199ebb4caSwyllys /*
299ebb4caSwyllys * CDDL HEADER START
399ebb4caSwyllys *
499ebb4caSwyllys * The contents of this file are subject to the terms of the
599ebb4caSwyllys * Common Development and Distribution License (the "License").
699ebb4caSwyllys * You may not use this file except in compliance with the License.
799ebb4caSwyllys *
899ebb4caSwyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
999ebb4caSwyllys * or http://www.opensolaris.org/os/licensing.
1099ebb4caSwyllys * See the License for the specific language governing permissions
1199ebb4caSwyllys * and limitations under the License.
1299ebb4caSwyllys *
1399ebb4caSwyllys * When distributing Covered Code, include this CDDL HEADER in each
1499ebb4caSwyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
1599ebb4caSwyllys * If applicable, add the following below this CDDL HEADER, with the
1699ebb4caSwyllys * fields enclosed by brackets "[]" replaced with your own identifying
1799ebb4caSwyllys * information: Portions Copyright [yyyy] [name of copyright owner]
1899ebb4caSwyllys *
1999ebb4caSwyllys * CDDL HEADER END
202c9a247fSWyllys Ingersoll *
212c9a247fSWyllys Ingersoll * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
2299ebb4caSwyllys */
2399ebb4caSwyllys
2499ebb4caSwyllys #include <stdio.h>
2599ebb4caSwyllys #include <string.h>
2699ebb4caSwyllys #include <ctype.h>
2799ebb4caSwyllys #include <malloc.h>
2899ebb4caSwyllys #include <libgen.h>
2999ebb4caSwyllys #include <errno.h>
3099ebb4caSwyllys #include <cryptoutil.h>
3199ebb4caSwyllys #include <security/cryptoki.h>
3299ebb4caSwyllys #include "common.h"
3399ebb4caSwyllys
3499ebb4caSwyllys #include <kmfapi.h>
3599ebb4caSwyllys
362f3d18f2SToomas Soome #define SET_VALUE(f, s) { \
372f3d18f2SToomas Soome kmfrv = f; \
382f3d18f2SToomas Soome if (kmfrv != KMF_OK) { \
392f3d18f2SToomas Soome cryptoerror(LOG_STDERR, \
402f3d18f2SToomas Soome gettext("Failed to set %s: 0x%02x\n"), \
412f3d18f2SToomas Soome s, kmfrv); \
422f3d18f2SToomas Soome goto cleanup; \
432f3d18f2SToomas Soome } \
4499ebb4caSwyllys }
4599ebb4caSwyllys
4699ebb4caSwyllys static int
gencert_pkcs11(KMF_HANDLE_T kmfhandle,char * token,char * subject,char * altname,KMF_GENERALNAMECHOICES alttype,int altcrit,char * certlabel,KMF_KEY_ALG keyAlg,KMF_ALGORITHM_INDEX sigAlg,int keylen,uint32_t ltime,KMF_BIGINT * serial,uint16_t kubits,int kucrit,KMF_CREDENTIAL * tokencred,EKU_LIST * ekulist,KMF_OID * curveoid)4799ebb4caSwyllys gencert_pkcs11(KMF_HANDLE_T kmfhandle,
4899ebb4caSwyllys char *token, char *subject, char *altname,
4999ebb4caSwyllys KMF_GENERALNAMECHOICES alttype, int altcrit,
5099ebb4caSwyllys char *certlabel, KMF_KEY_ALG keyAlg,
5199ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg,
5299ebb4caSwyllys int keylen, uint32_t ltime, KMF_BIGINT *serial,
53d00756ccSwyllys uint16_t kubits, int kucrit, KMF_CREDENTIAL *tokencred,
54e65e5c2dSWyllys Ingersoll EKU_LIST *ekulist, KMF_OID *curveoid)
5599ebb4caSwyllys {
5699ebb4caSwyllys KMF_RETURN kmfrv = KMF_OK;
5799ebb4caSwyllys KMF_KEY_HANDLE pubk, prik;
5899ebb4caSwyllys KMF_X509_CERTIFICATE signedCert;
5999ebb4caSwyllys KMF_X509_NAME certSubject;
6099ebb4caSwyllys KMF_X509_NAME certIssuer;
6199ebb4caSwyllys KMF_DATA x509DER;
6230a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
6330a5e8faSwyllys KMF_ATTRIBUTE attrlist[16];
6430a5e8faSwyllys int numattr = 0;
6530a5e8faSwyllys KMF_KEY_ALG keytype;
6630a5e8faSwyllys uint32_t keylength;
6799ebb4caSwyllys
6899ebb4caSwyllys (void) memset(&signedCert, 0, sizeof (signedCert));
6999ebb4caSwyllys (void) memset(&certSubject, 0, sizeof (certSubject));
7099ebb4caSwyllys (void) memset(&certIssuer, 0, sizeof (certIssuer));
7199ebb4caSwyllys (void) memset(&x509DER, 0, sizeof (x509DER));
7299ebb4caSwyllys
7399ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */
7430a5e8faSwyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
7599ebb4caSwyllys cryptoerror(LOG_STDERR,
7630a5e8faSwyllys gettext("Subject name cannot be parsed.\n"));
7799ebb4caSwyllys return (PK_ERR_USAGE);
7899ebb4caSwyllys }
7999ebb4caSwyllys
8099ebb4caSwyllys /* For a self-signed cert, the issuser and subject are the same */
8130a5e8faSwyllys if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
8299ebb4caSwyllys cryptoerror(LOG_STDERR,
8330a5e8faSwyllys gettext("Subject name cannot be parsed.\n"));
8499ebb4caSwyllys return (PK_ERR_USAGE);
8599ebb4caSwyllys }
8699ebb4caSwyllys
8730a5e8faSwyllys keylength = keylen; /* bits */
8830a5e8faSwyllys keytype = keyAlg;
8999ebb4caSwyllys
9099ebb4caSwyllys /* Select a PKCS11 token */
9199ebb4caSwyllys kmfrv = select_token(kmfhandle, token, FALSE);
9299ebb4caSwyllys if (kmfrv != KMF_OK) {
9399ebb4caSwyllys return (kmfrv);
9499ebb4caSwyllys }
9599ebb4caSwyllys
96e65e5c2dSWyllys Ingersoll /*
97e65e5c2dSWyllys Ingersoll * Share the "genkeypair" routine for creating the keypair.
98e65e5c2dSWyllys Ingersoll */
99e65e5c2dSWyllys Ingersoll kmfrv = genkeypair_pkcs11(kmfhandle, token, certlabel,
100e65e5c2dSWyllys Ingersoll keytype, keylength, tokencred, curveoid, &prik, &pubk);
101e65e5c2dSWyllys Ingersoll if (kmfrv != KMF_OK)
10299ebb4caSwyllys return (kmfrv);
10399ebb4caSwyllys
10430a5e8faSwyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
10530a5e8faSwyllys "keypair");
10699ebb4caSwyllys
10730a5e8faSwyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
10899ebb4caSwyllys
10930a5e8faSwyllys SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
11030a5e8faSwyllys "serial number");
11199ebb4caSwyllys
112*6f2b04a2SToomas Soome SET_VALUE(kmf_set_cert_validity(&signedCert, 0, ltime),
11330a5e8faSwyllys "validity time");
11499ebb4caSwyllys
11530a5e8faSwyllys SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
11630a5e8faSwyllys "signature algorithm");
11799ebb4caSwyllys
11830a5e8faSwyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
11930a5e8faSwyllys "subject name");
12099ebb4caSwyllys
12130a5e8faSwyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
12230a5e8faSwyllys "issuer name");
12399ebb4caSwyllys
12499ebb4caSwyllys if (altname != NULL)
12530a5e8faSwyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
12630a5e8faSwyllys alttype, altname), "subjectAltName");
12799ebb4caSwyllys
12899ebb4caSwyllys if (kubits != 0)
12930a5e8faSwyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
13030a5e8faSwyllys "KeyUsage");
13199ebb4caSwyllys
132d00756ccSwyllys if (ekulist != NULL) {
133d00756ccSwyllys int i;
134d00756ccSwyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
135d00756ccSwyllys SET_VALUE(kmf_add_cert_eku(&signedCert,
136d00756ccSwyllys &ekulist->ekulist[i], ekulist->critlist[i]),
137d00756ccSwyllys "Extended Key Usage");
138d00756ccSwyllys }
139d00756ccSwyllys }
140d00756ccSwyllys
14130a5e8faSwyllys /*
14230a5e8faSwyllys * Construct attributes for the kmf_sign_cert operation.
14330a5e8faSwyllys */
14430a5e8faSwyllys numattr = 0;
14530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
14630a5e8faSwyllys &kstype, sizeof (kstype));
14730a5e8faSwyllys numattr++;
14830a5e8faSwyllys
14930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
15030a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE_ATTR));
15130a5e8faSwyllys numattr++;
15230a5e8faSwyllys
15330a5e8faSwyllys /* cert data that is to be signed */
15430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
15530a5e8faSwyllys &signedCert, sizeof (KMF_X509_CERTIFICATE));
15630a5e8faSwyllys numattr++;
15730a5e8faSwyllys
15830a5e8faSwyllys /* output buffer for the signed cert */
15930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
16030a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
16130a5e8faSwyllys numattr++;
16230a5e8faSwyllys
1632c9a247fSWyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
1642c9a247fSWyllys Ingersoll &sigAlg, sizeof (sigAlg));
1652c9a247fSWyllys Ingersoll numattr++;
1662c9a247fSWyllys Ingersoll
16730a5e8faSwyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
16830a5e8faSwyllys KMF_OK) {
16999ebb4caSwyllys goto cleanup;
17099ebb4caSwyllys }
17199ebb4caSwyllys
17299ebb4caSwyllys /*
17399ebb4caSwyllys * Store the cert in the DB.
17499ebb4caSwyllys */
17530a5e8faSwyllys numattr = 0;
17630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
17730a5e8faSwyllys &kstype, sizeof (kstype));
17830a5e8faSwyllys numattr++;
17930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
18030a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
18130a5e8faSwyllys numattr++;
18230a5e8faSwyllys
18330a5e8faSwyllys if (certlabel != NULL) {
18430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
18530a5e8faSwyllys certlabel, strlen(certlabel));
18630a5e8faSwyllys numattr++;
18730a5e8faSwyllys }
18830a5e8faSwyllys
18930a5e8faSwyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
19030a5e8faSwyllys
19199ebb4caSwyllys cleanup:
19230a5e8faSwyllys kmf_free_data(&x509DER);
19330a5e8faSwyllys kmf_free_dn(&certSubject);
19430a5e8faSwyllys kmf_free_dn(&certIssuer);
195a44b45c8SHuie-Ying Lee
196a44b45c8SHuie-Ying Lee /*
197a44b45c8SHuie-Ying Lee * If kmf_sign_cert or kmf_store_cert failed, then we need to clean up
198a44b45c8SHuie-Ying Lee * the key pair from the token.
199a44b45c8SHuie-Ying Lee */
200a44b45c8SHuie-Ying Lee if (kmfrv != KMF_OK) {
201a44b45c8SHuie-Ying Lee /* delete the public key */
202a44b45c8SHuie-Ying Lee numattr = 0;
203a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
204a44b45c8SHuie-Ying Lee KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
205a44b45c8SHuie-Ying Lee numattr++;
206a44b45c8SHuie-Ying Lee
207a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
208a44b45c8SHuie-Ying Lee KMF_KEY_HANDLE_ATTR, &pubk, sizeof (KMF_KEY_HANDLE));
209a44b45c8SHuie-Ying Lee numattr++;
210a44b45c8SHuie-Ying Lee
211a44b45c8SHuie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
212a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
213a44b45c8SHuie-Ying Lee KMF_CREDENTIAL_ATTR, tokencred,
214a44b45c8SHuie-Ying Lee sizeof (KMF_CREDENTIAL));
215a44b45c8SHuie-Ying Lee numattr++;
216a44b45c8SHuie-Ying Lee }
217a44b45c8SHuie-Ying Lee
218a44b45c8SHuie-Ying Lee (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
219a44b45c8SHuie-Ying Lee attrlist);
220a44b45c8SHuie-Ying Lee
221a44b45c8SHuie-Ying Lee /* delete the private key */
222a44b45c8SHuie-Ying Lee numattr = 0;
223a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
224a44b45c8SHuie-Ying Lee KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
225a44b45c8SHuie-Ying Lee numattr++;
226a44b45c8SHuie-Ying Lee
227a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
228a44b45c8SHuie-Ying Lee KMF_KEY_HANDLE_ATTR, &prik, sizeof (KMF_KEY_HANDLE));
229a44b45c8SHuie-Ying Lee numattr++;
230a44b45c8SHuie-Ying Lee
231a44b45c8SHuie-Ying Lee if (tokencred != NULL && tokencred->cred != NULL) {
232a44b45c8SHuie-Ying Lee kmf_set_attr_at_index(attrlist, numattr,
233a44b45c8SHuie-Ying Lee KMF_CREDENTIAL_ATTR, tokencred,
234a44b45c8SHuie-Ying Lee sizeof (KMF_CREDENTIAL));
235a44b45c8SHuie-Ying Lee numattr++;
236a44b45c8SHuie-Ying Lee }
237a44b45c8SHuie-Ying Lee
238a44b45c8SHuie-Ying Lee (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
239a44b45c8SHuie-Ying Lee attrlist);
240a44b45c8SHuie-Ying Lee }
241a44b45c8SHuie-Ying Lee
24299ebb4caSwyllys return (kmfrv);
24399ebb4caSwyllys }
24499ebb4caSwyllys
24599ebb4caSwyllys static int
gencert_file(KMF_HANDLE_T kmfhandle,KMF_KEY_ALG keyAlg,KMF_ALGORITHM_INDEX sigAlg,int keylen,KMF_ENCODE_FORMAT fmt,uint32_t ltime,char * subject,char * altname,KMF_GENERALNAMECHOICES alttype,int altcrit,KMF_BIGINT * serial,uint16_t kubits,int kucrit,char * outcert,char * outkey,EKU_LIST * ekulist)24699ebb4caSwyllys gencert_file(KMF_HANDLE_T kmfhandle,
24799ebb4caSwyllys KMF_KEY_ALG keyAlg, KMF_ALGORITHM_INDEX sigAlg,
24899ebb4caSwyllys int keylen, KMF_ENCODE_FORMAT fmt,
24999ebb4caSwyllys uint32_t ltime, char *subject, char *altname,
25099ebb4caSwyllys KMF_GENERALNAMECHOICES alttype, int altcrit,
25199ebb4caSwyllys KMF_BIGINT *serial, uint16_t kubits, int kucrit,
252448b8615Swyllys char *outcert, char *outkey,
253d00756ccSwyllys EKU_LIST *ekulist)
25499ebb4caSwyllys {
25599ebb4caSwyllys KMF_RETURN kmfrv;
25699ebb4caSwyllys KMF_KEY_HANDLE pubk, prik;
25799ebb4caSwyllys KMF_X509_CERTIFICATE signedCert;
25899ebb4caSwyllys KMF_X509_NAME certSubject;
25999ebb4caSwyllys KMF_X509_NAME certIssuer;
26099ebb4caSwyllys KMF_DATA x509DER;
26199ebb4caSwyllys char *fullcertpath = NULL;
26299ebb4caSwyllys char *fullkeypath = NULL;
26330a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
26430a5e8faSwyllys KMF_ATTRIBUTE attrlist[10];
26530a5e8faSwyllys int numattr = 0;
26699ebb4caSwyllys
26799ebb4caSwyllys (void) memset(&signedCert, 0, sizeof (signedCert));
26899ebb4caSwyllys (void) memset(&certSubject, 0, sizeof (certSubject));
26999ebb4caSwyllys (void) memset(&certIssuer, 0, sizeof (certIssuer));
27099ebb4caSwyllys (void) memset(&x509DER, 0, sizeof (x509DER));
27199ebb4caSwyllys
27299ebb4caSwyllys if (EMPTYSTRING(outcert) || EMPTYSTRING(outkey)) {
27399ebb4caSwyllys cryptoerror(LOG_STDERR,
27430a5e8faSwyllys gettext("No output file was specified for "
27530a5e8faSwyllys "the cert or key\n"));
27699ebb4caSwyllys return (PK_ERR_USAGE);
27799ebb4caSwyllys }
278448b8615Swyllys fullcertpath = strdup(outcert);
27999ebb4caSwyllys if (verify_file(fullcertpath)) {
28099ebb4caSwyllys cryptoerror(LOG_STDERR,
28130a5e8faSwyllys gettext("Cannot write the indicated output "
28230a5e8faSwyllys "certificate file (%s).\n"), fullcertpath);
28399ebb4caSwyllys free(fullcertpath);
28499ebb4caSwyllys return (PK_ERR_USAGE);
28599ebb4caSwyllys }
286448b8615Swyllys
28799ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */
28830a5e8faSwyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
28999ebb4caSwyllys cryptoerror(LOG_STDERR,
29030a5e8faSwyllys gettext("Subject name cannot be parsed (%s)\n"), subject);
29199ebb4caSwyllys return (PK_ERR_USAGE);
29299ebb4caSwyllys }
29399ebb4caSwyllys
29499ebb4caSwyllys /* For a self-signed cert, the issuser and subject are the same */
29530a5e8faSwyllys if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
29699ebb4caSwyllys cryptoerror(LOG_STDERR,
29730a5e8faSwyllys gettext("Subject name cannot be parsed (%s)\n"), subject);
29830a5e8faSwyllys kmf_free_dn(&certSubject);
29999ebb4caSwyllys return (PK_ERR_USAGE);
30099ebb4caSwyllys }
30199ebb4caSwyllys
302e65e5c2dSWyllys Ingersoll /*
303e65e5c2dSWyllys Ingersoll * Share the "genkeypair" routine for creating the keypair.
304e65e5c2dSWyllys Ingersoll */
305e65e5c2dSWyllys Ingersoll kmfrv = genkeypair_file(kmfhandle, keyAlg, keylen,
306e65e5c2dSWyllys Ingersoll fmt, outkey, &prik, &pubk);
307e65e5c2dSWyllys Ingersoll if (kmfrv != KMF_OK)
308e65e5c2dSWyllys Ingersoll return (kmfrv);
30999ebb4caSwyllys
31030a5e8faSwyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
31130a5e8faSwyllys "keypair");
31230a5e8faSwyllys
31330a5e8faSwyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
31499ebb4caSwyllys
31530a5e8faSwyllys SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
31630a5e8faSwyllys "serial number");
31799ebb4caSwyllys
318*6f2b04a2SToomas Soome SET_VALUE(kmf_set_cert_validity(&signedCert, 0, ltime),
31930a5e8faSwyllys "validity time");
32099ebb4caSwyllys
32130a5e8faSwyllys SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
32230a5e8faSwyllys "signature algorithm");
32399ebb4caSwyllys
32430a5e8faSwyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
32530a5e8faSwyllys "subject name");
32699ebb4caSwyllys
32730a5e8faSwyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
32830a5e8faSwyllys "issuer name");
32999ebb4caSwyllys
33099ebb4caSwyllys if (altname != NULL)
33130a5e8faSwyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
33230a5e8faSwyllys alttype, altname), "subjectAltName");
33399ebb4caSwyllys
33499ebb4caSwyllys if (kubits != 0)
33530a5e8faSwyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
33630a5e8faSwyllys "KeyUsage");
337d00756ccSwyllys
338d00756ccSwyllys if (ekulist != NULL) {
339d00756ccSwyllys int i;
340d00756ccSwyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
341d00756ccSwyllys SET_VALUE(kmf_add_cert_eku(&signedCert,
342d00756ccSwyllys &ekulist->ekulist[i],
343d00756ccSwyllys ekulist->critlist[i]), "Extended Key Usage");
344d00756ccSwyllys }
345d00756ccSwyllys }
34630a5e8faSwyllys /*
34730a5e8faSwyllys * Construct attributes for the kmf_sign_cert operation.
34830a5e8faSwyllys */
34930a5e8faSwyllys numattr = 0;
35030a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
35130a5e8faSwyllys &kstype, sizeof (kstype));
35230a5e8faSwyllys numattr++;
35330a5e8faSwyllys
35430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
35530a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE_ATTR));
35630a5e8faSwyllys numattr++;
35730a5e8faSwyllys
35830a5e8faSwyllys /* cert data that is to be signed */
35930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
36030a5e8faSwyllys &signedCert, sizeof (KMF_X509_CERTIFICATE));
36130a5e8faSwyllys numattr++;
36230a5e8faSwyllys
36330a5e8faSwyllys /* output buffer for the signed cert */
36430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
36530a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
36630a5e8faSwyllys numattr++;
36730a5e8faSwyllys
3682c9a247fSWyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
3692c9a247fSWyllys Ingersoll &sigAlg, sizeof (sigAlg));
3702c9a247fSWyllys Ingersoll numattr++;
3712c9a247fSWyllys Ingersoll
37230a5e8faSwyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
37330a5e8faSwyllys KMF_OK) {
37499ebb4caSwyllys goto cleanup;
37599ebb4caSwyllys }
37699ebb4caSwyllys
37799ebb4caSwyllys /*
37899ebb4caSwyllys * Store the cert in the DB.
37999ebb4caSwyllys */
38030a5e8faSwyllys numattr = 0;
38130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
38230a5e8faSwyllys &kstype, sizeof (kstype));
38330a5e8faSwyllys numattr++;
38430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
38530a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
38630a5e8faSwyllys numattr++;
38730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_FILENAME_ATTR,
38830a5e8faSwyllys fullcertpath, strlen(fullcertpath));
38930a5e8faSwyllys numattr++;
39030a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
39130a5e8faSwyllys &fmt, sizeof (fmt));
39230a5e8faSwyllys numattr++;
39330a5e8faSwyllys
39430a5e8faSwyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
39599ebb4caSwyllys
39699ebb4caSwyllys cleanup:
39799ebb4caSwyllys if (fullkeypath != NULL)
39899ebb4caSwyllys free(fullkeypath);
39999ebb4caSwyllys if (fullcertpath != NULL)
40099ebb4caSwyllys free(fullcertpath);
40199ebb4caSwyllys
40230a5e8faSwyllys kmf_free_data(&x509DER);
40330a5e8faSwyllys kmf_free_dn(&certSubject);
40430a5e8faSwyllys kmf_free_dn(&certIssuer);
40599ebb4caSwyllys return (kmfrv);
40699ebb4caSwyllys }
40799ebb4caSwyllys
40899ebb4caSwyllys static KMF_RETURN
gencert_nss(KMF_HANDLE_T kmfhandle,char * token,char * subject,char * altname,KMF_GENERALNAMECHOICES alttype,int altcrit,char * nickname,char * dir,char * prefix,KMF_KEY_ALG keyAlg,KMF_ALGORITHM_INDEX sigAlg,int keylen,char * trust,uint32_t ltime,KMF_BIGINT * serial,uint16_t kubits,int kucrit,KMF_CREDENTIAL * tokencred,EKU_LIST * ekulist,KMF_OID * curveoid)40999ebb4caSwyllys gencert_nss(KMF_HANDLE_T kmfhandle,
41099ebb4caSwyllys char *token, char *subject, char *altname,
41199ebb4caSwyllys KMF_GENERALNAMECHOICES alttype, int altcrit,
41299ebb4caSwyllys char *nickname, char *dir, char *prefix,
41399ebb4caSwyllys KMF_KEY_ALG keyAlg,
41499ebb4caSwyllys KMF_ALGORITHM_INDEX sigAlg,
41599ebb4caSwyllys int keylen, char *trust,
41699ebb4caSwyllys uint32_t ltime, KMF_BIGINT *serial, uint16_t kubits,
417d00756ccSwyllys int kucrit, KMF_CREDENTIAL *tokencred,
418e65e5c2dSWyllys Ingersoll EKU_LIST *ekulist, KMF_OID *curveoid)
41999ebb4caSwyllys {
42099ebb4caSwyllys KMF_RETURN kmfrv;
42199ebb4caSwyllys KMF_KEY_HANDLE pubk, prik;
42299ebb4caSwyllys KMF_X509_CERTIFICATE signedCert;
42399ebb4caSwyllys KMF_X509_NAME certSubject;
42499ebb4caSwyllys KMF_X509_NAME certIssuer;
42599ebb4caSwyllys KMF_DATA x509DER;
42630a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
42730a5e8faSwyllys KMF_ATTRIBUTE attrlist[16];
42830a5e8faSwyllys int numattr = 0;
42999ebb4caSwyllys
43099ebb4caSwyllys if (token == NULL)
43199ebb4caSwyllys token = DEFAULT_NSS_TOKEN;
43299ebb4caSwyllys
43399ebb4caSwyllys kmfrv = configure_nss(kmfhandle, dir, prefix);
43499ebb4caSwyllys if (kmfrv != KMF_OK)
43599ebb4caSwyllys return (kmfrv);
43699ebb4caSwyllys
43799ebb4caSwyllys (void) memset(&signedCert, 0, sizeof (signedCert));
43899ebb4caSwyllys (void) memset(&certSubject, 0, sizeof (certSubject));
43999ebb4caSwyllys (void) memset(&certIssuer, 0, sizeof (certIssuer));
44099ebb4caSwyllys (void) memset(&x509DER, 0, sizeof (x509DER));
44199ebb4caSwyllys
44299ebb4caSwyllys /* If the subject name cannot be parsed, flag it now and exit */
44330a5e8faSwyllys if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
44499ebb4caSwyllys cryptoerror(LOG_STDERR,
44530a5e8faSwyllys gettext("Subject name cannot be parsed.\n"));
44699ebb4caSwyllys return (PK_ERR_USAGE);
44799ebb4caSwyllys }
44899ebb4caSwyllys
44999ebb4caSwyllys /* For a self-signed cert, the issuser and subject are the same */
45030a5e8faSwyllys if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
45199ebb4caSwyllys cryptoerror(LOG_STDERR,
45230a5e8faSwyllys gettext("Subject name cannot be parsed.\n"));
45399ebb4caSwyllys return (PK_ERR_USAGE);
45499ebb4caSwyllys }
45599ebb4caSwyllys
456e65e5c2dSWyllys Ingersoll kmfrv = genkeypair_nss(kmfhandle, token, nickname, dir,
457e65e5c2dSWyllys Ingersoll prefix, keyAlg, keylen, tokencred, curveoid,
458e65e5c2dSWyllys Ingersoll &prik, &pubk);
459e65e5c2dSWyllys Ingersoll if (kmfrv != KMF_OK)
46099ebb4caSwyllys return (kmfrv);
46199ebb4caSwyllys
46230a5e8faSwyllys SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
46330a5e8faSwyllys "keypair");
46499ebb4caSwyllys
46530a5e8faSwyllys SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
46699ebb4caSwyllys
46730a5e8faSwyllys SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
46830a5e8faSwyllys "serial number");
46999ebb4caSwyllys
470*6f2b04a2SToomas Soome SET_VALUE(kmf_set_cert_validity(&signedCert, 0, ltime),
47130a5e8faSwyllys "validity time");
47299ebb4caSwyllys
47330a5e8faSwyllys SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
47430a5e8faSwyllys "signature algorithm");
47599ebb4caSwyllys
47630a5e8faSwyllys SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
47730a5e8faSwyllys "subject name");
47899ebb4caSwyllys
47930a5e8faSwyllys SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
48030a5e8faSwyllys "issuer name");
48199ebb4caSwyllys
48299ebb4caSwyllys if (altname != NULL)
48330a5e8faSwyllys SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
48430a5e8faSwyllys alttype, altname), "subjectAltName");
48599ebb4caSwyllys
48699ebb4caSwyllys if (kubits)
48730a5e8faSwyllys SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
48830a5e8faSwyllys "subjectAltName");
48999ebb4caSwyllys
490d00756ccSwyllys if (ekulist != NULL) {
491d00756ccSwyllys int i;
492d00756ccSwyllys for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
493d00756ccSwyllys SET_VALUE(kmf_add_cert_eku(&signedCert,
494d00756ccSwyllys &ekulist->ekulist[i],
495d00756ccSwyllys ekulist->critlist[i]), "Extended Key Usage");
496d00756ccSwyllys }
497d00756ccSwyllys }
49830a5e8faSwyllys /*
49930a5e8faSwyllys * Construct attributes for the kmf_sign_cert operation.
50030a5e8faSwyllys */
50130a5e8faSwyllys numattr = 0;
50230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
50330a5e8faSwyllys &kstype, sizeof (kstype));
50430a5e8faSwyllys numattr++;
50530a5e8faSwyllys
50630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
50730a5e8faSwyllys &prik, sizeof (KMF_KEY_HANDLE_ATTR));
50830a5e8faSwyllys numattr++;
50930a5e8faSwyllys
51030a5e8faSwyllys /* cert data that is to be signed */
51130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
51230a5e8faSwyllys &signedCert, sizeof (KMF_X509_CERTIFICATE));
51330a5e8faSwyllys numattr++;
51430a5e8faSwyllys
51530a5e8faSwyllys /* output buffer for the signed cert */
51630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
51730a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
51830a5e8faSwyllys numattr++;
51930a5e8faSwyllys
5202c9a247fSWyllys Ingersoll kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
5212c9a247fSWyllys Ingersoll &sigAlg, sizeof (sigAlg));
5222c9a247fSWyllys Ingersoll numattr++;
5232c9a247fSWyllys Ingersoll
52430a5e8faSwyllys if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
52530a5e8faSwyllys KMF_OK) {
52699ebb4caSwyllys goto cleanup;
52799ebb4caSwyllys }
52899ebb4caSwyllys
52999ebb4caSwyllys /*
53099ebb4caSwyllys * Store the cert in the DB.
53199ebb4caSwyllys */
53230a5e8faSwyllys numattr = 0;
53330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
53430a5e8faSwyllys &kstype, sizeof (kstype));
53530a5e8faSwyllys numattr++;
53630a5e8faSwyllys
53730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
53830a5e8faSwyllys &x509DER, sizeof (KMF_DATA));
53930a5e8faSwyllys numattr++;
54030a5e8faSwyllys
54130a5e8faSwyllys if (nickname != NULL) {
54230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
54330a5e8faSwyllys nickname, strlen(nickname));
54430a5e8faSwyllys numattr++;
54530a5e8faSwyllys }
54630a5e8faSwyllys
54730a5e8faSwyllys if (trust != NULL) {
54830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TRUSTFLAG_ATTR,
54930a5e8faSwyllys trust, strlen(trust));
55030a5e8faSwyllys numattr++;
55130a5e8faSwyllys }
55230a5e8faSwyllys
55330a5e8faSwyllys if (token != NULL) {
55430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
55530a5e8faSwyllys token, strlen(token));
55630a5e8faSwyllys numattr++;
55730a5e8faSwyllys }
55830a5e8faSwyllys
55930a5e8faSwyllys kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
56099ebb4caSwyllys
56199ebb4caSwyllys cleanup:
56230a5e8faSwyllys kmf_free_data(&x509DER);
56330a5e8faSwyllys kmf_free_dn(&certSubject);
56430a5e8faSwyllys kmf_free_dn(&certIssuer);
56599ebb4caSwyllys return (kmfrv);
56699ebb4caSwyllys }
56799ebb4caSwyllys
56899ebb4caSwyllys int
pk_gencert(int argc,char * argv[])56999ebb4caSwyllys pk_gencert(int argc, char *argv[])
57099ebb4caSwyllys {
57199ebb4caSwyllys int rv;
57299ebb4caSwyllys int opt;
57399ebb4caSwyllys extern int optind_av;
57499ebb4caSwyllys extern char *optarg_av;
57599ebb4caSwyllys KMF_KEYSTORE_TYPE kstype = 0;
57699ebb4caSwyllys char *subject = NULL;
57799ebb4caSwyllys char *tokenname = NULL;
57899ebb4caSwyllys char *dir = NULL;
57999ebb4caSwyllys char *prefix = NULL;
58099ebb4caSwyllys char *keytype = PK_DEFAULT_KEYTYPE;
58199ebb4caSwyllys int keylen = PK_DEFAULT_KEYLENGTH;
58299ebb4caSwyllys char *trust = NULL;
58399ebb4caSwyllys char *lifetime = NULL;
58499ebb4caSwyllys char *certlabel = NULL;
58599ebb4caSwyllys char *outcert = NULL;
58699ebb4caSwyllys char *outkey = NULL;
58799ebb4caSwyllys char *format = NULL;
58899ebb4caSwyllys char *serstr = NULL;
58999ebb4caSwyllys char *altname = NULL;
59099ebb4caSwyllys char *keyusagestr = NULL;
591d00756ccSwyllys char *ekustr = NULL;
592e65e5c2dSWyllys Ingersoll char *hashname = NULL;
59399ebb4caSwyllys KMF_GENERALNAMECHOICES alttype = 0;
59499ebb4caSwyllys KMF_BIGINT serial = { NULL, 0 };
59599ebb4caSwyllys uint32_t ltime;
59699ebb4caSwyllys KMF_HANDLE_T kmfhandle = NULL;
59799ebb4caSwyllys KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
59899ebb4caSwyllys KMF_KEY_ALG keyAlg = KMF_RSA;
5994165f465SWyllys Ingersoll KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_SHA1WithRSA;
60099ebb4caSwyllys boolean_t interactive = B_FALSE;
60199ebb4caSwyllys char *subname = NULL;
6026b35cb3cSRichard PALO KMF_CREDENTIAL tokencred = { NULL, 0 };
60399ebb4caSwyllys uint16_t kubits = 0;
60499ebb4caSwyllys int altcrit = 0, kucrit = 0;
605d00756ccSwyllys EKU_LIST *ekulist = NULL;
606e65e5c2dSWyllys Ingersoll KMF_OID *curveoid = NULL; /* ECC */
607e65e5c2dSWyllys Ingersoll KMF_OID *hashoid = NULL;
608e65e5c2dSWyllys Ingersoll int y_flag = 0;
60999ebb4caSwyllys
61099ebb4caSwyllys while ((opt = getopt_av(argc, argv,
61130a5e8faSwyllys "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
61230a5e8faSwyllys "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
613d00756ccSwyllys "r:(trust)L:(lifetime)l:(label)c:(outcert)e:(eku)"
614e65e5c2dSWyllys Ingersoll "K:(outkey)S:(serial)F:(format)u:(keyusage)C:(curve)"
615e65e5c2dSWyllys Ingersoll "E(listcurves)h:(hash)")) != EOF) {
61699ebb4caSwyllys
617e65e5c2dSWyllys Ingersoll if (opt != 'i' && opt != 'E' && EMPTYSTRING(optarg_av))
61899ebb4caSwyllys return (PK_ERR_USAGE);
61999ebb4caSwyllys
62099ebb4caSwyllys switch (opt) {
62199ebb4caSwyllys case 'A':
62299ebb4caSwyllys altname = optarg_av;
62399ebb4caSwyllys break;
62499ebb4caSwyllys case 'i':
62599ebb4caSwyllys if (interactive || subject)
62699ebb4caSwyllys return (PK_ERR_USAGE);
62799ebb4caSwyllys else
62899ebb4caSwyllys interactive = B_TRUE;
62999ebb4caSwyllys break;
63099ebb4caSwyllys case 'k':
63199ebb4caSwyllys kstype = KS2Int(optarg_av);
63299ebb4caSwyllys if (kstype == 0)
63399ebb4caSwyllys return (PK_ERR_USAGE);
63499ebb4caSwyllys break;
63599ebb4caSwyllys case 's':
63699ebb4caSwyllys if (interactive || subject)
63799ebb4caSwyllys return (PK_ERR_USAGE);
63899ebb4caSwyllys else
63999ebb4caSwyllys subject = optarg_av;
64099ebb4caSwyllys break;
64199ebb4caSwyllys case 'l':
64299ebb4caSwyllys case 'n':
64399ebb4caSwyllys if (certlabel)
64499ebb4caSwyllys return (PK_ERR_USAGE);
64599ebb4caSwyllys certlabel = optarg_av;
64699ebb4caSwyllys break;
64799ebb4caSwyllys case 'T':
64899ebb4caSwyllys if (tokenname)
64999ebb4caSwyllys return (PK_ERR_USAGE);
65099ebb4caSwyllys tokenname = optarg_av;
65199ebb4caSwyllys break;
65299ebb4caSwyllys case 'd':
65399ebb4caSwyllys if (dir)
65499ebb4caSwyllys return (PK_ERR_USAGE);
65599ebb4caSwyllys dir = optarg_av;
65699ebb4caSwyllys break;
65799ebb4caSwyllys case 'p':
65899ebb4caSwyllys if (prefix)
65999ebb4caSwyllys return (PK_ERR_USAGE);
66099ebb4caSwyllys prefix = optarg_av;
66199ebb4caSwyllys break;
66299ebb4caSwyllys case 't':
66399ebb4caSwyllys keytype = optarg_av;
66499ebb4caSwyllys break;
66599ebb4caSwyllys case 'u':
66699ebb4caSwyllys keyusagestr = optarg_av;
66799ebb4caSwyllys break;
66899ebb4caSwyllys case 'y':
66999ebb4caSwyllys if (sscanf(optarg_av, "%d",
67030a5e8faSwyllys &keylen) != 1) {
67199ebb4caSwyllys cryptoerror(LOG_STDERR,
67230a5e8faSwyllys gettext("key length must be"
67330a5e8faSwyllys "a numeric value (%s)\n"),
67430a5e8faSwyllys optarg_av);
67599ebb4caSwyllys return (PK_ERR_USAGE);
67699ebb4caSwyllys }
677e65e5c2dSWyllys Ingersoll y_flag++;
67899ebb4caSwyllys break;
67999ebb4caSwyllys case 'r':
68099ebb4caSwyllys if (trust)
68199ebb4caSwyllys return (PK_ERR_USAGE);
68299ebb4caSwyllys trust = optarg_av;
68399ebb4caSwyllys break;
68499ebb4caSwyllys case 'L':
68599ebb4caSwyllys if (lifetime)
68699ebb4caSwyllys return (PK_ERR_USAGE);
68799ebb4caSwyllys lifetime = optarg_av;
68899ebb4caSwyllys break;
68999ebb4caSwyllys case 'c':
69099ebb4caSwyllys if (outcert)
69199ebb4caSwyllys return (PK_ERR_USAGE);
69299ebb4caSwyllys outcert = optarg_av;
69399ebb4caSwyllys break;
69499ebb4caSwyllys case 'K':
69599ebb4caSwyllys if (outkey)
69699ebb4caSwyllys return (PK_ERR_USAGE);
69799ebb4caSwyllys outkey = optarg_av;
69899ebb4caSwyllys break;
69999ebb4caSwyllys case 'S':
70099ebb4caSwyllys serstr = optarg_av;
70199ebb4caSwyllys break;
70299ebb4caSwyllys case 'F':
70399ebb4caSwyllys if (format)
70499ebb4caSwyllys return (PK_ERR_USAGE);
70599ebb4caSwyllys format = optarg_av;
70699ebb4caSwyllys break;
707d00756ccSwyllys case 'e':
708d00756ccSwyllys ekustr = optarg_av;
709d00756ccSwyllys break;
710e65e5c2dSWyllys Ingersoll case 'C':
711e65e5c2dSWyllys Ingersoll curveoid = ecc_name_to_oid(optarg_av);
712e65e5c2dSWyllys Ingersoll if (curveoid == NULL) {
713e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR,
714e65e5c2dSWyllys Ingersoll gettext("Unrecognized ECC "
715e65e5c2dSWyllys Ingersoll "curve.\n"));
716e65e5c2dSWyllys Ingersoll return (PK_ERR_USAGE);
717e65e5c2dSWyllys Ingersoll }
718e65e5c2dSWyllys Ingersoll break;
719e65e5c2dSWyllys Ingersoll case 'E':
720e65e5c2dSWyllys Ingersoll /*
721e65e5c2dSWyllys Ingersoll * This argument is only to be used
722e65e5c2dSWyllys Ingersoll * by itself, no other options should
723e65e5c2dSWyllys Ingersoll * be present.
724e65e5c2dSWyllys Ingersoll */
725e65e5c2dSWyllys Ingersoll if (argc != 2) {
726e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR,
727e65e5c2dSWyllys Ingersoll gettext("listcurves has no other "
728e65e5c2dSWyllys Ingersoll "options.\n"));
729e65e5c2dSWyllys Ingersoll return (PK_ERR_USAGE);
730e65e5c2dSWyllys Ingersoll }
731e65e5c2dSWyllys Ingersoll show_ecc_curves();
732e65e5c2dSWyllys Ingersoll return (0);
733e65e5c2dSWyllys Ingersoll case 'h':
734e65e5c2dSWyllys Ingersoll hashname = optarg_av;
735e65e5c2dSWyllys Ingersoll hashoid = ecc_name_to_oid(optarg_av);
736e65e5c2dSWyllys Ingersoll if (hashoid == NULL) {
737e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR,
738e65e5c2dSWyllys Ingersoll gettext("Unrecognized hash.\n"));
739e65e5c2dSWyllys Ingersoll return (PK_ERR_USAGE);
740e65e5c2dSWyllys Ingersoll }
741e65e5c2dSWyllys Ingersoll break;
74299ebb4caSwyllys default:
74399ebb4caSwyllys return (PK_ERR_USAGE);
74499ebb4caSwyllys }
74599ebb4caSwyllys }
74699ebb4caSwyllys
74799ebb4caSwyllys /* No additional args allowed. */
74899ebb4caSwyllys argc -= optind_av;
74999ebb4caSwyllys argv += optind_av;
75099ebb4caSwyllys if (argc) {
75199ebb4caSwyllys return (PK_ERR_USAGE);
75299ebb4caSwyllys }
75399ebb4caSwyllys
75430a5e8faSwyllys if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
75599ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
75699ebb4caSwyllys return (PK_ERR_USAGE);
75799ebb4caSwyllys }
75899ebb4caSwyllys
75999ebb4caSwyllys /* Assume keystore = PKCS#11 if not specified. */
76099ebb4caSwyllys if (kstype == 0)
76199ebb4caSwyllys kstype = KMF_KEYSTORE_PK11TOKEN;
76299ebb4caSwyllys
7632cbed729Swyllys if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
7642cbed729Swyllys if (interactive && EMPTYSTRING(certlabel)) {
7652cbed729Swyllys (void) get_certlabel(&certlabel);
7662cbed729Swyllys }
7672cbed729Swyllys /* It better not be empty now */
7682cbed729Swyllys if (EMPTYSTRING(certlabel)) {
7692cbed729Swyllys cryptoerror(LOG_STDERR, gettext("A label must be "
7702cbed729Swyllys "specified to create a self-signed certificate."
7712cbed729Swyllys "\n"));
7722cbed729Swyllys return (PK_ERR_USAGE);
7732cbed729Swyllys }
77499ebb4caSwyllys } else if (kstype == KMF_KEYSTORE_OPENSSL && EMPTYSTRING(outcert)) {
77599ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("A certificate filename must "
77699ebb4caSwyllys "be specified to create a self-signed certificate.\n"));
77799ebb4caSwyllys return (PK_ERR_USAGE);
77899ebb4caSwyllys }
77999ebb4caSwyllys
780577f4726Swyllys DIR_OPTION_CHECK(kstype, dir);
781577f4726Swyllys
78299ebb4caSwyllys if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
78399ebb4caSwyllys cryptoerror(LOG_STDERR,
78499ebb4caSwyllys gettext("Error parsing format string (%s).\n"),
78599ebb4caSwyllys format);
78699ebb4caSwyllys return (PK_ERR_USAGE);
78799ebb4caSwyllys }
78899ebb4caSwyllys
78999ebb4caSwyllys if (Str2Lifetime(lifetime, <ime) != 0) {
79099ebb4caSwyllys cryptoerror(LOG_STDERR,
79130a5e8faSwyllys gettext("Error parsing lifetime string\n"));
79299ebb4caSwyllys return (PK_ERR_USAGE);
79399ebb4caSwyllys }
79499ebb4caSwyllys
795e65e5c2dSWyllys Ingersoll if (Str2KeyType(keytype, hashoid, &keyAlg, &sigAlg) != 0) {
796e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR,
797e65e5c2dSWyllys Ingersoll gettext("Unsupported key/hash combination (%s/%s).\n"),
798e65e5c2dSWyllys Ingersoll keytype, (hashname ? hashname : "none"));
799e65e5c2dSWyllys Ingersoll return (PK_ERR_USAGE);
800e65e5c2dSWyllys Ingersoll }
801e65e5c2dSWyllys Ingersoll if (curveoid != NULL && keyAlg != KMF_ECDSA) {
802e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR, gettext("EC curves are only "
803e65e5c2dSWyllys Ingersoll "valid for EC keytypes.\n"));
804e65e5c2dSWyllys Ingersoll return (PK_ERR_USAGE);
805e65e5c2dSWyllys Ingersoll }
806e65e5c2dSWyllys Ingersoll if (keyAlg == KMF_ECDSA && curveoid == NULL) {
807e65e5c2dSWyllys Ingersoll cryptoerror(LOG_STDERR, gettext("A curve must be "
808e65e5c2dSWyllys Ingersoll "specifed when using EC keys.\n"));
80999ebb4caSwyllys return (PK_ERR_USAGE);
81099ebb4caSwyllys }
811e65e5c2dSWyllys Ingersoll /* Adjust default keylength for NSS and DSA */
812e65e5c2dSWyllys Ingersoll if (keyAlg == KMF_DSA && !y_flag && kstype == KMF_KEYSTORE_NSS)
813e65e5c2dSWyllys Ingersoll keylen = 1024;
81499ebb4caSwyllys
81599ebb4caSwyllys /*
81699ebb4caSwyllys * Check the subject name.
81799ebb4caSwyllys * If interactive is true, get it now interactively.
81899ebb4caSwyllys */
81999ebb4caSwyllys if (interactive) {
8202cbed729Swyllys subname = NULL;
8212cbed729Swyllys if (get_subname(&subname) != KMF_OK || subname == NULL) {
82299ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Failed to get the "
82399ebb4caSwyllys "subject name interactively.\n"));
82499ebb4caSwyllys return (PK_ERR_USAGE);
82599ebb4caSwyllys }
8262cbed729Swyllys if (serstr == NULL) {
8272cbed729Swyllys (void) get_serial(&serstr);
8282cbed729Swyllys }
82999ebb4caSwyllys } else {
83099ebb4caSwyllys if (EMPTYSTRING(subject)) {
83199ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("A subject name or "
83299ebb4caSwyllys "-i must be specified to create a self-signed "
83399ebb4caSwyllys "certificate.\n"));
83499ebb4caSwyllys return (PK_ERR_USAGE);
83599ebb4caSwyllys } else {
83699ebb4caSwyllys subname = strdup(subject);
83799ebb4caSwyllys if (subname == NULL) {
83899ebb4caSwyllys cryptoerror(LOG_STDERR,
83999ebb4caSwyllys gettext("Out of memory.\n"));
84099ebb4caSwyllys return (PK_ERR_SYSTEM);
84199ebb4caSwyllys }
84299ebb4caSwyllys }
84399ebb4caSwyllys }
84499ebb4caSwyllys
84599ebb4caSwyllys if (serstr == NULL) {
84699ebb4caSwyllys (void) fprintf(stderr, gettext("A serial number "
84730a5e8faSwyllys "must be specified as a hex number when creating"
84830a5e8faSwyllys " a self-signed certificate "
84930a5e8faSwyllys "(ex: serial=0x0102030405feedface)\n"));
85099ebb4caSwyllys rv = PK_ERR_USAGE;
85199ebb4caSwyllys goto end;
85299ebb4caSwyllys } else {
85399ebb4caSwyllys uchar_t *bytes = NULL;
85499ebb4caSwyllys size_t bytelen;
85599ebb4caSwyllys
85630a5e8faSwyllys rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
85799ebb4caSwyllys if (rv != KMF_OK || bytes == NULL) {
85899ebb4caSwyllys (void) fprintf(stderr, gettext("serial number "
85930a5e8faSwyllys "must be specified as a hex number "
86030a5e8faSwyllys "(ex: 0x0102030405ffeeddee)\n"));
86199ebb4caSwyllys rv = PK_ERR_USAGE;
86299ebb4caSwyllys goto end;
86399ebb4caSwyllys }
86499ebb4caSwyllys serial.val = bytes;
86599ebb4caSwyllys serial.len = bytelen;
86699ebb4caSwyllys }
86799ebb4caSwyllys
86899ebb4caSwyllys if (altname != NULL) {
86999ebb4caSwyllys rv = verify_altname(altname, &alttype, &altcrit);
87099ebb4caSwyllys if (rv != KMF_OK) {
87199ebb4caSwyllys (void) fprintf(stderr, gettext("Subject AltName "
87230a5e8faSwyllys "must be specified as a name=value pair. "
87330a5e8faSwyllys "See the man page for details.\n"));
87499ebb4caSwyllys rv = PK_ERR_USAGE;
87599ebb4caSwyllys goto end;
87699ebb4caSwyllys } else {
87799ebb4caSwyllys /* advance the altname past the '=' sign */
87899ebb4caSwyllys char *p = strchr(altname, '=');
87999ebb4caSwyllys if (p != NULL)
88099ebb4caSwyllys altname = p + 1;
88199ebb4caSwyllys }
88299ebb4caSwyllys }
88399ebb4caSwyllys
88499ebb4caSwyllys if (keyusagestr != NULL) {
88599ebb4caSwyllys rv = verify_keyusage(keyusagestr, &kubits, &kucrit);
88699ebb4caSwyllys if (rv != KMF_OK) {
88799ebb4caSwyllys (void) fprintf(stderr, gettext("KeyUsage "
88830a5e8faSwyllys "must be specified as a comma-separated list. "
88930a5e8faSwyllys "See the man page for details.\n"));
89099ebb4caSwyllys rv = PK_ERR_USAGE;
89199ebb4caSwyllys goto end;
89299ebb4caSwyllys }
89399ebb4caSwyllys }
894d00756ccSwyllys if (ekustr != NULL) {
895d00756ccSwyllys rv = verify_ekunames(ekustr, &ekulist);
896d00756ccSwyllys if (rv != KMF_OK) {
897d00756ccSwyllys (void) fprintf(stderr, gettext("EKUs must "
898d00756ccSwyllys "be specified as a comma-separated list. "
899d00756ccSwyllys "See the man page for details.\n"));
900d00756ccSwyllys rv = PK_ERR_USAGE;
901d00756ccSwyllys goto end;
902d00756ccSwyllys }
903d00756ccSwyllys }
904e65e5c2dSWyllys Ingersoll if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
905e65e5c2dSWyllys Ingersoll (void) fprintf(stderr, gettext("ECC certificates are"
906e65e5c2dSWyllys Ingersoll "only supported with the pkcs11 and nss keystores\n"));
907e65e5c2dSWyllys Ingersoll rv = PK_ERR_USAGE;
908e65e5c2dSWyllys Ingersoll goto end;
909e65e5c2dSWyllys Ingersoll }
91099ebb4caSwyllys
91199ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
91299ebb4caSwyllys if (tokenname == NULL || !strlen(tokenname)) {
91399ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS) {
91499ebb4caSwyllys tokenname = "internal";
91599ebb4caSwyllys } else {
91699ebb4caSwyllys tokenname = PK_DEFAULT_PK11TOKEN;
91799ebb4caSwyllys }
91899ebb4caSwyllys }
91999ebb4caSwyllys
92099ebb4caSwyllys (void) get_token_password(kstype, tokenname, &tokencred);
92199ebb4caSwyllys }
92299ebb4caSwyllys
92399ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS) {
92499ebb4caSwyllys if (dir == NULL)
92599ebb4caSwyllys dir = PK_DEFAULT_DIRECTORY;
92699ebb4caSwyllys
92799ebb4caSwyllys rv = gencert_nss(kmfhandle,
92830a5e8faSwyllys tokenname, subname, altname, alttype, altcrit,
92930a5e8faSwyllys certlabel, dir, prefix, keyAlg, sigAlg, keylen,
930d00756ccSwyllys trust, ltime, &serial, kubits, kucrit, &tokencred,
931e65e5c2dSWyllys Ingersoll ekulist, curveoid);
93299ebb4caSwyllys
93399ebb4caSwyllys } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
93499ebb4caSwyllys rv = gencert_pkcs11(kmfhandle,
93530a5e8faSwyllys tokenname, subname, altname, alttype, altcrit,
93630a5e8faSwyllys certlabel, keyAlg, sigAlg, keylen, ltime,
937e65e5c2dSWyllys Ingersoll &serial, kubits, kucrit, &tokencred, ekulist,
938e65e5c2dSWyllys Ingersoll curveoid);
93999ebb4caSwyllys
94099ebb4caSwyllys } else if (kstype == KMF_KEYSTORE_OPENSSL) {
94199ebb4caSwyllys rv = gencert_file(kmfhandle,
94230a5e8faSwyllys keyAlg, sigAlg, keylen, fmt,
94330a5e8faSwyllys ltime, subname, altname, alttype, altcrit,
944448b8615Swyllys &serial, kubits, kucrit, outcert, outkey,
945d00756ccSwyllys ekulist);
94699ebb4caSwyllys }
94799ebb4caSwyllys
94899ebb4caSwyllys if (rv != KMF_OK)
94999ebb4caSwyllys display_error(kmfhandle, rv,
95030a5e8faSwyllys gettext("Error creating certificate and keypair"));
95199ebb4caSwyllys end:
952d00756ccSwyllys if (ekulist != NULL)
953d00756ccSwyllys free_eku_list(ekulist);
95499ebb4caSwyllys if (subname)
95599ebb4caSwyllys free(subname);
95699ebb4caSwyllys if (tokencred.cred != NULL)
95799ebb4caSwyllys free(tokencred.cred);
95899ebb4caSwyllys
95999ebb4caSwyllys if (serial.val != NULL)
96099ebb4caSwyllys free(serial.val);
96199ebb4caSwyllys
96230a5e8faSwyllys (void) kmf_finalize(kmfhandle);
96399ebb4caSwyllys return (rv);
96499ebb4caSwyllys }
965