apps/ca.c

   1 /* apps/ca.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58
  59 /* The PPKI stuff has been donated by Jeff Barber <jeffb@issl.atl.hp.com> */
  60
  61 #include <stdio.h>
  62 #include <stdlib.h>
  63 #include <string.h>
  64 #include <ctype.h>
  65 #include <sys/types.h>
  66 #include <sys/stat.h>
  67 #include <openssl/conf.h>
  68 #include <openssl/bio.h>
  69 #include <openssl/err.h>
  70 #include <openssl/bn.h>
  71 #include <openssl/txt_db.h>
  72 #include <openssl/evp.h>
  73 #include <openssl/x509.h>
  74 #include <openssl/x509v3.h>
  75 #include <openssl/objects.h>
  76 #include <openssl/ocsp.h>
  77 #include <openssl/pem.h>
  78
  79 #ifdef OPENSSL_SYS_WINDOWS
  80 #define strcasecmp _stricmp
  81 #else
  82 #  ifdef NO_STRINGS_H
  83     int strcasecmp();
  84 #  else
  85 #    include <strings.h>
  86 #  endif /* NO_STRINGS_H */
  87 #endif
  88
  89 #ifndef W_OK
  90 #  ifdef OPENSSL_SYS_VMS
  91 #    if defined(__DECC)
  92 #      include <unistd.h>
  93 #    else
  94 #      include <unixlib.h>
  95 #    endif
  96 #  elif !defined(OPENSSL_SYS_VXWORKS) && !defined(OPENSSL_SYS_WINDOWS)
  97 #    include <sys/file.h>
  98 #  endif
  99 #endif
 100
 101 #include "apps.h"
 102
 103 #ifndef W_OK
 104 #  define F_OK 0
 105 #  define X_OK 1
 106 #  define W_OK 2
 107 #  define R_OK 4
 108 #endif
 109
 110 #undef PROG
 111 #define PROG ca_main
 112
 113 #define BASE_SECTION    "ca"
 114 #define CONFIG_FILE "openssl.cnf"
 115
 116 #define ENV_DEFAULT_CA          "default_ca"
 117
 118 #define ENV_DIR                 "dir"
 119 #define ENV_CERTS               "certs"
 120 #define ENV_CRL_DIR             "crl_dir"
 121 #define ENV_CA_DB               "CA_DB"
 122 #define ENV_NEW_CERTS_DIR       "new_certs_dir"
 123 #define ENV_CERTIFICATE         "certificate"
 124 #define ENV_SERIAL              "serial"
 125 #define ENV_CRL                 "crl"
 126 #define ENV_PRIVATE_KEY         "private_key"
 127 #define ENV_RANDFILE            "RANDFILE"
 128 #define ENV_DEFAULT_DAYS        "default_days"
 129 #define ENV_DEFAULT_STARTDATE   "default_startdate"
 130 #define ENV_DEFAULT_ENDDATE     "default_enddate"
 131 #define ENV_DEFAULT_CRL_DAYS    "default_crl_days"
 132 #define ENV_DEFAULT_CRL_HOURS   "default_crl_hours"
 133 #define ENV_DEFAULT_MD          "default_md"
 134 #define ENV_DEFAULT_EMAIL_DN    "email_in_dn"
 135 #define ENV_PRESERVE            "preserve"
 136 #define ENV_POLICY              "policy"
 137 #define ENV_EXTENSIONS          "x509_extensions"
 138 #define ENV_CRLEXT              "crl_extensions"
 139 #define ENV_MSIE_HACK           "msie_hack"
 140 #define ENV_NAMEOPT             "name_opt"
 141 #define ENV_CERTOPT             "cert_opt"
 142 #define ENV_EXTCOPY             "copy_extensions"
 143
 144 #define ENV_DATABASE            "database"
 145
 146 /* Additional revocation information types */
 147
 148 #define REV_NONE                0       /* No addditional information */
 149 #define REV_CRL_REASON          1       /* Value is CRL reason code */
 150 #define REV_HOLD                2       /* Value is hold instruction */
 151 #define REV_KEY_COMPROMISE      3       /* Value is cert key compromise time */
 152 #define REV_CA_COMPROMISE       4       /* Value is CA key compromise time */
 153
 154 static char *ca_usage[]={
 155 "usage: ca args\n",
 156 "\n",
 157 " -verbose        - Talk alot while doing things\n",
 158 " -config file    - A config file\n",
 159 " -name arg       - The particular CA definition to use\n",
 160 " -gencrl         - Generate a new CRL\n",
 161 " -crldays days   - Days is when the next CRL is due\n",
 162 " -crlhours hours - Hours is when the next CRL is due\n",
 163 " -startdate YYMMDDHHMMSSZ  - certificate validity notBefore\n",
 164 " -enddate YYMMDDHHMMSSZ    - certificate validity notAfter (overrides -days)\n",
 165 " -days arg       - number of days to certify the certificate for\n",
 166 " -md arg         - md to use, one of md2, md5, sha or sha1\n",
 167 " -policy arg     - The CA 'policy' to support\n",
 168 " -keyfile arg    - private key file\n",
 169 " -keyform arg    - private key file format (PEM or ENGINE)\n",
 170 " -key arg        - key to decode the private key if it is encrypted\n",
 171 " -cert file      - The CA certificate\n",
 172 " -in file        - The input PEM encoded certificate request(s)\n",
 173 " -out file       - Where to put the output file(s)\n",
 174 " -outdir dir     - Where to put output certificates\n",
 175 " -infiles ....   - The last argument, requests to process\n",
 176 " -spkac file     - File contains DN and signed public key and challenge\n",
 177 " -ss_cert file   - File contains a self signed cert to sign\n",
 178 " -preserveDN     - Don't re-order the DN\n",
 179 " -noemailDN      - Don't add the EMAIL field into certificate' subject\n",
 180 " -batch          - Don't ask questions\n",
 181 " -msie_hack      - msie modifications to handle all those universal strings\n",
 182 " -revoke file    - Revoke a certificate (given in file)\n",
 183 " -subj arg       - Use arg instead of request's subject\n",
 184 " -extensions ..  - Extension section (override value in config file)\n",
 185 " -extfile file   - Configuration file with X509v3 extentions to add\n",
 186 " -crlexts ..     - CRL extension section (override value in config file)\n",
 187 #ifndef OPENSSL_NO_ENGINE
 188 " -engine e       - use engine e, possibly a hardware device.\n",
 189 #endif
 190 " -status serial  - Shows certificate status given the serial number\n",
 191 " -updatedb       - Updates db for expired certificates\n",
 192 NULL
 193 };
 194
 195 #ifdef EFENCE
 196 extern int EF_PROTECT_FREE;
 197 extern int EF_PROTECT_BELOW;
 198 extern int EF_ALIGNMENT;
 199 #endif
 200
 201 static void lookup_fail(char *name,char *tag);
 202 static int certify(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 203                    const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,CA_DB *db,
 204                    BIGNUM *serial, char *subj, int email_dn, char *startdate,
 205                    char *enddate, long days, int batch, char *ext_sect, CONF *conf,
 206                    int verbose, unsigned long certopt, unsigned long nameopt,
 207                    int default_op, int ext_copy);
 208 static int certify_cert(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 209                         const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 210                         CA_DB *db, BIGNUM *serial, char *subj, int email_dn,
 211                         char *startdate, char *enddate, long days, int batch,
 212                         char *ext_sect, CONF *conf,int verbose, unsigned long certopt,
 213                         unsigned long nameopt, int default_op, int ext_copy,
 214                         ENGINE *e);
 215 static int certify_spkac(X509 **xret, char *infile,EVP_PKEY *pkey,X509 *x509,
 216                          const EVP_MD *dgst,STACK_OF(CONF_VALUE) *policy,
 217                          CA_DB *db, BIGNUM *serial,char *subj, int email_dn,
 218                          char *startdate, char *enddate, long days, char *ext_sect,
 219                          CONF *conf, int verbose, unsigned long certopt,
 220                          unsigned long nameopt, int default_op, int ext_copy);
 221 static int fix_data(int nid, int *type);
 222 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext);
 223 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 224         STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial,char *subj,
 225         int email_dn, char *startdate, char *enddate, long days, int batch,
 226         int verbose, X509_REQ *req, char *ext_sect, CONF *conf,
 227         unsigned long certopt, unsigned long nameopt, int default_op,
 228         int ext_copy);
 229 static int do_revoke(X509 *x509, CA_DB *db, int ext, char *extval);
 230 static int get_certificate_status(const char *ser_status, CA_DB *db);
 231 static int do_updatedb(CA_DB *db);
 232 static int check_time_format(char *str);
 233 char *make_revocation_str(int rev_type, char *rev_arg);
 234 int make_revoked(X509_REVOKED *rev, char *str);
 235 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str);
 236 static CONF *conf=NULL;
 237 static CONF *extconf=NULL;
 238 static char *section=NULL;
 239
 240 static int preserve=0;
 241 static int msie_hack=0;
 242
 243
 244 int MAIN(int, char **);
 245
 246 int MAIN(int argc, char **argv)
 247         {
 248         ENGINE *e = NULL;
 249         char *key=NULL,*passargin=NULL;
 250         int free_key = 0;
 251         int total=0;
 252         int total_done=0;
 253         int badops=0;
 254         int ret=1;
 255         int email_dn=1;
 256         int req=0;
 257         int verbose=0;
 258         int gencrl=0;
 259         int dorevoke=0;
 260         int doupdatedb=0;
 261         long crldays=0;
 262         long crlhours=0;
 263         long errorline= -1;
 264         char *configfile=NULL;
 265         char *md=NULL;
 266         char *policy=NULL;
 267         char *keyfile=NULL;
 268         char *certfile=NULL;
 269         int keyform=FORMAT_PEM;
 270         char *infile=NULL;
 271         char *spkac_file=NULL;
 272         char *ss_cert_file=NULL;
 273         char *ser_status=NULL;
 274         EVP_PKEY *pkey=NULL;
 275         int output_der = 0;
 276         char *outfile=NULL;
 277         char *outdir=NULL;
 278         char *serialfile=NULL;
 279         char *extensions=NULL;
 280         char *extfile=NULL;
 281         char *subj=NULL;
 282         char *tmp_email_dn=NULL;
 283         char *crl_ext=NULL;
 284         int rev_type = REV_NONE;
 285         char *rev_arg = NULL;
 286         BIGNUM *serial=NULL;
 287         char *startdate=NULL;
 288         char *enddate=NULL;
 289         long days=0;
 290         int batch=0;
 291         int notext=0;
 292         unsigned long nameopt = 0, certopt = 0;
 293         int default_op = 1;
 294         int ext_copy = EXT_COPY_NONE;
 295         X509 *x509=NULL;
 296         X509 *x=NULL;
 297         BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
 298         char *dbfile=NULL;
 299         CA_DB *db=NULL;
 300         X509_CRL *crl=NULL;
 301         X509_REVOKED *r=NULL;
 302         ASN1_TIME *tmptm;
 303         ASN1_INTEGER *tmpser;
 304         char **pp,*p,*f;
 305         int i,j;
 306         const EVP_MD *dgst=NULL;
 307         STACK_OF(CONF_VALUE) *attribs=NULL;
 308         STACK_OF(X509) *cert_sk=NULL;
 309 #undef BSIZE
 310 #define BSIZE 256
 311         MS_STATIC char buf[3][BSIZE];
 312         char *randfile=NULL;
 313 #ifndef OPENSSL_NO_ENGINE
 314         char *engine = NULL;
 315 #endif
 316         char *tofree=NULL;
 317         DB_ATTR db_attr;
 318
 319 #ifdef EFENCE
 320 EF_PROTECT_FREE=1;
 321 EF_PROTECT_BELOW=1;
 322 EF_ALIGNMENT=0;
 323 #endif
 324
 325         apps_startup();
 326
 327         conf = NULL;
 328         key = NULL;
 329         section = NULL;
 330
 331         preserve=0;
 332         msie_hack=0;
 333         if (bio_err == NULL)
 334                 if ((bio_err=BIO_new(BIO_s_file())) != NULL)
 335                         BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 336
 337         argc--;
 338         argv++;
 339         while (argc >= 1)
 340                 {
 341                 if      (strcmp(*argv,"-verbose") == 0)
 342                         verbose=1;
 343                 else if (strcmp(*argv,"-config") == 0)
 344                         {
 345                         if (--argc < 1) goto bad;
 346                         configfile= *(++argv);
 347                         }
 348                 else if (strcmp(*argv,"-name") == 0)
 349                         {
 350                         if (--argc < 1) goto bad;
 351                         section= *(++argv);
 352                         }
 353                 else if (strcmp(*argv,"-subj") == 0)
 354                         {
 355                         if (--argc < 1) goto bad;
 356                         subj= *(++argv);
 357                         /* preserve=1; */
 358                         }
 359                 else if (strcmp(*argv,"-startdate") == 0)
 360                         {
 361                         if (--argc < 1) goto bad;
 362                         startdate= *(++argv);
 363                         }
 364                 else if (strcmp(*argv,"-enddate") == 0)
 365                         {
 366                         if (--argc < 1) goto bad;
 367                         enddate= *(++argv);
 368                         }
 369                 else if (strcmp(*argv,"-days") == 0)
 370                         {
 371                         if (--argc < 1) goto bad;
 372                         days=atoi(*(++argv));
 373                         }
 374                 else if (strcmp(*argv,"-md") == 0)
 375                         {
 376                         if (--argc < 1) goto bad;
 377                         md= *(++argv);
 378                         }
 379                 else if (strcmp(*argv,"-policy") == 0)
 380                         {
 381                         if (--argc < 1) goto bad;
 382                         policy= *(++argv);
 383                         }
 384                 else if (strcmp(*argv,"-keyfile") == 0)
 385                         {
 386                         if (--argc < 1) goto bad;
 387                         keyfile= *(++argv);
 388                         }
 389                 else if (strcmp(*argv,"-keyform") == 0)
 390                         {
 391                         if (--argc < 1) goto bad;
 392                         keyform=str2fmt(*(++argv));
 393                         }
 394                 else if (strcmp(*argv,"-passin") == 0)
 395                         {
 396                         if (--argc < 1) goto bad;
 397                         passargin= *(++argv);
 398                         }
 399                 else if (strcmp(*argv,"-key") == 0)
 400                         {
 401                         if (--argc < 1) goto bad;
 402                         key= *(++argv);
 403                         }
 404                 else if (strcmp(*argv,"-cert") == 0)
 405                         {
 406                         if (--argc < 1) goto bad;
 407                         certfile= *(++argv);
 408                         }
 409                 else if (strcmp(*argv,"-in") == 0)
 410                         {
 411                         if (--argc < 1) goto bad;
 412                         infile= *(++argv);
 413                         req=1;
 414                         }
 415                 else if (strcmp(*argv,"-out") == 0)
 416                         {
 417                         if (--argc < 1) goto bad;
 418                         outfile= *(++argv);
 419                         }
 420                 else if (strcmp(*argv,"-outdir") == 0)
 421                         {
 422                         if (--argc < 1) goto bad;
 423                         outdir= *(++argv);
 424                         }
 425                 else if (strcmp(*argv,"-notext") == 0)
 426                         notext=1;
 427                 else if (strcmp(*argv,"-batch") == 0)
 428                         batch=1;
 429                 else if (strcmp(*argv,"-preserveDN") == 0)
 430                         preserve=1;
 431                 else if (strcmp(*argv,"-noemailDN") == 0)
 432                         email_dn=0;
 433                 else if (strcmp(*argv,"-gencrl") == 0)
 434                         gencrl=1;
 435                 else if (strcmp(*argv,"-msie_hack") == 0)
 436                         msie_hack=1;
 437                 else if (strcmp(*argv,"-crldays") == 0)
 438                         {
 439                         if (--argc < 1) goto bad;
 440                         crldays= atol(*(++argv));
 441                         }
 442                 else if (strcmp(*argv,"-crlhours") == 0)
 443                         {
 444                         if (--argc < 1) goto bad;
 445                         crlhours= atol(*(++argv));
 446                         }
 447                 else if (strcmp(*argv,"-infiles") == 0)
 448                         {
 449                         argc--;
 450                         argv++;
 451                         req=1;
 452                         break;
 453                         }
 454                 else if (strcmp(*argv, "-ss_cert") == 0)
 455                         {
 456                         if (--argc < 1) goto bad;
 457                         ss_cert_file = *(++argv);
 458                         req=1;
 459                         }
 460                 else if (strcmp(*argv, "-spkac") == 0)
 461                         {
 462                         if (--argc < 1) goto bad;
 463                         spkac_file = *(++argv);
 464                         req=1;
 465                         }
 466                 else if (strcmp(*argv,"-revoke") == 0)
 467                         {
 468                         if (--argc < 1) goto bad;
 469                         infile= *(++argv);
 470                         dorevoke=1;
 471                         }
 472                 else if (strcmp(*argv,"-extensions") == 0)
 473                         {
 474                         if (--argc < 1) goto bad;
 475                         extensions= *(++argv);
 476                         }
 477                 else if (strcmp(*argv,"-extfile") == 0)
 478                         {
 479                         if (--argc < 1) goto bad;
 480                         extfile= *(++argv);
 481                         }
 482                 else if (strcmp(*argv,"-status") == 0)
 483                         {
 484                         if (--argc < 1) goto bad;
 485                         ser_status= *(++argv);
 486                         }
 487                 else if (strcmp(*argv,"-updatedb") == 0)
 488                         {
 489                         doupdatedb=1;
 490                         }
 491                 else if (strcmp(*argv,"-crlexts") == 0)
 492                         {
 493                         if (--argc < 1) goto bad;
 494                         crl_ext= *(++argv);
 495                         }
 496                 else if (strcmp(*argv,"-crl_reason") == 0)
 497                         {
 498                         if (--argc < 1) goto bad;
 499                         rev_arg = *(++argv);
 500                         rev_type = REV_CRL_REASON;
 501                         }
 502                 else if (strcmp(*argv,"-crl_hold") == 0)
 503                         {
 504                         if (--argc < 1) goto bad;
 505                         rev_arg = *(++argv);
 506                         rev_type = REV_HOLD;
 507                         }
 508                 else if (strcmp(*argv,"-crl_compromise") == 0)
 509                         {
 510                         if (--argc < 1) goto bad;
 511                         rev_arg = *(++argv);
 512                         rev_type = REV_KEY_COMPROMISE;
 513                         }
 514                 else if (strcmp(*argv,"-crl_CA_compromise") == 0)
 515                         {
 516                         if (--argc < 1) goto bad;
 517                         rev_arg = *(++argv);
 518                         rev_type = REV_CA_COMPROMISE;
 519                         }
 520 #ifndef OPENSSL_NO_ENGINE
 521                 else if (strcmp(*argv,"-engine") == 0)
 522                         {
 523                         if (--argc < 1) goto bad;
 524                         engine= *(++argv);
 525                         }
 526 #endif
 527                 else
 528                         {
 529 bad:
 530                         BIO_printf(bio_err,"unknown option %s\n",*argv);
 531                         badops=1;
 532                         break;
 533                         }
 534                 argc--;
 535                 argv++;
 536                 }
 537
 538         if (badops)
 539                 {
 540                 for (pp=ca_usage; (*pp != NULL); pp++)
 541                         BIO_printf(bio_err,"%s",*pp);
 542                 goto err;
 543                 }
 544
 545         ERR_load_crypto_strings();
 546
 547 #ifndef OPENSSL_NO_ENGINE
 548         e = setup_engine(bio_err, engine, 0);
 549 #endif
 550
 551         /*****************************************************************/
 552         tofree=NULL;
 553         if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
 554         if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
 555         if (configfile == NULL)
 556                 {
 557                 const char *s=X509_get_default_cert_area();
 558
 559 #ifdef OPENSSL_SYS_VMS
 560                 tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE));
 561                 strcpy(tofree,s);
 562 #else
 563                 tofree=OPENSSL_malloc(strlen(s)+sizeof(CONFIG_FILE)+1);
 564                 strcpy(tofree,s);
 565                 strcat(tofree,"/");
 566 #endif
 567                 strcat(tofree,CONFIG_FILE);
 568                 configfile=tofree;
 569                 }
 570
 571         BIO_printf(bio_err,"Using configuration from %s\n",configfile);
 572         conf = NCONF_new(NULL);
 573         if (NCONF_load(conf,configfile,&errorline) <= 0)
 574                 {
 575                 if (errorline <= 0)
 576                         BIO_printf(bio_err,"error loading the config file '%s'\n",
 577                                 configfile);
 578                 else
 579                         BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
 580                                 ,errorline,configfile);
 581                 goto err;
 582                 }
 583         if(tofree)
 584                 {
 585                 OPENSSL_free(tofree);
 586                 tofree = NULL;
 587                 }
 588
 589         if (!load_config(bio_err, conf))
 590                 goto err;
 591
 592         /* Lets get the config section we are using */
 593         if (section == NULL)
 594                 {
 595                 section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
 596                 if (section == NULL)
 597                         {
 598                         lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
 599                         goto err;
 600                         }
 601                 }
 602
 603         if (conf != NULL)
 604                 {
 605                 p=NCONF_get_string(conf,NULL,"oid_file");
 606                 if (p == NULL)
 607                         ERR_clear_error();
 608                 if (p != NULL)
 609                         {
 610                         BIO *oid_bio;
 611
 612                         oid_bio=BIO_new_file(p,"r");
 613                         if (oid_bio == NULL)
 614                                 {
 615                                 /*
 616                                 BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);
 617                                 ERR_print_errors(bio_err);
 618                                 */
 619                                 ERR_clear_error();
 620                                 }
 621                         else
 622                                 {
 623                                 OBJ_create_objects(oid_bio);
 624                                 BIO_free(oid_bio);
 625                                 }
 626                         }
 627                 if (!add_oid_section(bio_err,conf))
 628                         {
 629                         ERR_print_errors(bio_err);
 630                         goto err;
 631                         }
 632                 }
 633
 634         randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
 635         if (randfile == NULL)
 636                 ERR_clear_error();
 637         app_RAND_load_file(randfile, bio_err, 0);
 638
 639         db_attr.unique_subject = 1;
 640         p = NCONF_get_string(conf, section, "unique_subject");
 641         if (p)
 642                 {
 643 #ifdef RL_DEBUG
 644                 BIO_printf(bio_err, "DEBUG: unique_subject = \"%s\"\n", p);
 645 #endif
 646                 switch(*p)
 647                         {
 648                 case 'f': /* false */
 649                 case 'F': /* FALSE */
 650                 case 'n': /* no */
 651                 case 'N': /* NO */
 652                         db_attr.unique_subject = 0;
 653                         break;
 654                 case 't': /* true */
 655                 case 'T': /* TRUE */
 656                 case 'y': /* yes */
 657                 case 'Y': /* YES */
 658                 default:
 659                         db_attr.unique_subject = 1;
 660                         break;
 661                         }
 662                 }
 663 #ifdef RL_DEBUG
 664         else
 665                 BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
 666 #endif
 667 #ifdef RL_DEBUG
 668         BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",
 669                 db_attr.unique_subject);
 670 #endif
 671
 672         in=BIO_new(BIO_s_file());
 673         out=BIO_new(BIO_s_file());
 674         Sout=BIO_new(BIO_s_file());
 675         Cout=BIO_new(BIO_s_file());
 676         if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
 677                 {
 678                 ERR_print_errors(bio_err);
 679                 goto err;
 680                 }
 681
 682         /*****************************************************************/
 683         /* report status of cert with serial number given on command line */
 684         if (ser_status)
 685         {
 686                 if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 687                         {
 688                         lookup_fail(section,ENV_DATABASE);
 689                         goto err;
 690                         }
 691                 db = load_index(dbfile,&db_attr);
 692                 if (db == NULL) goto err;
 693
 694                 if (!index_index(db)) goto err;
 695
 696                 if (get_certificate_status(ser_status,db) != 1)
 697                         BIO_printf(bio_err,"Error verifying serial %s!\n",
 698                                  ser_status);
 699                 goto err;
 700         }
 701
 702         /*****************************************************************/
 703         /* we definitely need a public key, so let's get it */
 704
 705         if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
 706                 section,ENV_PRIVATE_KEY)) == NULL))
 707                 {
 708                 lookup_fail(section,ENV_PRIVATE_KEY);
 709                 goto err;
 710                 }
 711         if (!key)
 712                 {
 713                 free_key = 1;
 714                 if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
 715                         {
 716                         BIO_printf(bio_err,"Error getting password\n");
 717                         goto err;
 718                         }
 719                 }
 720         pkey = load_key(bio_err, keyfile, keyform, 0, key, e,
 721                 "CA private key");
 722         if (key) OPENSSL_cleanse(key,strlen(key));
 723         if (pkey == NULL)
 724                 {
 725                 /* load_key() has already printed an appropriate message */
 726                 goto err;
 727                 }
 728
 729         /*****************************************************************/
 730         /* we need a certificate */
 731         if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
 732                 section,ENV_CERTIFICATE)) == NULL))
 733                 {
 734                 lookup_fail(section,ENV_CERTIFICATE);
 735                 goto err;
 736                 }
 737         x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
 738                 "CA certificate");
 739         if (x509 == NULL)
 740                 goto err;
 741
 742         if (!X509_check_private_key(x509,pkey))
 743                 {
 744                 BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
 745                 goto err;
 746                 }
 747
 748         f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
 749         if (f == NULL)
 750                 ERR_clear_error();
 751         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 752                 preserve=1;
 753         f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
 754         if (f == NULL)
 755                 ERR_clear_error();
 756         if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
 757                 msie_hack=1;
 758
 759         f=NCONF_get_string(conf,section,ENV_NAMEOPT);
 760
 761         if (f)
 762                 {
 763                 if (!set_name_ex(&nameopt, f))
 764                         {
 765                         BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
 766                         goto err;
 767                         }
 768                 default_op = 0;
 769                 }
 770         else
 771                 ERR_clear_error();
 772
 773         f=NCONF_get_string(conf,section,ENV_CERTOPT);
 774
 775         if (f)
 776                 {
 777                 if (!set_cert_ex(&certopt, f))
 778                         {
 779                         BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
 780                         goto err;
 781                         }
 782                 default_op = 0;
 783                 }
 784         else
 785                 ERR_clear_error();
 786
 787         f=NCONF_get_string(conf,section,ENV_EXTCOPY);
 788
 789         if (f)
 790                 {
 791                 if (!set_ext_copy(&ext_copy, f))
 792                         {
 793                         BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
 794                         goto err;
 795                         }
 796                 }
 797         else
 798                 ERR_clear_error();
 799
 800         /*****************************************************************/
 801         /* lookup where to write new certificates */
 802         if ((outdir == NULL) && (req))
 803                 {
 804                 struct stat sb;
 805
 806                 if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
 807                         == NULL)
 808                         {
 809                         BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
 810                         goto err;
 811                         }
 812 #ifndef OPENSSL_SYS_VMS
 813             /* outdir is a directory spec, but access() for VMS demands a
 814                filename.  In any case, stat(), below, will catch the problem
 815                if outdir is not a directory spec, and the fopen() or open()
 816                will catch an error if there is no write access.
 817
 818                Presumably, this problem could also be solved by using the DEC
 819                C routines to convert the directory syntax to Unixly, and give
 820                that to access().  However, time's too short to do that just
 821                now.
 822             */
 823                 if (access(outdir,R_OK|W_OK|X_OK) != 0)
 824                         {
 825                         BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
 826                         perror(outdir);
 827                         goto err;
 828                         }
 829
 830                 if (stat(outdir,&sb) != 0)
 831                         {
 832                         BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
 833                         perror(outdir);
 834                         goto err;
 835                         }
 836 #ifdef S_IFDIR
 837                 if (!(sb.st_mode & S_IFDIR))
 838                         {
 839                         BIO_printf(bio_err,"%s need to be a directory\n",outdir);
 840                         perror(outdir);
 841                         goto err;
 842                         }
 843 #endif
 844 #endif
 845                 }
 846
 847         /*****************************************************************/
 848         /* we need to load the database file */
 849         if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
 850                 {
 851                 lookup_fail(section,ENV_DATABASE);
 852                 goto err;
 853                 }
 854         db = load_index(dbfile, &db_attr);
 855         if (db == NULL) goto err;
 856
 857         /* Lets check some fields */
 858         for (i=0; i<sk_num(db->db->data); i++)
 859                 {
 860                 pp=(char **)sk_value(db->db->data,i);
 861                 if ((pp[DB_type][0] != DB_TYPE_REV) &&
 862                         (pp[DB_rev_date][0] != '\0'))
 863                         {
 864                         BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
 865                         goto err;
 866                         }
 867                 if ((pp[DB_type][0] == DB_TYPE_REV) &&
 868                         !make_revoked(NULL, pp[DB_rev_date]))
 869                         {
 870                         BIO_printf(bio_err," in entry %d\n", i+1);
 871                         goto err;
 872                         }
 873                 if (!check_time_format(pp[DB_exp_date]))
 874                         {
 875                         BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
 876                         goto err;
 877                         }
 878                 p=pp[DB_serial];
 879                 j=strlen(p);
 880                 if (*p == '-')
 881                         {
 882                         p++;
 883                         j--;
 884                         }
 885                 if ((j&1) || (j < 2))
 886                         {
 887                         BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
 888                         goto err;
 889                         }
 890                 while (*p)
 891                         {
 892                         if (!(  ((*p >= '0') && (*p <= '9')) ||
 893                                 ((*p >= 'A') && (*p <= 'F')) ||
 894                                 ((*p >= 'a') && (*p <= 'f')))  )
 895                                 {
 896                                 BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
 897                                 goto err;
 898                                 }
 899                         p++;
 900                         }
 901                 }
 902         if (verbose)
 903                 {
 904                 BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */
 905 #ifdef OPENSSL_SYS_VMS
 906                 {
 907                 BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 908                 out = BIO_push(tmpbio, out);
 909                 }
 910 #endif
 911                 TXT_DB_write(out,db->db);
 912                 BIO_printf(bio_err,"%d entries loaded from the database\n",
 913                         db->db->data->num);
 914                 BIO_printf(bio_err,"generating index\n");
 915                 }
 916
 917         if (!index_index(db)) goto err;
 918
 919         /*****************************************************************/
 920         /* Update the db file for expired certificates */
 921         if (doupdatedb)
 922                 {
 923                 if (verbose)
 924                         BIO_printf(bio_err, "Updating %s ...\n",
 925                                                         dbfile);
 926
 927                 i = do_updatedb(db);
 928                 if (i == -1)
 929                         {
 930                         BIO_printf(bio_err,"Malloc failure\n");
 931                         goto err;
 932                         }
 933                 else if (i == 0)
 934                         {
 935                         if (verbose) BIO_printf(bio_err,
 936                                         "No entries found to mark expired\n");
 937                         }
 938                 else
 939                         {
 940                         if (!save_index(dbfile,"new",db)) goto err;
 941
 942                         if (!rotate_index(dbfile,"new","old")) goto err;
 943
 944                         if (verbose) BIO_printf(bio_err,
 945                                 "Done. %d entries marked as expired\n",i);
 946                         }
 947                         goto err;
 948                 }
 949
 950         /*****************************************************************/
 951         /* Read extentions config file                                   */
 952         if (extfile)
 953                 {
 954                 extconf = NCONF_new(NULL);
 955                 if (NCONF_load(extconf,extfile,&errorline) <= 0)
 956                         {
 957                         if (errorline <= 0)
 958                                 BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
 959                                         extfile);
 960                         else
 961                                 BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
 962                                         errorline,extfile);
 963                         ret = 1;
 964                         goto err;
 965                         }
 966
 967                 if (verbose)
 968                         BIO_printf(bio_err, "Successfully loaded extensions file %s\n", extfile);
 969
 970                 /* We can have sections in the ext file */
 971                 if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
 972                         extensions = "default";
 973                 }
 974
 975         /*****************************************************************/
 976         if (req || gencrl)
 977                 {
 978                 if (outfile != NULL)
 979                         {
 980                         if (BIO_write_filename(Sout,outfile) <= 0)
 981                                 {
 982                                 perror(outfile);
 983                                 goto err;
 984                                 }
 985                         }
 986                 else
 987                         {
 988                         BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 989 #ifdef OPENSSL_SYS_VMS
 990                         {
 991                         BIO *tmpbio = BIO_new(BIO_f_linebuffer());
 992                         Sout = BIO_push(tmpbio, Sout);
 993                         }
 994 #endif
 995                         }
 996                 }
 997
 998         if (req)
 999                 {
1000                 if ((md == NULL) && ((md=NCONF_get_string(conf,
1001                         section,ENV_DEFAULT_MD)) == NULL))
1002                         {
1003                         lookup_fail(section,ENV_DEFAULT_MD);
1004                         goto err;
1005                         }
1006                 if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
1007                         section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
1008                         {
1009                         if(strcmp(tmp_email_dn,"no") == 0)
1010                                 email_dn=0;
1011                         }
1012                 if ((dgst=EVP_get_digestbyname(md)) == NULL)
1013                         {
1014                         BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1015                         goto err;
1016                         }
1017                 if (verbose)
1018                         BIO_printf(bio_err,"message digest is %s\n",
1019                                 OBJ_nid2ln(dgst->type));
1020                 if ((policy == NULL) && ((policy=NCONF_get_string(conf,
1021                         section,ENV_POLICY)) == NULL))
1022                         {
1023                         lookup_fail(section,ENV_POLICY);
1024                         goto err;
1025                         }
1026                 if (verbose)
1027                         BIO_printf(bio_err,"policy is %s\n",policy);
1028
1029                 if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
1030                         == NULL)
1031                         {
1032                         lookup_fail(section,ENV_SERIAL);
1033                         goto err;
1034                         }
1035
1036                 if (!extconf)
1037                         {
1038                         /* no '-extfile' option, so we look for extensions
1039                          * in the main configuration file */
1040                         if (!extensions)
1041                                 {
1042                                 extensions=NCONF_get_string(conf,section,
1043                                                                 ENV_EXTENSIONS);
1044                                 if (!extensions)
1045                                         ERR_clear_error();
1046                                 }
1047                         if (extensions)
1048                                 {
1049                                 /* Check syntax of file */
1050                                 X509V3_CTX ctx;
1051                                 X509V3_set_ctx_test(&ctx);
1052                                 X509V3_set_nconf(&ctx, conf);
1053                                 if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
1054                                                                 NULL))
1055                                         {
1056                                         BIO_printf(bio_err,
1057                                         "Error Loading extension section %s\n",
1058                                                                  extensions);
1059                                         ret = 1;
1060                                         goto err;
1061                                         }
1062                                 }
1063                         }
1064
1065                 if (startdate == NULL)
1066                         {
1067                         startdate=NCONF_get_string(conf,section,
1068                                 ENV_DEFAULT_STARTDATE);
1069                         if (startdate == NULL)
1070                                 ERR_clear_error();
1071                         }
1072                 if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
1073                         {
1074                         BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
1075                         goto err;
1076                         }
1077                 if (startdate == NULL) startdate="today";
1078
1079                 if (enddate == NULL)
1080                         {
1081                         enddate=NCONF_get_string(conf,section,
1082                                 ENV_DEFAULT_ENDDATE);
1083                         if (enddate == NULL)
1084                                 ERR_clear_error();
1085                         }
1086                 if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
1087                         {
1088                         BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
1089                         goto err;
1090                         }
1091
1092                 if (days == 0)
1093                         {
1094                         if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
1095                                 days = 0;
1096                         }
1097                 if (!enddate && (days == 0))
1098                         {
1099                         BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
1100                         goto err;
1101                         }
1102
1103                 if ((serial=load_serial(serialfile, 0, NULL)) == NULL)
1104                         {
1105                         BIO_printf(bio_err,"error while loading serial number\n");
1106                         goto err;
1107                         }
1108                 if (verbose)
1109                         {
1110                         if (BN_is_zero(serial))
1111                                 BIO_printf(bio_err,"next serial number is 00\n");
1112                         else
1113                                 {
1114                                 if ((f=BN_bn2hex(serial)) == NULL) goto err;
1115                                 BIO_printf(bio_err,"next serial number is %s\n",f);
1116                                 OPENSSL_free(f);
1117                                 }
1118                         }
1119
1120                 if ((attribs=NCONF_get_section(conf,policy)) == NULL)
1121                         {
1122                         BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
1123                         goto err;
1124                         }
1125
1126                 if ((cert_sk=sk_X509_new_null()) == NULL)
1127                         {
1128                         BIO_printf(bio_err,"Memory allocation failure\n");
1129                         goto err;
1130                         }
1131                 if (spkac_file != NULL)
1132                         {
1133                         total++;
1134                         j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
1135                                 serial,subj,email_dn,startdate,enddate,days,extensions,
1136                                 conf,verbose,certopt,nameopt,default_op,ext_copy);
1137                         if (j < 0) goto err;
1138                         if (j > 0)
1139                                 {
1140                                 total_done++;
1141                                 BIO_printf(bio_err,"\n");
1142                                 if (!BN_add_word(serial,1)) goto err;
1143                                 if (!sk_X509_push(cert_sk,x))
1144                                         {
1145                                         BIO_printf(bio_err,"Memory allocation failure\n");
1146                                         goto err;
1147                                         }
1148                                 if (outfile)
1149                                         {
1150                                         output_der = 1;
1151                                         batch = 1;
1152                                         }
1153                                 }
1154                         }
1155                 if (ss_cert_file != NULL)
1156                         {
1157                         total++;
1158                         j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
1159                                 db,serial,subj,email_dn,startdate,enddate,days,batch,
1160                                 extensions,conf,verbose, certopt, nameopt,
1161                                 default_op, ext_copy, e);
1162                         if (j < 0) goto err;
1163                         if (j > 0)
1164                                 {
1165                                 total_done++;
1166                                 BIO_printf(bio_err,"\n");
1167                                 if (!BN_add_word(serial,1)) goto err;
1168                                 if (!sk_X509_push(cert_sk,x))
1169                                         {
1170                                         BIO_printf(bio_err,"Memory allocation failure\n");
1171                                         goto err;
1172                                         }
1173                                 }
1174                         }
1175                 if (infile != NULL)
1176                         {
1177                         total++;
1178                         j=certify(&x,infile,pkey,x509,dgst,attribs,db,
1179                                 serial,subj,email_dn,startdate,enddate,days,batch,
1180                                 extensions,conf,verbose, certopt, nameopt,
1181                                 default_op, ext_copy);
1182                         if (j < 0) goto err;
1183                         if (j > 0)
1184                                 {
1185                                 total_done++;
1186                                 BIO_printf(bio_err,"\n");
1187                                 if (!BN_add_word(serial,1)) goto err;
1188                                 if (!sk_X509_push(cert_sk,x))
1189                                         {
1190                                         BIO_printf(bio_err,"Memory allocation failure\n");
1191                                         goto err;
1192                                         }
1193                                 }
1194                         }
1195                 for (i=0; i<argc; i++)
1196                         {
1197                         total++;
1198                         j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
1199                                 serial,subj,email_dn,startdate,enddate,days,batch,
1200                                 extensions,conf,verbose, certopt, nameopt,
1201                                 default_op, ext_copy);
1202                         if (j < 0) goto err;
1203                         if (j > 0)
1204                                 {
1205                                 total_done++;
1206                                 BIO_printf(bio_err,"\n");
1207                                 if (!BN_add_word(serial,1)) goto err;
1208                                 if (!sk_X509_push(cert_sk,x))
1209                                         {
1210                                         BIO_printf(bio_err,"Memory allocation failure\n");
1211                                         goto err;
1212                                         }
1213                                 }
1214                         }
1215                 /* we have a stack of newly certified certificates
1216                  * and a data base and serial number that need
1217                  * updating */
1218
1219                 if (sk_X509_num(cert_sk) > 0)
1220                         {
1221                         if (!batch)
1222                                 {
1223                                 BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
1224                                 (void)BIO_flush(bio_err);
1225                                 buf[0][0]='\0';
1226                                 fgets(buf[0],10,stdin);
1227                                 if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
1228                                         {
1229                                         BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
1230                                         ret=0;
1231                                         goto err;
1232                                         }
1233                                 }
1234
1235                         BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
1236
1237                         if(strlen(serialfile) > BSIZE-5 || strlen(dbfile) > BSIZE-5)
1238                                 {
1239                                 BIO_printf(bio_err,"file name too long\n");
1240                                 goto err;
1241                                 }
1242
1243                         strcpy(buf[0],serialfile);
1244
1245 #ifdef OPENSSL_SYS_VMS
1246                         strcat(buf[0],"-new");
1247 #else
1248                         strcat(buf[0],".new");
1249 #endif
1250
1251                         if (!save_serial(buf[0],serial,NULL)) goto err;
1252
1253                         if (!save_index(dbfile, "new", db)) goto err;
1254                         }
1255
1256                 if (verbose)
1257                         BIO_printf(bio_err,"writing new certificates\n");
1258                 for (i=0; i<sk_X509_num(cert_sk); i++)
1259                         {
1260                         int k;
1261                         unsigned char *n;
1262
1263                         x=sk_X509_value(cert_sk,i);
1264
1265                         j=x->cert_info->serialNumber->length;
1266                         p=(char *)x->cert_info->serialNumber->data;
1267
1268                         if(strlen(outdir) >= (size_t)(j ? BSIZE-j*2-6 : BSIZE-8))
1269                                 {
1270                                 BIO_printf(bio_err,"certificate file name too long\n");
1271                                 goto err;
1272                                 }
1273
1274                         strcpy(buf[2],outdir);
1275
1276 #ifndef OPENSSL_SYS_VMS
1277                         strcat(buf[2],"/");
1278 #endif
1279
1280                         n=(unsigned char *)&(buf[2][strlen(buf[2])]);
1281                         if (j > 0)
1282                                 {
1283                                 for (k=0; k<j; k++)
1284                                         {
1285                                         sprintf((char *)n,"%02X",(unsigned char)*(p++));
1286                                         n+=2;
1287                                         }
1288                                 }
1289                         else
1290                                 {
1291                                 *(n++)='0';
1292                                 *(n++)='0';
1293                                 }
1294                         *(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
1295                         *n='\0';
1296                         if (verbose)
1297                                 BIO_printf(bio_err,"writing %s\n",buf[2]);
1298
1299                         if (BIO_write_filename(Cout,buf[2]) <= 0)
1300                                 {
1301                                 perror(buf[2]);
1302                                 goto err;
1303                                 }
1304                         write_new_certificate(Cout,x, 0, notext);
1305                         write_new_certificate(Sout,x, output_der, notext);
1306                         }
1307
1308                 if (sk_X509_num(cert_sk))
1309                         {
1310                         /* Rename the database and the serial file */
1311                         strncpy(buf[2],serialfile,BSIZE-4);
1312                         buf[2][BSIZE-4]='\0';
1313
1314 #ifdef OPENSSL_SYS_VMS
1315                         strcat(buf[2],"-old");
1316 #else
1317                         strcat(buf[2],".old");
1318 #endif
1319
1320                         BIO_free(in);
1321                         BIO_free_all(out);
1322                         in=NULL;
1323                         out=NULL;
1324                         if (rename(serialfile,buf[2]) < 0)
1325                                 {
1326                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1327                                         serialfile,buf[2]);
1328                                 perror("reason");
1329                                 goto err;
1330                                 }
1331                         if (rename(buf[0],serialfile) < 0)
1332                                 {
1333                                 BIO_printf(bio_err,"unable to rename %s to %s\n",
1334                                         buf[0],serialfile);
1335                                 perror("reason");
1336                                 rename(buf[2],serialfile);
1337                                 goto err;
1338                                 }
1339
1340                         if (!rotate_index(dbfile,"new","old")) goto err;
1341
1342                         BIO_printf(bio_err,"Data Base Updated\n");
1343                         }
1344                 }
1345
1346         /*****************************************************************/
1347         if (gencrl)
1348                 {
1349                 int crl_v2 = 0;
1350                 if (!crl_ext)
1351                         {
1352                         crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
1353                         if (!crl_ext)
1354                                 ERR_clear_error();
1355                         }
1356                 if (crl_ext)
1357                         {
1358                         /* Check syntax of file */
1359                         X509V3_CTX ctx;
1360                         X509V3_set_ctx_test(&ctx);
1361                         X509V3_set_nconf(&ctx, conf);
1362                         if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
1363                                 {
1364                                 BIO_printf(bio_err,
1365                                  "Error Loading CRL extension section %s\n",
1366                                                                  crl_ext);
1367                                 ret = 1;
1368                                 goto err;
1369                                 }
1370                         }
1371
1372                 if (!crldays && !crlhours)
1373                         {
1374                         if (!NCONF_get_number(conf,section,
1375                                 ENV_DEFAULT_CRL_DAYS, &crldays))
1376                                 crldays = 0;
1377                         if (!NCONF_get_number(conf,section,
1378                                 ENV_DEFAULT_CRL_HOURS, &crlhours))
1379                                 crlhours = 0;
1380                         }
1381                 if ((crldays == 0) && (crlhours == 0))
1382                         {
1383                         BIO_printf(bio_err,"cannot lookup how long until the next CRL is issued\n");
1384                         goto err;
1385                         }
1386
1387                 if (verbose) BIO_printf(bio_err,"making CRL\n");
1388                 if ((crl=X509_CRL_new()) == NULL) goto err;
1389                 if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1390
1391                 tmptm = ASN1_TIME_new();
1392                 if (!tmptm) goto err;
1393                 X509_gmtime_adj(tmptm,0);
1394                 X509_CRL_set_lastUpdate(crl, tmptm);
1395                 X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
1396                 X509_CRL_set_nextUpdate(crl, tmptm);
1397
1398                 ASN1_TIME_free(tmptm);
1399
1400                 for (i=0; i<sk_num(db->db->data); i++)
1401                         {
1402                         pp=(char **)sk_value(db->db->data,i);
1403                         if (pp[DB_type][0] == DB_TYPE_REV)
1404                                 {
1405                                 if ((r=X509_REVOKED_new()) == NULL) goto err;
1406                                 j = make_revoked(r, pp[DB_rev_date]);
1407                                 if (!j) goto err;
1408                                 if (j == 2) crl_v2 = 1;
1409                                 if (!BN_hex2bn(&serial, pp[DB_serial]))
1410                                         goto err;
1411                                 tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1412                                 BN_free(serial);
1413                                 serial = NULL;
1414                                 if (!tmpser)
1415                                         goto err;
1416                                 X509_REVOKED_set_serialNumber(r, tmpser);
1417                                 ASN1_INTEGER_free(tmpser);
1418                                 X509_CRL_add0_revoked(crl,r);
1419                                 }
1420                         }
1421
1422                 /* sort the data so it will be written in serial
1423                  * number order */
1424                 X509_CRL_sort(crl);
1425
1426                 /* we now have a CRL */
1427                 if (verbose) BIO_printf(bio_err,"signing CRL\n");
1428                 if (md != NULL)
1429                         {
1430                         if ((dgst=EVP_get_digestbyname(md)) == NULL)
1431                                 {
1432                                 BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
1433                                 goto err;
1434                                 }
1435                         }
1436                 else
1437                         {
1438 #ifndef OPENSSL_NO_DSA
1439                         if (pkey->type == EVP_PKEY_DSA)
1440                                 dgst=EVP_dss1();
1441                         else
1442 #endif
1443 #ifndef OPENSSL_NO_ECDSA
1444                         if (pkey->type == EVP_PKEY_EC)
1445                                 dgst=EVP_ecdsa();
1446                         else
1447 #endif
1448                                 dgst=EVP_md5();
1449                         }
1450
1451                 /* Add any extensions asked for */
1452
1453                 if (crl_ext)
1454                         {
1455                         X509V3_CTX crlctx;
1456                         X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
1457                         X509V3_set_nconf(&crlctx, conf);
1458
1459                         if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
1460                                 crl_ext, crl)) goto err;
1461                         }
1462                 if (crl_ext || crl_v2)
1463                         {
1464                         if (!X509_CRL_set_version(crl, 1))
1465                                 goto err; /* version 2 CRL */
1466                         }
1467
1468                 if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
1469
1470                 PEM_write_bio_X509_CRL(Sout,crl);
1471                 }
1472         /*****************************************************************/
1473         if (dorevoke)
1474                 {
1475                 if (infile == NULL)
1476                         {
1477                         BIO_printf(bio_err,"no input files\n");
1478                         goto err;
1479                         }
1480                 else
1481                         {
1482                         X509 *revcert;
1483                         revcert=load_cert(bio_err, infile, FORMAT_PEM,
1484                                 NULL, e, infile);
1485                         if (revcert == NULL)
1486                                 goto err;
1487                         j=do_revoke(revcert,db, rev_type, rev_arg);
1488                         if (j <= 0) goto err;
1489                         X509_free(revcert);
1490
1491                         if (!save_index(dbfile, "new", db)) goto err;
1492
1493                         if (!rotate_index(dbfile, "new", "old")) goto err;
1494
1495                         BIO_printf(bio_err,"Data Base Updated\n");
1496                         }
1497                 }
1498         /*****************************************************************/
1499         ret=0;
1500 err:
1501         if(tofree)
1502                 OPENSSL_free(tofree);
1503         BIO_free_all(Cout);
1504         BIO_free_all(Sout);
1505         BIO_free_all(out);
1506         BIO_free_all(in);
1507
1508         if (cert_sk)
1509                 sk_X509_pop_free(cert_sk,X509_free);
1510
1511         if (ret) ERR_print_errors(bio_err);
1512         app_RAND_write_file(randfile, bio_err);
1513         if (free_key && key)
1514                 OPENSSL_free(key);
1515         BN_free(serial);
1516         free_index(db);
1517         EVP_PKEY_free(pkey);
1518         X509_free(x509);
1519         X509_CRL_free(crl);
1520         NCONF_free(conf);
1521         OBJ_cleanup();
1522         apps_shutdown();
1523         OPENSSL_EXIT(ret);
1524         }
1525
1526 static void lookup_fail(char *name, char *tag)
1527         {
1528         BIO_printf(bio_err,"variable lookup failed for %s::%s\n",name,tag);
1529         }
1530
1531 static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1532              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1533              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1534              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1535              unsigned long certopt, unsigned long nameopt, int default_op,
1536              int ext_copy)
1537         {
1538         X509_REQ *req=NULL;
1539         BIO *in=NULL;
1540         EVP_PKEY *pktmp=NULL;
1541         int ok= -1,i;
1542
1543         in=BIO_new(BIO_s_file());
1544
1545         if (BIO_read_filename(in,infile) <= 0)
1546                 {
1547                 perror(infile);
1548                 goto err;
1549                 }
1550         if ((req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL)) == NULL)
1551                 {
1552                 BIO_printf(bio_err,"Error reading certificate request in %s\n",
1553                         infile);
1554                 goto err;
1555                 }
1556         if (verbose)
1557                 X509_REQ_print(bio_err,req);
1558
1559         BIO_printf(bio_err,"Check that the request matches the signature\n");
1560
1561         if ((pktmp=X509_REQ_get_pubkey(req)) == NULL)
1562                 {
1563                 BIO_printf(bio_err,"error unpacking public key\n");
1564                 goto err;
1565                 }
1566         i=X509_REQ_verify(req,pktmp);
1567         EVP_PKEY_free(pktmp);
1568         if (i < 0)
1569                 {
1570                 ok=0;
1571                 BIO_printf(bio_err,"Signature verification problems....\n");
1572                 goto err;
1573                 }
1574         if (i == 0)
1575                 {
1576                 ok=0;
1577                 BIO_printf(bio_err,"Signature did not match the certificate request\n");
1578                 goto err;
1579                 }
1580         else
1581                 BIO_printf(bio_err,"Signature ok\n");
1582
1583         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj, email_dn,
1584                 startdate,enddate,days,batch,verbose,req,ext_sect,lconf,
1585                 certopt, nameopt, default_op, ext_copy);
1586
1587 err:
1588         if (req != NULL) X509_REQ_free(req);
1589         if (in != NULL) BIO_free(in);
1590         return(ok);
1591         }
1592
1593 static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
1594              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
1595              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
1596              long days, int batch, char *ext_sect, CONF *lconf, int verbose,
1597              unsigned long certopt, unsigned long nameopt, int default_op,
1598              int ext_copy, ENGINE *e)
1599         {
1600         X509 *req=NULL;
1601         X509_REQ *rreq=NULL;
1602         EVP_PKEY *pktmp=NULL;
1603         int ok= -1,i;
1604
1605         if ((req=load_cert(bio_err, infile, FORMAT_PEM, NULL, e, infile)) == NULL)
1606                 goto err;
1607         if (verbose)
1608                 X509_print(bio_err,req);
1609
1610         BIO_printf(bio_err,"Check that the request matches the signature\n");
1611
1612         if ((pktmp=X509_get_pubkey(req)) == NULL)
1613                 {
1614                 BIO_printf(bio_err,"error unpacking public key\n");
1615                 goto err;
1616                 }
1617         i=X509_verify(req,pktmp);
1618         EVP_PKEY_free(pktmp);
1619         if (i < 0)
1620                 {
1621                 ok=0;
1622                 BIO_printf(bio_err,"Signature verification problems....\n");
1623                 goto err;
1624                 }
1625         if (i == 0)
1626                 {
1627                 ok=0;
1628                 BIO_printf(bio_err,"Signature did not match the certificate\n");
1629                 goto err;
1630                 }
1631         else
1632                 BIO_printf(bio_err,"Signature ok\n");
1633
1634         if ((rreq=X509_to_X509_REQ(req,NULL,EVP_md5())) == NULL)
1635                 goto err;
1636
1637         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
1638                 days,batch,verbose,rreq,ext_sect,lconf, certopt, nameopt, default_op,
1639                 ext_copy);
1640
1641 err:
1642         if (rreq != NULL) X509_REQ_free(rreq);
1643         if (req != NULL) X509_free(req);
1644         return(ok);
1645         }
1646
1647 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
1648              STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
1649              int email_dn, char *startdate, char *enddate, long days, int batch,
1650              int verbose, X509_REQ *req, char *ext_sect, CONF *lconf,
1651              unsigned long certopt, unsigned long nameopt, int default_op,
1652              int ext_copy)
1653         {
1654         X509_NAME *name=NULL,*CAname=NULL,*subject=NULL, *dn_subject=NULL;
1655         ASN1_UTCTIME *tm,*tmptm;
1656         ASN1_STRING *str,*str2;
1657         ASN1_OBJECT *obj;
1658         X509 *ret=NULL;
1659         X509_CINF *ci;
1660         X509_NAME_ENTRY *ne;
1661         X509_NAME_ENTRY *tne,*push;
1662         EVP_PKEY *pktmp;
1663         int ok= -1,i,j,last,nid;
1664         char *p;
1665         CONF_VALUE *cv;
1666         char *row[DB_NUMBER],**rrow=NULL,**irow=NULL;
1667         char buf[25];
1668
1669         tmptm=ASN1_UTCTIME_new();
1670         if (tmptm == NULL)
1671                 {
1672                 BIO_printf(bio_err,"malloc error\n");
1673                 return(0);
1674                 }
1675
1676         for (i=0; i<DB_NUMBER; i++)
1677                 row[i]=NULL;
1678
1679         if (subj)
1680                 {
1681                 X509_NAME *n = do_subject(subj, MBSTRING_ASC);
1682
1683                 if (!n)
1684                         {
1685                         ERR_print_errors(bio_err);
1686                         goto err;
1687                         }
1688                 X509_REQ_set_subject_name(req,n);
1689                 req->req_info->enc.modified = 1;
1690                 X509_NAME_free(n);
1691                 }
1692
1693         if (default_op)
1694                 BIO_printf(bio_err,"The Subject's Distinguished Name is as follows\n");
1695
1696         name=X509_REQ_get_subject_name(req);
1697         for (i=0; i<X509_NAME_entry_count(name); i++)
1698                 {
1699                 ne= X509_NAME_get_entry(name,i);
1700                 str=X509_NAME_ENTRY_get_data(ne);
1701                 obj=X509_NAME_ENTRY_get_object(ne);
1702
1703                 if (msie_hack)
1704                         {
1705                         /* assume all type should be strings */
1706                         nid=OBJ_obj2nid(ne->object);
1707
1708                         if (str->type == V_ASN1_UNIVERSALSTRING)
1709                                 ASN1_UNIVERSALSTRING_to_string(str);
1710
1711                         if ((str->type == V_ASN1_IA5STRING) &&
1712                                 (nid != NID_pkcs9_emailAddress))
1713                                 str->type=V_ASN1_T61STRING;
1714
1715                         if ((nid == NID_pkcs9_emailAddress) &&
1716                                 (str->type == V_ASN1_PRINTABLESTRING))
1717                                 str->type=V_ASN1_IA5STRING;
1718                         }
1719
1720                 /* If no EMAIL is wanted in the subject */
1721                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) && (!email_dn))
1722                         continue;
1723
1724                 /* check some things */
1725                 if ((OBJ_obj2nid(obj) == NID_pkcs9_emailAddress) &&
1726                         (str->type != V_ASN1_IA5STRING))
1727                         {
1728                         BIO_printf(bio_err,"\nemailAddress type needs to be of type IA5STRING\n");
1729                         goto err;
1730                         }
1731                 if ((str->type != V_ASN1_BMPSTRING) && (str->type != V_ASN1_UTF8STRING))
1732                         {
1733                         j=ASN1_PRINTABLE_type(str->data,str->length);
1734                         if (    ((j == V_ASN1_T61STRING) &&
1735                                  (str->type != V_ASN1_T61STRING)) ||
1736                                 ((j == V_ASN1_IA5STRING) &&
1737                                  (str->type == V_ASN1_PRINTABLESTRING)))
1738                                 {
1739                                 BIO_printf(bio_err,"\nThe string contains characters that are illegal for the ASN.1 type\n");
1740                                 goto err;
1741                                 }
1742                         }
1743
1744                 if (default_op)
1745                         old_entry_print(bio_err, obj, str);
1746                 }
1747
1748         /* Ok, now we check the 'policy' stuff. */
1749         if ((subject=X509_NAME_new()) == NULL)
1750                 {
1751                 BIO_printf(bio_err,"Memory allocation failure\n");
1752                 goto err;
1753                 }
1754
1755         /* take a copy of the issuer name before we mess with it. */
1756         CAname=X509_NAME_dup(x509->cert_info->subject);
1757         if (CAname == NULL) goto err;
1758         str=str2=NULL;
1759
1760         for (i=0; i<sk_CONF_VALUE_num(policy); i++)
1761                 {
1762                 cv=sk_CONF_VALUE_value(policy,i); /* get the object id */
1763                 if ((j=OBJ_txt2nid(cv->name)) == NID_undef)
1764                         {
1765                         BIO_printf(bio_err,"%s:unknown object type in 'policy' configuration\n",cv->name);
1766                         goto err;
1767                         }
1768                 obj=OBJ_nid2obj(j);
1769
1770                 last= -1;
1771                 for (;;)
1772                         {
1773                         /* lookup the object in the supplied name list */
1774                         j=X509_NAME_get_index_by_OBJ(name,obj,last);
1775                         if (j < 0)
1776                                 {
1777                                 if (last != -1) break;
1778                                 tne=NULL;
1779                                 }
1780                         else
1781                                 {
1782                                 tne=X509_NAME_get_entry(name,j);
1783                                 }
1784                         last=j;
1785
1786                         /* depending on the 'policy', decide what to do. */
1787                         push=NULL;
1788                         if (strcmp(cv->value,"optional") == 0)
1789                                 {
1790                                 if (tne != NULL)
1791                                         push=tne;
1792                                 }
1793                         else if (strcmp(cv->value,"supplied") == 0)
1794                                 {
1795                                 if (tne == NULL)
1796                                         {
1797                                         BIO_printf(bio_err,"The %s field needed to be supplied and was missing\n",cv->name);
1798                                         goto err;
1799                                         }
1800                                 else
1801                                         push=tne;
1802                                 }
1803                         else if (strcmp(cv->value,"match") == 0)
1804                                 {
1805                                 int last2;
1806
1807                                 if (tne == NULL)
1808                                         {
1809                                         BIO_printf(bio_err,"The mandatory %s field was missing\n",cv->name);
1810                                         goto err;
1811                                         }
1812
1813                                 last2= -1;
1814
1815 again2:
1816                                 j=X509_NAME_get_index_by_OBJ(CAname,obj,last2);
1817                                 if ((j < 0) && (last2 == -1))
1818                                         {
1819                                         BIO_printf(bio_err,"The %s field does not exist in the CA certificate,\nthe 'policy' is misconfigured\n",cv->name);
1820                                         goto err;
1821                                         }
1822                                 if (j >= 0)
1823                                         {
1824                                         push=X509_NAME_get_entry(CAname,j);
1825                                         str=X509_NAME_ENTRY_get_data(tne);
1826                                         str2=X509_NAME_ENTRY_get_data(push);
1827                                         last2=j;
1828                                         if (ASN1_STRING_cmp(str,str2) != 0)
1829                                                 goto again2;
1830                                         }
1831                                 if (j < 0)
1832                                         {
1833                                         BIO_printf(bio_err,"The %s field needed to be the same in the\nCA certificate (%s) and the request (%s)\n",cv->name,((str2 == NULL)?"NULL":(char *)str2->data),((str == NULL)?"NULL":(char *)str->data));
1834                                         goto err;
1835                                         }
1836                                 }
1837                         else
1838                                 {
1839                                 BIO_printf(bio_err,"%s:invalid type in 'policy' configuration\n",cv->value);
1840                                 goto err;
1841                                 }
1842
1843                         if (push != NULL)
1844                                 {
1845                                 if (!X509_NAME_add_entry(subject,push, -1, 0))
1846                                         {
1847                                         if (push != NULL)
1848                                                 X509_NAME_ENTRY_free(push);
1849                                         BIO_printf(bio_err,"Memory allocation failure\n");
1850                                         goto err;
1851                                         }
1852                                 }
1853                         if (j < 0) break;
1854                         }
1855                 }
1856
1857         if (preserve)
1858                 {
1859                 X509_NAME_free(subject);
1860                 /* subject=X509_NAME_dup(X509_REQ_get_subject_name(req)); */
1861                 subject=X509_NAME_dup(name);
1862                 if (subject == NULL) goto err;
1863                 }
1864
1865         if (verbose)
1866                 BIO_printf(bio_err,"The subject name appears to be ok, checking data base for clashes\n");
1867
1868         /* Build the correct Subject if no e-mail is wanted in the subject */
1869         /* and add it later on because of the method extensions are added (altName) */
1870
1871         if (email_dn)
1872                 dn_subject = subject;
1873         else
1874                 {
1875                 X509_NAME_ENTRY *tmpne;
1876                 /* Its best to dup the subject DN and then delete any email
1877                  * addresses because this retains its structure.
1878                  */
1879                 if (!(dn_subject = X509_NAME_dup(subject)))
1880                         {
1881                         BIO_printf(bio_err,"Memory allocation failure\n");
1882                         goto err;
1883                         }
1884                 while((i = X509_NAME_get_index_by_NID(dn_subject,
1885                                         NID_pkcs9_emailAddress, -1)) >= 0)
1886                         {
1887                         tmpne = X509_NAME_get_entry(dn_subject, i);
1888                         X509_NAME_delete_entry(dn_subject, i);
1889                         X509_NAME_ENTRY_free(tmpne);
1890                         }
1891                 }
1892
1893         if (BN_is_zero(serial))
1894                 row[DB_serial]=BUF_strdup("00");
1895         else
1896                 row[DB_serial]=BN_bn2hex(serial);
1897         if (row[DB_serial] == NULL)
1898                 {
1899                 BIO_printf(bio_err,"Memory allocation failure\n");
1900                 goto err;
1901                 }
1902
1903         if (db->attributes.unique_subject)
1904                 {
1905                 rrow=TXT_DB_get_by_index(db->db,DB_name,row);
1906                 if (rrow != NULL)
1907                         {
1908                         BIO_printf(bio_err,
1909                                 "ERROR:There is already a certificate for %s\n",
1910                                 row[DB_name]);
1911                         }
1912                 }
1913         if (rrow == NULL)
1914                 {
1915                 rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
1916                 if (rrow != NULL)
1917                         {
1918                         BIO_printf(bio_err,"ERROR:Serial number %s has already been issued,\n",
1919                                 row[DB_serial]);
1920                         BIO_printf(bio_err,"      check the database/serial_file for corruption\n");
1921                         }
1922                 }
1923
1924         if (rrow != NULL)
1925                 {
1926                 BIO_printf(bio_err,
1927                         "The matching entry has the following details\n");
1928                 if (rrow[DB_type][0] == 'E')
1929                         p="Expired";
1930                 else if (rrow[DB_type][0] == 'R')
1931                         p="Revoked";
1932                 else if (rrow[DB_type][0] == 'V')
1933                         p="Valid";
1934                 else
1935                         p="\ninvalid type, Data base error\n";
1936                 BIO_printf(bio_err,"Type          :%s\n",p);;
1937                 if (rrow[DB_type][0] == 'R')
1938                         {
1939                         p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1940                         BIO_printf(bio_err,"Was revoked on:%s\n",p);
1941                         }
1942                 p=rrow[DB_exp_date]; if (p == NULL) p="undef";
1943                 BIO_printf(bio_err,"Expires on    :%s\n",p);
1944                 p=rrow[DB_serial]; if (p == NULL) p="undef";
1945                 BIO_printf(bio_err,"Serial Number :%s\n",p);
1946                 p=rrow[DB_file]; if (p == NULL) p="undef";
1947                 BIO_printf(bio_err,"File name     :%s\n",p);
1948                 p=rrow[DB_name]; if (p == NULL) p="undef";
1949                 BIO_printf(bio_err,"Subject Name  :%s\n",p);
1950                 ok= -1; /* This is now a 'bad' error. */
1951                 goto err;
1952                 }
1953
1954         /* We are now totally happy, lets make and sign the certificate */
1955         if (verbose)
1956                 BIO_printf(bio_err,"Everything appears to be ok, creating and signing the certificate\n");
1957
1958         if ((ret=X509_new()) == NULL) goto err;
1959         ci=ret->cert_info;
1960
1961 #ifdef X509_V3
1962         /* Make it an X509 v3 certificate. */
1963         if (!X509_set_version(ret,2)) goto err;
1964 #endif
1965
1966         if (BN_to_ASN1_INTEGER(serial,ci->serialNumber) == NULL)
1967                 goto err;
1968         if (!X509_set_issuer_name(ret,X509_get_subject_name(x509)))
1969                 goto err;
1970
1971         if (strcmp(startdate,"today") == 0)
1972                 X509_gmtime_adj(X509_get_notBefore(ret),0);
1973         else ASN1_UTCTIME_set_string(X509_get_notBefore(ret),startdate);
1974
1975         if (enddate == NULL)
1976                 X509_gmtime_adj(X509_get_notAfter(ret),(long)60*60*24*days);
1977         else ASN1_UTCTIME_set_string(X509_get_notAfter(ret),enddate);
1978
1979         if (!X509_set_subject_name(ret,subject)) goto err;
1980
1981         pktmp=X509_REQ_get_pubkey(req);
1982         i = X509_set_pubkey(ret,pktmp);
1983         EVP_PKEY_free(pktmp);
1984         if (!i) goto err;
1985
1986         /* Lets add the extensions, if there are any */
1987         if (ext_sect)
1988                 {
1989                 X509V3_CTX ctx;
1990                 if (ci->version == NULL)
1991                         if ((ci->version=ASN1_INTEGER_new()) == NULL)
1992                                 goto err;
1993                 ASN1_INTEGER_set(ci->version,2); /* version 3 certificate */
1994
1995                 /* Free the current entries if any, there should not
1996                  * be any I believe */
1997                 if (ci->extensions != NULL)
1998                         sk_X509_EXTENSION_pop_free(ci->extensions,
1999                                                    X509_EXTENSION_free);
2000
2001                 ci->extensions = NULL;
2002
2003                 /* Initialize the context structure */
2004                 X509V3_set_ctx(&ctx, x509, ret, req, NULL, 0);
2005
2006                 if (extconf)
2007                         {
2008                         if (verbose)
2009                                 BIO_printf(bio_err, "Extra configuration file found\n");
2010
2011                         /* Use the extconf configuration db LHASH */
2012                         X509V3_set_nconf(&ctx, extconf);
2013
2014                         /* Test the structure (needed?) */
2015                         /* X509V3_set_ctx_test(&ctx); */
2016
2017                         /* Adds exts contained in the configuration file */
2018                         if (!X509V3_EXT_add_nconf(extconf, &ctx, ext_sect,ret))
2019                                 {
2020                                 BIO_printf(bio_err,
2021                                     "ERROR: adding extensions in section %s\n",
2022                                                                 ext_sect);
2023                                 ERR_print_errors(bio_err);
2024                                 goto err;
2025                                 }
2026                         if (verbose)
2027                                 BIO_printf(bio_err, "Successfully added extensions from file.\n");
2028                         }
2029                 else if (ext_sect)
2030                         {
2031                         /* We found extensions to be set from config file */
2032                         X509V3_set_nconf(&ctx, lconf);
2033
2034                         if(!X509V3_EXT_add_nconf(lconf, &ctx, ext_sect, ret))
2035                                 {
2036                                 BIO_printf(bio_err, "ERROR: adding extensions in section %s\n", ext_sect);
2037                                 ERR_print_errors(bio_err);
2038                                 goto err;
2039                                 }
2040
2041                         if (verbose)
2042                                 BIO_printf(bio_err, "Successfully added extensions from config\n");
2043                         }
2044                 }
2045
2046         /* Copy extensions from request (if any) */
2047
2048         if (!copy_extensions(ret, req, ext_copy))
2049                 {
2050                 BIO_printf(bio_err, "ERROR: adding extensions from request\n");
2051                 ERR_print_errors(bio_err);
2052                 goto err;
2053                 }
2054
2055         /* Set the right value for the noemailDN option */
2056         if( email_dn == 0 )
2057                 {
2058                 if (!X509_set_subject_name(ret,dn_subject)) goto err;
2059                 }
2060
2061         if (!default_op)
2062                 {
2063                 BIO_printf(bio_err, "Certificate Details:\n");
2064                 /* Never print signature details because signature not present */
2065                 certopt |= X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_SIGNAME;
2066                 X509_print_ex(bio_err, ret, nameopt, certopt);
2067                 }
2068
2069         BIO_printf(bio_err,"Certificate is to be certified until ");
2070         ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ret));
2071         if (days) BIO_printf(bio_err," (%d days)",days);
2072         BIO_printf(bio_err, "\n");
2073
2074         if (!batch)
2075                 {
2076
2077                 BIO_printf(bio_err,"Sign the certificate? [y/n]:");
2078                 (void)BIO_flush(bio_err);
2079                 buf[0]='\0';
2080                 fgets(buf,sizeof(buf)-1,stdin);
2081                 if (!((buf[0] == 'y') || (buf[0] == 'Y')))
2082                         {
2083                         BIO_printf(bio_err,"CERTIFICATE WILL NOT BE CERTIFIED\n");
2084                         ok=0;
2085                         goto err;
2086                         }
2087                 }
2088
2089
2090 #ifndef OPENSSL_NO_DSA
2091         if (pkey->type == EVP_PKEY_DSA) dgst=EVP_dss1();
2092         pktmp=X509_get_pubkey(ret);
2093         if (EVP_PKEY_missing_parameters(pktmp) &&
2094                 !EVP_PKEY_missing_parameters(pkey))
2095                 EVP_PKEY_copy_parameters(pktmp,pkey);
2096         EVP_PKEY_free(pktmp);
2097 #endif
2098 #ifndef OPENSSL_NO_ECDSA
2099         if (pkey->type == EVP_PKEY_EC)
2100                 dgst = EVP_ecdsa();
2101         pktmp = X509_get_pubkey(ret);
2102         if (EVP_PKEY_missing_parameters(pktmp) &&
2103                 !EVP_PKEY_missing_parameters(pkey))
2104                 EVP_PKEY_copy_parameters(pktmp, pkey);
2105         EVP_PKEY_free(pktmp);
2106 #endif
2107
2108
2109         if (!X509_sign(ret,pkey,dgst))
2110                 goto err;
2111
2112         /* We now just add it to the database */
2113         row[DB_type]=(char *)OPENSSL_malloc(2);
2114
2115         tm=X509_get_notAfter(ret);
2116         row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2117         memcpy(row[DB_exp_date],tm->data,tm->length);
2118         row[DB_exp_date][tm->length]='\0';
2119
2120         row[DB_rev_date]=NULL;
2121
2122         /* row[DB_serial] done already */
2123         row[DB_file]=(char *)OPENSSL_malloc(8);
2124         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
2125
2126         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2127                 (row[DB_file] == NULL) || (row[DB_name] == NULL))
2128                 {
2129                 BIO_printf(bio_err,"Memory allocation failure\n");
2130                 goto err;
2131                 }
2132         strcpy(row[DB_file],"unknown");
2133         row[DB_type][0]='V';
2134         row[DB_type][1]='\0';
2135
2136         if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2137                 {
2138                 BIO_printf(bio_err,"Memory allocation failure\n");
2139                 goto err;
2140                 }
2141
2142         for (i=0; i<DB_NUMBER; i++)
2143                 {
2144                 irow[i]=row[i];
2145                 row[i]=NULL;
2146                 }
2147         irow[DB_NUMBER]=NULL;
2148
2149         if (!TXT_DB_insert(db->db,irow))
2150                 {
2151                 BIO_printf(bio_err,"failed to update database\n");
2152                 BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2153                 goto err;
2154                 }
2155         ok=1;
2156 err:
2157         for (i=0; i<DB_NUMBER; i++)
2158                 if (row[i] != NULL) OPENSSL_free(row[i]);
2159
2160         if (CAname != NULL)
2161                 X509_NAME_free(CAname);
2162         if (subject != NULL)
2163                 X509_NAME_free(subject);
2164         if ((dn_subject != NULL) && !email_dn)
2165                 X509_NAME_free(dn_subject);
2166         if (tmptm != NULL)
2167                 ASN1_UTCTIME_free(tmptm);
2168         if (ok <= 0)
2169                 {
2170                 if (ret != NULL) X509_free(ret);
2171                 ret=NULL;
2172                 }
2173         else
2174                 *xret=ret;
2175         return(ok);
2176         }
2177
2178 static void write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
2179         {
2180
2181         if (output_der)
2182                 {
2183                 (void)i2d_X509_bio(bp,x);
2184                 return;
2185                 }
2186 #if 0
2187         /* ??? Not needed since X509_print prints all this stuff anyway */
2188         f=X509_NAME_oneline(X509_get_issuer_name(x),buf,256);
2189         BIO_printf(bp,"issuer :%s\n",f);
2190
2191         f=X509_NAME_oneline(X509_get_subject_name(x),buf,256);
2192         BIO_printf(bp,"subject:%s\n",f);
2193
2194         BIO_puts(bp,"serial :");
2195         i2a_ASN1_INTEGER(bp,x->cert_info->serialNumber);
2196         BIO_puts(bp,"\n\n");
2197 #endif
2198         if (!notext)X509_print(bp,x);
2199         PEM_write_bio_X509(bp,x);
2200         }
2201
2202 static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
2203              const EVP_MD *dgst, STACK_OF(CONF_VALUE) *policy, CA_DB *db,
2204              BIGNUM *serial, char *subj, int email_dn, char *startdate, char *enddate,
2205              long days, char *ext_sect, CONF *lconf, int verbose, unsigned long certopt,
2206              unsigned long nameopt, int default_op, int ext_copy)
2207         {
2208         STACK_OF(CONF_VALUE) *sk=NULL;
2209         LHASH *parms=NULL;
2210         X509_REQ *req=NULL;
2211         CONF_VALUE *cv=NULL;
2212         NETSCAPE_SPKI *spki = NULL;
2213         X509_REQ_INFO *ri;
2214         char *type,*buf;
2215         EVP_PKEY *pktmp=NULL;
2216         X509_NAME *n=NULL;
2217         X509_NAME_ENTRY *ne=NULL;
2218         int ok= -1,i,j;
2219         long errline;
2220         int nid;
2221
2222         /*
2223          * Load input file into a hash table.  (This is just an easy
2224          * way to read and parse the file, then put it into a convenient
2225          * STACK format).
2226          */
2227         parms=CONF_load(NULL,infile,&errline);
2228         if (parms == NULL)
2229                 {
2230                 BIO_printf(bio_err,"error on line %ld of %s\n",errline,infile);
2231                 ERR_print_errors(bio_err);
2232                 goto err;
2233                 }
2234
2235         sk=CONF_get_section(parms, "default");
2236         if (sk_CONF_VALUE_num(sk) == 0)
2237                 {
2238                 BIO_printf(bio_err, "no name/value pairs found in %s\n", infile);
2239                 CONF_free(parms);
2240                 goto err;
2241                 }
2242
2243         /*
2244          * Now create a dummy X509 request structure.  We don't actually
2245          * have an X509 request, but we have many of the components
2246          * (a public key, various DN components).  The idea is that we
2247          * put these components into the right X509 request structure
2248          * and we can use the same code as if you had a real X509 request.
2249          */
2250         req=X509_REQ_new();
2251         if (req == NULL)
2252                 {
2253                 ERR_print_errors(bio_err);
2254                 goto err;
2255                 }
2256
2257         /*
2258          * Build up the subject name set.
2259          */
2260         ri=req->req_info;
2261         n = ri->subject;
2262
2263         for (i = 0; ; i++)
2264                 {
2265                 if (sk_CONF_VALUE_num(sk) <= i) break;
2266
2267                 cv=sk_CONF_VALUE_value(sk,i);
2268                 type=cv->name;
2269                 /* Skip past any leading X. X: X, etc to allow for
2270                  * multiple instances
2271                  */
2272                 for (buf = cv->name; *buf ; buf++)
2273                         if ((*buf == ':') || (*buf == ',') || (*buf == '.'))
2274                                 {
2275                                 buf++;
2276                                 if (*buf) type = buf;
2277                                 break;
2278                                 }
2279
2280                 buf=cv->value;
2281                 if ((nid=OBJ_txt2nid(type)) == NID_undef)
2282                         {
2283                         if (strcmp(type, "SPKAC") == 0)
2284                                 {
2285                                 spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
2286                                 if (spki == NULL)
2287                                         {
2288                                         BIO_printf(bio_err,"unable to load Netscape SPKAC structure\n");
2289                                         ERR_print_errors(bio_err);
2290                                         goto err;
2291                                         }
2292                                 }
2293                         continue;
2294                         }
2295
2296                 /*
2297                 if ((nid == NID_pkcs9_emailAddress) && (email_dn == 0))
2298                         continue;
2299                 */
2300
2301                 j=ASN1_PRINTABLE_type((unsigned char *)buf,-1);
2302                 if (fix_data(nid, &j) == 0)
2303                         {
2304                         BIO_printf(bio_err,
2305                                 "invalid characters in string %s\n",buf);
2306                         goto err;
2307                         }
2308
2309                 if ((ne=X509_NAME_ENTRY_create_by_NID(&ne,nid,j,
2310                         (unsigned char *)buf,
2311                         strlen(buf))) == NULL)
2312                         goto err;
2313
2314                 if (!X509_NAME_add_entry(n,ne,-1, 0)) goto err;
2315                 }
2316         if (spki == NULL)
2317                 {
2318                 BIO_printf(bio_err,"Netscape SPKAC structure not found in %s\n",
2319                         infile);
2320                 goto err;
2321                 }
2322
2323         /*
2324          * Now extract the key from the SPKI structure.
2325          */
2326
2327         BIO_printf(bio_err,"Check that the SPKAC request matches the signature\n");
2328
2329         if ((pktmp=NETSCAPE_SPKI_get_pubkey(spki)) == NULL)
2330                 {
2331                 BIO_printf(bio_err,"error unpacking SPKAC public key\n");
2332                 goto err;
2333                 }
2334
2335         j = NETSCAPE_SPKI_verify(spki, pktmp);
2336         if (j <= 0)
2337                 {
2338                 BIO_printf(bio_err,"signature verification failed on SPKAC public key\n");
2339                 goto err;
2340                 }
2341         BIO_printf(bio_err,"Signature ok\n");
2342
2343         X509_REQ_set_pubkey(req,pktmp);
2344         EVP_PKEY_free(pktmp);
2345         ok=do_body(xret,pkey,x509,dgst,policy,db,serial,subj,email_dn,startdate,enddate,
2346                    days,1,verbose,req,ext_sect,lconf, certopt, nameopt, default_op,
2347                         ext_copy);
2348 err:
2349         if (req != NULL) X509_REQ_free(req);
2350         if (parms != NULL) CONF_free(parms);
2351         if (spki != NULL) NETSCAPE_SPKI_free(spki);
2352         if (ne != NULL) X509_NAME_ENTRY_free(ne);
2353
2354         return(ok);
2355         }
2356
2357 static int fix_data(int nid, int *type)
2358         {
2359         if (nid == NID_pkcs9_emailAddress)
2360                 *type=V_ASN1_IA5STRING;
2361         if ((nid == NID_commonName) && (*type == V_ASN1_IA5STRING))
2362                 *type=V_ASN1_T61STRING;
2363         if ((nid == NID_pkcs9_challengePassword) && (*type == V_ASN1_IA5STRING))
2364                 *type=V_ASN1_T61STRING;
2365         if ((nid == NID_pkcs9_unstructuredName) && (*type == V_ASN1_T61STRING))
2366                 return(0);
2367         if (nid == NID_pkcs9_unstructuredName)
2368                 *type=V_ASN1_IA5STRING;
2369         return(1);
2370         }
2371
2372 static int check_time_format(char *str)
2373         {
2374         ASN1_UTCTIME tm;
2375
2376         tm.data=(unsigned char *)str;
2377         tm.length=strlen(str);
2378         tm.type=V_ASN1_UTCTIME;
2379         return(ASN1_UTCTIME_check(&tm));
2380         }
2381
2382 static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
2383         {
2384         ASN1_UTCTIME *tm=NULL;
2385         char *row[DB_NUMBER],**rrow,**irow;
2386         char *rev_str = NULL;
2387         BIGNUM *bn = NULL;
2388         int ok=-1,i;
2389
2390         for (i=0; i<DB_NUMBER; i++)
2391                 row[i]=NULL;
2392         row[DB_name]=X509_NAME_oneline(X509_get_subject_name(x509),NULL,0);
2393         bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509),NULL);
2394         if (BN_is_zero(bn))
2395                 row[DB_serial]=BUF_strdup("00");
2396         else
2397                 row[DB_serial]=BN_bn2hex(bn);
2398         BN_free(bn);
2399         if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
2400                 {
2401                 BIO_printf(bio_err,"Memory allocation failure\n");
2402                 goto err;
2403                 }
2404         /* We have to lookup by serial number because name lookup
2405          * skips revoked certs
2406          */
2407         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2408         if (rrow == NULL)
2409                 {
2410                 BIO_printf(bio_err,"Adding Entry with serial number %s to DB for %s\n", row[DB_serial], row[DB_name]);
2411
2412                 /* We now just add it to the database */
2413                 row[DB_type]=(char *)OPENSSL_malloc(2);
2414
2415                 tm=X509_get_notAfter(x509);
2416                 row[DB_exp_date]=(char *)OPENSSL_malloc(tm->length+1);
2417                 memcpy(row[DB_exp_date],tm->data,tm->length);
2418                 row[DB_exp_date][tm->length]='\0';
2419
2420                 row[DB_rev_date]=NULL;
2421
2422                 /* row[DB_serial] done already */
2423                 row[DB_file]=(char *)OPENSSL_malloc(8);
2424
2425                 /* row[DB_name] done already */
2426
2427                 if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
2428                         (row[DB_file] == NULL))
2429                         {
2430                         BIO_printf(bio_err,"Memory allocation failure\n");
2431                         goto err;
2432                         }
2433                 strcpy(row[DB_file],"unknown");
2434                 row[DB_type][0]='V';
2435                 row[DB_type][1]='\0';
2436
2437                 if ((irow=(char **)OPENSSL_malloc(sizeof(char *)*(DB_NUMBER+1))) == NULL)
2438                         {
2439                         BIO_printf(bio_err,"Memory allocation failure\n");
2440                         goto err;
2441                         }
2442
2443                 for (i=0; i<DB_NUMBER; i++)
2444                         {
2445                         irow[i]=row[i];
2446                         row[i]=NULL;
2447                         }
2448                 irow[DB_NUMBER]=NULL;
2449
2450                 if (!TXT_DB_insert(db->db,irow))
2451                         {
2452                         BIO_printf(bio_err,"failed to update database\n");
2453                         BIO_printf(bio_err,"TXT_DB error number %ld\n",db->db->error);
2454                         goto err;
2455                         }
2456
2457                 /* Revoke Certificate */
2458                 ok = do_revoke(x509,db, type, value);
2459
2460                 goto err;
2461
2462                 }
2463         else if (index_name_cmp((const char **)row,(const char **)rrow))
2464                 {
2465                 BIO_printf(bio_err,"ERROR:name does not match %s\n",
2466                            row[DB_name]);
2467                 goto err;
2468                 }
2469         else if (rrow[DB_type][0]=='R')
2470                 {
2471                 BIO_printf(bio_err,"ERROR:Already revoked, serial number %s\n",
2472                            row[DB_serial]);
2473                 goto err;
2474                 }
2475         else
2476                 {
2477                 BIO_printf(bio_err,"Revoking Certificate %s.\n", rrow[DB_serial]);
2478                 rev_str = make_revocation_str(type, value);
2479                 if (!rev_str)
2480                         {
2481                         BIO_printf(bio_err, "Error in revocation arguments\n");
2482                         goto err;
2483                         }
2484                 rrow[DB_type][0]='R';
2485                 rrow[DB_type][1]='\0';
2486                 rrow[DB_rev_date] = rev_str;
2487                 }
2488         ok=1;
2489 err:
2490         for (i=0; i<DB_NUMBER; i++)
2491                 {
2492                 if (row[i] != NULL)
2493                         OPENSSL_free(row[i]);
2494                 }
2495         return(ok);
2496         }
2497
2498 static int get_certificate_status(const char *serial, CA_DB *db)
2499         {
2500         char *row[DB_NUMBER],**rrow;
2501         int ok=-1,i;
2502
2503         /* Free Resources */
2504         for (i=0; i<DB_NUMBER; i++)
2505                 row[i]=NULL;
2506
2507         /* Malloc needed char spaces */
2508         row[DB_serial] = OPENSSL_malloc(strlen(serial) + 2);
2509         if (row[DB_serial] == NULL)
2510                 {
2511                 BIO_printf(bio_err,"Malloc failure\n");
2512                 goto err;
2513                 }
2514
2515         if (strlen(serial) % 2)
2516                 {
2517                 /* Set the first char to 0 */;
2518                 row[DB_serial][0]='0';
2519
2520                 /* Copy String from serial to row[DB_serial] */
2521                 memcpy(row[DB_serial]+1, serial, strlen(serial));
2522                 row[DB_serial][strlen(serial)+1]='\0';
2523                 }
2524         else
2525                 {
2526                 /* Copy String from serial to row[DB_serial] */
2527                 memcpy(row[DB_serial], serial, strlen(serial));
2528                 row[DB_serial][strlen(serial)]='\0';
2529                 }
2530
2531         /* Make it Upper Case */
2532         for (i=0; row[DB_serial][i] != '\0'; i++)
2533                 row[DB_serial][i] = toupper(row[DB_serial][i]);
2534
2535
2536         ok=1;
2537
2538         /* Search for the certificate */
2539         rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
2540         if (rrow == NULL)
2541                 {
2542                 BIO_printf(bio_err,"Serial %s not present in db.\n",
2543                                  row[DB_serial]);
2544                 ok=-1;
2545                 goto err;
2546                 }
2547         else if (rrow[DB_type][0]=='V')
2548                 {
2549                 BIO_printf(bio_err,"%s=Valid (%c)\n",
2550                         row[DB_serial], rrow[DB_type][0]);
2551                 goto err;
2552                 }
2553         else if (rrow[DB_type][0]=='R')
2554                 {
2555                 BIO_printf(bio_err,"%s=Revoked (%c)\n",
2556                         row[DB_serial], rrow[DB_type][0]);
2557                 goto err;
2558                 }
2559         else if (rrow[DB_type][0]=='E')
2560                 {
2561                 BIO_printf(bio_err,"%s=Expired (%c)\n",
2562                         row[DB_serial], rrow[DB_type][0]);
2563                 goto err;
2564                 }
2565         else if (rrow[DB_type][0]=='S')
2566                 {
2567                 BIO_printf(bio_err,"%s=Suspended (%c)\n",
2568                         row[DB_serial], rrow[DB_type][0]);
2569                 goto err;
2570                 }
2571         else
2572                 {
2573                 BIO_printf(bio_err,"%s=Unknown (%c).\n",
2574                         row[DB_serial], rrow[DB_type][0]);
2575                 ok=-1;
2576                 }
2577 err:
2578         for (i=0; i<DB_NUMBER; i++)
2579                 {
2580                 if (row[i] != NULL)
2581                         OPENSSL_free(row[i]);
2582                 }
2583         return(ok);
2584         }
2585
2586 static int do_updatedb (CA_DB *db)
2587         {
2588         ASN1_UTCTIME    *a_tm = NULL;
2589         int i, cnt = 0;
2590         int db_y2k, a_y2k;  /* flags = 1 if y >= 2000 */
2591         char **rrow, *a_tm_s;
2592
2593         a_tm = ASN1_UTCTIME_new();
2594
2595         /* get actual time and make a string */
2596         a_tm = X509_gmtime_adj(a_tm, 0);
2597         a_tm_s = (char *) OPENSSL_malloc(a_tm->length+1);
2598         if (a_tm_s == NULL)
2599                 {
2600                 cnt = -1;
2601                 goto err;
2602                 }
2603
2604         memcpy(a_tm_s, a_tm->data, a_tm->length);
2605         a_tm_s[a_tm->length] = '\0';
2606
2607         if (strncmp(a_tm_s, "49", 2) <= 0)
2608                 a_y2k = 1;
2609         else
2610                 a_y2k = 0;
2611
2612         for (i = 0; i < sk_num(db->db->data); i++)
2613                 {
2614                 rrow = (char **) sk_value(db->db->data, i);
2615
2616                 if (rrow[DB_type][0] == 'V')
2617                         {
2618                         /* ignore entries that are not valid */
2619                         if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2620                                 db_y2k = 1;
2621                         else
2622                                 db_y2k = 0;
2623
2624                         if (db_y2k == a_y2k)
2625                                 {
2626                                 /* all on the same y2k side */
2627                                 if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)
2628                                         {
2629                                         rrow[DB_type][0]  = 'E';
2630                                         rrow[DB_type][1]  = '\0';
2631                                         cnt++;
2632
2633                                         BIO_printf(bio_err, "%s=Expired\n",
2634                                                         rrow[DB_serial]);
2635                                         }
2636                                 }
2637                         else if (db_y2k < a_y2k)
2638                                 {
2639                                 rrow[DB_type][0]  = 'E';
2640                                 rrow[DB_type][1]  = '\0';
2641                                 cnt++;
2642
2643                                 BIO_printf(bio_err, "%s=Expired\n",
2644                                                         rrow[DB_serial]);
2645                                 }
2646
2647                         }
2648                 }
2649
2650 err:
2651
2652         ASN1_UTCTIME_free(a_tm);
2653         OPENSSL_free(a_tm_s);
2654
2655         return (cnt);
2656         }
2657
2658 static char *crl_reasons[] = {
2659         /* CRL reason strings */
2660         "unspecified",
2661         "keyCompromise",
2662         "CACompromise",
2663         "affiliationChanged",
2664         "superseded",
2665         "cessationOfOperation",
2666         "certificateHold",
2667         "removeFromCRL",
2668         /* Additional pseudo reasons */
2669         "holdInstruction",
2670         "keyTime",
2671         "CAkeyTime"
2672 };
2673
2674 #define NUM_REASONS (sizeof(crl_reasons) / sizeof(char *))
2675
2676 /* Given revocation information convert to a DB string.
2677  * The format of the string is:
2678  * revtime[,reason,extra]. Where 'revtime' is the
2679  * revocation time (the current time). 'reason' is the
2680  * optional CRL reason and 'extra' is any additional
2681  * argument
2682  */
2683
2684 char *make_revocation_str(int rev_type, char *rev_arg)
2685         {
2686         char *reason = NULL, *other = NULL, *str;
2687         ASN1_OBJECT *otmp;
2688         ASN1_UTCTIME *revtm = NULL;
2689         int i;
2690         switch (rev_type)
2691                 {
2692         case REV_NONE:
2693                 break;
2694
2695         case REV_CRL_REASON:
2696                 for (i = 0; i < 8; i++)
2697                         {
2698                         if (!strcasecmp(rev_arg, crl_reasons[i]))
2699                                 {
2700                                 reason = crl_reasons[i];
2701                                 break;
2702                                 }
2703                         }
2704                 if (reason == NULL)
2705                         {
2706                         BIO_printf(bio_err, "Unknown CRL reason %s\n", rev_arg);
2707                         return NULL;
2708                         }
2709                 break;
2710
2711         case REV_HOLD:
2712                 /* Argument is an OID */
2713
2714                 otmp = OBJ_txt2obj(rev_arg, 0);
2715                 ASN1_OBJECT_free(otmp);
2716
2717                 if (otmp == NULL)
2718                         {
2719                         BIO_printf(bio_err, "Invalid object identifier %s\n", rev_arg);
2720                         return NULL;
2721                         }
2722
2723                 reason = "holdInstruction";
2724                 other = rev_arg;
2725                 break;
2726
2727         case REV_KEY_COMPROMISE:
2728         case REV_CA_COMPROMISE:
2729
2730                 /* Argument is the key compromise time  */
2731                 if (!ASN1_GENERALIZEDTIME_set_string(NULL, rev_arg))
2732                         {
2733                         BIO_printf(bio_err, "Invalid time format %s. Need YYYYMMDDHHMMSSZ\n", rev_arg);
2734                         return NULL;
2735                         }
2736                 other = rev_arg;
2737                 if (rev_type == REV_KEY_COMPROMISE)
2738                         reason = "keyTime";
2739                 else
2740                         reason = "CAkeyTime";
2741
2742                 break;
2743
2744                 }
2745
2746         revtm = X509_gmtime_adj(NULL, 0);
2747
2748         i = revtm->length + 1;
2749
2750         if (reason) i += strlen(reason) + 1;
2751         if (other) i += strlen(other) + 1;
2752
2753         str = OPENSSL_malloc(i);
2754
2755         if (!str) return NULL;
2756
2757         strcpy(str, (char *)revtm->data);
2758         if (reason)
2759                 {
2760                 strcat(str, ",");
2761                 strcat(str, reason);
2762                 }
2763         if (other)
2764                 {
2765                 strcat(str, ",");
2766                 strcat(str, other);
2767                 }
2768         ASN1_UTCTIME_free(revtm);
2769         return str;
2770         }
2771
2772 /* Convert revocation field to X509_REVOKED entry
2773  * return code:
2774  * 0 error
2775  * 1 OK
2776  * 2 OK and some extensions added (i.e. V2 CRL)
2777  */
2778
2779
2780 int make_revoked(X509_REVOKED *rev, char *str)
2781         {
2782         char *tmp = NULL;
2783         int reason_code = -1;
2784         int i, ret = 0;
2785         ASN1_OBJECT *hold = NULL;
2786         ASN1_GENERALIZEDTIME *comp_time = NULL;
2787         ASN1_ENUMERATED *rtmp = NULL;
2788
2789         ASN1_TIME *revDate = NULL;
2790
2791         i = unpack_revinfo(&revDate, &reason_code, &hold, &comp_time, str);
2792
2793         if (i == 0)
2794                 goto err;
2795
2796         if (rev && !X509_REVOKED_set_revocationDate(rev, revDate))
2797                 goto err;
2798
2799         if (rev && (reason_code != OCSP_REVOKED_STATUS_NOSTATUS))
2800                 {
2801                 rtmp = ASN1_ENUMERATED_new();
2802                 if (!rtmp || !ASN1_ENUMERATED_set(rtmp, reason_code))
2803                         goto err;
2804                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_crl_reason, rtmp, 0, 0))
2805                         goto err;
2806                 }
2807
2808         if (rev && comp_time)
2809                 {
2810                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_invalidity_date, comp_time, 0, 0))
2811                         goto err;
2812                 }
2813         if (rev && hold)
2814                 {
2815                 if (!X509_REVOKED_add1_ext_i2d(rev, NID_hold_instruction_code, hold, 0, 0))
2816                         goto err;
2817                 }
2818
2819         if (reason_code != OCSP_REVOKED_STATUS_NOSTATUS)
2820                 ret = 2;
2821         else ret = 1;
2822
2823         err:
2824
2825         if (tmp) OPENSSL_free(tmp);
2826         ASN1_OBJECT_free(hold);
2827         ASN1_GENERALIZEDTIME_free(comp_time);
2828         ASN1_ENUMERATED_free(rtmp);
2829         ASN1_TIME_free(revDate);
2830
2831         return ret;
2832         }
2833
2834 /*
2835  * subject is expected to be in the format /type0=value0/type1=value1/type2=...
2836  * where characters may be escaped by \
2837  */
2838 X509_NAME *do_subject(char *subject, long chtype)
2839         {
2840         size_t buflen = strlen(subject)+1; /* to copy the types and values into. due to escaping, the copy can only become shorter */
2841         char *buf = OPENSSL_malloc(buflen);
2842         size_t max_ne = buflen / 2 + 1; /* maximum number of name elements */
2843         char **ne_types = OPENSSL_malloc(max_ne * sizeof (char *));
2844         char **ne_values = OPENSSL_malloc(max_ne * sizeof (char *));
2845
2846         char *sp = subject, *bp = buf;
2847         int i, ne_num = 0;
2848
2849         X509_NAME *n = NULL;
2850         int nid;
2851
2852         if (!buf || !ne_types || !ne_values)
2853                 {
2854                 BIO_printf(bio_err, "malloc error\n");
2855                 goto error;
2856                 }
2857
2858         if (*subject != '/')
2859                 {
2860                 BIO_printf(bio_err, "Subject does not start with '/'.\n");
2861                 goto error;
2862                 }
2863         sp++; /* skip leading / */
2864
2865         while (*sp)
2866                 {
2867                 /* collect type */
2868                 ne_types[ne_num] = bp;
2869                 while (*sp)
2870                         {
2871                         if (*sp == '\\') /* is there anything to escape in the type...? */
2872                                 {
2873                                 if (*++sp)
2874                                         *bp++ = *sp++;
2875                                 else
2876                                         {
2877                                         BIO_printf(bio_err, "escape character at end of string\n");
2878                                         goto error;
2879                                         }
2880                                 }
2881                         else if (*sp == '=')
2882                                 {
2883                                 sp++;
2884                                 *bp++ = '\0';
2885                                 break;
2886                                 }
2887                         else
2888                                 *bp++ = *sp++;
2889                         }
2890                 if (!*sp)
2891                         {
2892                         BIO_printf(bio_err, "end of string encountered while processing type of subject name element #%d\n", ne_num);
2893                         goto error;
2894                         }
2895                 ne_values[ne_num] = bp;
2896                 while (*sp)
2897                         {
2898                         if (*sp == '\\')
2899                                 {
2900                                 if (*++sp)
2901                                         *bp++ = *sp++;
2902                                 else
2903                                         {
2904                                         BIO_printf(bio_err, "escape character at end of string\n");
2905                                         goto error;
2906                                         }
2907                                 }
2908                         else if (*sp == '/')
2909                                 {
2910                                 sp++;
2911                                 break;
2912                                 }
2913                         else
2914                                 *bp++ = *sp++;
2915                         }
2916                 *bp++ = '\0';
2917                 ne_num++;
2918                 }
2919
2920         if (!(n = X509_NAME_new()))
2921                 goto error;
2922
2923         for (i = 0; i < ne_num; i++)
2924                 {
2925                 if ((nid=OBJ_txt2nid(ne_types[i])) == NID_undef)
2926                         {
2927                         BIO_printf(bio_err, "Subject Attribute %s has no known NID, skipped\n", ne_types[i]);
2928                         continue;
2929                         }
2930
2931                 if (!*ne_values[i])
2932                         {
2933                         BIO_printf(bio_err, "No value provided for Subject Attribute %s, skipped\n", ne_types[i]);
2934                         continue;
2935                         }
2936
2937                 if (!X509_NAME_add_entry_by_NID(n, nid, chtype, (unsigned char*)ne_values[i], -1,-1,0))
2938                         goto error;
2939                 }
2940
2941         OPENSSL_free(ne_values);
2942         OPENSSL_free(ne_types);
2943         OPENSSL_free(buf);
2944         return n;
2945
2946 error:
2947         X509_NAME_free(n);
2948         if (ne_values)
2949                 OPENSSL_free(ne_values);
2950         if (ne_types)
2951                 OPENSSL_free(ne_types);
2952         if (buf)
2953                 OPENSSL_free(buf);
2954         return NULL;
2955 }
2956
2957 int old_entry_print(BIO *bp, ASN1_OBJECT *obj, ASN1_STRING *str)
2958         {
2959         char buf[25],*pbuf, *p;
2960         int j;
2961         j=i2a_ASN1_OBJECT(bp,obj);
2962         pbuf=buf;
2963         for (j=22-j; j>0; j--)
2964                 *(pbuf++)=' ';
2965         *(pbuf++)=':';
2966         *(pbuf++)='\0';
2967         BIO_puts(bp,buf);
2968
2969         if (str->type == V_ASN1_PRINTABLESTRING)
2970                 BIO_printf(bp,"PRINTABLE:'");
2971         else if (str->type == V_ASN1_T61STRING)
2972                 BIO_printf(bp,"T61STRING:'");
2973         else if (str->type == V_ASN1_IA5STRING)
2974                 BIO_printf(bp,"IA5STRING:'");
2975         else if (str->type == V_ASN1_UNIVERSALSTRING)
2976                 BIO_printf(bp,"UNIVERSALSTRING:'");
2977         else
2978                 BIO_printf(bp,"ASN.1 %2d:'",str->type);
2979
2980         p=(char *)str->data;
2981         for (j=str->length; j>0; j--)
2982                 {
2983                 if ((*p >= ' ') && (*p <= '~'))
2984                         BIO_printf(bp,"%c",*p);
2985                 else if (*p & 0x80)
2986                         BIO_printf(bp,"\\0x%02X",*p);
2987                 else if ((unsigned char)*p == 0xf7)
2988                         BIO_printf(bp,"^?");
2989                 else    BIO_printf(bp,"^%c",*p+'@');
2990                 p++;
2991                 }
2992         BIO_printf(bp,"'\n");
2993         return 1;
2994         }
2995
2996 int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold, ASN1_GENERALIZEDTIME **pinvtm, char *str)
2997         {
2998         char *tmp = NULL;
2999         char *rtime_str, *reason_str = NULL, *arg_str = NULL, *p;
3000         int reason_code = -1;
3001         int i, ret = 0;
3002         ASN1_OBJECT *hold = NULL;
3003         ASN1_GENERALIZEDTIME *comp_time = NULL;
3004         tmp = BUF_strdup(str);
3005
3006         p = strchr(tmp, ',');
3007
3008         rtime_str = tmp;
3009
3010         if (p)
3011                 {
3012                 *p = '\0';
3013                 p++;
3014                 reason_str = p;
3015                 p = strchr(p, ',');
3016                 if (p)
3017                         {
3018                         *p = '\0';
3019                         arg_str = p + 1;
3020                         }
3021                 }
3022
3023         if (prevtm)
3024                 {
3025                 *prevtm = ASN1_UTCTIME_new();
3026                 if (!ASN1_UTCTIME_set_string(*prevtm, rtime_str))
3027                         {
3028                         BIO_printf(bio_err, "invalid revocation date %s\n", rtime_str);
3029                         goto err;
3030                         }
3031                 }
3032         if (reason_str)
3033                 {
3034                 for (i = 0; i < NUM_REASONS; i++)
3035                         {
3036                         if(!strcasecmp(reason_str, crl_reasons[i]))
3037                                 {
3038                                 reason_code = i;
3039                                 break;
3040                                 }
3041                         }
3042                 if (reason_code == OCSP_REVOKED_STATUS_NOSTATUS)
3043                         {
3044                         BIO_printf(bio_err, "invalid reason code %s\n", reason_str);
3045                         goto err;
3046                         }
3047
3048                 if (reason_code == 7)
3049                         reason_code = OCSP_REVOKED_STATUS_REMOVEFROMCRL;
3050                 else if (reason_code == 8)              /* Hold instruction */
3051                         {
3052                         if (!arg_str)
3053                                 {
3054                                 BIO_printf(bio_err, "missing hold instruction\n");
3055                                 goto err;
3056                                 }
3057                         reason_code = OCSP_REVOKED_STATUS_CERTIFICATEHOLD;
3058                         hold = OBJ_txt2obj(arg_str, 0);
3059
3060                         if (!hold)
3061                                 {
3062                                 BIO_printf(bio_err, "invalid object identifier %s\n", arg_str);
3063                                 goto err;
3064                                 }
3065                         if (phold) *phold = hold;
3066                         }
3067                 else if ((reason_code == 9) || (reason_code == 10))
3068                         {
3069                         if (!arg_str)
3070                                 {
3071                                 BIO_printf(bio_err, "missing compromised time\n");
3072                                 goto err;
3073                                 }
3074                         comp_time = ASN1_GENERALIZEDTIME_new();
3075                         if (!ASN1_GENERALIZEDTIME_set_string(comp_time, arg_str))
3076                                 {
3077                                 BIO_printf(bio_err, "invalid compromised time %s\n", arg_str);
3078                                 goto err;
3079                                 }
3080                         if (reason_code == 9)
3081                                 reason_code = OCSP_REVOKED_STATUS_KEYCOMPROMISE;
3082                         else
3083                                 reason_code = OCSP_REVOKED_STATUS_CACOMPROMISE;
3084                         }
3085                 }
3086
3087         if (preason) *preason = reason_code;
3088         if (pinvtm) *pinvtm = comp_time;
3089         else ASN1_GENERALIZEDTIME_free(comp_time);
3090
3091         ret = 1;
3092
3093         err:
3094
3095         if (tmp) OPENSSL_free(tmp);
3096         if (!phold) ASN1_OBJECT_free(hold);
3097         if (!pinvtm) ASN1_GENERALIZEDTIME_free(comp_time);
3098
3099         return ret;
3100         }
3101