Another noemailDN fix.
[openssl.git] / apps / ca.c
index e0349a765608510401f89b42080faf136479ef38..107c4d2b981c78798c8553ca5ba66c8fbf537b29 100644 (file)
--- a/apps/ca.c
+++ b/apps/ca.c
 #include <openssl/objects.h>
 #include <openssl/ocsp.h>
 #include <openssl/pem.h>
 #include <openssl/objects.h>
 #include <openssl/ocsp.h>
 #include <openssl/pem.h>
-#include <openssl/engine.h>
+
+#ifdef OPENSSL_SYS_WINDOWS
+#define strcasecmp _stricmp
+#else
+#include <strings.h>
+#endif
 
 #ifndef W_OK
 
 #ifndef W_OK
-#  ifdef VMS
+#  ifdef OPENSSL_SYS_VMS
 #    if defined(__DECC)
 #      include <unistd.h>
 #    else
 #    if defined(__DECC)
 #      include <unistd.h>
 #    else
 #define ENV_DEFAULT_CRL_DAYS   "default_crl_days"
 #define ENV_DEFAULT_CRL_HOURS  "default_crl_hours"
 #define ENV_DEFAULT_MD         "default_md"
 #define ENV_DEFAULT_CRL_DAYS   "default_crl_days"
 #define ENV_DEFAULT_CRL_HOURS  "default_crl_hours"
 #define ENV_DEFAULT_MD         "default_md"
+#define ENV_DEFAULT_EMAIL_DN   "email_in_dn"
 #define ENV_PRESERVE           "preserve"
 #define ENV_POLICY             "policy"
 #define ENV_EXTENSIONS         "x509_extensions"
 #define ENV_CRLEXT             "crl_extensions"
 #define ENV_MSIE_HACK          "msie_hack"
 #define ENV_PRESERVE           "preserve"
 #define ENV_POLICY             "policy"
 #define ENV_EXTENSIONS         "x509_extensions"
 #define ENV_CRLEXT             "crl_extensions"
 #define ENV_MSIE_HACK          "msie_hack"
+#define ENV_NAMEOPT            "name_opt"
+#define ENV_CERTOPT            "cert_opt"
+#define ENV_EXTCOPY            "copy_extensions"
 
 #define ENV_DATABASE           "database"
 
 
 #define ENV_DATABASE           "database"
 
@@ -174,9 +183,11 @@ static char *ca_usage[]={
 " -spkac file     - File contains DN and signed public key and challenge\n",
 " -ss_cert file   - File contains a self signed cert to sign\n",
 " -preserveDN     - Don't re-order the DN\n",
 " -spkac file     - File contains DN and signed public key and challenge\n",
 " -ss_cert file   - File contains a self signed cert to sign\n",
 " -preserveDN     - Don't re-order the DN\n",
+" -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 " -batch          - Don't ask questions\n",
 " -msie_hack      - msie modifications to handle all those universal strings\n",
 " -revoke file    - Revoke a certificate (given in file)\n",
 " -batch          - Don't ask questions\n",
 " -msie_hack      - msie modifications to handle all those universal strings\n",
 " -revoke file    - Revoke a certificate (given in file)\n",
+" -subj arg       - Use arg instead of request's subject\n",
 " -extensions ..  - Extension section (override value in config file)\n",
 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 " -crlexts ..     - CRL extension section (override value in config file)\n",
 " -extensions ..  - Extension section (override value in config file)\n",
 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 " -crlexts ..     - CRL extension section (override value in config file)\n",
@@ -202,32 +213,41 @@ static BIGNUM *load_serial(char *serialfile);
 static int save_serial(char *serialfile, BIGNUM *serial);
 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                   const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
 static int save_serial(char *serialfile, BIGNUM *serial);
 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                   const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,TXT_DB *db,
-                  BIGNUM *serial, char *startdate,char *enddate, int days,
-                  int batch, char *ext_sect, LHASH *conf,int verbose);
+                  BIGNUM *serial, char *subj, int email_dn, char *startdate,
+                  char *enddate, long days, int batch, char *ext_sect, CONF *conf,
+                  int verbose, unsigned long certopt, unsigned long nameopt,
+                  int default_op, int ext_copy);
 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                        const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                        const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
-                       TXT_DB *db, BIGNUM *serial,char *startdate,
-                       char *enddate, int days, int batch, char *ext_sect,
-                       LHASH *conf,int verbose);
+                       TXT_DB *db, BIGNUM *serial, char *subj, int email_dn,
+                       char *startdate, char *enddate, long days, int batch,
+                       char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
+                       unsigned long nameopt, int default_op, int ext_copy,
+                       ENGINE *e);
 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
-                        TXT_DB *db, BIGNUM *serial,char *startdate,
-                        char *enddate, int days, char *ext_sect,LHASH *conf,
-                               int verbose);
+                        TXT_DB *db, BIGNUM *serial,char *subj, int email_dn,
+                        char *startdate, char *enddate, long days, char *ext_sect,
+                        CONF *conf, int verbose, unsigned long certopt, 
+                        unsigned long nameopt, int default_op, int ext_copy);
 static int fix_data(int nid, int *type);
 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 static int fix_data(int nid, int *type);
 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
-       STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,
-       char *startdate, char *enddate, int days, int batch, int verbose,
-       X509_REQ *req, char *ext_sect, LHASH *conf);
+       STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,char *subj,
+       int email_dn, char *startdate, char *enddate, long days, int batch,
+               int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
+       unsigned long certopt, unsigned long nameopt, int default_op,
+       int ext_copy);
+static X509_NAME *do_subject(char *subject);
 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 static int do_updatedb(TXT_DB *db);
 static int check_time_format(char *str);
 char *make_revocation_str(int rev_type, char *rev_arg);
 int make_revoked(X509_REVOKED *rev, char *str);
 static int do_revoke(X509 *x509, TXT_DB *db, int ext, char *extval);
 static int get_certificate_status(const char *ser_status, TXT_DB *db);
 static int do_updatedb(TXT_DB *db);
 static int check_time_format(char *str);
 char *make_revocation_str(int rev_type, char *rev_arg);
 int make_revoked(X509_REVOKED *rev, char *str);
-static LHASH *conf=NULL;
-static LHASH *extconf=NULL;
+int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
+static CONF *conf=NULL;
+static CONF *extconf=NULL;
 static char *section=NULL;
 
 static int preserve=0;
 static char *section=NULL;
 
 static int preserve=0;
@@ -245,10 +265,12 @@ int MAIN(int argc, char **argv)
        {
        ENGINE *e = NULL;
        char *key=NULL,*passargin=NULL;
        {
        ENGINE *e = NULL;
        char *key=NULL,*passargin=NULL;
+       int free_key = 0;
        int total=0;
        int total_done=0;
        int badops=0;
        int ret=1;
        int total=0;
        int total_done=0;
        int badops=0;
        int ret=1;
+       int email_dn=1;
        int req=0;
        int verbose=0;
        int gencrl=0;
        int req=0;
        int verbose=0;
        int gencrl=0;
@@ -274,30 +296,35 @@ int MAIN(int argc, char **argv)
        char *serialfile=NULL;
        char *extensions=NULL;
        char *extfile=NULL;
        char *serialfile=NULL;
        char *extensions=NULL;
        char *extfile=NULL;
+       char *subj=NULL;
+       char *tmp_email_dn=NULL;
        char *crl_ext=NULL;
        int rev_type = REV_NONE;
        char *rev_arg = NULL;
        BIGNUM *serial=NULL;
        char *startdate=NULL;
        char *enddate=NULL;
        char *crl_ext=NULL;
        int rev_type = REV_NONE;
        char *rev_arg = NULL;
        BIGNUM *serial=NULL;
        char *startdate=NULL;
        char *enddate=NULL;
-       int days=0;
+       long days=0;
        int batch=0;
        int notext=0;
        int batch=0;
        int notext=0;
+       unsigned long nameopt = 0, certopt = 0;
+       int default_op = 1;
+       int ext_copy = EXT_COPY_NONE;
        X509 *x509=NULL;
        X509 *x=NULL;
        BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
        char *dbfile=NULL;
        TXT_DB *db=NULL;
        X509_CRL *crl=NULL;
        X509 *x509=NULL;
        X509 *x=NULL;
        BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
        char *dbfile=NULL;
        TXT_DB *db=NULL;
        X509_CRL *crl=NULL;
-       X509_CRL_INFO *ci=NULL;
        X509_REVOKED *r=NULL;
        X509_REVOKED *r=NULL;
+       ASN1_TIME *tmptm;
+       ASN1_INTEGER *tmpser;
        char **pp,*p,*f;
        int i,j;
        long l;
        const EVP_MD *dgst=NULL;
        STACK_OF(CONF_VALUE) *attribs=NULL;
        STACK_OF(X509) *cert_sk=NULL;
        char **pp,*p,*f;
        int i,j;
        long l;
        const EVP_MD *dgst=NULL;
        STACK_OF(CONF_VALUE) *attribs=NULL;
        STACK_OF(X509) *cert_sk=NULL;
-       BIO *hex=NULL;
 #undef BSIZE
 #define BSIZE 256
        MS_STATIC char buf[3][BSIZE];
 #undef BSIZE
 #define BSIZE 256
        MS_STATIC char buf[3][BSIZE];
@@ -338,6 +365,12 @@ EF_ALIGNMENT=0;
                        if (--argc < 1) goto bad;
                        section= *(++argv);
                        }
                        if (--argc < 1) goto bad;
                        section= *(++argv);
                        }
+               else if (strcmp(*argv,"-subj") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       subj= *(++argv);
+                       /* preserve=1; */
+                       }
                else if (strcmp(*argv,"-startdate") == 0)
                        {
                        if (--argc < 1) goto bad;
                else if (strcmp(*argv,"-startdate") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -410,6 +443,8 @@ EF_ALIGNMENT=0;
                        batch=1;
                else if (strcmp(*argv,"-preserveDN") == 0)
                        preserve=1;
                        batch=1;
                else if (strcmp(*argv,"-preserveDN") == 0)
                        preserve=1;
+               else if (strcmp(*argv,"-noemailDN") == 0)
+                       email_dn=0;
                else if (strcmp(*argv,"-gencrl") == 0)
                        gencrl=1;
                else if (strcmp(*argv,"-msie_hack") == 0)
                else if (strcmp(*argv,"-gencrl") == 0)
                        gencrl=1;
                else if (strcmp(*argv,"-msie_hack") == 0)
@@ -522,23 +557,7 @@ bad:
 
        ERR_load_crypto_strings();
 
 
        ERR_load_crypto_strings();
 
-       if (engine != NULL)
-               {
-               if ((e = ENGINE_by_id(engine)) == NULL)
-                       {
-                       BIO_printf(bio_err,"invalid engine \"%s\"\n",
-                               engine);
-                       goto err;
-                       }
-               if (!ENGINE_set_default(e, ENGINE_METHOD_ALL))
-                       {
-                       BIO_printf(bio_err,"can't use that engine\n");
-                       goto err;
-                       }
-               BIO_printf(bio_err,"engine \"%s\" set.\n", engine);
-               /* Free our "structural" reference. */
-               ENGINE_free(e);
-               }
+        e = setup_engine(bio_err, engine, 0);
 
        /*****************************************************************/
        if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 
        /*****************************************************************/
        if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
@@ -546,7 +565,7 @@ bad:
        if (configfile == NULL)
                {
                /* We will just use 'buf[0]' as a temporary buffer.  */
        if (configfile == NULL)
                {
                /* We will just use 'buf[0]' as a temporary buffer.  */
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                strncpy(buf[0],X509_get_default_cert_area(),
                        sizeof(buf[0])-1-sizeof(CONFIG_FILE));
 #else
                strncpy(buf[0],X509_get_default_cert_area(),
                        sizeof(buf[0])-1-sizeof(CONFIG_FILE));
 #else
@@ -559,7 +578,8 @@ bad:
                }
 
        BIO_printf(bio_err,"Using configuration from %s\n",configfile);
                }
 
        BIO_printf(bio_err,"Using configuration from %s\n",configfile);
-       if ((conf=CONF_load(NULL,configfile,&errorline)) == NULL)
+       conf = NCONF_new(NULL);
+       if (NCONF_load(conf,configfile,&errorline) <= 0)
                {
                if (errorline <= 0)
                        BIO_printf(bio_err,"error loading the config file '%s'\n",
                {
                if (errorline <= 0)
                        BIO_printf(bio_err,"error loading the config file '%s'\n",
@@ -573,7 +593,7 @@ bad:
        /* Lets get the config section we are using */
        if (section == NULL)
                {
        /* Lets get the config section we are using */
        if (section == NULL)
                {
-               section=CONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
+               section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
                if (section == NULL)
                        {
                        lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
                if (section == NULL)
                        {
                        lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
@@ -583,7 +603,7 @@ bad:
 
        if (conf != NULL)
                {
 
        if (conf != NULL)
                {
-               p=CONF_get_string(conf,NULL,"oid_file");
+               p=NCONF_get_string(conf,NULL,"oid_file");
                if (p == NULL)
                        ERR_clear_error();
                if (p != NULL)
                if (p == NULL)
                        ERR_clear_error();
                if (p != NULL)
@@ -612,7 +632,7 @@ bad:
                        }
                }
 
                        }
                }
 
-       randfile = CONF_get_string(conf, BASE_SECTION, "RANDFILE");
+       randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
        if (randfile == NULL)
                ERR_clear_error();
        app_RAND_load_file(randfile, bio_err, 0);
        if (randfile == NULL)
                ERR_clear_error();
        app_RAND_load_file(randfile, bio_err, 0);
@@ -631,7 +651,7 @@ bad:
        /* report status of cert with serial number given on command line */
        if (ser_status)
        {
        /* report status of cert with serial number given on command line */
        if (ser_status)
        {
-               if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
+               if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
                        {
                        lookup_fail(section,ENV_DATABASE);
                        goto err;
                        {
                        lookup_fail(section,ENV_DATABASE);
                        goto err;
@@ -645,15 +665,8 @@ bad:
                db=TXT_DB_read(in,DB_NUMBER);
                if (db == NULL) goto err;
 
                db=TXT_DB_read(in,DB_NUMBER);
                if (db == NULL) goto err;
 
-               if (!TXT_DB_create_index(db, DB_serial, NULL,
-                                       LHASH_HASH_FN(index_serial_hash),
-                                       LHASH_COMP_FN(index_serial_cmp)))
-                       {
-                       BIO_printf(bio_err,
-                         "error creating serial number index:(%ld,%ld,%ld)\n",
-                                               db->error,db->arg1,db->arg2);
+               if (!make_serial_index(db))
                        goto err;
                        goto err;
-                       }
 
                if (get_certificate_status(ser_status,db) != 1)
                        BIO_printf(bio_err,"Error verifying serial %s!\n",
 
                if (get_certificate_status(ser_status,db) != 1)
                        BIO_printf(bio_err,"Error verifying serial %s!\n",
@@ -664,68 +677,42 @@ bad:
        /*****************************************************************/
        /* we definitely need a public key, so let's get it */
 
        /*****************************************************************/
        /* we definitely need a public key, so let's get it */
 
-       if ((keyfile == NULL) && ((keyfile=CONF_get_string(conf,
+       if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
                section,ENV_PRIVATE_KEY)) == NULL))
                {
                lookup_fail(section,ENV_PRIVATE_KEY);
                goto err;
                }
                section,ENV_PRIVATE_KEY)) == NULL))
                {
                lookup_fail(section,ENV_PRIVATE_KEY);
                goto err;
                }
-       if (!key && !app_passwd(bio_err, passargin, NULL, &key, NULL))
-               {
-               BIO_printf(bio_err,"Error getting password\n");
-               goto err;
-               }
-       if (keyform == FORMAT_ENGINE)
+       if (!key)
                {
                {
-               if (!e)
+               free_key = 1;
+               if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
                        {
                        {
-                       BIO_printf(bio_err,"no engine specified\n");
+                       BIO_printf(bio_err,"Error getting password\n");
                        goto err;
                        }
                        goto err;
                        }
-               pkey = ENGINE_load_private_key(e, keyfile, key);
-               }
-       else if (keyform == FORMAT_PEM)
-               {
-               if (BIO_read_filename(in,keyfile) <= 0)
-                       {
-                       perror(keyfile);
-                       BIO_printf(bio_err,"trying to load CA private key\n");
-                       goto err;
-                       }
-               pkey=PEM_read_bio_PrivateKey(in,NULL,NULL,key);
-               }
-       else
-               {
-               BIO_printf(bio_err,"bad input format specified for key file\n");
-               goto err;
                }
                }
+       pkey = load_key(bio_err, keyfile, keyform, key, e, 
+               "CA private key");
        if (key) memset(key,0,strlen(key));
        if (pkey == NULL)
                {
        if (key) memset(key,0,strlen(key));
        if (pkey == NULL)
                {
-               BIO_printf(bio_err,"unable to load CA private key\n");
+               /* load_key() has already printed an appropriate message */
                goto err;
                }
 
        /*****************************************************************/
        /* we need a certificate */
                goto err;
                }
 
        /*****************************************************************/
        /* we need a certificate */
-       if ((certfile == NULL) && ((certfile=CONF_get_string(conf,
+       if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
                section,ENV_CERTIFICATE)) == NULL))
                {
                lookup_fail(section,ENV_CERTIFICATE);
                goto err;
                }
                section,ENV_CERTIFICATE)) == NULL))
                {
                lookup_fail(section,ENV_CERTIFICATE);
                goto err;
                }
-        if (BIO_read_filename(in,certfile) <= 0)
-               {
-               perror(certfile);
-               BIO_printf(bio_err,"trying to load CA certificate\n");
-               goto err;
-               }
-       x509=PEM_read_bio_X509(in,NULL,NULL,NULL);
+       x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
+               "CA certificate");
        if (x509 == NULL)
        if (x509 == NULL)
-               {
-               BIO_printf(bio_err,"unable to load CA certificate\n");
                goto err;
                goto err;
-               }
 
        if (!X509_check_private_key(x509,pkey))
                {
 
        if (!X509_check_private_key(x509,pkey))
                {
@@ -733,30 +720,72 @@ bad:
                goto err;
                }
 
                goto err;
                }
 
-       f=CONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
+       f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
        if (f == NULL)
                ERR_clear_error();
        if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
                preserve=1;
        if (f == NULL)
                ERR_clear_error();
        if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
                preserve=1;
-       f=CONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
+       f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
        if (f == NULL)
                ERR_clear_error();
        if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
                msie_hack=1;
 
        if (f == NULL)
                ERR_clear_error();
        if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
                msie_hack=1;
 
+       f=NCONF_get_string(conf,section,ENV_NAMEOPT);
+
+       if (f)
+               {
+               if (!set_name_ex(&nameopt, f))
+                       {
+                       BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
+                       goto err;
+                       }
+               default_op = 0;
+               }
+       else
+               ERR_clear_error();
+
+       f=NCONF_get_string(conf,section,ENV_CERTOPT);
+
+       if (f)
+               {
+               if (!set_cert_ex(&certopt, f))
+                       {
+                       BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
+                       goto err;
+                       }
+               default_op = 0;
+               }
+       else
+               ERR_clear_error();
+
+       f=NCONF_get_string(conf,section,ENV_EXTCOPY);
+
+       if (f)
+               {
+               if (!set_ext_copy(&ext_copy, f))
+                       {
+                       BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
+                       goto err;
+                       }
+               }
+       else
+               ERR_clear_error();
+
        /*****************************************************************/
        /* lookup where to write new certificates */
        if ((outdir == NULL) && (req))
                {
                struct stat sb;
 
        /*****************************************************************/
        /* lookup where to write new certificates */
        if ((outdir == NULL) && (req))
                {
                struct stat sb;
 
-               if ((outdir=CONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
+               if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
                        == NULL)
                        {
                        BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
                        goto err;
                        }
                        == NULL)
                        {
                        BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
                        goto err;
                        }
-#ifndef VMS /* outdir is a directory spec, but access() for VMS demands a
+#ifndef OPENSSL_SYS_VMS
+           /* outdir is a directory spec, but access() for VMS demands a
               filename.  In any case, stat(), below, will catch the problem
               if outdir is not a directory spec, and the fopen() or open()
               will catch an error if there is no write access.
               filename.  In any case, stat(), below, will catch the problem
               if outdir is not a directory spec, and the fopen() or open()
               will catch an error if there is no write access.
@@ -765,7 +794,7 @@ bad:
               C routines to convert the directory syntax to Unixly, and give
               that to access().  However, time's too short to do that just
               now.
               C routines to convert the directory syntax to Unixly, and give
               that to access().  However, time's too short to do that just
               now.
-            */
+           */
                if (access(outdir,R_OK|W_OK|X_OK) != 0)
                        {
                        BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
                if (access(outdir,R_OK|W_OK|X_OK) != 0)
                        {
                        BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
@@ -792,7 +821,7 @@ bad:
 
        /*****************************************************************/
        /* we need to load the database file */
 
        /*****************************************************************/
        /* we need to load the database file */
-       if ((dbfile=CONF_get_string(conf,section,ENV_DATABASE)) == NULL)
+       if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
                {
                lookup_fail(section,ENV_DATABASE);
                goto err;
                {
                lookup_fail(section,ENV_DATABASE);
                goto err;
@@ -829,6 +858,11 @@ bad:
                        }
                p=pp[DB_serial];
                j=strlen(p);
                        }
                p=pp[DB_serial];
                j=strlen(p);
+               if (*p == '-')
+                       {
+                       p++;
+                       j--;
+                       }
                if ((j&1) || (j < 2))
                        {
                        BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
                if ((j&1) || (j < 2))
                        {
                        BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
@@ -849,7 +883,7 @@ bad:
        if (verbose)
                {
                BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
        if (verbose)
                {
                BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                {
                BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                out = BIO_push(tmpbio, out);
                {
                BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                out = BIO_push(tmpbio, out);
@@ -861,13 +895,8 @@ bad:
                BIO_printf(bio_err,"generating index\n");
                }
        
                BIO_printf(bio_err,"generating index\n");
                }
        
-       if (!TXT_DB_create_index(db, DB_serial, NULL,
-                       LHASH_HASH_FN(index_serial_hash),
-                       LHASH_COMP_FN(index_serial_cmp)))
-               {
-               BIO_printf(bio_err,"error creating serial number index:(%ld,%ld,%ld)\n",db->error,db->arg1,db->arg2);
+       if (!make_serial_index(db))
                goto err;
                goto err;
-               }
 
        if (!TXT_DB_create_index(db, DB_name, index_name_qual,
                        LHASH_HASH_FN(index_name_hash),
 
        if (!TXT_DB_create_index(db, DB_name, index_name_qual,
                        LHASH_HASH_FN(index_name_hash),
@@ -891,9 +920,9 @@ bad:
                        {
                        BIO_printf(bio_err,"Malloc failure\n");
                        goto err;
                        {
                        BIO_printf(bio_err,"Malloc failure\n");
                        goto err;
-                       }
+                       }
                else if (i == 0)
                else if (i == 0)
-                       {
+                       {
                        if (verbose) BIO_printf(bio_err,
                                        "No entries found to mark expired\n"); 
                        }
                        if (verbose) BIO_printf(bio_err,
                                        "No entries found to mark expired\n"); 
                        }
@@ -906,7 +935,11 @@ bad:
                                goto err;
                                }
 
                                goto err;
                                }
 
+#ifndef OPENSSL_SYS_VMS
                        j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
                        j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
+#else
+                       j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
+#endif
                        if (j < 0 || j >= sizeof buf[0])
                                {
                                BIO_printf(bio_err, "file name too long\n");
                        if (j < 0 || j >= sizeof buf[0])
                                {
                                BIO_printf(bio_err, "file name too long\n");
@@ -924,7 +957,11 @@ bad:
                        
                        BIO_free(out);
                        out = NULL;
                        
                        BIO_free(out);
                        out = NULL;
+#ifndef OPENSSL_SYS_VMS
                        j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
                        j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
+#else
+                       j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
+#endif
                        if (j < 0 || j >= sizeof buf[1])
                                {
                                BIO_printf(bio_err, "file name too long\n");
                        if (j < 0 || j >= sizeof buf[1])
                                {
                                BIO_printf(bio_err, "file name too long\n");
@@ -958,7 +995,8 @@ bad:
        /* Read extentions config file                                   */
        if (extfile)
                {
        /* Read extentions config file                                   */
        if (extfile)
                {
-               if (!(extconf=CONF_load(NULL,extfile,&errorline)))
+               extconf = NCONF_new(NULL);
+               if (NCONF_load(extconf,extfile,&errorline) <= 0)
                        {
                        if (errorline <= 0)
                                BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
                        {
                        if (errorline <= 0)
                                BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
@@ -974,9 +1012,9 @@ bad:
                        BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
 
                /* We can have sections in the ext file */
                        BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
 
                /* We can have sections in the ext file */
-               if (!extensions && !(extensions = CONF_get_string(extconf, "default", "extensions")))
+               if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
                        extensions = "default";
                        extensions = "default";
-                }
+               }
 
        /*****************************************************************/
        if (req || gencrl)
 
        /*****************************************************************/
        if (req || gencrl)
@@ -992,7 +1030,7 @@ bad:
                else
                        {
                        BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
                else
                        {
                        BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                        {
                        BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                        Sout = BIO_push(tmpbio, Sout);
                        {
                        BIO *tmpbio = BIO_new(BIO_f_linebuffer());
                        Sout = BIO_push(tmpbio, Sout);
@@ -1003,12 +1041,18 @@ bad:
 
        if (req)
                {
 
        if (req)
                {
-               if ((md == NULL) && ((md=CONF_get_string(conf,
+               if ((md == NULL) && ((md=NCONF_get_string(conf,
                        section,ENV_DEFAULT_MD)) == NULL))
                        {
                        lookup_fail(section,ENV_DEFAULT_MD);
                        goto err;
                        }
                        section,ENV_DEFAULT_MD)) == NULL))
                        {
                        lookup_fail(section,ENV_DEFAULT_MD);
                        goto err;
                        }
+               if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
+                       section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
+                       {
+                       if(strcmp(tmp_email_dn,"no") == 0)
+                               email_dn=0;
+                       }
                if ((dgst=EVP_get_digestbyname(md)) == NULL)
                        {
                        BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
                if ((dgst=EVP_get_digestbyname(md)) == NULL)
                        {
                        BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
@@ -1017,7 +1061,7 @@ bad:
                if (verbose)
                        BIO_printf(bio_err,"message digest is %s\n",
                                OBJ_nid2ln(dgst->type));
                if (verbose)
                        BIO_printf(bio_err,"message digest is %s\n",
                                OBJ_nid2ln(dgst->type));
-               if ((policy == NULL) && ((policy=CONF_get_string(conf,
+               if ((policy == NULL) && ((policy=NCONF_get_string(conf,
                        section,ENV_POLICY)) == NULL))
                        {
                        lookup_fail(section,ENV_POLICY);
                        section,ENV_POLICY)) == NULL))
                        {
                        lookup_fail(section,ENV_POLICY);
@@ -1026,7 +1070,7 @@ bad:
                if (verbose)
                        BIO_printf(bio_err,"policy is %s\n",policy);
 
                if (verbose)
                        BIO_printf(bio_err,"policy is %s\n",policy);
 
-               if ((serialfile=CONF_get_string(conf,section,ENV_SERIAL))
+               if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
                        == NULL)
                        {
                        lookup_fail(section,ENV_SERIAL);
                        == NULL)
                        {
                        lookup_fail(section,ENV_SERIAL);
@@ -1039,7 +1083,7 @@ bad:
                         * in the main configuration file */
                        if (!extensions)
                                {
                         * in the main configuration file */
                        if (!extensions)
                                {
-                               extensions=CONF_get_string(conf,section,
+                               extensions=NCONF_get_string(conf,section,
                                                                ENV_EXTENSIONS);
                                if (!extensions)
                                        ERR_clear_error();
                                                                ENV_EXTENSIONS);
                                if (!extensions)
                                        ERR_clear_error();
@@ -1049,8 +1093,8 @@ bad:
                                /* Check syntax of file */
                                X509V3_CTX ctx;
                                X509V3_set_ctx_test(&ctx);
                                /* Check syntax of file */
                                X509V3_CTX ctx;
                                X509V3_set_ctx_test(&ctx);
-                               X509V3_set_conf_lhash(&ctx, conf);
-                               if (!X509V3_EXT_add_conf(conf, &ctx, extensions,
+                               X509V3_set_nconf(&ctx, conf);
+                               if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
                                                                NULL))
                                        {
                                        BIO_printf(bio_err,
                                                                NULL))
                                        {
                                        BIO_printf(bio_err,
@@ -1064,7 +1108,7 @@ bad:
 
                if (startdate == NULL)
                        {
 
                if (startdate == NULL)
                        {
-                       startdate=CONF_get_string(conf,section,
+                       startdate=NCONF_get_string(conf,section,
                                ENV_DEFAULT_STARTDATE);
                        if (startdate == NULL)
                                ERR_clear_error();
                                ENV_DEFAULT_STARTDATE);
                        if (startdate == NULL)
                                ERR_clear_error();
@@ -1078,7 +1122,7 @@ bad:
 
                if (enddate == NULL)
                        {
 
                if (enddate == NULL)
                        {
-                       enddate=CONF_get_string(conf,section,
+                       enddate=NCONF_get_string(conf,section,
                                ENV_DEFAULT_ENDDATE);
                        if (enddate == NULL)
                                ERR_clear_error();
                                ENV_DEFAULT_ENDDATE);
                        if (enddate == NULL)
                                ERR_clear_error();
@@ -1091,8 +1135,8 @@ bad:
 
                if (days == 0)
                        {
 
                if (days == 0)
                        {
-                       days=(int)CONF_get_number(conf,section,
-                               ENV_DEFAULT_DAYS);
+                       if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
+                               days = 0;
                        }
                if (!enddate && (days == 0))
                        {
                        }
                if (!enddate && (days == 0))
                        {
@@ -1112,7 +1156,7 @@ bad:
                        OPENSSL_free(f);
                        }
 
                        OPENSSL_free(f);
                        }
 
-               if ((attribs=CONF_get_section(conf,policy)) == NULL)
+               if ((attribs=NCONF_get_section(conf,policy)) == NULL)
                        {
                        BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
                        goto err;
                        {
                        BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
                        goto err;
@@ -1127,8 +1171,8 @@ bad:
                        {
                        total++;
                        j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
                        {
                        total++;
                        j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
-                               serial,startdate,enddate, days,extensions,conf,
-                               verbose);
+                               serial,subj,email_dn,startdate,enddate,days,extensions,
+                               conf,verbose,certopt,nameopt,default_op,ext_copy);
                        if (j < 0) goto err;
                        if (j > 0)
                                {
                        if (j < 0) goto err;
                        if (j > 0)
                                {
@@ -1151,8 +1195,9 @@ bad:
                        {
                        total++;
                        j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
                        {
                        total++;
                        j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
-                               db,serial,startdate,enddate,days,batch,
-                               extensions,conf,verbose);
+                               db,serial,subj,email_dn,startdate,enddate,days,batch,
+                               extensions,conf,verbose, certopt, nameopt,
+                               default_op, ext_copy, e);
                        if (j < 0) goto err;
                        if (j > 0)
                                {
                        if (j < 0) goto err;
                        if (j > 0)
                                {
@@ -1170,8 +1215,9 @@ bad:
                        {
                        total++;
                        j=certify(&x,infile,pkey,x509,dgst,attribs,db,
                        {
                        total++;
                        j=certify(&x,infile,pkey,x509,dgst,attribs,db,
-                               serial,startdate,enddate,days,batch,
-                               extensions,conf,verbose);
+                               serial,subj,email_dn,startdate,enddate,days,batch,
+                               extensions,conf,verbose, certopt, nameopt,
+                               default_op, ext_copy);
                        if (j < 0) goto err;
                        if (j > 0)
                                {
                        if (j < 0) goto err;
                        if (j > 0)
                                {
@@ -1189,8 +1235,9 @@ bad:
                        {
                        total++;
                        j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
                        {
                        total++;
                        j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
-                               serial,startdate,enddate,days,batch,
-                               extensions,conf,verbose);
+                               serial,subj,email_dn,startdate,enddate,days,batch,
+                               extensions,conf,verbose, certopt, nameopt,
+                               default_op, ext_copy);
                        if (j < 0) goto err;
                        if (j > 0)
                                {
                        if (j < 0) goto err;
                        if (j > 0)
                                {
@@ -1228,7 +1275,7 @@ bad:
 
                        strncpy(buf[0],serialfile,BSIZE-4);
 
 
                        strncpy(buf[0],serialfile,BSIZE-4);
 
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                        strcat(buf[0],"-new");
 #else
                        strcat(buf[0],".new");
                        strcat(buf[0],"-new");
 #else
                        strcat(buf[0],".new");
@@ -1238,7 +1285,7 @@ bad:
 
                        strncpy(buf[1],dbfile,BSIZE-4);
 
 
                        strncpy(buf[1],dbfile,BSIZE-4);
 
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                        strcat(buf[1],"-new");
 #else
                        strcat(buf[1],".new");
                        strcat(buf[1],"-new");
 #else
                        strcat(buf[1],".new");
@@ -1268,7 +1315,7 @@ bad:
                        
                        strncpy(buf[2],outdir,BSIZE-(j*2)-6);
 
                        
                        strncpy(buf[2],outdir,BSIZE-(j*2)-6);
 
-#ifndef VMS
+#ifndef OPENSSL_SYS_VMS
                        strcat(buf[2],"/");
 #endif
 
                        strcat(buf[2],"/");
 #endif
 
@@ -1305,7 +1352,7 @@ bad:
                        /* Rename the database and the serial file */
                        strncpy(buf[2],serialfile,BSIZE-4);
 
                        /* Rename the database and the serial file */
                        strncpy(buf[2],serialfile,BSIZE-4);
 
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                        strcat(buf[2],"-old");
 #else
                        strcat(buf[2],".old");
                        strcat(buf[2],"-old");
 #else
                        strcat(buf[2],".old");
@@ -1333,7 +1380,7 @@ bad:
 
                        strncpy(buf[2],dbfile,BSIZE-4);
 
 
                        strncpy(buf[2],dbfile,BSIZE-4);
 
-#ifdef VMS
+#ifdef OPENSSL_SYS_VMS
                        strcat(buf[2],"-old");
 #else
                        strcat(buf[2],".old");
                        strcat(buf[2],"-old");
 #else
                        strcat(buf[2],".old");
@@ -1364,7 +1411,7 @@ bad:
                int crl_v2 = 0;
                if (!crl_ext)
                        {
                int crl_v2 = 0;
                if (!crl_ext)
                        {
-                       crl_ext=CONF_get_string(conf,section,ENV_CRLEXT);
+                       crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
                        if (!crl_ext)
                                ERR_clear_error();
                        }
                        if (!crl_ext)
                                ERR_clear_error();
                        }
@@ -1373,8 +1420,8 @@ bad:
                        /* Check syntax of file */
                        X509V3_CTX ctx;
                        X509V3_set_ctx_test(&ctx);
                        /* Check syntax of file */
                        X509V3_CTX ctx;
                        X509V3_set_ctx_test(&ctx);
-                       X509V3_set_conf_lhash(&ctx, conf);
-                       if (!X509V3_EXT_add_conf(conf, &ctx, crl_ext, NULL))
+                       X509V3_set_nconf(&ctx, conf);
+                       if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
                                {
                                BIO_printf(bio_err,
                                 "Error Loading CRL extension section %s\n",
                                {
                                BIO_printf(bio_err,
                                 "Error Loading CRL extension section %s\n",
@@ -1383,14 +1430,15 @@ bad:
                                goto err;
                                }
                        }
                                goto err;
                                }
                        }
-               if ((hex=BIO_new(BIO_s_mem())) == NULL) goto err;
 
                if (!crldays && !crlhours)
                        {
 
                if (!crldays && !crlhours)
                        {
-                       crldays=CONF_get_number(conf,section,
-                               ENV_DEFAULT_CRL_DAYS);
-                       crlhours=CONF_get_number(conf,section,
-                               ENV_DEFAULT_CRL_HOURS);
+                       if (!NCONF_get_number(conf,section,
+                               ENV_DEFAULT_CRL_DAYS, &crldays))
+                               crldays = 0;
+                       if (!NCONF_get_number(conf,section,
+                               ENV_DEFAULT_CRL_HOURS, &crlhours))
+                               crlhours = 0;
                        }
                if ((crldays == 0) && (crlhours == 0))
                        {
                        }
                if ((crldays == 0) && (crlhours == 0))
                        {
@@ -1400,15 +1448,16 @@ bad:
 
                if (verbose) BIO_printf(bio_err,"making CRL\n");
                if ((crl=X509_CRL_new()) == NULL) goto err;
 
                if (verbose) BIO_printf(bio_err,"making CRL\n");
                if ((crl=X509_CRL_new()) == NULL) goto err;
-               ci=crl->crl;
-               X509_NAME_free(ci->issuer);
-               ci->issuer=X509_NAME_dup(x509->cert_info->subject);
-               if (ci->issuer == NULL) goto err;
+               if (!X509_CRL_set_issuer_name(crl, X509_get_issuer_name(x509))) goto err;
 
 
-               X509_gmtime_adj(ci->lastUpdate,0);
-               if (ci->nextUpdate == NULL)
-                       ci->nextUpdate=ASN1_UTCTIME_new();
-               X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);
+               tmptm = ASN1_TIME_new();
+               if (!tmptm) goto err;
+               X509_gmtime_adj(tmptm,0);
+               X509_CRL_set_lastUpdate(crl, tmptm);    
+               X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
+               X509_CRL_set_nextUpdate(crl, tmptm);    
+
+               ASN1_TIME_free(tmptm);
 
                for (i=0; i<sk_num(db->data); i++)
                        {
 
                for (i=0; i<sk_num(db->data); i++)
                        {
@@ -1419,23 +1468,22 @@ bad:
                                j = make_revoked(r, pp[DB_rev_date]);
                                if (!j) goto err;
                                if (j == 2) crl_v2 = 1;
                                j = make_revoked(r, pp[DB_rev_date]);
                                if (!j) goto err;
                                if (j == 2) crl_v2 = 1;
-                               (void)BIO_reset(hex);
-                               if (!BIO_puts(hex,pp[DB_serial]))
+                               if (!BN_hex2bn(&serial, pp[DB_serial]))
                                        goto err;
                                        goto err;
-                               if (!a2i_ASN1_INTEGER(hex,r->serialNumber,
-                                       buf[0],BSIZE)) goto err;
-
+                               tmpser = BN_to_ASN1_INTEGER(serial, NULL);
+                               BN_free(serial);
+                               serial = NULL;
+                               if (!tmpser)
+                                       goto err;
+                               X509_REVOKED_set_serialNumber(r, tmpser);
+                               ASN1_INTEGER_free(tmpser);
                                X509_CRL_add0_revoked(crl,r);
                                }
                        }
                                X509_CRL_add0_revoked(crl,r);
                                }
                        }
+
                /* sort the data so it will be written in serial
                 * number order */
                /* sort the data so it will be written in serial
                 * number order */
-               sk_X509_REVOKED_sort(ci->revoked);
-               for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)
-                       {
-                       r=sk_X509_REVOKED_value(ci->revoked,i);
-                       r->sequence=i;
-                       }
+               X509_CRL_sort(crl);
 
                /* we now have a CRL */
                if (verbose) BIO_printf(bio_err,"signing CRL\n");
 
                /* we now have a CRL */
                if (verbose) BIO_printf(bio_err,"signing CRL\n");
@@ -1449,7 +1497,7 @@ bad:
                        }
                else
                        {
                        }
                else
                        {
-#ifndef NO_DSA
+#ifndef OPENSSL_NO_DSA
                        if (pkey->type == EVP_PKEY_DSA) 
                                dgst=EVP_dss1();
                        else
                        if (pkey->type == EVP_PKEY_DSA) 
                                dgst=EVP_dss1();
                        else
@@ -1462,19 +1510,16 @@ bad:
                if (crl_ext)
                        {
                        X509V3_CTX crlctx;
                if (crl_ext)
                        {
                        X509V3_CTX crlctx;
-                       if (ci->version == NULL)
-                               if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
                        X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
                        X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
-                       X509V3_set_conf_lhash(&crlctx, conf);
+                       X509V3_set_nconf(&crlctx, conf);
 
 
-                       if (!X509V3_EXT_CRL_add_conf(conf, &crlctx,
+                       if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
                                crl_ext, crl)) goto err;
                        }
                if (crl_ext || crl_v2)
                        {
                                crl_ext, crl)) goto err;
                        }
                if (crl_ext || crl_v2)
                        {
-                       if (ci->version == NULL)
-                               if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;
-                       ASN1_INTEGER_set(ci->version,1); /* version 2 CRL */
+                       if (!X509_CRL_set_version(crl, 1))
+                               goto err; /* version 2 CRL */
                        }
 
                if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
                        }
 
                if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
@@ -1492,24 +1537,20 @@ bad:
                else
                        {
                        X509 *revcert;
                else
                        {
                        X509 *revcert;
-                       if (BIO_read_filename(in,infile) <= 0)
-                               {
-                               perror(infile);
-                               BIO_printf(bio_err,"error trying to load '%s' certificate\n",infile);
-                               goto err;
-                               }
-                       revcert=PEM_read_bio_X509(in,NULL,NULL,NULL);
+                       revcert=load_cert(bio_err, infile, FORMAT_PEM,
+                               NULL, e, infile);
                        if (revcert == NULL)
                        if (revcert == NULL)
-                               {
-                               BIO_printf(bio_err,"unable to load '%s' certificate\n",infile);
                                goto err;
                                goto err;
-                               }
                        j=do_revoke(revcert,db, rev_type, rev_arg);
                        if (j <= 0) goto err;
                        X509_free(revcert);
 
                        strncpy(buf[0],dbfile,BSIZE-4);
                        j=do_revoke(revcert,db, rev_type, rev_arg);
                        if (j <= 0) goto err;
                        X509_free(revcert);
 
                        strncpy(buf[0],dbfile,BSIZE-4);
+#ifndef OPENSSL_SYS_VMS
                        strcat(buf[0],".new");
                        strcat(buf[0],".new");
+#else
+                       strcat(buf[0],"-new");
+#endif
                        if (BIO_write_filename(out,buf[0]) <= 0)
                                {
                                perror(dbfile);
                        if (BIO_write_filename(out,buf[0]) <= 0)
                                {
                                perror(dbfile);
@@ -1519,7 +1560,11 @@ bad:
                        j=TXT_DB_write(out,db);
                        if (j <= 0) goto err;
                        strncpy(buf[1],dbfile,BSIZE-4);
                        j=TXT_DB_write(out,db);
                        if (j <= 0) goto err;
                        strncpy(buf[1],dbfile,BSIZE-4);
+#ifndef OPENSSL_SYS_VMS
                        strcat(buf[1],".old");
                        strcat(buf[1],".old");
+#else
+                       strcat(buf[1],"-old");
+#endif
                        if (rename(dbfile,buf[1]) < 0)
                                {
                                BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
                        if (rename(dbfile,buf[1]) < 0)
                                {
                                BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
@@ -1539,23 +1584,25 @@ bad:
        /*****************************************************************/
        ret=0;
 err:
        /*****************************************************************/
        ret=0;
 err:
-       BIO_free(hex);
        BIO_free_all(Cout);
        BIO_free_all(Sout);
        BIO_free_all(out);
        BIO_free_all(Cout);
        BIO_free_all(Sout);
        BIO_free_all(out);
-       BIO_free(in);
+       BIO_free_all(in);
 
        sk_X509_pop_free(cert_sk,X509_free);
 
        if (ret) ERR_print_errors(bio_err);
        app_RAND_write_file(randfile, bio_err);
 
        sk_X509_pop_free(cert_sk,X509_free);
 
        if (ret) ERR_print_errors(bio_err);
        app_RAND_write_file(randfile, bio_err);
+       if (free_key)
+               OPENSSL_free(key);
        BN_free(serial);
        TXT_DB_free(db);
        EVP_PKEY_free(pkey);
        X509_free(x509);
        X509_CRL_free(crl);
        BN_free(serial);
        TXT_DB_free(db);
        EVP_PKEY_free(pkey);
        X509_free(x509);
        X509_CRL_free(crl);
-       CONF_free(conf);
+       NCONF_free(conf);
        OBJ_cleanup();
        OBJ_cleanup();
+       apps_shutdown();
        EXIT(ret);
        }
 
        EXIT(ret);
        }
 
@@ -1664,8 +1711,10 @@ err:
 
 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
 
 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
-            BIGNUM *serial, char *startdate, char *enddate, int days,
-            int batch, char *ext_sect, LHASH *lconf, int verbose)
+            BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+            long days, int batch, char *ext_sect, CONF *lconf, int verbose,
+            unsigned long certopt, unsigned long nameopt, int default_op,
+            int ext_copy)
        {
        X509_REQ *req=NULL;
        BIO *in=NULL;
        {
        X509_REQ *req=NULL;
        BIO *in=NULL;
@@ -1712,8 +1761,9 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
        else
                BIO_printf(bio_err,"Signature ok\n");
 
        else
                BIO_printf(bio_err,"Signature ok\n");
 
-       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate, enddate,
-               days,batch,verbose,req,ext_sect,lconf);
+       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
+               startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
+               certopt, nameopt, default_op, ext_copy);
 
 err:
        if (req != NULL) X509_REQ_free(req);
 
 err:
        if (req != NULL) X509_REQ_free(req);
@@ -1723,27 +1773,18 @@ err:
 
 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
 
 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
-            BIGNUM *serial, char *startdate, char *enddate, int days,
-            int batch, char *ext_sect, LHASH *lconf, int verbose)
+            BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+            long days, int batch, char *ext_sect, CONF *lconf, int verbose,
+            unsigned long certopt, unsigned long nameopt, int default_op,
+            int ext_copy, ENGINE *e)
        {
        X509 *req=NULL;
        X509_REQ *rreq=NULL;
        {
        X509 *req=NULL;
        X509_REQ *rreq=NULL;
-       BIO *in=NULL;
        EVP_PKEY *pktmp=NULL;
        int ok= -1,i;
 
        EVP_PKEY *pktmp=NULL;
        int ok= -1,i;
 
-       in=BIO_new(BIO_s_file());
-
-       if (BIO_read_filename(in,infile) <= 0)
-               {
-               perror(infile);
+       if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
                goto err;
                goto err;
-               }
-       if ((req=PEM_read_bio_X509(in,NULL,NULL,NULL)) == NULL)
-               {
-               BIO_printf(bio_err,"Error reading self signed certificate in %s\n",infile);
-               goto err;
-               }
        if (verbose)
                X509_print(bio_err,req);
 
        if (verbose)
                X509_print(bio_err,req);
 
@@ -1774,22 +1815,24 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
        if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
                goto err;
 
        if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
                goto err;
 
-       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,days,
-               batch,verbose,rreq,ext_sect,lconf);
+       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
+               days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
+               ext_copy);
 
 err:
        if (rreq != NULL) X509_REQ_free(rreq);
        if (req != NULL) X509_free(req);
 
 err:
        if (rreq != NULL) X509_REQ_free(rreq);
        if (req != NULL) X509_free(req);
-       if (in != NULL) BIO_free(in);
        return(ok);
        }
 
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
        return(ok);
        }
 
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
-            STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial,
-            char *startdate, char *enddate, int days, int batch, int verbose,
-            X509_REQ *req, char *ext_sect, LHASH *lconf)
+            STACK_OF(CONF_VALUE) *policy, TXT_DB *db, BIGNUM *serial, char *subj,
+            int email_dn, char *startdate, char *enddate, long days, int batch,
+            int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
+            unsigned long certopt, unsigned long nameopt, int default_op,
+            int ext_copy)
        {
        {
-       X509_NAME *name=NULL,*CAname=NULL,*subject=NULL;
+       X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
        ASN1_UTCTIME *tm,*tmptm;
        ASN1_STRING *str,*str2;
        ASN1_OBJECT *obj;
        ASN1_UTCTIME *tm,*tmptm;
        ASN1_STRING *str,*str2;
        ASN1_OBJECT *obj;
@@ -1802,7 +1845,7 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
        char *p;
        CONF_VALUE *cv;
        char *row[DB_NUMBER],**rrow,**irow=NULL;
        char *p;
        CONF_VALUE *cv;
        char *row[DB_NUMBER],**rrow,**irow=NULL;
-       char buf[25],*pbuf;
+       char buf[25];
 
        tmptm=ASN1_UTCTIME_new();
        if (tmptm == NULL)
 
        tmptm=ASN1_UTCTIME_new();
        if (tmptm == NULL)
@@ -1814,20 +1857,29 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
        for (i=0; i<DB_NUMBER; i++)
                row[i]=NULL;
 
        for (i=0; i<DB_NUMBER; i++)
                row[i]=NULL;
 
-       BIO_printf(bio_err,"The Subjects Distinguished Name is as follows\n");
+       if (subj)
+               {
+               X509_NAME *n = do_subject(subj);
+
+               if (!n)
+                       {
+                       ERR_print_errors(bio_err);
+                       goto err;
+                       }
+               X509_REQ_set_subject_name(req,n);
+               req->req_info->enc.modified = 1;
+               X509_NAME_free(n);
+               }
+
+       if (default_op)
+               BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
+
        name=X509_REQ_get_subject_name(req);
        for (i=0; i<X509_NAME_entry_count(name); i++)
                {
        name=X509_REQ_get_subject_name(req);
        for (i=0; i<X509_NAME_entry_count(name); i++)
                {
-               ne=(X509_NAME_ENTRY *)X509_NAME_get_entry(name,i);
-               obj=X509_NAME_ENTRY_get_object(ne);
-               j=i2a_ASN1_OBJECT(bio_err,obj);
+               ne= X509_NAME_get_entry(name,i);
                str=X509_NAME_ENTRY_get_data(ne);
                str=X509_NAME_ENTRY_get_data(ne);
-               pbuf=buf;
-               for (j=22-j; j>0; j--)
-                       *(pbuf++)=' ';
-               *(pbuf++)=':';
-               *(pbuf++)='\0';
-               BIO_puts(bio_err,buf);
+               obj=X509_NAME_ENTRY_get_object(ne);
 
                if (msie_hack)
                        {
 
                if (msie_hack)
                        {
@@ -1846,16 +1898,9 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
                                str->type=V_ASN1_IA5STRING;
                        }
 
                                str->type=V_ASN1_IA5STRING;
                        }
 
-               if (str->type == V_ASN1_PRINTABLESTRING)
-                       BIO_printf(bio_err,"PRINTABLE:'");
-               else if (str->type == V_ASN1_T61STRING)
-                       BIO_printf(bio_err,"T61STRING:'");
-               else if (str->type == V_ASN1_IA5STRING)
-                       BIO_printf(bio_err,"IA5STRING:'");
-               else if (str->type == V_ASN1_UNIVERSALSTRING)
-                       BIO_printf(bio_err,"UNIVERSALSTRING:'");
-               else
-                       BIO_printf(bio_err,"ASN.1 %2d:'",str->type);
+               /* If no EMAIL is wanted in the subject */
+               if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
+                       continue;
 
                /* check some things */
                if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
 
                /* check some things */
                if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
@@ -1864,29 +1909,21 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
                        BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
                        goto err;
                        }
                        BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
                        goto err;
                        }
-               j=ASN1_PRINTABLE_type(str->data,str->length);
-               if (    ((j == V_ASN1_T61STRING) &&
-                        (str->type != V_ASN1_T61STRING)) ||
-                       ((j == V_ASN1_IA5STRING) &&
-                        (str->type == V_ASN1_PRINTABLESTRING)))
+               if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
                        {
                        {
-                       BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
-                       goto err;
-                       }
-                       
-               p=(char *)str->data;
-               for (j=str->length; j>0; j--)
-                       {
-                       if ((*p >= ' ') && (*p <= '~'))
-                               BIO_printf(bio_err,"%c",*p);
-                       else if (*p & 0x80)
-                               BIO_printf(bio_err,"\\0x%02X",*p);
-                       else if ((unsigned char)*p == 0xf7)
-                               BIO_printf(bio_err,"^?");
-                       else    BIO_printf(bio_err,"^%c",*p+'@');
-                       p++;
+                       j=ASN1_PRINTABLE_type(str->data,str->length);
+                       if (    ((j == V_ASN1_T61STRING) &&
+                                (str->type != V_ASN1_T61STRING)) ||
+                               ((j == V_ASN1_IA5STRING) &&
+                                (str->type == V_ASN1_PRINTABLESTRING)))
+                               {
+                               BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
+                               goto err;
+                               }
                        }
                        }
-               BIO_printf(bio_err,"'\n");
+
+               if (default_op)
+                       old_entry_print(bio_err, obj, str);
                }
 
        /* Ok, now we check the 'policy' stuff. */
                }
 
        /* Ok, now we check the 'policy' stuff. */
@@ -2001,14 +2038,40 @@ again2:
        if (preserve)
                {
                X509_NAME_free(subject);
        if (preserve)
                {
                X509_NAME_free(subject);
-               subject=X509_NAME_dup(X509_REQ_get_subject_name(req));
+               /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
+               subject=X509_NAME_dup(name);
                if (subject == NULL) goto err;
                }
 
        if (verbose)
                BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
 
                if (subject == NULL) goto err;
                }
 
        if (verbose)
                BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
 
-       row[DB_name]=X509_NAME_oneline(subject,NULL,0);
+       /* Build the correct Subject if no e-mail is wanted in the subject */
+       /* and add it later on because of the method extensions are added (altName) */
+        
+       if (email_dn)
+               dn_subject = subject;
+       else
+               {
+               X509_NAME_ENTRY *tmpne;
+               /* Its best to dup the subject DN and then delete any email
+                * addresses because this retains its structure.
+                */
+               if (!(dn_subject = X509_NAME_dup(subject)))
+                       {
+                       BIO_printf(bio_err,"Memory allocation failure\n");
+                       goto err;
+                       }
+               while((i = X509_NAME_get_index_by_NID(dn_subject,
+                                       NID_pkcs9_emailAddress, -1) >= 0))
+                       {
+                       tmpne = X509_NAME_get_entry(dn_subject, i);
+                       X509_NAME_delete_entry(dn_subject, i);
+                       X509_NAME_ENTRY_free(tmpne);
+                       }
+               }
+
+       row[DB_name]=X509_NAME_oneline(dn_subject,NULL,0);
        row[DB_serial]=BN_bn2hex(serial);
        if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
                {
        row[DB_serial]=BN_bn2hex(serial);
        if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
                {
@@ -2080,7 +2143,6 @@ again2:
        if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
                goto err;
 
        if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
                goto err;
 
-       BIO_printf(bio_err,"Certificate is to be certified until ");
        if (strcmp(startdate,"today") == 0)
                X509_gmtime_adj(X509_get_notBefore(ret),0);
        else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
        if (strcmp(startdate,"today") == 0)
                X509_gmtime_adj(X509_get_notBefore(ret),0);
        else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
@@ -2089,10 +2151,6 @@ again2:
                X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
        else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
 
                X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
        else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
 
-       ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
-       if (days) BIO_printf(bio_err," (%d days)",days);
-       BIO_printf(bio_err, "\n");
-
        if (!X509_set_subject_name(ret,subject)) goto err;
 
        pktmp=X509_REQ_get_pubkey(req);
        if (!X509_set_subject_name(ret,subject)) goto err;
 
        pktmp=X509_REQ_get_pubkey(req);
@@ -2126,13 +2184,13 @@ again2:
                                BIO_printf(bio_err, "Extra configuration file found\n");
  
                        /* Use the extconf configuration db LHASH */
                                BIO_printf(bio_err, "Extra configuration file found\n");
  
                        /* Use the extconf configuration db LHASH */
-                       X509V3_set_conf_lhash(&ctx, extconf);
+                       X509V3_set_nconf(&ctx, extconf);
  
                        /* Test the structure (needed?) */
                        /* X509V3_set_ctx_test(&ctx); */
 
                        /* Adds exts contained in the configuration file */
  
                        /* Test the structure (needed?) */
                        /* X509V3_set_ctx_test(&ctx); */
 
                        /* Adds exts contained in the configuration file */
-                       if (!X509V3_EXT_add_conf(extconf, &ctx, ext_sect,ret))
+                       if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
                                {
                                BIO_printf(bio_err,
                                    "ERROR: adding extensions in section %s\n",
                                {
                                BIO_printf(bio_err,
                                    "ERROR: adding extensions in section %s\n",
@@ -2146,9 +2204,9 @@ again2:
                else if (ext_sect)
                        {
                        /* We found extensions to be set from config file */
                else if (ext_sect)
                        {
                        /* We found extensions to be set from config file */
-                       X509V3_set_conf_lhash(&ctx, lconf);
+                       X509V3_set_nconf(&ctx, lconf);
 
 
-                       if(!X509V3_EXT_add_conf(lconf, &ctx, ext_sect, ret))
+                       if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
                                {
                                BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
                                ERR_print_errors(bio_err);
                                {
                                BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
                                ERR_print_errors(bio_err);
@@ -2160,9 +2218,37 @@ again2:
                        }
                }
 
                        }
                }
 
+       /* Copy extensions from request (if any) */
+
+       if (!copy_extensions(ret, req, ext_copy))
+               {
+               BIO_printf(bio_err, "ERROR: adding extensions from request\n");
+               ERR_print_errors(bio_err);
+               goto err;
+               }
+
+       /* Set the right value for the noemailDN option */
+       if( email_dn == 0 )
+               {
+               if (!X509_set_subject_name(ret,dn_subject)) goto err;
+               }
+
+       if (!default_op)
+               {
+               BIO_printf(bio_err, "Certificate Details:\n");
+               /* Never print signature details because signature not present */
+               certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
+               X509_print_ex(bio_err, ret, nameopt, certopt); 
+               }
+
+       BIO_printf(bio_err,"Certificate is to be certified until ");
+       ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
+       if (days) BIO_printf(bio_err," (%d days)",days);
+       BIO_printf(bio_err, "\n");
 
        if (!batch)
                {
 
        if (!batch)
                {
+
                BIO_printf(bio_err,"Sign the certificate? [y/n]:");
                (void)BIO_flush(bio_err);
                buf[0]='\0';
                BIO_printf(bio_err,"Sign the certificate? [y/n]:");
                (void)BIO_flush(bio_err);
                buf[0]='\0';
@@ -2176,7 +2262,7 @@ again2:
                }
 
 
                }
 
 
-#ifndef NO_DSA
+#ifndef OPENSSL_NO_DSA
        if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
        pktmp=X509_get_pubkey(ret);
        if (EVP_PKEY_missing_parameters(pktmp) &&
        if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
        pktmp=X509_get_pubkey(ret);
        if (EVP_PKEY_missing_parameters(pktmp) &&
@@ -2240,6 +2326,8 @@ err:
                X509_NAME_free(CAname);
        if (subject != NULL)
                X509_NAME_free(subject);
                X509_NAME_free(CAname);
        if (subject != NULL)
                X509_NAME_free(subject);
+       if ((dn_subject != NULL) && !email_dn)
+               X509_NAME_free(dn_subject);
        if (tmptm != NULL)
                ASN1_UTCTIME_free(tmptm);
        if (ok <= 0)
        if (tmptm != NULL)
                ASN1_UTCTIME_free(tmptm);
        if (ok <= 0)
@@ -2278,8 +2366,9 @@ static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
 
 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
 
 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
             const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, TXT_DB *db,
-            BIGNUM *serial, char *startdate, char *enddate, int days,
-            char *ext_sect, LHASH *lconf, int verbose)
+            BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
+            long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
+            unsigned long nameopt, int default_op, int ext_copy)
        {
        STACK_OF(CONF_VALUE) *sk=NULL;
        LHASH *parms=NULL;
        {
        STACK_OF(CONF_VALUE) *sk=NULL;
        LHASH *parms=NULL;
@@ -2369,6 +2458,11 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
                        continue;
                        }
 
                        continue;
                        }
 
+               /*
+               if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
+                       continue;
+               */
+               
                j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
                if (fix_data(nid, &j) == 0)
                        {
                j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
                if (fix_data(nid, &j) == 0)
                        {
@@ -2413,8 +2507,9 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
 
        X509_REQ_set_pubkey(req,pktmp);
        EVP_PKEY_free(pktmp);
 
        X509_REQ_set_pubkey(req,pktmp);
        EVP_PKEY_free(pktmp);
-       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,startdate,enddate,
-                  days,1,verbose,req,ext_sect,lconf);
+       ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
+                  days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
+                       ext_copy);
 err:
        if (req != NULL) X509_REQ_free(req);
        if (parms != NULL) CONF_free(parms);
 err:
        if (req != NULL) X509_REQ_free(req);
        if (parms != NULL) CONF_free(parms);
@@ -2843,15 +2938,168 @@ char *make_revocation_str(int rev_type, char *rev_arg)
  * 2 OK and some extensions added (i.e. V2 CRL)
  */
 
  * 2 OK and some extensions added (i.e. V2 CRL)
  */
 
+
 int make_revoked(X509_REVOKED *rev, char *str)
        {
        char *tmp = NULL;
 int make_revoked(X509_REVOKED *rev, char *str)
        {
        char *tmp = NULL;
-       char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
        int reason_code = -1;
        int i, ret = 0;
        ASN1_OBJECT *hold = NULL;
        ASN1_GENERALIZEDTIME *comp_time = NULL;
        ASN1_ENUMERATED *rtmp = NULL;
        int reason_code = -1;
        int i, ret = 0;
        ASN1_OBJECT *hold = NULL;
        ASN1_GENERALIZEDTIME *comp_time = NULL;
        ASN1_ENUMERATED *rtmp = NULL;
+
+       ASN1_TIME *revDate = NULL;
+
+       i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
+
+       if (i == 0)
+               goto err;
+
+       if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
+               goto err;
+
+       if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
+               {
+               rtmp = ASN1_ENUMERATED_new();
+               if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
+                       goto err;
+               if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
+                       goto err;
+               }
+
+       if (rev && comp_time)
+               {
+               if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
+                       goto err;
+               }
+       if (rev && hold)
+               {
+               if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
+                       goto err;
+               }
+
+       if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
+               ret = 2;
+       else ret = 1;
+
+       err:
+
+       if (tmp) OPENSSL_free(tmp);
+       ASN1_OBJECT_free(hold);
+       ASN1_GENERALIZEDTIME_free(comp_time);
+       ASN1_ENUMERATED_free(rtmp);
+       ASN1_TIME_free(revDate);
+
+       return ret;
+       }
+
+static X509_NAME *do_subject(char *subject)
+       {
+       X509_NAME *n = NULL;
+
+       int i, nid, ne_num=0;
+
+       char *ne_name = NULL;
+       char *ne_value = NULL;
+
+       char *tmp = NULL;
+       char *p[2];
+
+       char *str_list[256];
+       
+       p[0] = ",/";
+       p[1] = "=";
+
+       n = X509_NAME_new();
+
+       tmp = strtok(subject, p[0]);
+       while((tmp != NULL) && (ne_num < (sizeof str_list/sizeof *str_list)))
+               {
+               char *token = tmp;
+
+               while (token[0] == ' ')
+                       token++;
+               str_list[ne_num] = token;
+
+               tmp = strtok(NULL, p[0]);
+               ne_num++;
+               }
+
+       for (i = 0; i < ne_num; i++)
+               {
+               ne_name  = strtok(str_list[i], p[1]);
+               ne_value = strtok(NULL, p[1]);
+
+               if ((nid=OBJ_txt2nid(ne_name)) == NID_undef)
+                       {
+                       BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_name);
+                       continue;
+                       }
+
+               if (ne_value == NULL)
+                       {
+                       BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_name);
+                       continue;
+                       }
+
+               if (!X509_NAME_add_entry_by_NID(n, nid, MBSTRING_ASC, (unsigned char*)ne_value, -1,-1,0))
+                       {
+                       X509_NAME_free(n);
+                       return NULL;
+                       }
+               }
+
+       return n;
+       }
+
+
+int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
+       {
+       char buf[25],*pbuf, *p;
+       int j;
+       j=i2a_ASN1_OBJECT(bp,obj);
+       pbuf=buf;
+       for (j=22-j; j>0; j--)
+               *(pbuf++)=' ';
+       *(pbuf++)=':';
+       *(pbuf++)='\0';
+       BIO_puts(bp,buf);
+
+       if (str->type == V_ASN1_PRINTABLESTRING)
+               BIO_printf(bp,"PRINTABLE:'");
+       else if (str->type == V_ASN1_T61STRING)
+               BIO_printf(bp,"T61STRING:'");
+       else if (str->type == V_ASN1_IA5STRING)
+               BIO_printf(bp,"IA5STRING:'");
+       else if (str->type == V_ASN1_UNIVERSALSTRING)
+               BIO_printf(bp,"UNIVERSALSTRING:'");
+       else
+               BIO_printf(bp,"ASN.1 %2d:'",str->type);
+                       
+       p=(char *)str->data;
+       for (j=str->length; j>0; j--)
+               {
+               if ((*p >= ' ') && (*p <= '~'))
+                       BIO_printf(bp,"%c",*p);
+               else if (*p & 0x80)
+                       BIO_printf(bp,"\\0x%02X",*p);
+               else if ((unsigned char)*p == 0xf7)
+                       BIO_printf(bp,"^?");
+               else    BIO_printf(bp,"^%c",*p+'@');
+               p++;
+               }
+       BIO_printf(bp,"'\n");
+       return 1;
+       }
+
+int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
+       {
+       char *tmp = NULL;
+       char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
+       int reason_code = -1;
+       int i, ret = 0;
+       ASN1_OBJECT *hold = NULL;
+       ASN1_GENERALIZEDTIME *comp_time = NULL;
        tmp = BUF_strdup(str);
 
        p = strchr(tmp, ',');
        tmp = BUF_strdup(str);
 
        p = strchr(tmp, ',');
@@ -2871,10 +3119,14 @@ int make_revoked(X509_REVOKED *rev, char *str)
                        }
                }
 
                        }
                }
 
-       if (rev && !ASN1_UTCTIME_set_string(rev->revocationDate, rtime_str))
+       if (prevtm)
                {
                {
-               BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
-               goto err;
+               *prevtm = ASN1_UTCTIME_new();
+               if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
+                       {
+                       BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
+                       goto err;
+                       }
                }
        if (reason_str)
                {
                }
        if (reason_str)
                {
@@ -2909,6 +3161,7 @@ int make_revoked(X509_REVOKED *rev, char *str)
                                BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
                                goto err;
                                }
                                BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
                                goto err;
                                }
+                       if (phold) *phold = hold;
                        }
                else if ((reason_code == 9) || (reason_code == 10))
                        {
                        }
                else if ((reason_code == 9) || (reason_code == 10))
                        {
@@ -2930,36 +3183,31 @@ int make_revoked(X509_REVOKED *rev, char *str)
                        }
                }
 
                        }
                }
 
-       if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
-               {
-               rtmp = ASN1_ENUMERATED_new();
-               if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
-                       goto err;
-               if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
-                       goto err;
-               }
+       if (preason) *preason = reason_code;
+       if (pinvtm) *pinvtm = comp_time;
+       else ASN1_GENERALIZEDTIME_free(comp_time);
 
 
-       if (rev && comp_time)
-               {
-               if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
-                       goto err;
-               }
-       if (rev && hold)
-               {
-               if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
-                       goto err;
-               }
-
-       if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
-               ret = 2;
-       else ret = 1;
+       ret = 1;
 
        err:
 
        if (tmp) OPENSSL_free(tmp);
 
        err:
 
        if (tmp) OPENSSL_free(tmp);
-       ASN1_OBJECT_free(hold);
-       ASN1_GENERALIZEDTIME_free(comp_time);
-       ASN1_ENUMERATED_free(rtmp);
+       if (!phold) ASN1_OBJECT_free(hold);
+       if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
 
        return ret;
        }
 
        return ret;
        }
+
+int make_serial_index(TXT_DB *db)
+       {
+       if (!TXT_DB_create_index(db, DB_serial, NULL,
+                               LHASH_HASH_FN(index_serial_hash),
+                               LHASH_COMP_FN(index_serial_cmp)))
+               {
+               BIO_printf(bio_err,
+                 "error creating serial number index:(%ld,%ld,%ld)\n",
+                                       db->error,db->arg1,db->arg2);
+                       return 0;
+               }
+       return 1;
+       }