apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <openssl/conf.h>
  67 #include <openssl/bio.h>
  68 #include <openssl/err.h>
  69 #include <openssl/bn.h>
  70 #include <openssl/txt_db.h>
  71 #include <openssl/evp.h>
  72 #include <openssl/x509.h>
  73 #include <openssl/x509v3.h>
  74 #include <openssl/objects.h>
  75 #include <openssl/ocsp.h>
  76 #include <openssl/pem.h>
  77
  78 #ifndef W_OK
  79 #  ifdef OPENSSL_SYS_VMS
  80 #    if defined(__DECC)
  81 #      include <unistd.h>
  82 #    else
  83 #      include <unixlib.h>
  84 #    endif
  85 #  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_NETWARE)
  86 #    include <sys/file.h>
  87 #  endif
  88 #endif
  89
  90 #include "apps.h"
  91
  92 #ifndef W_OK
  93 #  define F_OK 0
  94 #  define X_OK 1
  95 #  define W_OK 2
  96 #  define R_OK 4
  97 #endif
  98
  99 #undef PROG
 100 #define PROG ca_main
 101
 102 #define BASE_SECTION    "ca"
 103 #define CONFIG_FILE "openssl.cnf"
 104
 105 #define ENV_DEFAULT_CA          "default_ca"
 106
 107 #define STRING_MASK     "string_mask"
 108 #define UTF8_IN                 "utf8"
 109
 110 #define ENV_DIR                 "dir"
 111 #define ENV_CERTS               "certs"
 112 #define ENV_CRL_DIR             "crl_dir"
 113 #define ENV_CA_DB               "CA_DB"
 114 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 115 #define ENV_CERTIFICATE         "certificate"
 116 #define ENV_SERIAL              "serial"
 117 #define ENV_CRLNUMBER           "crlnumber"
 118 #define ENV_CRL                 "crl"
 119 #define ENV_PRIVATE_KEY         "private_key"
 120 #define ENV_RANDFILE            "RANDFILE"
 121 #define ENV_DEFAULT_DAYS        "default_days"
 122 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 123 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 124 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 125 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 126 #define ENV_DEFAULT_MD          "default_md"
 127 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 128 #define ENV_PRESERVE            "preserve"
 129 #define ENV_POLICY              "policy"
 130 #define ENV_EXTENSIONS          "x509_extensions"
 131 #define ENV_CRLEXT              "crl_extensions"
 132 #define ENV_MSIE_HACK           "msie_hack"
 133 #define ENV_NAMEOPT             "name_opt"
 134 #define ENV_CERTOPT             "cert_opt"
 135 #define ENV_EXTCOPY             "copy_extensions"
 136 #define ENV_UNIQUE_SUBJECT      "unique_subject"
 137
 138 #define ENV_DATABASE            "database"
 139
 140 /* Additional revocation information types */
 141
 142 #define REV_NONE                0       /* No addditional information */
 143 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 144 #define REV_HOLD                2       /* Value is hold instruction */
 145 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 146 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 147
 148 static const char *ca_usage[]={
 149 "usage: ca args\n",
 150 "\n",
 151 " -verbose        - Talk alot while doing things\n",
 152 " -config file    - A config file\n",
 153 " -name arg       - The particular CA definition to use\n",
 154 " -gencrl         - Generate a new CRL\n",
 155 " -crldays days   - Days is when the next CRL is due\n",
 156 " -crlhours hours - Hours is when the next CRL is due\n",
 157 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 158 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 159 " -days arg       - number of days to certify the certificate for\n",
 160 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 161 " -policy arg     - The CA 'policy' to support\n",
 162 " -keyfile arg    - private key file\n",
 163 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 164 " -key arg        - key to decode the private key if it is encrypted\n",
 165 " -cert file      - The CA certificate\n",
 166 " -selfsign       - sign a certificate with the key associated with it\n",
 167 " -in file        - The input PEM encoded certificate request(s)\n",
 168 " -out file       - Where to put the output file(s)\n",
 169 " -outdir dir     - Where to put output certificates\n",
 170 " -infiles ....   - The last argument, requests to process\n",
 171 " -spkac file     - File contains DN and signed public key and challenge\n",
 172 " -ss_cert file   - File contains a self signed cert to sign\n",
 173 " -preserveDN     - Don't re-order the DN\n",
 174 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 175 " -batch          - Don't ask questions\n",
 176 " -msie_hack      - msie modifications to handle all those universal strings\n",
 177 " -revoke file    - Revoke a certificate (given in file)\n",
 178 " -subj arg       - Use arg instead of request's subject\n",
 179 " -utf8           - input characters are UTF8 (default ASCII)\n",
 180 " -multivalue-rdn - enable support for multivalued RDNs\n",
 181 " -extensions ..  - Extension section (override value in config file)\n",
 182 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 183 " -crlexts ..     - CRL extension section (override value in config file)\n",
 184 #ifndef OPENSSL_NO_ENGINE
 185 " -engine e       - use engine e, possibly a hardware device.\n",
 186 #endif
 187 " -status serial  - Shows certificate status given the serial number\n",
 188 " -updatedb       - Updates db for expired certificates\n",
 189 NULL
 190 };
 191
 192 #ifdef EFENCE
 193 extern int EF_PROTECT_FREE;
 194 extern int EF_PROTECT_BELOW;
 195 extern int EF_ALIGNMENT;
 196 #endif
 197
 198 static void lookup_fail(const char *name, const char *tag);
 199 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 200                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
 201                    BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate,
 202                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 203                    int verbose, unsigned long certopt, unsigned long nameopt,
 204                    int default_op, int ext_copy, int selfsign);
 205 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 206                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 207                         CA_DB *db, BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn,
 208                         char *startdate, char *enddate, long days, int batch,
 209                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 210                         unsigned long nameopt, int default_op, int ext_copy,
 211                         ENGINE *e);
 212 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 213                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 214                          CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn, int email_dn,
 215                          char *startdate, char *enddate, long days, char *ext_sect,
 216                          CONF *conf, int verbose, unsigned long certopt,
 217                          unsigned long nameopt, int default_op, int ext_copy);
 218 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 219 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 220         STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,unsigned long chtype, int multirdn,
 221         int email_dn, char *startdate, char *enddate, long days, int batch,
 222         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 223         unsigned long certopt, unsigned long nameopt, int default_op,
 224         int ext_copy, int selfsign);
 225 static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
 226 static int get_certificate_status(const char *ser_status, CA_DB *db);
 227 static int do_updatedb(CA_DB *db);
 228 static int check_time_format(const char *str);
 229 char *make_revocation_str(int rev_type, char *rev_arg);
 230 int make_revoked(X509_REVOKED *rev, const char *str);
 231 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 232 static CONF *conf=NULL;
 233 static CONF *extconf=NULL;
 234 static char *section=NULL;
 235
 236 static int preserve=0;
 237 static int msie_hack=0;
 238
 239
 240 int MAIN(int, char **);
 241
 242 int MAIN(int argc, char **argv)
 243         {
 244         ENGINE *e = NULL;
 245         char *key=NULL,*passargin=NULL;
 246         int create_ser = 0;
 247         int free_key = 0;
 248         int total=0;
 249         int total_done=0;
 250         int badops=0;
 251         int ret=1;
 252         int email_dn=1;
 253         int req=0;
 254         int verbose=0;
 255         int gencrl=0;
 256         int dorevoke=0;
 257         int doupdatedb=0;
 258         long crldays=0;
 259         long crlhours=0;
 260         long crlsec=0;
 261         long errorline= -1;
 262         char *configfile=NULL;
 263         char *md=NULL;
 264         char *policy=NULL;
 265         char *keyfile=NULL;
 266         char *certfile=NULL;
 267         int keyform=FORMAT_PEM;
 268         char *infile=NULL;
 269         char *spkac_file=NULL;
 270         char *ss_cert_file=NULL;
 271         char *ser_status=NULL;
 272         EVP_PKEY *pkey=NULL;
 273         int output_der = 0;
 274         char *outfile=NULL;
 275         char *outdir=NULL;
 276         char *serialfile=NULL;
 277         char *crlnumberfile=NULL;
 278         char *extensions=NULL;
 279         char *extfile=NULL;
 280         char *subj=NULL;
 281         unsigned long chtype = MBSTRING_ASC;
 282         int multirdn = 0;
 283         char *tmp_email_dn=NULL;
 284         char *crl_ext=NULL;
 285         int rev_type = REV_NONE;
 286         char *rev_arg = NULL;
 287         BIGNUM *serial=NULL;
 288         BIGNUM *crlnumber=NULL;
 289         char *startdate=NULL;
 290         char *enddate=NULL;
 291         long days=0;
 292         int batch=0;
 293         int notext=0;
 294         unsigned long nameopt = 0, certopt = 0;
 295         int default_op = 1;
 296         int ext_copy = EXT_COPY_NONE;
 297         int selfsign = 0;
 298         X509 *x509=NULL, *x509p = NULL;
 299         X509 *x=NULL;
 300         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 301         char *dbfile=NULL;
 302         CA_DB *db=NULL;
 303         X509_CRL *crl=NULL;
 304         X509_REVOKED *r=NULL;
 305         ASN1_TIME *tmptm;
 306         ASN1_INTEGER *tmpser;
 307         char *f;
 308         const char *p;
 309         char * const *pp;
 310         int i,j;
 311         const EVP_MD *dgst=NULL;
 312         STACK_OF(CONF_VALUE) *attribs=NULL;
 313         STACK_OF(X509) *cert_sk=NULL;
 314 #undef BSIZE
 315 #define BSIZE 256
 316         MS_STATIC char buf[3][BSIZE];
 317         char *randfile=NULL;
 318 #ifndef OPENSSL_NO_ENGINE
 319         char *engine = NULL;
 320 #endif
 321         char *tofree=NULL;
 322         DB_ATTR db_attr;
 323
 324 #ifdef EFENCE
 325 EF_PROTECT_FREE=1;
 326 EF_PROTECT_BELOW=1;
 327 EF_ALIGNMENT=0;
 328 #endif
 329
 330         apps_startup();
 331
 332         conf = NULL;
 333         key = NULL;
 334         section = NULL;
 335
 336         preserve=0;
 337         msie_hack=0;
 338         if (bio_err == NULL)
 339                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 340                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 341
 342         argc--;
 343         argv++;
 344         while (argc >= 1)
 345                 {
 346                 if      (strcmp(*argv,"-verbose") == 0)
 347                         verbose=1;
 348                 else if (strcmp(*argv,"-config") == 0)
 349                         {
 350                         if (--argc < 1) goto bad;
 351                         configfile= *(++argv);
 352                         }
 353                 else if (strcmp(*argv,"-name") == 0)
 354                         {
 355                         if (--argc < 1) goto bad;
 356                         section= *(++argv);
 357                         }
 358                 else if (strcmp(*argv,"-subj") == 0)
 359                         {
 360                         if (--argc < 1) goto bad;
 361                         subj= *(++argv);
 362                         /* preserve=1; */
 363                         }
 364                 else if (strcmp(*argv,"-utf8") == 0)
 365                         chtype = MBSTRING_UTF8;
 366                 else if (strcmp(*argv,"-create_serial") == 0)
 367                         create_ser = 1;
 368                 else if (strcmp(*argv,"-multivalue-rdn") == 0)
 369                         multirdn=1;
 370                 else if (strcmp(*argv,"-startdate") == 0)
 371                         {
 372                         if (--argc < 1) goto bad;
 373                         startdate= *(++argv);
 374                         }
 375                 else if (strcmp(*argv,"-enddate") == 0)
 376                         {
 377                         if (--argc < 1) goto bad;
 378                         enddate= *(++argv);
 379                         }
 380                 else if (strcmp(*argv,"-days") == 0)
 381                         {
 382                         if (--argc < 1) goto bad;
 383                         days=atoi(*(++argv));
 384                         }
 385                 else if (strcmp(*argv,"-md") == 0)
 386                         {
 387                         if (--argc < 1) goto bad;
 388                         md= *(++argv);
 389                         }
 390                 else if (strcmp(*argv,"-policy") == 0)
 391                         {
 392                         if (--argc < 1) goto bad;
 393                         policy= *(++argv);
 394                         }
 395                 else if (strcmp(*argv,"-keyfile") == 0)
 396                         {
 397                         if (--argc < 1) goto bad;
 398                         keyfile= *(++argv);
 399                         }
 400                 else if (strcmp(*argv,"-keyform") == 0)
 401                         {
 402                         if (--argc < 1) goto bad;
 403                         keyform=str2fmt(*(++argv));
 404                         }
 405                 else if (strcmp(*argv,"-passin") == 0)
 406                         {
 407                         if (--argc < 1) goto bad;
 408                         passargin= *(++argv);
 409                         }
 410                 else if (strcmp(*argv,"-key") == 0)
 411                         {
 412                         if (--argc < 1) goto bad;
 413                         key= *(++argv);
 414                         }
 415                 else if (strcmp(*argv,"-cert") == 0)
 416                         {
 417                         if (--argc < 1) goto bad;
 418                         certfile= *(++argv);
 419                         }
 420                 else if (strcmp(*argv,"-selfsign") == 0)
 421                         selfsign=1;
 422                 else if (strcmp(*argv,"-in") == 0)
 423                         {
 424                         if (--argc < 1) goto bad;
 425                         infile= *(++argv);
 426                         req=1;
 427                         }
 428                 else if (strcmp(*argv,"-out") == 0)
 429                         {
 430                         if (--argc < 1) goto bad;
 431                         outfile= *(++argv);
 432                         }
 433                 else if (strcmp(*argv,"-outdir") == 0)
 434                         {
 435                         if (--argc < 1) goto bad;
 436                         outdir= *(++argv);
 437                         }
 438                 else if (strcmp(*argv,"-notext") == 0)
 439                         notext=1;
 440                 else if (strcmp(*argv,"-batch") == 0)
 441                         batch=1;
 442                 else if (strcmp(*argv,"-preserveDN") == 0)
 443                         preserve=1;
 444                 else if (strcmp(*argv,"-noemailDN") == 0)
 445                         email_dn=0;
 446                 else if (strcmp(*argv,"-gencrl") == 0)
 447                         gencrl=1;
 448                 else if (strcmp(*argv,"-msie_hack") == 0)
 449                         msie_hack=1;
 450                 else if (strcmp(*argv,"-crldays") == 0)
 451                         {
 452                         if (--argc < 1) goto bad;
 453                         crldays= atol(*(++argv));
 454                         }
 455                 else if (strcmp(*argv,"-crlhours") == 0)
 456                         {
 457                         if (--argc < 1) goto bad;
 458                         crlhours= atol(*(++argv));
 459                         }
 460                 else if (strcmp(*argv,"-crlsec") == 0)
 461                         {
 462                         if (--argc < 1) goto bad;
 463                         crlsec = atol(*(++argv));
 464                         }
 465                 else if (strcmp(*argv,"-infiles") == 0)
 466                         {
 467                         argc--;
 468                         argv++;
 469                         req=1;
 470                         break;
 471                         }
 472                 else if (strcmp(*argv, "-ss_cert") == 0)
 473                         {
 474                         if (--argc < 1) goto bad;
 475                         ss_cert_file = *(++argv);
 476                         req=1;
 477                         }
 478                 else if (strcmp(*argv, "-spkac") == 0)
 479                         {
 480                         if (--argc < 1) goto bad;
 481                         spkac_file = *(++argv);
 482                         req=1;
 483                         }
 484                 else if (strcmp(*argv,"-revoke") == 0)
 485                         {
 486                         if (--argc < 1) goto bad;
 487                         infile= *(++argv);
 488                         dorevoke=1;
 489                         }
 490                 else if (strcmp(*argv,"-extensions") == 0)
 491                         {
 492                         if (--argc < 1) goto bad;
 493                         extensions= *(++argv);
 494                         }
 495                 else if (strcmp(*argv,"-extfile") == 0)
 496                         {
 497                         if (--argc < 1) goto bad;
 498                         extfile= *(++argv);
 499                         }
 500                 else if (strcmp(*argv,"-status") == 0)
 501                         {
 502                         if (--argc < 1) goto bad;
 503                         ser_status= *(++argv);
 504                         }
 505                 else if (strcmp(*argv,"-updatedb") == 0)
 506                         {
 507                         doupdatedb=1;
 508                         }
 509                 else if (strcmp(*argv,"-crlexts") == 0)
 510                         {
 511                         if (--argc < 1) goto bad;
 512                         crl_ext= *(++argv);
 513                         }
 514                 else if (strcmp(*argv,"-crl_reason") == 0)
 515                         {
 516                         if (--argc < 1) goto bad;
 517                         rev_arg = *(++argv);
 518                         rev_type = REV_CRL_REASON;
 519                         }
 520                 else if (strcmp(*argv,"-crl_hold") == 0)
 521                         {
 522                         if (--argc < 1) goto bad;
 523                         rev_arg = *(++argv);
 524                         rev_type = REV_HOLD;
 525                         }
 526                 else if (strcmp(*argv,"-crl_compromise") == 0)
 527                         {
 528                         if (--argc < 1) goto bad;
 529                         rev_arg = *(++argv);
 530                         rev_type = REV_KEY_COMPROMISE;
 531                         }
 532                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 533                         {
 534                         if (--argc < 1) goto bad;
 535                         rev_arg = *(++argv);
 536                         rev_type = REV_CA_COMPROMISE;
 537                         }
 538 #ifndef OPENSSL_NO_ENGINE
 539                 else if (strcmp(*argv,"-engine") == 0)
 540                         {
 541                         if (--argc < 1) goto bad;
 542                         engine= *(++argv);
 543                         }
 544 #endif
 545                 else
 546                         {
 547 bad:
 548                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 549                         badops=1;
 550                         break;
 551                         }
 552                 argc--;
 553                 argv++;
 554                 }
 555
 556         if (badops)
 557                 {
 558                 const char **pp2;
 559
 560                 for (pp2=ca_usage; (*pp2 != NULL); pp2++)
 561                         BIO_printf(bio_err,"%s",*pp2);
 562                 goto err;
 563                 }
 564
 565         ERR_load_crypto_strings();
 566
 567         /*****************************************************************/
 568         tofree=NULL;
 569         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 570         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 571         if (configfile == NULL)
 572                 {
 573                 const char *s=X509_get_default_cert_area();
 574                 size_t len;
 575
 576 #ifdef OPENSSL_SYS_VMS
 577                 len = strlen(s)+sizeof(CONFIG_FILE);
 578                 tofree=OPENSSL_malloc(len);
 579                 strcpy(tofree,s);
 580 #else
 581                 len = strlen(s)+sizeof(CONFIG_FILE)+1;
 582                 tofree=OPENSSL_malloc(len);
 583                 BUF_strlcpy(tofree,s,len);
 584                 BUF_strlcat(tofree,"/",len);
 585 #endif
 586                 BUF_strlcat(tofree,CONFIG_FILE,len);
 587                 configfile=tofree;
 588                 }
 589
 590         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 591         conf = NCONF_new(NULL);
 592         if (NCONF_load(conf,configfile,&errorline) <= 0)
 593                 {
 594                 if (errorline <= 0)
 595                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 596                                 configfile);
 597                 else
 598                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 599                                 ,errorline,configfile);
 600                 goto err;
 601                 }
 602         if(tofree)
 603                 {
 604                 OPENSSL_free(tofree);
 605                 tofree = NULL;
 606                 }
 607
 608         if (!load_config(bio_err, conf))
 609                 goto err;
 610
 611 #ifndef OPENSSL_NO_ENGINE
 612         e = setup_engine(bio_err, engine, 0);
 613 #endif
 614
 615         /* Lets get the config section we are using */
 616         if (section == NULL)
 617                 {
 618                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 619                 if (section == NULL)
 620                         {
 621                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 622                         goto err;
 623                         }
 624                 }
 625
 626         if (conf != NULL)
 627                 {
 628                 p=NCONF_get_string(conf,NULL,"oid_file");
 629                 if (p == NULL)
 630                         ERR_clear_error();
 631                 if (p != NULL)
 632                         {
 633                         BIO *oid_bio;
 634
 635                         oid_bio=BIO_new_file(p,"r");
 636                         if (oid_bio == NULL)
 637                                 {
 638                                 /*
 639                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 640                                 ERR_print_errors(bio_err);
 641                                 */
 642                                 ERR_clear_error();
 643                                 }
 644                         else
 645                                 {
 646                                 OBJ_create_objects(oid_bio);
 647                                 BIO_free(oid_bio);
 648                                 }
 649                         }
 650                 if (!add_oid_section(bio_err,conf))
 651                         {
 652                         ERR_print_errors(bio_err);
 653                         goto err;
 654                         }
 655                 }
 656
 657         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 658         if (randfile == NULL)
 659                 ERR_clear_error();
 660         app_RAND_load_file(randfile, bio_err, 0);
 661
 662         f = NCONF_get_string(conf, section, STRING_MASK);
 663         if (!f)
 664                 ERR_clear_error();
 665
 666         if(f && !ASN1_STRING_set_default_mask_asc(f)) {
 667                 BIO_printf(bio_err, "Invalid global string mask setting %s\n", f);
 668                 goto err;
 669         }
 670
 671         if (chtype != MBSTRING_UTF8){
 672                 f = NCONF_get_string(conf, section, UTF8_IN);
 673                 if (!f)
 674                         ERR_clear_error();
 675                 else if (!strcmp(f, "yes"))
 676                         chtype = MBSTRING_UTF8;
 677         }
 678
 679         db_attr.unique_subject = 1;
 680         p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);
 681         if (p)
 682                 {
 683 #ifdef RL_DEBUG
 684                 BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
 685 #endif
 686                 db_attr.unique_subject = parse_yesno(p,1);
 687                 }
 688         else
 689                 ERR_clear_error();
 690 #ifdef RL_DEBUG
 691         if (!p)
 692                 BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
 693 #endif
 694 #ifdef RL_DEBUG
 695         BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
 696                 db_attr.unique_subject);
 697 #endif
 698
 699         in=BIO_new(BIO_s_file());
 700         out=BIO_new(BIO_s_file());
 701         Sout=BIO_new(BIO_s_file());
 702         Cout=BIO_new(BIO_s_file());
 703         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 704                 {
 705                 ERR_print_errors(bio_err);
 706                 goto err;
 707                 }
 708
 709         /*****************************************************************/
 710         /* report status of cert with serial number given on command line */
 711         if (ser_status)
 712         {
 713                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 714                         {
 715                         lookup_fail(section,ENV_DATABASE);
 716                         goto err;
 717                         }
 718                 db = load_index(dbfile,&db_attr);
 719                 if (db == NULL) goto err;
 720
 721                 if (!index_index(db)) goto err;
 722
 723                 if (get_certificate_status(ser_status,db) != 1)
 724                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 725                                  ser_status);
 726                 goto err;
 727         }
 728
 729         /*****************************************************************/
 730         /* we definitely need a private key, so let's get it */
 731
 732         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 733                 section,ENV_PRIVATE_KEY)) == NULL))
 734                 {
 735                 lookup_fail(section,ENV_PRIVATE_KEY);
 736                 goto err;
 737                 }
 738         if (!key)
 739                 {
 740                 free_key = 1;
 741                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 742                         {
 743                         BIO_printf(bio_err,"Error getting password\n");
 744                         goto err;
 745                         }
 746                 }
 747         pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
 748                 "CA private key");
 749         if (key) OPENSSL_cleanse(key,strlen(key));
 750         if (pkey == NULL)
 751                 {
 752                 /* load_key() has already printed an appropriate message */
 753                 goto err;
 754                 }
 755
 756         /*****************************************************************/
 757         /* we need a certificate */
 758         if (!selfsign || spkac_file || ss_cert_file || gencrl)
 759                 {
 760                 if ((certfile == NULL)
 761                         && ((certfile=NCONF_get_string(conf,
 762                                      section,ENV_CERTIFICATE)) == NULL))
 763                         {
 764                         lookup_fail(section,ENV_CERTIFICATE);
 765                         goto err;
 766                         }
 767                 x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 768                         "CA certificate");
 769                 if (x509 == NULL)
 770                         goto err;
 771
 772                 if (!X509_check_private_key(x509,pkey))
 773                         {
 774                         BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 775                         goto err;
 776                         }
 777                 }
 778         if (!selfsign) x509p = x509;
 779
 780         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 781         if (f == NULL)
 782                 ERR_clear_error();
 783         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 784                 preserve=1;
 785         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 786         if (f == NULL)
 787                 ERR_clear_error();
 788         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 789                 msie_hack=1;
 790
 791         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 792
 793         if (f)
 794                 {
 795                 if (!set_name_ex(&nameopt, f))
 796                         {
 797                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 798                         goto err;
 799                         }
 800                 default_op = 0;
 801                 }
 802         else
 803                 ERR_clear_error();
 804
 805         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 806
 807         if (f)
 808                 {
 809                 if (!set_cert_ex(&certopt, f))
 810                         {
 811                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 812                         goto err;
 813                         }
 814                 default_op = 0;
 815                 }
 816         else
 817                 ERR_clear_error();
 818
 819         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 820
 821         if (f)
 822                 {
 823                 if (!set_ext_copy(&ext_copy, f))
 824                         {
 825                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 826                         goto err;
 827                         }
 828                 }
 829         else
 830                 ERR_clear_error();
 831
 832         /*****************************************************************/
 833         /* lookup where to write new certificates */
 834         if ((outdir == NULL) && (req))
 835                 {
 836
 837                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 838                         == NULL)
 839                         {
 840                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 841                         goto err;
 842                         }
 843 #ifndef OPENSSL_SYS_VMS
 844             /* outdir is a directory spec, but access() for VMS demands a
 845                filename.  In any case, stat(), below, will catch the problem
 846                if outdir is not a directory spec, and the fopen() or open()
 847                will catch an error if there is no write access.
 848
 849                Presumably, this problem could also be solved by using the DEC
 850                C routines to convert the directory syntax to Unixly, and give
 851                that to access().  However, time's too short to do that just
 852                now.
 853             */
 854 #ifndef _WIN32
 855                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 856 #else
 857                 if (_access(outdir,R_OK|W_OK|X_OK) != 0)
 858 #endif
 859                         {
 860                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 861                         perror(outdir);
 862                         goto err;
 863                         }
 864
 865                 if (app_isdir(outdir)<=0)
 866                         {
 867                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 868                         perror(outdir);
 869                         goto err;
 870                         }
 871 #endif
 872                 }
 873
 874         /*****************************************************************/
 875         /* we need to load the database file */
 876         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 877                 {
 878                 lookup_fail(section,ENV_DATABASE);
 879                 goto err;
 880                 }
 881         db = load_index(dbfile, &db_attr);
 882         if (db == NULL) goto err;
 883
 884         /* Lets check some fields */
 885         for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
 886                 {
 887                 pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
 888                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 889                         (pp[DB_rev_date][0] != '\0'))
 890                         {
 891                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 892                         goto err;
 893                         }
 894                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 895                         !make_revoked(NULL, pp[DB_rev_date]))
 896                         {
 897                         BIO_printf(bio_err," in entry %d\n", i+1);
 898                         goto err;
 899                         }
 900                 if (!check_time_format((char *)pp[DB_exp_date]))
 901                         {
 902                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 903                         goto err;
 904                         }
 905                 p=pp[DB_serial];
 906                 j=strlen(p);
 907                 if (*p == '-')
 908                         {
 909                         p++;
 910                         j--;
 911                         }
 912                 if ((j&1) || (j < 2))
 913                         {
 914                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 915                         goto err;
 916                         }
 917                 while (*p)
 918                         {
 919                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 920                                 ((*p >= 'A') && (*p <= 'F')) ||
 921                                 ((*p >= 'a') && (*p <= 'f')))  )
 922                                 {
 923                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 924                                 goto err;
 925                                 }
 926                         p++;
 927                         }
 928                 }
 929         if (verbose)
 930                 {
 931                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 932 #ifdef OPENSSL_SYS_VMS
 933                 {
 934                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 935                 out = BIO_push(tmpbio, out);
 936                 }
 937 #endif
 938                 TXT_DB_write(out,db->db);
 939                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 940                            sk_OPENSSL_PSTRING_num(db->db->data));
 941                 BIO_printf(bio_err,"generating index\n");
 942                 }
 943
 944         if (!index_index(db)) goto err;
 945
 946         /*****************************************************************/
 947         /* Update the db file for expired certificates */
 948         if (doupdatedb)
 949                 {
 950                 if (verbose)
 951                         BIO_printf(bio_err, "Updating %s ...\n",
 952                                                         dbfile);
 953
 954                 i = do_updatedb(db);
 955                 if (i == -1)
 956                         {
 957                         BIO_printf(bio_err,"Malloc failure\n");
 958                         goto err;
 959                         }
 960                 else if (i == 0)
 961                         {
 962                         if (verbose) BIO_printf(bio_err,
 963                                         "No entries found to mark expired\n");
 964                         }
 965                 else
 966                         {
 967                         if (!save_index(dbfile,"new",db)) goto err;
 968
 969                         if (!rotate_index(dbfile,"new","old")) goto err;
 970
 971                         if (verbose) BIO_printf(bio_err,
 972                                 "Done. %d entries marked as expired\n",i);
 973                         }
 974                 }
 975
 976         /*****************************************************************/
 977         /* Read extentions config file                                   */
 978         if (extfile)
 979                 {
 980                 extconf = NCONF_new(NULL);
 981                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
 982                         {
 983                         if (errorline <= 0)
 984                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
 985                                         extfile);
 986                         else
 987                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
 988                                         errorline,extfile);
 989                         ret = 1;
 990                         goto err;
 991                         }
 992
 993                 if (verbose)
 994                         BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
 995
 996                 /* We can have sections in the ext file */
 997                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
 998                         extensions = "default";
 999                 }
1000
1001         /*****************************************************************/
1002         if (req || gencrl)
1003                 {
1004                 if (outfile != NULL)
1005                         {
1006                         if (BIO_write_filename(Sout,outfile) <= 0)
1007                                 {
1008                                 perror(outfile);
1009                                 goto err;
1010                                 }
1011                         }
1012                 else
1013                         {
1014                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
1015 #ifdef OPENSSL_SYS_VMS
1016                         {
1017                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
1018                         Sout = BIO_push(tmpbio, Sout);
1019                         }
1020 #endif
1021                         }
1022                 }
1023
1024         if ((md == NULL) && ((md=NCONF_get_string(conf,
1025                 section,ENV_DEFAULT_MD)) == NULL))
1026                 {
1027                 lookup_fail(section,ENV_DEFAULT_MD);
1028                 goto err;
1029                 }
1030
1031         if (!strcmp(md, "default"))
1032                 {
1033                 int def_nid;
1034                 if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0)
1035                         {
1036                         BIO_puts(bio_err,"no default digest\n");
1037                         goto err;
1038                         }
1039                 md = (char *)OBJ_nid2sn(def_nid);
1040                 }
1041
1042         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1043                 {
1044                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1045                 goto err;
1046                 }
1047
1048         if (req)
1049                 {
1050                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1051                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1052                         {
1053                         if(strcmp(tmp_email_dn,"no") == 0)
1054                                 email_dn=0;
1055                         }
1056                 if (verbose)
1057                         BIO_printf(bio_err,"message digest is %s\n",
1058                                 OBJ_nid2ln(dgst->type));
1059                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1060                         section,ENV_POLICY)) == NULL))
1061                         {
1062                         lookup_fail(section,ENV_POLICY);
1063                         goto err;
1064                         }
1065                 if (verbose)
1066                         BIO_printf(bio_err,"policy is %s\n",policy);
1067
1068                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1069                         == NULL)
1070                         {
1071                         lookup_fail(section,ENV_SERIAL);
1072                         goto err;
1073                         }
1074
1075                 if (!extconf)
1076                         {
1077                         /* no '-extfile' option, so we look for extensions
1078                          * in the main configuration file */
1079                         if (!extensions)
1080                                 {
1081                                 extensions=NCONF_get_string(conf,section,
1082                                                                 ENV_EXTENSIONS);
1083                                 if (!extensions)
1084                                         ERR_clear_error();
1085                                 }
1086                         if (extensions)
1087                                 {
1088                                 /* Check syntax of file */
1089                                 X509V3_CTX ctx;
1090                                 X509V3_set_ctx_test(&ctx);
1091                                 X509V3_set_nconf(&ctx, conf);
1092                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1093                                                                 NULL))
1094                                         {
1095                                         BIO_printf(bio_err,
1096                                         "Error Loading extension section %s\n",
1097                                                                  extensions);
1098                                         ret = 1;
1099                                         goto err;
1100                                         }
1101                                 }
1102                         }
1103
1104                 if (startdate == NULL)
1105                         {
1106                         startdate=NCONF_get_string(conf,section,
1107                                 ENV_DEFAULT_STARTDATE);
1108                         if (startdate == NULL)
1109                                 ERR_clear_error();
1110                         }
1111                 if (startdate && !ASN1_TIME_set_string(NULL, startdate))
1112                         {
1113                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
1114                         goto err;
1115                         }
1116                 if (startdate == NULL) startdate="today";
1117
1118                 if (enddate == NULL)
1119                         {
1120                         enddate=NCONF_get_string(conf,section,
1121                                 ENV_DEFAULT_ENDDATE);
1122                         if (enddate == NULL)
1123                                 ERR_clear_error();
1124                         }
1125                 if (enddate && !ASN1_TIME_set_string(NULL, enddate))
1126                         {
1127                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\n");
1128                         goto err;
1129                         }
1130
1131                 if (days == 0)
1132                         {
1133                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1134                                 days = 0;
1135                         }
1136                 if (!enddate && (days == 0))
1137                         {
1138                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1139                         goto err;
1140                         }
1141
1142                 if ((serial=load_serial(serialfile, create_ser, NULL)) == NULL)
1143                         {
1144                         BIO_printf(bio_err,"error while loading serial number\n");
1145                         goto err;
1146                         }
1147                 if (verbose)
1148                         {
1149                         if (BN_is_zero(serial))
1150                                 BIO_printf(bio_err,"next serial number is 00\n");
1151                         else
1152                                 {
1153                                 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1154                                 BIO_printf(bio_err,"next serial number is %s\n",f);
1155                                 OPENSSL_free(f);
1156                                 }
1157                         }
1158
1159                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1160                         {
1161                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1162                         goto err;
1163                         }
1164
1165                 if ((cert_sk=sk_X509_new_null()) == NULL)
1166                         {
1167                         BIO_printf(bio_err,"Memory allocation failure\n");
1168                         goto err;
1169                         }
1170                 if (spkac_file != NULL)
1171                         {
1172                         total++;
1173                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1174                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,extensions,
1175                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1176                         if (j < 0) goto err;
1177                         if (j > 0)
1178                                 {
1179                                 total_done++;
1180                                 BIO_printf(bio_err,"\n");
1181                                 if (!BN_add_word(serial,1)) goto err;
1182                                 if (!sk_X509_push(cert_sk,x))
1183                                         {
1184                                         BIO_printf(bio_err,"Memory allocation failure\n");
1185                                         goto err;
1186                                         }
1187                                 if (outfile)
1188                                         {
1189                                         output_der = 1;
1190                                         batch = 1;
1191                                         }
1192                                 }
1193                         }
1194                 if (ss_cert_file != NULL)
1195                         {
1196                         total++;
1197                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1198                                 db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1199                                 extensions,conf,verbose, certopt, nameopt,
1200                                 default_op, ext_copy, e);
1201                         if (j < 0) goto err;
1202                         if (j > 0)
1203                                 {
1204                                 total_done++;
1205                                 BIO_printf(bio_err,"\n");
1206                                 if (!BN_add_word(serial,1)) goto err;
1207                                 if (!sk_X509_push(cert_sk,x))
1208                                         {
1209                                         BIO_printf(bio_err,"Memory allocation failure\n");
1210                                         goto err;
1211                                         }
1212                                 }
1213                         }
1214                 if (infile != NULL)
1215                         {
1216                         total++;
1217                         j=certify(&x,infile,pkey,x509p,dgst,attribs,db,
1218                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1219                                 extensions,conf,verbose, certopt, nameopt,
1220                                 default_op, ext_copy, selfsign);
1221                         if (j < 0) goto err;
1222                         if (j > 0)
1223                                 {
1224                                 total_done++;
1225                                 BIO_printf(bio_err,"\n");
1226                                 if (!BN_add_word(serial,1)) goto err;
1227                                 if (!sk_X509_push(cert_sk,x))
1228                                         {
1229                                         BIO_printf(bio_err,"Memory allocation failure\n");
1230                                         goto err;
1231                                         }
1232                                 }
1233                         }
1234                 for (i=0; i<argc; i++)
1235                         {
1236                         total++;
1237                         j=certify(&x,argv[i],pkey,x509p,dgst,attribs,db,
1238                                 serial,subj,chtype,multirdn,email_dn,startdate,enddate,days,batch,
1239                                 extensions,conf,verbose, certopt, nameopt,
1240                                 default_op, ext_copy, selfsign);
1241                         if (j < 0) goto err;
1242                         if (j > 0)
1243                                 {
1244                                 total_done++;
1245                                 BIO_printf(bio_err,"\n");
1246                                 if (!BN_add_word(serial,1)) goto err;
1247                                 if (!sk_X509_push(cert_sk,x))
1248                                         {
1249                                         BIO_printf(bio_err,"Memory allocation failure\n");
1250                                         goto err;
1251                                         }
1252                                 }
1253                         }
1254                 /* we have a stack of newly certified certificates
1255                  * and a data base and serial number that need
1256                  * updating */
1257
1258                 if (sk_X509_num(cert_sk) > 0)
1259                         {
1260                         if (!batch)
1261                                 {
1262                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1263                                 (void)BIO_flush(bio_err);
1264                                 buf[0][0]='\0';
1265                                 if (!fgets(buf[0],10,stdin))
1266                                         {
1267                                         BIO_printf(bio_err,"CERTIFICATION CANCELED: I/O error\n");
1268                                         ret=0;
1269                                         goto err;
1270                                         }
1271                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1272                                         {
1273                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1274                                         ret=0;
1275                                         goto err;
1276                                         }
1277                                 }
1278
1279                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1280
1281                         if (!save_serial(serialfile,"new",serial,NULL)) goto err;
1282
1283                         if (!save_index(dbfile, "new", db)) goto err;
1284                         }
1285
1286                 if (verbose)
1287                         BIO_printf(bio_err,"writing new certificates\n");
1288                 for (i=0; i<sk_X509_num(cert_sk); i++)
1289                         {
1290                         int k;
1291                         char *n;
1292
1293                         x=sk_X509_value(cert_sk,i);
1294
1295                         j=x->cert_info->serialNumber->length;
1296                         p=(const char *)x->cert_info->serialNumber->data;
1297
1298                         if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
1299                                 {
1300                                 BIO_printf(bio_err,"certificate file name too long\n");
1301                                 goto err;
1302                                 }
1303
1304                         strcpy(buf[2],outdir);
1305
1306 #ifndef OPENSSL_SYS_VMS
1307                         BUF_strlcat(buf[2],"/",sizeof(buf[2]));
1308 #endif
1309
1310                         n=(char *)&(buf[2][strlen(buf[2])]);
1311                         if (j > 0)
1312                                 {
1313                                 for (k=0; k<j; k++)
1314                                         {
1315                                         if (n >= &(buf[2][sizeof(buf[2])]))
1316                                                 break;
1317                                         BIO_snprintf(n,
1318                                                      &buf[2][0] + sizeof(buf[2]) - n,
1319                                                      "%02X",(unsigned char)*(p++));
1320                                         n+=2;
1321                                         }
1322                                 }
1323                         else
1324                                 {
1325                                 *(n++)='0';
1326                                 *(n++)='0';
1327                                 }
1328                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1329                         *n='\0';
1330                         if (verbose)
1331                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1332
1333                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1334                                 {
1335                                 perror(buf[2]);
1336                                 goto err;
1337                                 }
1338                         write_new_certificate(Cout,x, 0, notext);
1339                         write_new_certificate(Sout,x, output_der, notext);
1340                         }
1341
1342                 if (sk_X509_num(cert_sk))
1343                         {
1344                         /* Rename the database and the serial file */
1345                         if (!rotate_serial(serialfile,"new","old")) goto err;
1346
1347                         if (!rotate_index(dbfile,"new","old")) goto err;
1348
1349                         BIO_printf(bio_err,"Data Base Updated\n");
1350                         }
1351                 }
1352
1353         /*****************************************************************/
1354         if (gencrl)
1355                 {
1356                 int crl_v2 = 0;
1357                 if (!crl_ext)
1358                         {
1359                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1360                         if (!crl_ext)
1361                                 ERR_clear_error();
1362                         }
1363                 if (crl_ext)
1364                         {
1365                         /* Check syntax of file */
1366                         X509V3_CTX ctx;
1367                         X509V3_set_ctx_test(&ctx);
1368                         X509V3_set_nconf(&ctx, conf);
1369                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1370                                 {
1371                                 BIO_printf(bio_err,
1372                                  "Error Loading CRL extension section %s\n",
1373                                                                  crl_ext);
1374                                 ret = 1;
1375                                 goto err;
1376                                 }
1377                         }
1378
1379                 if ((crlnumberfile=NCONF_get_string(conf,section,ENV_CRLNUMBER))
1380                         != NULL)
1381                         if ((crlnumber=load_serial(crlnumberfile,0,NULL)) == NULL)
1382                                 {
1383                                 BIO_printf(bio_err,"error while loading CRL number\n");
1384                                 goto err;
1385                                 }
1386
1387                 if (!crldays && !crlhours && !crlsec)
1388                         {
1389                         if (!NCONF_get_number(conf,section,
1390                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1391                                 crldays = 0;
1392                         if (!NCONF_get_number(conf,section,
1393                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1394                                 crlhours = 0;
1395                         }
1396                 if ((crldays == 0) && (crlhours == 0) && (crlsec == 0))
1397                         {
1398                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
1399                         goto err;
1400                         }
1401
1402                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1403                 if ((crl=X509_CRL_new()) == NULL) goto err;
1404                 if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1405
1406                 tmptm = ASN1_TIME_new();
1407                 if (!tmptm) goto err;
1408                 X509_gmtime_adj(tmptm,0);
1409                 X509_CRL_set_lastUpdate(crl, tmptm);
1410                 if (!X509_time_adj_ex(tmptm, crldays, crlhours*60*60 + crlsec,
1411                         NULL))
1412                         {
1413                         BIO_puts(bio_err, "error setting CRL nextUpdate\n");
1414                         goto err;
1415                         }
1416                 X509_CRL_set_nextUpdate(crl, tmptm);
1417
1418                 ASN1_TIME_free(tmptm);
1419
1420                 for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
1421                         {
1422                         pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
1423                         if (pp[DB_type][0] == DB_TYPE_REV)
1424                                 {
1425                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1426                                 j = make_revoked(r, pp[DB_rev_date]);
1427                                 if (!j) goto err;
1428                                 if (j == 2) crl_v2 = 1;
1429                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1430                                         goto err;
1431                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1432                                 BN_free(serial);
1433                                 serial = NULL;
1434                                 if (!tmpser)
1435                                         goto err;
1436                                 X509_REVOKED_set_serialNumber(r, tmpser);
1437                                 ASN1_INTEGER_free(tmpser);
1438                                 X509_CRL_add0_revoked(crl,r);
1439                                 }
1440                         }
1441
1442                 /* sort the data so it will be written in serial
1443                  * number order */
1444                 X509_CRL_sort(crl);
1445
1446                 /* we now have a CRL */
1447                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1448
1449                 /* Add any extensions asked for */
1450
1451                 if (crl_ext || crlnumberfile != NULL)
1452                         {
1453                         X509V3_CTX crlctx;
1454                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1455                         X509V3_set_nconf(&crlctx, conf);
1456
1457                         if (crl_ext)
1458                                 if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1459                                         crl_ext, crl)) goto err;
1460                         if (crlnumberfile != NULL)
1461                                 {
1462                                 tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);
1463                                 if (!tmpser) goto err;
1464                                 X509_CRL_add1_ext_i2d(crl,NID_crl_number,tmpser,0,0);
1465                                 ASN1_INTEGER_free(tmpser);
1466                                 crl_v2 = 1;
1467                                 if (!BN_add_word(crlnumber,1)) goto err;
1468                                 }
1469                         }
1470                 if (crl_ext || crl_v2)
1471                         {
1472                         if (!X509_CRL_set_version(crl, 1))
1473                                 goto err; /* version 2 CRL */
1474                         }
1475
1476
1477                 if (crlnumberfile != NULL)      /* we have a CRL number that need updating */
1478                         if (!save_serial(crlnumberfile,"new",crlnumber,NULL)) goto err;
1479
1480                 if (crlnumber)
1481                         {
1482                         BN_free(crlnumber);
1483                         crlnumber = NULL;
1484                         }
1485
1486                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1487
1488                 PEM_write_bio_X509_CRL(Sout,crl);
1489
1490                 if (crlnumberfile != NULL)      /* Rename the crlnumber file */
1491                         if (!rotate_serial(crlnumberfile,"new","old")) goto err;
1492
1493                 }
1494         /*****************************************************************/
1495         if (dorevoke)
1496                 {
1497                 if (infile == NULL)
1498                         {
1499                         BIO_printf(bio_err,"no input files\n");
1500                         goto err;
1501                         }
1502                 else
1503                         {
1504                         X509 *revcert;
1505                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1506                                 NULL, e, infile);
1507                         if (revcert == NULL)
1508                                 goto err;
1509                         j=do_revoke(revcert,db, rev_type, rev_arg);
1510                         if (j <= 0) goto err;
1511                         X509_free(revcert);
1512
1513                         if (!save_index(dbfile, "new", db)) goto err;
1514
1515                         if (!rotate_index(dbfile, "new", "old")) goto err;
1516
1517                         BIO_printf(bio_err,"Data Base Updated\n");
1518                         }
1519                 }
1520         /*****************************************************************/
1521         ret=0;
1522 err:
1523         if(tofree)
1524                 OPENSSL_free(tofree);
1525         BIO_free_all(Cout);
1526         BIO_free_all(Sout);
1527         BIO_free_all(out);
1528         BIO_free_all(in);
1529
1530         if (cert_sk)
1531                 sk_X509_pop_free(cert_sk,X509_free);
1532
1533         if (ret) ERR_print_errors(bio_err);
1534         app_RAND_write_file(randfile, bio_err);
1535         if (free_key && key)
1536                 OPENSSL_free(key);
1537         BN_free(serial);
1538         BN_free(crlnumber);
1539         free_index(db);
1540         EVP_PKEY_free(pkey);
1541         if (x509) X509_free(x509);
1542         X509_CRL_free(crl);
1543         NCONF_free(conf);
1544         NCONF_free(extconf);
1545         OBJ_cleanup();
1546         apps_shutdown();
1547         OPENSSL_EXIT(ret);
1548         }
1549
1550 static void lookup_fail(const char *name, const char *tag)
1551         {
1552         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1553         }
1554
1555 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1556              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1557              BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1558              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1559              unsigned long certopt, unsigned long nameopt, int default_op,
1560              int ext_copy, int selfsign)
1561         {
1562         X509_REQ *req=NULL;
1563         BIO *in=NULL;
1564         EVP_PKEY *pktmp=NULL;
1565         int ok= -1,i;
1566
1567         in=BIO_new(BIO_s_file());
1568
1569         if (BIO_read_filename(in,infile) <= 0)
1570                 {
1571                 perror(infile);
1572                 goto err;
1573                 }
1574         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1575                 {
1576                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1577                         infile);
1578                 goto err;
1579                 }
1580         if (verbose)
1581                 X509_REQ_print(bio_err,req);
1582
1583         BIO_printf(bio_err,"Check that the request matches the signature\n");
1584
1585         if (selfsign && !X509_REQ_check_private_key(req,pkey))
1586                 {
1587                 BIO_printf(bio_err,"Certificate request and CA private key do not match\n");
1588                 ok=0;
1589                 goto err;
1590                 }
1591         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1592                 {
1593                 BIO_printf(bio_err,"error unpacking public key\n");
1594                 goto err;
1595                 }
1596         i=X509_REQ_verify(req,pktmp);
1597         EVP_PKEY_free(pktmp);
1598         if (i < 0)
1599                 {
1600                 ok=0;
1601                 BIO_printf(bio_err,"Signature verification problems....\n");
1602                 ERR_print_errors(bio_err);
1603                 goto err;
1604                 }
1605         if (i == 0)
1606                 {
1607                 ok=0;
1608                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1609                 ERR_print_errors(bio_err);
1610                 goto err;
1611                 }
1612         else
1613                 BIO_printf(bio_err,"Signature ok\n");
1614
1615         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn, email_dn,
1616                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1617                 certopt, nameopt, default_op, ext_copy, selfsign);
1618
1619 err:
1620         if (req != NULL) X509_REQ_free(req);
1621         if (in != NULL) BIO_free(in);
1622         return(ok);
1623         }
1624
1625 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1626              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1627              BIGNUM *serial, char *subj, unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
1628              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1629              unsigned long certopt, unsigned long nameopt, int default_op,
1630              int ext_copy, ENGINE *e)
1631         {
1632         X509 *req=NULL;
1633         X509_REQ *rreq=NULL;
1634         EVP_PKEY *pktmp=NULL;
1635         int ok= -1,i;
1636
1637         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1638                 goto err;
1639         if (verbose)
1640                 X509_print(bio_err,req);
1641
1642         BIO_printf(bio_err,"Check that the request matches the signature\n");
1643
1644         if ((pktmp=X509_get_pubkey(req)) == NULL)
1645                 {
1646                 BIO_printf(bio_err,"error unpacking public key\n");
1647                 goto err;
1648                 }
1649         i=X509_verify(req,pktmp);
1650         EVP_PKEY_free(pktmp);
1651         if (i < 0)
1652                 {
1653                 ok=0;
1654                 BIO_printf(bio_err,"Signature verification problems....\n");
1655                 goto err;
1656                 }
1657         if (i == 0)
1658                 {
1659                 ok=0;
1660                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1661                 goto err;
1662                 }
1663         else
1664                 BIO_printf(bio_err,"Signature ok\n");
1665
1666         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1667                 goto err;
1668
1669         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
1670                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1671                 ext_copy, 0);
1672
1673 err:
1674         if (rreq != NULL) X509_REQ_free(rreq);
1675         if (req != NULL) X509_free(req);
1676         return(ok);
1677         }
1678
1679 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1680              STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1681              unsigned long chtype, int multirdn,
1682              int email_dn, char *startdate, char *enddate, long days, int batch,
1683              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1684              unsigned long certopt, unsigned long nameopt, int default_op,
1685              int ext_copy, int selfsign)
1686         {
1687         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1688         ASN1_UTCTIME *tm,*tmptm;
1689         ASN1_STRING *str,*str2;
1690         ASN1_OBJECT *obj;
1691         X509 *ret=NULL;
1692         X509_CINF *ci;
1693         X509_NAME_ENTRY *ne;
1694         X509_NAME_ENTRY *tne,*push;
1695         EVP_PKEY *pktmp;
1696         int ok= -1,i,j,last,nid;
1697         const char *p;
1698         CONF_VALUE *cv;
1699         OPENSSL_STRING row[DB_NUMBER];
1700         OPENSSL_STRING *irow=NULL;
1701         OPENSSL_STRING *rrow=NULL;
1702         char buf[25];
1703
1704         tmptm=ASN1_UTCTIME_new();
1705         if (tmptm == NULL)
1706                 {
1707                 BIO_printf(bio_err,"malloc error\n");
1708                 return(0);
1709                 }
1710
1711         for (i=0; i<DB_NUMBER; i++)
1712                 row[i]=NULL;
1713
1714         if (subj)
1715                 {
1716                 X509_NAME *n = parse_name(subj, chtype, multirdn);
1717
1718                 if (!n)
1719                         {
1720                         ERR_print_errors(bio_err);
1721                         goto err;
1722                         }
1723                 X509_REQ_set_subject_name(req,n);
1724                 req->req_info->enc.modified = 1;
1725                 X509_NAME_free(n);
1726                 }
1727
1728         if (default_op)
1729                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1730
1731         name=X509_REQ_get_subject_name(req);
1732         for (i=0; i<X509_NAME_entry_count(name); i++)
1733                 {
1734                 ne= X509_NAME_get_entry(name,i);
1735                 str=X509_NAME_ENTRY_get_data(ne);
1736                 obj=X509_NAME_ENTRY_get_object(ne);
1737
1738                 if (msie_hack)
1739                         {
1740                         /* assume all type should be strings */
1741                         nid=OBJ_obj2nid(ne->object);
1742
1743                         if (str->type == V_ASN1_UNIVERSALSTRING)
1744                                 ASN1_UNIVERSALSTRING_to_string(str);
1745
1746                         if ((str->type == V_ASN1_IA5STRING) &&
1747                                 (nid != NID_pkcs9_emailAddress))
1748                                 str->type=V_ASN1_T61STRING;
1749
1750                         if ((nid == NID_pkcs9_emailAddress) &&
1751                                 (str->type == V_ASN1_PRINTABLESTRING))
1752                                 str->type=V_ASN1_IA5STRING;
1753                         }
1754
1755                 /* If no EMAIL is wanted in the subject */
1756                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1757                         continue;
1758
1759                 /* check some things */
1760                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1761                         (str->type != V_ASN1_IA5STRING))
1762                         {
1763                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1764                         goto err;
1765                         }
1766                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1767                         {
1768                         j=ASN1_PRINTABLE_type(str->data,str->length);
1769                         if (    ((j == V_ASN1_T61STRING) &&
1770                                  (str->type != V_ASN1_T61STRING)) ||
1771                                 ((j == V_ASN1_IA5STRING) &&
1772                                  (str->type == V_ASN1_PRINTABLESTRING)))
1773                                 {
1774                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1775                                 goto err;
1776                                 }
1777                         }
1778
1779                 if (default_op)
1780                         old_entry_print(bio_err, obj, str);
1781                 }
1782
1783         /* Ok, now we check the 'policy' stuff. */
1784         if ((subject=X509_NAME_new()) == NULL)
1785                 {
1786                 BIO_printf(bio_err,"Memory allocation failure\n");
1787                 goto err;
1788                 }
1789
1790         /* take a copy of the issuer name before we mess with it. */
1791         if (selfsign)
1792                 CAname=X509_NAME_dup(name);
1793         else
1794                 CAname=X509_NAME_dup(x509->cert_info->subject);
1795         if (CAname == NULL) goto err;
1796         str=str2=NULL;
1797
1798         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1799                 {
1800                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1801                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1802                         {
1803                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1804                         goto err;
1805                         }
1806                 obj=OBJ_nid2obj(j);
1807
1808                 last= -1;
1809                 for (;;)
1810                         {
1811                         /* lookup the object in the supplied name list */
1812                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1813                         if (j < 0)
1814                                 {
1815                                 if (last != -1) break;
1816                                 tne=NULL;
1817                                 }
1818                         else
1819                                 {
1820                                 tne=X509_NAME_get_entry(name,j);
1821                                 }
1822                         last=j;
1823
1824                         /* depending on the 'policy', decide what to do. */
1825                         push=NULL;
1826                         if (strcmp(cv->value,"optional") == 0)
1827                                 {
1828                                 if (tne != NULL)
1829                                         push=tne;
1830                                 }
1831                         else if (strcmp(cv->value,"supplied") == 0)
1832                                 {
1833                                 if (tne == NULL)
1834                                         {
1835                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1836                                         goto err;
1837                                         }
1838                                 else
1839                                         push=tne;
1840                                 }
1841                         else if (strcmp(cv->value,"match") == 0)
1842                                 {
1843                                 int last2;
1844
1845                                 if (tne == NULL)
1846                                         {
1847                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1848                                         goto err;
1849                                         }
1850
1851                                 last2= -1;
1852
1853 again2:
1854                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1855                                 if ((j < 0) && (last2 == -1))
1856                                         {
1857                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1858                                         goto err;
1859                                         }
1860                                 if (j >= 0)
1861                                         {
1862                                         push=X509_NAME_get_entry(CAname,j);
1863                                         str=X509_NAME_ENTRY_get_data(tne);
1864                                         str2=X509_NAME_ENTRY_get_data(push);
1865                                         last2=j;
1866                                         if (ASN1_STRING_cmp(str,str2) != 0)
1867                                                 goto again2;
1868                                         }
1869                                 if (j < 0)
1870                                         {
1871                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
1872                                         goto err;
1873                                         }
1874                                 }
1875                         else
1876                                 {
1877                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
1878                                 goto err;
1879                                 }
1880
1881                         if (push != NULL)
1882                                 {
1883                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
1884                                         {
1885                                         if (push != NULL)
1886                                                 X509_NAME_ENTRY_free(push);
1887                                         BIO_printf(bio_err,"Memory allocation failure\n");
1888                                         goto err;
1889                                         }
1890                                 }
1891                         if (j < 0) break;
1892                         }
1893                 }
1894
1895         if (preserve)
1896                 {
1897                 X509_NAME_free(subject);
1898                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
1899                 subject=X509_NAME_dup(name);
1900                 if (subject == NULL) goto err;
1901                 }
1902
1903         if (verbose)
1904                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
1905
1906         /* Build the correct Subject if no e-mail is wanted in the subject */
1907         /* and add it later on because of the method extensions are added (altName) */
1908
1909         if (email_dn)
1910                 dn_subject = subject;
1911         else
1912                 {
1913                 X509_NAME_ENTRY *tmpne;
1914                 /* Its best to dup the subject DN and then delete any email
1915                  * addresses because this retains its structure.
1916                  */
1917                 if (!(dn_subject = X509_NAME_dup(subject)))
1918                         {
1919                         BIO_printf(bio_err,"Memory allocation failure\n");
1920                         goto err;
1921                         }
1922                 while((i = X509_NAME_get_index_by_NID(dn_subject,
1923                                         NID_pkcs9_emailAddress, -1)) >= 0)
1924                         {
1925                         tmpne = X509_NAME_get_entry(dn_subject, i);
1926                         X509_NAME_delete_entry(dn_subject, i);
1927                         X509_NAME_ENTRY_free(tmpne);
1928                         }
1929                 }
1930
1931         if (BN_is_zero(serial))
1932                 row[DB_serial]=BUF_strdup("00");
1933         else
1934                 row[DB_serial]=BN_bn2hex(serial);
1935         if (row[DB_serial] == NULL)
1936                 {
1937                 BIO_printf(bio_err,"Memory allocation failure\n");
1938                 goto err;
1939                 }
1940
1941         if (db->attributes.unique_subject)
1942                 {
1943                 OPENSSL_STRING *crow=row;
1944
1945                 rrow=TXT_DB_get_by_index(db->db,DB_name,crow);
1946                 if (rrow != NULL)
1947                         {
1948                         BIO_printf(bio_err,
1949                                 "ERROR:There is already a certificate for %s\n",
1950                                 row[DB_name]);
1951                         }
1952                 }
1953         if (rrow == NULL)
1954                 {
1955                 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
1956                 if (rrow != NULL)
1957                         {
1958                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
1959                                 row[DB_serial]);
1960                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
1961                         }
1962                 }
1963
1964         if (rrow != NULL)
1965                 {
1966                 BIO_printf(bio_err,
1967                         "The matching entry has the following details\n");
1968                 if (rrow[DB_type][0] == 'E')
1969                         p="Expired";
1970                 else if (rrow[DB_type][0] == 'R')
1971                         p="Revoked";
1972                 else if (rrow[DB_type][0] == 'V')
1973                         p="Valid";
1974                 else
1975                         p="\ninvalid type, Data base error\n";
1976                 BIO_printf(bio_err,"Type          :%s\n",p);;
1977                 if (rrow[DB_type][0] == 'R')
1978                         {
1979                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1980                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
1981                         }
1982                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1983                 BIO_printf(bio_err,"Expires on    :%s\n",p);
1984                 p=rrow[DB_serial]; if (p == NULL) p="undef";
1985                 BIO_printf(bio_err,"Serial Number :%s\n",p);
1986                 p=rrow[DB_file]; if (p == NULL) p="undef";
1987                 BIO_printf(bio_err,"File name     :%s\n",p);
1988                 p=rrow[DB_name]; if (p == NULL) p="undef";
1989                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
1990                 ok= -1; /* This is now a 'bad' error. */
1991                 goto err;
1992                 }
1993
1994         /* We are now totally happy, lets make and sign the certificate */
1995         if (verbose)
1996                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
1997
1998         if ((ret=X509_new()) == NULL) goto err;
1999         ci=ret->cert_info;
2000
2001 #ifdef X509_V3
2002         /* Make it an X509 v3 certificate. */
2003         if (!X509_set_version(ret,2)) goto err;
2004 #endif
2005
2006         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
2007                 goto err;
2008         if (selfsign)
2009                 {
2010                 if (!X509_set_issuer_name(ret,subject))
2011                         goto err;
2012                 }
2013         else
2014                 {
2015                 if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
2016                         goto err;
2017                 }
2018
2019         if (strcmp(startdate,"today") == 0)
2020                 X509_gmtime_adj(X509_get_notBefore(ret),0);
2021         else ASN1_TIME_set_string(X509_get_notBefore(ret),startdate);
2022
2023         if (enddate == NULL)
2024                 X509_time_adj_ex(X509_get_notAfter(ret),days, 0, NULL);
2025         else ASN1_TIME_set_string(X509_get_notAfter(ret),enddate);
2026
2027         if (!X509_set_subject_name(ret,subject)) goto err;
2028
2029         pktmp=X509_REQ_get_pubkey(req);
2030         i = X509_set_pubkey(ret,pktmp);
2031         EVP_PKEY_free(pktmp);
2032         if (!i) goto err;
2033
2034         /* Lets add the extensions, if there are any */
2035         if (ext_sect)
2036                 {
2037                 X509V3_CTX ctx;
2038                 if (ci->version == NULL)
2039                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
2040                                 goto err;
2041                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
2042
2043                 /* Free the current entries if any, there should not
2044                  * be any I believe */
2045                 if (ci->extensions != NULL)
2046                         sk_X509_EXTENSION_pop_free(ci->extensions,
2047                                                    X509_EXTENSION_free);
2048
2049                 ci->extensions = NULL;
2050
2051                 /* Initialize the context structure */
2052                 if (selfsign)
2053                         X509V3_set_ctx(&ctx, ret, ret, req, NULL, 0);
2054                 else
2055                         X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2056
2057                 if (extconf)
2058                         {
2059                         if (verbose)
2060                                 BIO_printf(bio_err, "Extra configuration file found\n");
2061
2062                         /* Use the extconf configuration db LHASH */
2063                         X509V3_set_nconf(&ctx, extconf);
2064
2065                         /* Test the structure (needed?) */
2066                         /* X509V3_set_ctx_test(&ctx); */
2067
2068                         /* Adds exts contained in the configuration file */
2069                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2070                                 {
2071                                 BIO_printf(bio_err,
2072                                     "ERROR: adding extensions in section %s\n",
2073                                                                 ext_sect);
2074                                 ERR_print_errors(bio_err);
2075                                 goto err;
2076                                 }
2077                         if (verbose)
2078                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2079                         }
2080                 else if (ext_sect)
2081                         {
2082                         /* We found extensions to be set from config file */
2083                         X509V3_set_nconf(&ctx, lconf);
2084
2085                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2086                                 {
2087                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2088                                 ERR_print_errors(bio_err);
2089                                 goto err;
2090                                 }
2091
2092                         if (verbose)
2093                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2094                         }
2095                 }
2096
2097         /* Copy extensions from request (if any) */
2098
2099         if (!copy_extensions(ret, req, ext_copy))
2100                 {
2101                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2102                 ERR_print_errors(bio_err);
2103                 goto err;
2104                 }
2105
2106         /* Set the right value for the noemailDN option */
2107         if( email_dn == 0 )
2108                 {
2109                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2110                 }
2111
2112         if (!default_op)
2113                 {
2114                 BIO_printf(bio_err, "Certificate Details:\n");
2115                 /* Never print signature details because signature not present */
2116                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2117                 X509_print_ex(bio_err, ret, nameopt, certopt);
2118                 }
2119
2120         BIO_printf(bio_err,"Certificate is to be certified until ");
2121         ASN1_TIME_print(bio_err,X509_get_notAfter(ret));
2122         if (days) BIO_printf(bio_err," (%ld days)",days);
2123         BIO_printf(bio_err, "\n");
2124
2125         if (!batch)
2126                 {
2127
2128                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2129                 (void)BIO_flush(bio_err);
2130                 buf[0]='\0';
2131                 if (!fgets(buf,sizeof(buf)-1,stdin))
2132                         {
2133                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED: I/O error\n");
2134                         ok=0;
2135                         goto err;
2136                         }
2137                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2138                         {
2139                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2140                         ok=0;
2141                         goto err;
2142                         }
2143                 }
2144
2145         pktmp=X509_get_pubkey(ret);
2146         if (EVP_PKEY_missing_parameters(pktmp) &&
2147                 !EVP_PKEY_missing_parameters(pkey))
2148                 EVP_PKEY_copy_parameters(pktmp,pkey);
2149         EVP_PKEY_free(pktmp);
2150
2151         if (!X509_sign(ret,pkey,dgst))
2152                 goto err;
2153
2154         /* We now just add it to the database */
2155         row[DB_type]=(char *)OPENSSL_malloc(2);
2156
2157         tm=X509_get_notAfter(ret);
2158         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2159         memcpy(row[DB_exp_date],tm->data,tm->length);
2160         row[DB_exp_date][tm->length]='\0';
2161
2162         row[DB_rev_date]=NULL;
2163
2164         /* row[DB_serial] done already */
2165         row[DB_file]=(char *)OPENSSL_malloc(8);
2166         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
2167
2168         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2169                 (row[DB_file] == NULL) || (row[DB_name] == NULL))
2170                 {
2171                 BIO_printf(bio_err,"Memory allocation failure\n");
2172                 goto err;
2173                 }
2174         BUF_strlcpy(row[DB_file],"unknown",8);
2175         row[DB_type][0]='V';
2176         row[DB_type][1]='\0';
2177
2178         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2179                 {
2180                 BIO_printf(bio_err,"Memory allocation failure\n");
2181                 goto err;
2182                 }
2183
2184         for (i=0; i<DB_NUMBER; i++)
2185                 {
2186                 irow[i]=row[i];
2187                 row[i]=NULL;
2188                 }
2189         irow[DB_NUMBER]=NULL;
2190
2191         if (!TXT_DB_insert(db->db,irow))
2192                 {
2193                 BIO_printf(bio_err,"failed to update database\n");
2194                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2195                 goto err;
2196                 }
2197         ok=1;
2198 err:
2199         for (i=0; i<DB_NUMBER; i++)
2200                 if (row[i] != NULL) OPENSSL_free(row[i]);
2201
2202         if (CAname != NULL)
2203                 X509_NAME_free(CAname);
2204         if (subject != NULL)
2205                 X509_NAME_free(subject);
2206         if ((dn_subject != NULL) && !email_dn)
2207                 X509_NAME_free(dn_subject);
2208         if (tmptm != NULL)
2209                 ASN1_UTCTIME_free(tmptm);
2210         if (ok <= 0)
2211                 {
2212                 if (ret != NULL) X509_free(ret);
2213                 ret=NULL;
2214                 }
2215         else
2216                 *xret=ret;
2217         return(ok);
2218         }
2219
2220 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2221         {
2222
2223         if (output_der)
2224                 {
2225                 (void)i2d_X509_bio(bp,x);
2226                 return;
2227                 }
2228 #if 0
2229         /* ??? Not needed since X509_print prints all this stuff anyway */
2230         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2231         BIO_printf(bp,"issuer :%s\n",f);
2232
2233         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2234         BIO_printf(bp,"subject:%s\n",f);
2235
2236         BIO_puts(bp,"serial :");
2237         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2238         BIO_puts(bp,"\n\n");
2239 #endif
2240         if (!notext)X509_print(bp,x);
2241         PEM_write_bio_X509(bp,x);
2242         }
2243
2244 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2245              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
2246              BIGNUM *serial, char *subj,unsigned long chtype, int multirdn, int email_dn, char *startdate, char *enddate,
2247              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2248              unsigned long nameopt, int default_op, int ext_copy)
2249         {
2250         STACK_OF(CONF_VALUE) *sk=NULL;
2251         LHASH_OF(CONF_VALUE) *parms=NULL;
2252         X509_REQ *req=NULL;
2253         CONF_VALUE *cv=NULL;
2254         NETSCAPE_SPKI *spki = NULL;
2255         X509_REQ_INFO *ri;
2256         char *type,*buf;
2257         EVP_PKEY *pktmp=NULL;
2258         X509_NAME *n=NULL;
2259         X509_NAME_ENTRY *ne=NULL;
2260         int ok= -1,i,j;
2261         long errline;
2262         int nid;
2263
2264         /*
2265          * Load input file into a hash table.  (This is just an easy
2266          * way to read and parse the file, then put it into a convenient
2267          * STACK format).
2268          */
2269         parms=CONF_load(NULL,infile,&errline);
2270         if (parms == NULL)
2271                 {
2272                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2273                 ERR_print_errors(bio_err);
2274                 goto err;
2275                 }
2276
2277         sk=CONF_get_section(parms, "default");
2278         if (sk_CONF_VALUE_num(sk) == 0)
2279                 {
2280                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2281                 CONF_free(parms);
2282                 goto err;
2283                 }
2284
2285         /*
2286          * Now create a dummy X509 request structure.  We don't actually
2287          * have an X509 request, but we have many of the components
2288          * (a public key, various DN components).  The idea is that we
2289          * put these components into the right X509 request structure
2290          * and we can use the same code as if you had a real X509 request.
2291          */
2292         req=X509_REQ_new();
2293         if (req == NULL)
2294                 {
2295                 ERR_print_errors(bio_err);
2296                 goto err;
2297                 }
2298
2299         /*
2300          * Build up the subject name set.
2301          */
2302         ri=req->req_info;
2303         n = ri->subject;
2304
2305         for (i = 0; ; i++)
2306                 {
2307                 if (sk_CONF_VALUE_num(sk) <= i) break;
2308
2309                 cv=sk_CONF_VALUE_value(sk,i);
2310                 type=cv->name;
2311                 /* Skip past any leading X. X: X, etc to allow for
2312                  * multiple instances
2313                  */
2314                 for (buf = cv->name; *buf ; buf++)
2315                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2316                                 {
2317                                 buf++;
2318                                 if (*buf) type = buf;
2319                                 break;
2320                                 }
2321
2322                 buf=cv->value;
2323                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2324                         {
2325                         if (strcmp(type, "SPKAC") == 0)
2326                                 {
2327                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2328                                 if (spki == NULL)
2329                                         {
2330                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2331                                         ERR_print_errors(bio_err);
2332                                         goto err;
2333                                         }
2334                                 }
2335                         continue;
2336                         }
2337
2338                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
2339                                 (unsigned char *)buf, -1, -1, 0))
2340                         goto err;
2341                 }
2342         if (spki == NULL)
2343                 {
2344                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2345                         infile);
2346                 goto err;
2347                 }
2348
2349         /*
2350          * Now extract the key from the SPKI structure.
2351          */
2352
2353         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2354
2355         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2356                 {
2357                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2358                 goto err;
2359                 }
2360
2361         j = NETSCAPE_SPKI_verify(spki, pktmp);
2362         if (j <= 0)
2363                 {
2364                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2365                 goto err;
2366                 }
2367         BIO_printf(bio_err,"Signature ok\n");
2368
2369         X509_REQ_set_pubkey(req,pktmp);
2370         EVP_PKEY_free(pktmp);
2371         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,chtype,multirdn,email_dn,startdate,enddate,
2372                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2373                         ext_copy, 0);
2374 err:
2375         if (req != NULL) X509_REQ_free(req);
2376         if (parms != NULL) CONF_free(parms);
2377         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2378         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2379
2380         return(ok);
2381         }
2382
2383 static int check_time_format(const char *str)
2384         {
2385         return ASN1_TIME_set_string(NULL, str);
2386         }
2387
2388 static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
2389         {
2390         ASN1_UTCTIME *tm=NULL;
2391         char *row[DB_NUMBER],**rrow,**irow;
2392         char *rev_str = NULL;
2393         BIGNUM *bn = NULL;
2394         int ok=-1,i;
2395
2396         for (i=0; i<DB_NUMBER; i++)
2397                 row[i]=NULL;
2398         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2399         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2400         if (!bn)
2401                 goto err;
2402         if (BN_is_zero(bn))
2403                 row[DB_serial]=BUF_strdup("00");
2404         else
2405                 row[DB_serial]=BN_bn2hex(bn);
2406         BN_free(bn);
2407         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2408                 {
2409                 BIO_printf(bio_err,"Memory allocation failure\n");
2410                 goto err;
2411                 }
2412         /* We have to lookup by serial number because name lookup
2413          * skips revoked certs
2414          */
2415         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2416         if (rrow == NULL)
2417                 {
2418                 BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
2419
2420                 /* We now just add it to the database */
2421                 row[DB_type]=(char *)OPENSSL_malloc(2);
2422
2423                 tm=X509_get_notAfter(x509);
2424                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2425                 memcpy(row[DB_exp_date],tm->data,tm->length);
2426                 row[DB_exp_date][tm->length]='\0';
2427
2428                 row[DB_rev_date]=NULL;
2429
2430                 /* row[DB_serial] done already */
2431                 row[DB_file]=(char *)OPENSSL_malloc(8);
2432
2433                 /* row[DB_name] done already */
2434
2435                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2436                         (row[DB_file] == NULL))
2437                         {
2438                         BIO_printf(bio_err,"Memory allocation failure\n");
2439                         goto err;
2440                         }
2441                 BUF_strlcpy(row[DB_file],"unknown",8);
2442                 row[DB_type][0]='V';
2443                 row[DB_type][1]='\0';
2444
2445                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2446                         {
2447                         BIO_printf(bio_err,"Memory allocation failure\n");
2448                         goto err;
2449                         }
2450
2451                 for (i=0; i<DB_NUMBER; i++)
2452                         {
2453                         irow[i]=row[i];
2454                         row[i]=NULL;
2455                         }
2456                 irow[DB_NUMBER]=NULL;
2457
2458                 if (!TXT_DB_insert(db->db,irow))
2459                         {
2460                         BIO_printf(bio_err,"failed to update database\n");
2461                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2462                         goto err;
2463                         }
2464
2465                 /* Revoke Certificate */
2466                 ok = do_revoke(x509,db, type, value);
2467
2468                 goto err;
2469
2470                 }
2471         else if (index_name_cmp_noconst(row, rrow))
2472                 {
2473                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2474                            row[DB_name]);
2475                 goto err;
2476                 }
2477         else if (rrow[DB_type][0]=='R')
2478                 {
2479                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2480                            row[DB_serial]);
2481                 goto err;
2482                 }
2483         else
2484                 {
2485                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2486                 rev_str = make_revocation_str(type, value);
2487                 if (!rev_str)
2488                         {
2489                         BIO_printf(bio_err, "Error in revocation arguments\n");
2490                         goto err;
2491                         }
2492                 rrow[DB_type][0]='R';
2493                 rrow[DB_type][1]='\0';
2494                 rrow[DB_rev_date] = rev_str;
2495                 }
2496         ok=1;
2497 err:
2498         for (i=0; i<DB_NUMBER; i++)
2499                 {
2500                 if (row[i] != NULL)
2501                         OPENSSL_free(row[i]);
2502                 }
2503         return(ok);
2504         }
2505
2506 static int get_certificate_status(const char *serial, CA_DB *db)
2507         {
2508         char *row[DB_NUMBER],**rrow;
2509         int ok=-1,i;
2510
2511         /* Free Resources */
2512         for (i=0; i<DB_NUMBER; i++)
2513                 row[i]=NULL;
2514
2515         /* Malloc needed char spaces */
2516         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2517         if (row[DB_serial] == NULL)
2518                 {
2519                 BIO_printf(bio_err,"Malloc failure\n");
2520                 goto err;
2521                 }
2522
2523         if (strlen(serial) % 2)
2524                 {
2525                 /* Set the first char to 0 */;
2526                 row[DB_serial][0]='0';
2527
2528                 /* Copy String from serial to row[DB_serial] */
2529                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2530                 row[DB_serial][strlen(serial)+1]='\0';
2531                 }
2532         else
2533                 {
2534                 /* Copy String from serial to row[DB_serial] */
2535                 memcpy(row[DB_serial], serial, strlen(serial));
2536                 row[DB_serial][strlen(serial)]='\0';
2537                 }
2538
2539         /* Make it Upper Case */
2540         for (i=0; row[DB_serial][i] != '\0'; i++)
2541                 row[DB_serial][i] = toupper((unsigned char)row[DB_serial][i]);
2542
2543
2544         ok=1;
2545
2546         /* Search for the certificate */
2547         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2548         if (rrow == NULL)
2549                 {
2550                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2551                                  row[DB_serial]);
2552                 ok=-1;
2553                 goto err;
2554                 }
2555         else if (rrow[DB_type][0]=='V')
2556                 {
2557                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2558                         row[DB_serial], rrow[DB_type][0]);
2559                 goto err;
2560                 }
2561         else if (rrow[DB_type][0]=='R')
2562                 {
2563                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2564                         row[DB_serial], rrow[DB_type][0]);
2565                 goto err;
2566                 }
2567         else if (rrow[DB_type][0]=='E')
2568                 {
2569                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2570                         row[DB_serial], rrow[DB_type][0]);
2571                 goto err;
2572                 }
2573         else if (rrow[DB_type][0]=='S')
2574                 {
2575                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2576                         row[DB_serial], rrow[DB_type][0]);
2577                 goto err;
2578                 }
2579         else
2580                 {
2581                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2582                         row[DB_serial], rrow[DB_type][0]);
2583                 ok=-1;
2584                 }
2585 err:
2586         for (i=0; i<DB_NUMBER; i++)
2587                 {
2588                 if (row[i] != NULL)
2589                         OPENSSL_free(row[i]);
2590                 }
2591         return(ok);
2592         }
2593
2594 static int do_updatedb (CA_DB *db)
2595         {
2596         ASN1_UTCTIME    *a_tm = NULL;
2597         int i, cnt = 0;
2598         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2599         char **rrow, *a_tm_s;
2600
2601         a_tm = ASN1_UTCTIME_new();
2602
2603         /* get actual time and make a string */
2604         a_tm = X509_gmtime_adj(a_tm, 0);
2605         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2606         if (a_tm_s == NULL)
2607                 {
2608                 cnt = -1;
2609                 goto err;
2610                 }
2611
2612         memcpy(a_tm_s, a_tm->data, a_tm->length);
2613         a_tm_s[a_tm->length] = '\0';
2614
2615         if (strncmp(a_tm_s, "49", 2) <= 0)
2616                 a_y2k = 1;
2617         else
2618                 a_y2k = 0;
2619
2620         for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++)
2621                 {
2622                 rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
2623
2624                 if (rrow[DB_type][0] == 'V')
2625                         {
2626                         /* ignore entries that are not valid */
2627                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2628                                 db_y2k = 1;
2629                         else
2630                                 db_y2k = 0;
2631
2632                         if (db_y2k == a_y2k)
2633                                 {
2634                                 /* all on the same y2k side */
2635                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2636                                         {
2637                                         rrow[DB_type][0]  = 'E';
2638                                         rrow[DB_type][1]  = '\0';
2639                                         cnt++;
2640
2641                                         BIO_printf(bio_err, "%s=Expired\n",
2642                                                         rrow[DB_serial]);
2643                                         }
2644                                 }
2645                         else if (db_y2k < a_y2k)
2646                                 {
2647                                 rrow[DB_type][0]  = 'E';
2648                                 rrow[DB_type][1]  = '\0';
2649                                 cnt++;
2650
2651                                 BIO_printf(bio_err, "%s=Expired\n",
2652                                                         rrow[DB_serial]);
2653                                 }
2654
2655                         }
2656                 }
2657
2658 err:
2659
2660         ASN1_UTCTIME_free(a_tm);
2661         OPENSSL_free(a_tm_s);
2662
2663         return (cnt);
2664         }
2665
2666 static const char *crl_reasons[] = {
2667         /* CRL reason strings */
2668         "unspecified",
2669         "keyCompromise",
2670         "CACompromise",
2671         "affiliationChanged",
2672         "superseded",
2673         "cessationOfOperation",
2674         "certificateHold",
2675         "removeFromCRL",
2676         /* Additional pseudo reasons */
2677         "holdInstruction",
2678         "keyTime",
2679         "CAkeyTime"
2680 };
2681
2682 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2683
2684 /* Given revocation information convert to a DB string.
2685  * The format of the string is:
2686  * revtime[,reason,extra]. Where 'revtime' is the
2687  * revocation time (the current time). 'reason' is the
2688  * optional CRL reason and 'extra' is any additional
2689  * argument
2690  */
2691
2692 char *make_revocation_str(int rev_type, char *rev_arg)
2693         {
2694         char *other = NULL, *str;
2695         const char *reason = NULL;
2696         ASN1_OBJECT *otmp;
2697         ASN1_UTCTIME *revtm = NULL;
2698         int i;
2699         switch (rev_type)
2700                 {
2701         case REV_NONE:
2702                 break;
2703
2704         case REV_CRL_REASON:
2705                 for (i = 0; i < 8; i++)
2706                         {
2707                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2708                                 {
2709                                 reason = crl_reasons[i];
2710                                 break;
2711                                 }
2712                         }
2713                 if (reason == NULL)
2714                         {
2715                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2716                         return NULL;
2717                         }
2718                 break;
2719
2720         case REV_HOLD:
2721                 /* Argument is an OID */
2722
2723                 otmp = OBJ_txt2obj(rev_arg, 0);
2724                 ASN1_OBJECT_free(otmp);
2725
2726                 if (otmp == NULL)
2727                         {
2728                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2729                         return NULL;
2730                         }
2731
2732                 reason = "holdInstruction";
2733                 other = rev_arg;
2734                 break;
2735
2736         case REV_KEY_COMPROMISE:
2737         case REV_CA_COMPROMISE:
2738
2739                 /* Argument is the key compromise time  */
2740                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2741                         {
2742                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2743                         return NULL;
2744                         }
2745                 other = rev_arg;
2746                 if (rev_type == REV_KEY_COMPROMISE)
2747                         reason = "keyTime";
2748                 else
2749                         reason = "CAkeyTime";
2750
2751                 break;
2752
2753                 }
2754
2755         revtm = X509_gmtime_adj(NULL, 0);
2756
2757         if (!revtm)
2758                 return NULL;
2759
2760         i = revtm->length + 1;
2761
2762         if (reason) i += strlen(reason) + 1;
2763         if (other) i += strlen(other) + 1;
2764
2765         str = OPENSSL_malloc(i);
2766
2767         if (!str) return NULL;
2768
2769         BUF_strlcpy(str, (char *)revtm->data, i);
2770         if (reason)
2771                 {
2772                 BUF_strlcat(str, ",", i);
2773                 BUF_strlcat(str, reason, i);
2774                 }
2775         if (other)
2776                 {
2777                 BUF_strlcat(str, ",", i);
2778                 BUF_strlcat(str, other, i);
2779                 }
2780         ASN1_UTCTIME_free(revtm);
2781         return str;
2782         }
2783
2784 /* Convert revocation field to X509_REVOKED entry
2785  * return code:
2786  * 0 error
2787  * 1 OK
2788  * 2 OK and some extensions added (i.e. V2 CRL)
2789  */
2790
2791
2792 int make_revoked(X509_REVOKED *rev, const char *str)
2793         {
2794         char *tmp = NULL;
2795         int reason_code = -1;
2796         int i, ret = 0;
2797         ASN1_OBJECT *hold = NULL;
2798         ASN1_GENERALIZEDTIME *comp_time = NULL;
2799         ASN1_ENUMERATED *rtmp = NULL;
2800
2801         ASN1_TIME *revDate = NULL;
2802
2803         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2804
2805         if (i == 0)
2806                 goto err;
2807
2808         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2809                 goto err;
2810
2811         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2812                 {
2813                 rtmp = ASN1_ENUMERATED_new();
2814                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2815                         goto err;
2816                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2817                         goto err;
2818                 }
2819
2820         if (rev && comp_time)
2821                 {
2822                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2823                         goto err;
2824                 }
2825         if (rev && hold)
2826                 {
2827                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2828                         goto err;
2829                 }
2830
2831         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2832                 ret = 2;
2833         else ret = 1;
2834
2835         err:
2836
2837         if (tmp) OPENSSL_free(tmp);
2838         ASN1_OBJECT_free(hold);
2839         ASN1_GENERALIZEDTIME_free(comp_time);
2840         ASN1_ENUMERATED_free(rtmp);
2841         ASN1_TIME_free(revDate);
2842
2843         return ret;
2844         }
2845
2846 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
2847         {
2848         char buf[25],*pbuf, *p;
2849         int j;
2850         j=i2a_ASN1_OBJECT(bp,obj);
2851         pbuf=buf;
2852         for (j=22-j; j>0; j--)
2853                 *(pbuf++)=' ';
2854         *(pbuf++)=':';
2855         *(pbuf++)='\0';
2856         BIO_puts(bp,buf);
2857
2858         if (str->type == V_ASN1_PRINTABLESTRING)
2859                 BIO_printf(bp,"PRINTABLE:'");
2860         else if (str->type == V_ASN1_T61STRING)
2861                 BIO_printf(bp,"T61STRING:'");
2862         else if (str->type == V_ASN1_IA5STRING)
2863                 BIO_printf(bp,"IA5STRING:'");
2864         else if (str->type == V_ASN1_UNIVERSALSTRING)
2865                 BIO_printf(bp,"UNIVERSALSTRING:'");
2866         else
2867                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
2868
2869         p=(char *)str->data;
2870         for (j=str->length; j>0; j--)
2871                 {
2872                 if ((*p >= ' ') && (*p <= '~'))
2873                         BIO_printf(bp,"%c",*p);
2874                 else if (*p & 0x80)
2875                         BIO_printf(bp,"\\0x%02X",*p);
2876                 else if ((unsigned char)*p == 0xf7)
2877                         BIO_printf(bp,"^?");
2878                 else    BIO_printf(bp,"^%c",*p+'@');
2879                 p++;
2880                 }
2881         BIO_printf(bp,"'\n");
2882         return 1;
2883         }
2884
2885 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, const char *str)
2886         {
2887         char *tmp = NULL;
2888         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
2889         int reason_code = -1;
2890         int ret = 0;
2891         unsigned int i;
2892         ASN1_OBJECT *hold = NULL;
2893         ASN1_GENERALIZEDTIME *comp_time = NULL;
2894         tmp = BUF_strdup(str);
2895
2896         p = strchr(tmp, ',');
2897
2898         rtime_str = tmp;
2899
2900         if (p)
2901                 {
2902                 *p = '\0';
2903                 p++;
2904                 reason_str = p;
2905                 p = strchr(p, ',');
2906                 if (p)
2907                         {
2908                         *p = '\0';
2909                         arg_str = p + 1;
2910                         }
2911                 }
2912
2913         if (prevtm)
2914                 {
2915                 *prevtm = ASN1_UTCTIME_new();
2916                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
2917                         {
2918                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
2919                         goto err;
2920                         }
2921                 }
2922         if (reason_str)
2923                 {
2924                 for (i = 0; i < NUM_REASONS; i++)
2925                         {
2926                         if(!strcasecmp(reason_str, crl_reasons[i]))
2927                                 {
2928                                 reason_code = i;
2929                                 break;
2930                                 }
2931                         }
2932                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
2933                         {
2934                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
2935                         goto err;
2936                         }
2937
2938                 if (reason_code == 7)
2939                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
2940                 else if (reason_code == 8)              /* Hold instruction */
2941                         {
2942                         if (!arg_str)
2943                                 {
2944                                 BIO_printf(bio_err, "missing hold instruction\n");
2945                                 goto err;
2946                                 }
2947                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
2948                         hold = OBJ_txt2obj(arg_str, 0);
2949
2950                         if (!hold)
2951                                 {
2952                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
2953                                 goto err;
2954                                 }
2955                         if (phold) *phold = hold;
2956                         }
2957                 else if ((reason_code == 9) || (reason_code == 10))
2958                         {
2959                         if (!arg_str)
2960                                 {
2961                                 BIO_printf(bio_err, "missing compromised time\n");
2962                                 goto err;
2963                                 }
2964                         comp_time = ASN1_GENERALIZEDTIME_new();
2965                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
2966                                 {
2967                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
2968                                 goto err;
2969                                 }
2970                         if (reason_code == 9)
2971                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
2972                         else
2973                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
2974                         }
2975                 }
2976
2977         if (preason) *preason = reason_code;
2978         if (pinvtm) *pinvtm = comp_time;
2979         else ASN1_GENERALIZEDTIME_free(comp_time);
2980
2981         ret = 1;
2982
2983         err:
2984
2985         if (tmp) OPENSSL_free(tmp);
2986         if (!phold) ASN1_OBJECT_free(hold);
2987         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
2988
2989         return ret;
2990         }