&& opt_csr == NULL && opt_oldcert == NULL && opt_cert == NULL
&& opt_cmd != CMP_RR && opt_cmd != CMP_GENM)
CMP_warn("no -subject given; no -csr or -oldcert or -cert available for fallback");
- if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject")
- || !set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
+
+ if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
+ if (opt_newkey == NULL && opt_key == NULL && opt_csr == NULL) {
+ CMP_err("missing -newkey (or -key) to be certified and no -csr given");
+ return 0;
+ }
+ if (opt_certout == NULL) {
+ CMP_err("-certout not given, nowhere to save newly enrolled certificate");
+ return 0;
+ }
+ if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject")
+ || !set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
+ return 0;
+ } else {
+ const char *msg = "option is ignored for commands other than 'ir', 'cr', and 'kur'";
+
+ if (opt_subject != NULL) {
+ if (opt_ref == NULL && opt_cert == NULL) {
+ /* use subject as default sender unless oldcert subject is used */
+ if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject"))
+ return 0;
+ } else {
+ CMP_warn1("-subject %s since -ref or -cert is given", msg);
+ }
+ }
+ if (opt_issuer != NULL)
+ CMP_warn1("-issuer %s", msg);
+ if (opt_reqexts != NULL)
+ CMP_warn1("-reqexts %s", msg);
+ if (opt_san_nodefault)
+ CMP_warn1("-san_nodefault %s", msg);
+ if (opt_sans != NULL)
+ CMP_warn1("-sans %s", msg);
+ if (opt_policies != NULL)
+ CMP_warn1("-policies %s", msg);
+ if (opt_policy_oids != NULL)
+ CMP_warn1("-policy_oids %s", msg);
+ }
+ if (opt_cmd == CMP_KUR) {
+ char *ref_cert = opt_oldcert != NULL ? opt_oldcert : opt_cert;
+
+ if (ref_cert == NULL && opt_csr == NULL) {
+ CMP_err("missing -oldcert for certificate to be updated and no -csr given");
+ return 0;
+ }
+ if (opt_subject != NULL)
+ CMP_warn2("given -subject '%s' overrides the subject of '%s' for KUR",
+ opt_subject, ref_cert != NULL ? ref_cert : opt_csr);
+ }
+ if (opt_cmd == CMP_RR) {
+ if (opt_oldcert == NULL && opt_csr == NULL) {
+ CMP_err("missing -oldcert for certificate to be revoked and no -csr given");
+ return 0;
+ }
+ if (opt_oldcert != NULL && opt_csr != NULL)
+ CMP_warn("ignoring -csr since certificate to be revoked is given");
+ }
+ if (opt_cmd == CMP_P10CR && opt_csr == NULL) {
+ CMP_err("missing PKCS#10 CSR for p10cr");
return 0;
+ }
- if (opt_newkey != NULL) {
+ if (opt_recipient == NULL && opt_srvcert == NULL && opt_issuer == NULL
+ && opt_oldcert == NULL && opt_cert == NULL)
+ CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\"");
+
+ if (opt_cmd == CMP_P10CR || opt_cmd == CMP_RR) {
+ const char *msg = "option is ignored for 'p10cr' and 'rr' commands";
+
+ if (opt_newkeypass != NULL)
+ CMP_warn1("-newkeytype %s", msg);
+ if (opt_newkey != NULL)
+ CMP_warn1("-newkey %s", msg);
+ if (opt_days != 0)
+ CMP_warn1("-days %s", msg);
+ if (opt_popo != OSSL_CRMF_POPO_NONE - 1)
+ CMP_warn1("-popo %s", msg);
+ } else if (opt_newkey != NULL) {
const char *file = opt_newkey;
const int format = opt_keyform;
const char *pass = opt_newkeypass;
if (!transform_opts())
goto err;
- if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
- if (opt_newkey == NULL && opt_key == NULL && opt_csr == NULL) {
- CMP_err("missing -newkey (or -key) to be certified");
- goto err;
- }
- if (opt_certout == NULL) {
- CMP_err("-certout not given, nowhere to save certificate");
- goto err;
- }
- }
- if (opt_cmd == CMP_KUR) {
- char *ref_cert = opt_oldcert != NULL ? opt_oldcert : opt_cert;
-
- if (ref_cert == NULL && opt_csr == NULL) {
- CMP_err("missing -oldcert for certificate to be updated and no fallback -csr given");
- goto err;
- }
- if (opt_subject != NULL)
- CMP_warn2("given -subject '%s' overrides the subject of '%s' for KUR",
- opt_subject, ref_cert != NULL ? ref_cert : opt_csr);
- }
- if (opt_cmd == CMP_RR) {
- if (opt_oldcert == NULL && opt_csr == NULL) {
- CMP_err("missing -oldcert for certificate to be revoked and no fallback -csr given");
- goto err;
- }
- if (opt_oldcert != NULL && opt_csr != NULL)
- CMP_warn("ignoring -csr since certificate to be revoked is given");
- }
- if (opt_cmd == CMP_P10CR && opt_csr == NULL) {
- CMP_err("missing PKCS#10 CSR for p10cr");
- goto err;
- }
-
- if (opt_recipient == NULL && opt_srvcert == NULL && opt_issuer == NULL
- && opt_oldcert == NULL && opt_cert == NULL)
- CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\"");
-
if (opt_infotype_s != NULL) {
char id_buf[100] = "id-it-";
return hdr->recipNonce;
}
+/* a NULL-DN as an empty sequence of RDNs */
int ossl_cmp_general_name_is_NULL_DN(GENERAL_NAME *name)
{
- X509_NAME *null = X509_NAME_new();
- int res = name == NULL || null == NULL
- || (name->type == GEN_DIRNAME
- && X509_NAME_cmp(name->d.directoryName, null) == 0);
-
- X509_NAME_free(null);
- return res;
+ return name == NULL
+ || (name->type == GEN_DIRNAME && IS_NULL_DN(name->d.directoryName));
}
/* assign to *tgt a copy of src (which may be NULL to indicate an empty DN) */
*/
int ossl_cmp_hdr_set_transactionID(OSSL_CMP_CTX *ctx, OSSL_CMP_PKIHEADER *hdr)
{
+ if (ctx->transactionID == NULL) {
+ char *tid;
+
+ if (!set_random(&ctx->transactionID, ctx,
+ OSSL_CMP_TRANSACTIONID_LENGTH))
+ return 0;
+ tid = OPENSSL_buf2hexstr(ctx->transactionID->data,
+ ctx->transactionID->length);
+ if (tid != NULL)
+ ossl_cmp_log1(DEBUG, ctx,
+ "Starting new transaction with ID=%s", tid);
+ OPENSSL_free(tid);
+ }
+
if (ctx->transactionID == NULL
&& !set_random(&ctx->transactionID, ctx, OSSL_CMP_TRANSACTIONID_LENGTH))
return 0;