL;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum char *lifetime = NULL;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum char *signkey = NULL;
0a586cea3ceec7e5e50e7e54c745082a7a333ac2Mark Shellenbaum char *outlabel = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens uint32_t ltime = 365 * 24 * 60 * 60; /* 1 Year */
fa9e4066f08beec538e775443c5be79dd423fcabahrens int store = 0;
8a2f1b9190d1dc288470a1fd2776d79ce82cb129ahrens uint16_t kubits = 0;
fa9e4066f08beec538e775443c5be79dd423fcabahrens int altcrit = 0, kucrit = 0;
fa9e4066f08beec538e775443c5be79dd423fcabahrens KMF_BIGINT serial = { NULL, 0 };
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia EKU_LIST *ekulist = NULL;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_KEYSTORE_TYPE kstype = 0;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_RETURN rv = KMF_OK;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_HANDLE_T kmfhandle = NULL;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_CREDENTIAL tokencred = { NULL, 0 };
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_GENERALNAMECHOICES alttype = 0;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia KMF_ENCODE_FORMAT fmt = KMF_FORMAT_PEM;
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia /* Parse command line options. Do NOT i18n/l10n. */
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia while ((opt = getopt_av(argc, argv,
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia "k:(keystore)c:(csr)T:(token)d:(dir)"
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia "p:(prefix)S:(serial)s:(subject)a:(altname)"
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia "t:(store)F:(format)K:(keyusage)l:(signkey)"
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia "L:(lifetime)e:(eku)i:(issuer)"
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia "n:(outlabel)o:(outcert)")) != EOF) {
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia if (EMPTYSTRING(optarg_av))
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia return (PK_ERR_USAGE);
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia switch (opt) {
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia case 'k':
d20e665c84abf083a9e8b62cca93383ecb55afdfRicardo M. Correia if (kstype != 0)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens kstype = KS2Int(optarg_av);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (kstype == 0)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 't':
cdb0ab79ea1af7b8fc339a04d4bf7426dc77ec4emaybee if (storestr != NULL)
cdb0ab79ea1af7b8fc339a04d4bf7426dc77ec4emaybee return (PK_ERR_USAGE);
cdb0ab79ea1af7b8fc339a04d4bf7426dc77ec4emaybee storestr = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens store = yn_to_int(optarg_av);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (store == -1)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'a':
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (altname)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
7bfdf011e081684f853a3242d0296695110d9d84Neil Perrin altname = optarg_av;
7bfdf011e081684f853a3242d0296695110d9d84Neil Perrin break;
ea8dc4b6d2251b437950c0056bc626b311c73c27eschrock case 's':
7bfdf011e081684f853a3242d0296695110d9d84Neil Perrin if (subject)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens subject = optarg_av;
82c9918f28a2d8d9e93769e16f7fa7bee347e80fTim Haley break;
82c9918f28a2d8d9e93769e16f7fa7bee347e80fTim Haley case 'i':
feb08c6bb47ceffa5bb7a70f2c0549113f40fcc5billm if (issuer)
feb08c6bb47ceffa5bb7a70f2c0549113f40fcc5billm return (PK_ERR_USAGE);
feb08c6bb47ceffa5bb7a70f2c0549113f40fcc5billm issuer = optarg_av;
94d1a2100edbb6781ea1c047a6334bb3f15640f5Tim Haley break;
94d1a2100edbb6781ea1c047a6334bb3f15640f5Tim Haley case 'd':
44eda4d76a9383a159e44aa60b63a17644ddd5b1maybee if (dir)
44eda4d76a9383a159e44aa60b63a17644ddd5b1maybee return (PK_ERR_USAGE);
2fdbea25c2ba89186b8a6b7c6840ebc9f4dff245Aleksandr Guzovskiy dir = optarg_av;
2fdbea25c2ba89186b8a6b7c6840ebc9f4dff245Aleksandr Guzovskiy break;
2fdbea25c2ba89186b8a6b7c6840ebc9f4dff245Aleksandr Guzovskiy case 'p':
2fdbea25c2ba89186b8a6b7c6840ebc9f4dff245Aleksandr Guzovskiy if (prefix)
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States return (PK_ERR_USAGE);
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States prefix = optarg_av;
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States break;
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States case 'S':
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States if (serstr != NULL)
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States return (PK_ERR_USAGE);
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States serstr = optarg_av;
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States break;
c242f9a02a2ef021449275ae0a1d2581ee77231dchunli zhang - Sun Microsystems - Irvine United States case 'c':
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (csrfile)
416e0cd82df71e380f21199abde8c5f7a18bac51ek return (PK_ERR_USAGE);
416e0cd82df71e380f21199abde8c5f7a18bac51ek csrfile = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'T': /* token specifier */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (token_spec)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens token_spec = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'l': /* object with specific label */
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (signkey)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens signkey = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'e':
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (ekustr != NULL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens ekustr = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'K':
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (kustr != NULL)
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick return (PK_ERR_USAGE);
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick kustr = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'F':
e45ce728996d8e573eecb27f555fb86aaff0cafdahrens if (format != NULL)
e45ce728996d8e573eecb27f555fb86aaff0cafdahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens format = optarg_av;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens case 'o':
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (certfile != NULL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens certfile = optarg_av;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden break;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden case 'L':
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden if (lifetime != NULL)
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden return (PK_ERR_USAGE);
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden lifetime = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
ad135b5d644628e791c3188a6ecbd9c257961ef8Christopher Siden case 'n':
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (outlabel != NULL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens outlabel = optarg_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens break;
fa9e4066f08beec538e775443c5be79dd423fcabahrens default:
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* No additional args allowed. */
fa9e4066f08beec538e775443c5be79dd423fcabahrens argc -= optind_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens argv += optind_av;
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (argc)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens /* Assume keystore = PKCS#11 if not specified. */
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (kstype == 0)
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens kstype = KMF_KEYSTORE_PK11TOKEN;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens DIR_OPTION_CHECK(kstype, dir);
31fd60d36d9ae794bbedd5e834b8be6d412a853fahrens
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens if (signkey == NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens (void) fprintf(stderr, gettext("The signing key label "
fa9e4066f08beec538e775443c5be79dd423fcabahrens "or filename was not specified\n"));
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens return (PK_ERR_USAGE);
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (csrfile == NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens (void) fprintf(stderr, gettext("The CSR filename was not"
fa9e4066f08beec538e775443c5be79dd423fcabahrens " specified\n"));
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens return (PK_ERR_USAGE);
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (certfile == NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens (void) fprintf(stderr, gettext("The output certificate file "
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens "was not specified\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (issuer == NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens (void) fprintf(stderr, gettext("The issuer DN "
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens "was not specified\n"));
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens return (PK_ERR_USAGE);
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (lifetime != NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (Str2Lifetime(lifetime, &ltime) != 0) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens cryptoerror(LOG_STDERR,
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens gettext("Error parsing lifetime string\n"));
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens return (PK_ERR_USAGE);
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec)) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens token_spec = PK_DEFAULT_PK11TOKEN;
fa9e4066f08beec538e775443c5be79dd423fcabahrens } else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec)) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens token_spec = DEFAULT_NSS_TOKEN;
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens }
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (serstr != NULL) {
a2eea2e101e6a163a537dcc6d4e3c4da2a0ea5b2ahrens uchar_t *bytes = NULL;
fa9e4066f08beec538e775443c5be79dd423fcabahrens size_t bytelen;
71eb05381846ad14a2087631474e832d0f316654Chris Kirby
71eb05381846ad14a2087631474e832d0f316654Chris Kirby rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
71eb05381846ad14a2087631474e832d0f316654Chris Kirby if (rv != KMF_OK || bytes == NULL) {
71eb05381846ad14a2087631474e832d0f316654Chris Kirby (void) fprintf(stderr, gettext("Serial number "
71eb05381846ad14a2087631474e832d0f316654Chris Kirby "must be specified as a hex number "
fa9e4066f08beec538e775443c5be79dd423fcabahrens "(ex: 0x0102030405ffeeddee)\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens serial.val = bytes;
fa9e4066f08beec538e775443c5be79dd423fcabahrens serial.len = bytelen;
fa9e4066f08beec538e775443c5be79dd423fcabahrens } else {
fa9e4066f08beec538e775443c5be79dd423fcabahrens (void) fprintf(stderr, gettext("The serial number was not"
fa9e4066f08beec538e775443c5be79dd423fcabahrens " specified\n"));
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
55da60b91d96984f12de050ce428373ea25c7f35Mark J Musante }
e09fa4dacfb671e707d50a55ae9b5cc191e1b8cbNeil Perrin
fa9e4066f08beec538e775443c5be79dd423fcabahrens if ((kstype == KMF_KEYSTORE_PK11TOKEN ||
b38f097029665f4ece801ca129913d36f757b49cck kstype == KMF_KEYSTORE_NSS)) {
ab04eb8ef60d9dc9614d6cccffc474f24ca1d162timh /* Need to get password for private key access */
ab04eb8ef60d9dc9614d6cccffc474f24ca1d162timh (void) get_token_password(kstype, token_spec,
87e5029a3226958edab1512d6182bc74d8d80c9aahrens &tokencred);
87e5029a3226958edab1512d6182bc74d8d80c9aahrens }
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens if (kustr != NULL) {
9966ca11f4a1481acce85f690fa59e4084050627Matthew Ahrens rv = verify_keyusage(kustr, &kubits, &kucrit);
9966ca11f4a1481acce85f690fa59e4084050627Matthew Ahrens if (rv != KMF_OK) {
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens (void) fprintf(stderr, gettext("KeyUsage "
148434217c040ea38dc844384f6ba68d9b325906Matthew Ahrens "must be specified as a comma-separated list. "
f18faf3f3e5def85fdfff681617d227703ace2adek "See the man page for details.\n"));
f18faf3f3e5def85fdfff681617d227703ace2adek rv = PK_ERR_USAGE;
fa9e4066f08beec538e775443c5be79dd423fcabahrens goto end;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (ekustr != NULL) {
87e5029a3226958edab1512d6182bc74d8d80c9aahrens rv = verify_ekunames(ekustr, &ekulist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (rv != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens (void) fprintf(stderr, gettext("EKUs must "
fa9e4066f08beec538e775443c5be79dd423fcabahrens "be specified as a comma-separated list. "
c5c6ffa0498b9c8555798756141b4a3061a138c1maybee "See the man page for details.\n"));
c5c6ffa0498b9c8555798756141b4a3061a138c1maybee rv = PK_ERR_USAGE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto end;
c5c6ffa0498b9c8555798756141b4a3061a138c1maybee }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
c5c6ffa0498b9c8555798756141b4a3061a138c1maybee if (altname != NULL) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens char *p;
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = verify_altname(altname, &alttype, &altcrit);
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (rv != KMF_OK) {
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick (void) fprintf(stderr, gettext("Subject AltName "
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick "must be specified as a name=value pair. "
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick "See the man page for details.\n"));
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick rv = PK_ERR_USAGE;
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick goto end;
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick }
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick /* advance the altname past the '=' sign */
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick p = strchr(altname, '=');
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (p != NULL)
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick altname = p + 1;
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick }
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
b24ab6762772a3f6a89393947930c7fa61306783Jeff Bonwick cryptoerror(LOG_STDERR,
fa9e4066f08beec538e775443c5be79dd423fcabahrens gettext("Error parsing format string (%s).\n"),
fa9e4066f08beec538e775443c5be79dd423fcabahrens format);
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (PK_ERR_USAGE);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (rv);
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (kstype == KMF_KEYSTORE_PK11TOKEN) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens rv = pk_signcsr_pk11_nss(kmfhandle,
fa9e4066f08beec538e775443c5be79dd423fcabahrens kstype, dir, prefix, token_spec, &tokencred,
fa9e4066f08beec538e775443c5be79dd423fcabahrens signkey, csrfile, &serial, certfile, issuer, subject,
fa9e4066f08beec538e775443c5be79dd423fcabahrens altname, alttype, altcrit, kubits, kucrit,
fa9e4066f08beec538e775443c5be79dd423fcabahrens ekulist, ltime, fmt, store, outlabel);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens } else if (kstype == KMF_KEYSTORE_NSS) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (dir == NULL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens dir = PK_DEFAULT_DIRECTORY;
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens
4e3c9f4489a18514e5e8caeb91d4e6db07c98415Bill Pijewski rv = pk_signcsr_pk11_nss(kmfhandle,
4445fffbbb1ea25fd0e9ea68b9380dd7a6709025Matthew Ahrens kstype, dir, prefix, token_spec, &tokencred,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens signkey, csrfile, &serial, certfile, issuer, subject,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens altname, alttype, altcrit, kubits, kucrit,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens ekulist, ltime, fmt, store, outlabel);
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens } else if (kstype == KMF_KEYSTORE_OPENSSL) {
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens rv = pk_signcsr_files(kmfhandle,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens signkey, csrfile, &serial, certfile, issuer, subject,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens altname, alttype, altcrit, kubits, kucrit,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens ekulist, ltime, fmt);
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens }
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens
3cb34c601f3ef3016f638574f5982e80c3735c71ahrensend:
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens if (rv != KMF_OK) {
9e69d7d0feb2a0394435ca1d9746c4c3d7bf9b22Lori Alt display_error(kmfhandle, rv,
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens gettext("Error listing objects"));
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens }
ec5cf9d53a1d7280f3f1a6eadd7cdabdc99814ebAlexander Stetsenko
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens if (serial.val != NULL)
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens free(serial.val);
9e69d7d0feb2a0394435ca1d9746c4c3d7bf9b22Lori Alt
f4b94bde302dc950da6b4ec29936dd9a7b9d61abMatthew Ahrens if (tokencred.cred != NULL)
c99e4bdccfb4ac4da569c64a43baaf908d726329Chris Kirby free(tokencred.cred);
c99e4bdccfb4ac4da569c64a43baaf908d726329Chris Kirby
3cb34c601f3ef3016f638574f5982e80c3735c71ahrens free_eku_list(ekulist);
fa9e4066f08beec538e775443c5be79dd423fcabahrens
99d5e173470cf967aa87653364ed614299e7b511Tim Haley (void) kmf_finalize(kmfhandle);
99d5e173470cf967aa87653364ed614299e7b511Tim Haley return (rv);
99d5e173470cf967aa87653364ed614299e7b511Tim Haley}
fa9e4066f08beec538e775443c5be79dd423fcabahrens