+
+if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
+ print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+ print STDERR " CA -pkcs12 [certname]\n";
+ print STDERR " CA -crl|-revoke cert-filename [reason]\n";
+ exit 0;
+}
+if ($WHAT eq '-newcert' ) {
+ # create a certificate
+ $RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS");
+ print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT eq '-newreq' ) {
+ # create a certificate request
+ $RET = run("$REQ -new -keyout $NEWKEY -out $NEWREQ $DAYS");
+ print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT eq '-newreq-nodes' ) {
+ # create a certificate request
+ $RET = run("$REQ -new -nodes -keyout $NEWKEY -out $NEWREQ $DAYS");
+ print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT eq '-newca' ) {
+ # create the directory hierarchy
+ mkdir ${CATOP}, $DIRMODE;
+ mkdir "${CATOP}/certs", $DIRMODE;
+ mkdir "${CATOP}/crl", $DIRMODE ;
+ mkdir "${CATOP}/newcerts", $DIRMODE;
+ mkdir "${CATOP}/private", $DIRMODE;
+ open OUT, ">${CATOP}/index.txt";
+ close OUT;
+ open OUT, ">${CATOP}/crlnumber";
+ print OUT "01\n";
+ close OUT;
+ # ask user for existing CA certificate
+ print "CA certificate filename (or enter to create)\n";
+ $FILE = <STDIN>;
+ chop $FILE if $FILE;
+ if ($FILE) {
+ copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
+ copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
+ } else {
+ print "Making CA certificate ...\n";
+ $RET = run("$REQ -new -keyout"
+ . " ${CATOP}/private/$CAKEY"
+ . " -out ${CATOP}/$CAREQ");
+ $RET = run("$CA -create_serial"
+ . " -out ${CATOP}/$CACERT $CADAYS -batch"
+ . " -keyfile ${CATOP}/private/$CAKEY -selfsign"
+ . " -extensions v3_ca"
+ . " -infiles ${CATOP}/$CAREQ") if $RET == 0;
+ print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
+ }
+} elsif ($WHAT eq '-pkcs12' ) {
+ my $cname = $ARGV[1];
+ $cname = "My Certificate" unless defined $cname;
+ $RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
+ . " -certfile ${CATOP}/$CACERT"
+ . " -out $NEWP12"
+ . " -export -name \"$cname\"");
+ print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
+} elsif ($WHAT eq '-xsign' ) {
+ $RET = run("$CA -policy policy_anything -infiles $NEWREQ");
+} elsif ($WHAT eq '-sign' ) {
+ $RET = run("$CA -policy policy_anything -out $NEWCERT -infiles $NEWREQ");
+ print "Signed certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-signCA' ) {
+ $RET = run("$CA -policy policy_anything -out $NEWCERT"
+ . " -extensions v3_ca -infiles $NEWREQ");
+ print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-signcert' ) {
+ $RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
+ . " -out tmp.pem");
+ $RET = run("$CA -policy policy_anything -out $NEWCERT"
+ . " -infiles tmp.pem") if $RET == 0;
+ print "Signed certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-verify' ) {
+ my @files = @ARGV ? @ARGV : ( $NEWCERT );
+ my $file;
+ foreach $file (@files) {
+ my $status = run("$VERIFY -CAfile ${CATOP}/$CACERT $file");
+ $RET = $status if $status != 0;
+ }
+} elsif ($WHAT eq '-crl' ) {
+ $RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL");
+ print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;
+} elsif ($WHAT eq '-revoke' ) {
+ my $cname = $ARGV[1];
+ if (!defined $cname) {
+ print "Certificate filename is required; reason optional.\n";
+ exit 1;
+ }
+ my $reason = $ARGV[2];
+ $reason = " -crl_reason $reason"
+ if defined $reason && crl_reason_ok($reason);
+ $RET = run("$CA -revoke \"$cname\"" . $reason);
+} else {
+ print STDERR "Unknown arg \"$WHAT\"\n";
+ print STDERR "Use -help for help.\n";
+ exit 1;
+}
+
+exit $RET;