Reduce chances of issuer and serial number duplication by use of random

[openssl.git] / apps / CA.pl.in

diff --git a/apps/CA.pl.in b/apps/CA.pl.in
index 7c023ae71f66c5b3ccc91afb1f40341511cb9e1c..b09820755dca1056e613ff34f9e930330813f0c9 100644 (file)
--- a/apps/CA.pl.in
+++ b/apps/CA.pl.in
@@ -5,7 +5,7 @@
 #      things easier between now and when Eric is convinced to fix it :-)
 #
 # CA -newca ... will setup the right stuff
-# CA -newreq ... will generate a certificate request 
+# CA -newreq[-nodes] ... will generate a certificate request 
 # CA -sign ... will sign the generated request and output 
 #
 # At the end of that grab newreq.pem and newcert.pem (one has the key 
@@ -36,14 +36,18 @@
 # default openssl.cnf file has setup as per the following
 # demoCA ... where everything is stored
 
-$DAYS="-days 365";
+$SSLEAY_CONFIG=$ENV{"SSLEAY_CONFIG"};
+$DAYS="-days 365";     # 1 year
+$CADAYS="-days 1095";  # 3 years
 $REQ="openssl req $SSLEAY_CONFIG";
 $CA="openssl ca $SSLEAY_CONFIG";
 $VERIFY="openssl verify";
 $X509="openssl x509";
+$PKCS12="openssl pkcs12";
 
 $CATOP="./demoCA";
 $CAKEY="cakey.pem";
+$CAREQ="careq.pem";
 $CACERT="cacert.pem";
 
 $DIRMODE = 0777;
@@ -52,7 +56,7 @@ $RET = 0;
 
 foreach (@ARGV) {
        if ( /^(-\?|-h|-help)$/ ) {
-           print STDERR "usage: CA -newcert|-newreq|-newca|-sign|-verify\n";
+           print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
            exit 0;
        } elsif (/^-newcert$/) {
            # create a certificate
@@ -64,8 +68,13 @@ foreach (@ARGV) {
            system ("$REQ -new -keyout newreq.pem -out newreq.pem $DAYS");
            $RET=$?;
            print "Request (and private key) is in newreq.pem\n";
+       } elsif (/^-newreq-nodes$/) {
+           # create a certificate request
+           system ("$REQ -new -nodes -keyout newreq.pem -out newreq.pem $DAYS");
+           $RET=$?;
+           print "Request (and private key) is in newreq.pem\n";
        } elsif (/^-newca$/) {
-               # if explictly asked for or it doesn't exist then setup the
+               # if explicitly asked for or it doesn't exist then setup the
                # directory structure that Eric likes to manage things 
            $NEW="1";
            if ( "$NEW" || ! -f "${CATOP}/serial" ) {
@@ -75,9 +84,6 @@ foreach (@ARGV) {
                mkdir "${CATOP}/crl", $DIRMODE ;
                mkdir "${CATOP}/newcerts", $DIRMODE;
                mkdir "${CATOP}/private", $DIRMODE;
-               open OUT, ">${CATOP}/serial";
-               print OUT "01\n";
-               close OUT;
                open OUT, ">${CATOP}/index.txt";
                close OUT;
            }
@@ -94,11 +100,23 @@ foreach (@ARGV) {
                    $RET=$?;
                } else {
                    print "Making CA certificate ...\n";
-                   system ("$REQ -new -x509 -keyout " .
-                       "${CATOP}/private/$CAKEY -out ${CATOP}/$CACERT $DAYS");
+                   system ("$REQ -new -keyout " .
+                       "${CATOP}/private/$CAKEY -out ${CATOP}/$CAREQ");
+                   system ("$CA -create_serial " .
+                       "-out ${CATOP}/$CACERT $CADAYS -batch " . 
+                       "-keyfile ${CATOP}/private/$CAKEY -selfsign " .
+                       "-infiles ${CATOP}/$CAREQ ");
                    $RET=$?;
                }
            }
+       } elsif (/^-pkcs12$/) {
+           my $cname = $ARGV[1];
+           $cname = "My Certificate" unless defined $cname;
+           system ("$PKCS12 -in newcert.pem -inkey newreq.pem " .
+                       "-certfile ${CATOP}/$CACERT -out newcert.p12 " .
+                       "-export -name \"$cname\"");
+           $RET=$?;
+           exit $RET;
        } elsif (/^-xsign$/) {
            system ("$CA -policy policy_anything -infiles newreq.pem");
            $RET=$?;
@@ -107,6 +125,11 @@ foreach (@ARGV) {
                                                        "-infiles newreq.pem");
            $RET=$?;
            print "Signed certificate is in newcert.pem\n";
+       } elsif (/^(-signCA)$/) {
+           system ("$CA -policy policy_anything -out newcert.pem " .
+                                       "-extensions v3_ca -infiles newreq.pem");
+           $RET=$?;
+           print "Signed CA certificate is in newcert.pem\n";
        } elsif (/^-signcert$/) {
            system ("$X509 -x509toreq -in newreq.pem -signkey newreq.pem " .
                                                                "-out tmp.pem");
@@ -128,7 +151,7 @@ foreach (@ARGV) {
            }
        } else {
            print STDERR "Unknown arg $_\n";
-           print STDERR "usage: CA -newcert|-newreq|-newca|-sign|-verify\n";
+           print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
            exit 1;
        }
 }