svr4pkg/pkgadm/certs.c

5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland/*
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * CDDL HEADER START
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * The contents of this file are subject to the terms of the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Common Development and Distribution License (the "License").
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * You may not use this file except in compliance with the License.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * or http://www.opensolaris.org/os/licensing.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * See the License for the specific language governing permissions
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * and limitations under the License.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * When distributing Covered Code, include this CDDL HEADER in each
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * If applicable, add the following below this CDDL HEADER, with the
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * fields enclosed by brackets "[]" replaced with your own identifying
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * information: Portions Copyright [yyyy] [name of copyright owner]
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * CDDL HEADER END
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland/*
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Use is subject to license terms.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <stdio.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <limits.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <stdlib.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <unistd.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <string.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <pkglocs.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <locale.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <libintl.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <signal.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <sys/stat.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <sys/statvfs.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <sys/types.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <fcntl.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <libintl.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <dirent.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/err.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/pkcs7.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/pkcs12.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/x509.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/pem.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <openssl/x509v3.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <pkglib.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <p12lib.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <install.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <libadm.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include <libinst.h>
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include "pkgadm.h"
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland#include "pkgadm_msgs.h"
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland/*
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Function:    load_cert_and_key
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Description: Loads a public key certificate and associated private key
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      from a stream.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Parameters:  err - Where to write errors to for underlying library calls
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      incert - File to read certs and keys from
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      format - The format of the file
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      passarg - How to collect password if needed to decrypt file
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      key - Location to store resulting key if found
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      cert - Location to store resulting cert if found.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Returns: f one or more certificates are found in the file,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      and one or more keys are found, then the first
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      certificate is used, and the keys are searched for a
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      match.  If no key matches the cert, then only the cert
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      is returned.  If no certs are found, but one or more
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      keys are found, then the first key is returned.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandint
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandload_cert_and_key(PKG_ERR *err, FILE *incert,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    keystore_encoding_format_t format, char *passarg, EVP_PKEY **key,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    X509 **cert)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland{
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    X509 *tmpcert = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    EVP_PKEY *tmpkey = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    STACK_OF(EVP_PKEY)  *keys = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    STACK_OF(X509)      *certs = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    int i, ret = 0;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    keystore_passphrase_data    data;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    unsigned long crypto_err;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (key) *key = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (cert) *cert = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    switch (format) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    case KEYSTORE_FORMAT_DER:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        /* first try to load a DER cert, which cannot contain a key */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if ((tmpcert = d2i_X509_fp(incert, NULL)) == NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            log_msg(LOG_MSG_ERR, MSG_PARSE);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            ret = 1;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        break;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    case KEYSTORE_FORMAT_PEM:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    default:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        data.err = err;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        set_passphrase_passarg(passarg);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        set_passphrase_prompt(gettext("Enter PEM passphrase:"));
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if (sunw_PEM_contents(incert, pkg_passphrase_cb,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            &data, &keys, &certs) < 0) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            /* print out openssl-generated PEM errors */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            while ((crypto_err = ERR_get_error()) != 0) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                log_msg(LOG_MSG_ERR,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                    ERR_reason_error_string(crypto_err));
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            ret = 1;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            goto cleanup;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        /* take the first cert in the file, if any */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if (cert && (certs != NULL)) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            if (sk_X509_num(certs) != 1) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                log_msg(LOG_MSG_ERR, MSG_MULTIPLE_CERTS);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                ret = 1;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                goto cleanup;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            } else {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                tmpcert = sk_X509_value(certs, 0);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if (key && (keys != NULL)) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            if (tmpcert != NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                /*
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                 * if we found a cert and some keys,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                 * only return the key that
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                 * matches the cert
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                 */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                for (i = 0; i < sk_EVP_PKEY_num(keys); i++) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                    if (X509_check_private_key(tmpcert,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                        sk_EVP_PKEY_value(keys, i))) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                        tmpkey =
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                            sk_EVP_PKEY_value(keys, i);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                        break;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            } else {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                if (sk_EVP_PKEY_num(keys) > 0) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                    tmpkey = sk_EVP_PKEY_value(keys, 0);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        break;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    /* set results */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (key && tmpkey) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        *key = tmpkey;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        tmpkey = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (cert && tmpcert) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        *cert = tmpcert;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        tmpcert = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandcleanup:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (tmpcert != NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        X509_free(tmpcert);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (tmpkey != NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        sunw_evp_pkey_free(tmpkey);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    return (ret);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland}
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland/*
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Function:    load_all_certs
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Description: Loads alll certificates from a stream.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Parameters:  err - Where to write errors to for underlying library calls
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      incert - File to read certs and keys from
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      format - The format of the file
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      passarg - How to collect password if needed to decrypt file
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      certs - Location to store resulting cert if found.
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland * Returns: 0 - success, all certs placed in ''certs'
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland *      non-zero failure, errors in 'err'
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandint
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandload_all_certs(PKG_ERR *err, FILE *incert,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    keystore_encoding_format_t format, char *passarg, STACK_OF(X509) **certs)
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland{
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    X509 *tmpcert = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    STACK_OF(X509) *tmpcerts = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    int ret = 0;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    keystore_passphrase_data    data;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    unsigned long crypto_err;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (certs) *certs = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    switch (format) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    case KEYSTORE_FORMAT_DER:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        /* first try to load a DER cert, which cannot contain a key */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if ((tmpcert = d2i_X509_fp(incert, NULL)) == NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            log_msg(LOG_MSG_ERR, MSG_PARSE);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            ret = 1;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            goto cleanup;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if ((tmpcerts = sk_X509_new_null()) == NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            log_msg(LOG_MSG_ERR, MSG_MEM);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            ret = 1;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            goto cleanup;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        sk_X509_push(tmpcerts, tmpcert);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        break;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    case KEYSTORE_FORMAT_PEM:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    default:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        data.err = err;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        set_passphrase_prompt(MSG_PEM_PASSPROMPT);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        set_passphrase_passarg(passarg);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        if (sunw_PEM_contents(incert, pkg_passphrase_cb,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            &data, NULL, &tmpcerts) < 0) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            /* print out openssl-generated PEM errors */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            while ((crypto_err = ERR_get_error()) != 0) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                log_msg(LOG_MSG_ERR,
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland                    ERR_reason_error_string(crypto_err));
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland            }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        break;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    /* set results */
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (certs && tmpcerts) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        *certs = tmpcerts;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        tmpcerts = NULL;
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterlandcleanup:
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    if (tmpcerts != NULL) {
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland        sk_X509_free(tmpcerts);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    }
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland    return (ret);
5c51f1241dbbdf2656d0e10011981411ed0c9673Moriah Waterland}