Edit File by line

#!/usr/bin/env perl

[0] Fix | Delete

[1] Fix | Delete

[2] Fix | Delete

# Licensed under the OpenSSL license (the "License"). You may not use

[3] Fix | Delete

# this file except in compliance with the License. You can obtain a copy

[4] Fix | Delete

# in the file LICENSE in the source distribution or at

[5] Fix | Delete

# https://www.openssl.org/source/license.html

[6] Fix | Delete

[7] Fix | Delete

[8] Fix | Delete

# Wrapper around the ca to make it easier to use

[9] Fix | Delete

[10] Fix | Delete

# WARNING: do not edit!

[11] Fix | Delete

# Generated by Makefile from apps/CA.pl.in

[12] Fix | Delete

[13] Fix | Delete

use strict;

[14] Fix | Delete

use warnings;

[15] Fix | Delete

[16] Fix | Delete

my $openssl = "openssl";

[17] Fix | Delete

if(defined $ENV{'OPENSSL'}) {

[18] Fix | Delete

$openssl = $ENV{'OPENSSL'};

[19] Fix | Delete

} else {

[20] Fix | Delete

$ENV{'OPENSSL'} = $openssl;

[21] Fix | Delete

}

[22] Fix | Delete

[23] Fix | Delete

my $verbose = 1;

[24] Fix | Delete

[25] Fix | Delete

my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} || "";

[26] Fix | Delete

my $DAYS = "-days 365";

[27] Fix | Delete

my $CADAYS = "-days 1095"; # 3 years

[28] Fix | Delete

my $REQ = "$openssl req $OPENSSL_CONFIG";

[29] Fix | Delete

my $CA = "$openssl ca $OPENSSL_CONFIG";

[30] Fix | Delete

my $VERIFY = "$openssl verify";

[31] Fix | Delete

my $X509 = "$openssl x509";

[32] Fix | Delete

my $PKCS12 = "$openssl pkcs12";

[33] Fix | Delete

[34] Fix | Delete

# default openssl.cnf file has setup as per the following

[35] Fix | Delete

my $CATOP = "/etc/pki/CA";

[36] Fix | Delete

my $CAKEY = "cakey.pem";

[37] Fix | Delete

my $CAREQ = "careq.pem";

[38] Fix | Delete

my $CACERT = "cacert.pem";

[39] Fix | Delete

my $CACRL = "crl.pem";

[40] Fix | Delete

my $DIRMODE = 0777;

[41] Fix | Delete

[42] Fix | Delete

my $NEWKEY = "newkey.pem";

[43] Fix | Delete

my $NEWREQ = "newreq.pem";

[44] Fix | Delete

my $NEWCERT = "newcert.pem";

[45] Fix | Delete

my $NEWP12 = "newcert.p12";

[46] Fix | Delete

my $RET = 0;

[47] Fix | Delete

my $WHAT = shift @ARGV || "";

[48] Fix | Delete

my $FILE;

[49] Fix | Delete

[50] Fix | Delete

# See if reason for a CRL entry is valid; exit if not.

[51] Fix | Delete

sub crl_reason_ok

[52] Fix | Delete

{

[53] Fix | Delete

my $r = shift;

[54] Fix | Delete

[55] Fix | Delete

if ($r eq 'unspecified' || $r eq 'keyCompromise'

[56] Fix | Delete

|| $r eq 'CACompromise' || $r eq 'affiliationChanged'

[57] Fix | Delete

|| $r eq 'superseded' || $r eq 'cessationOfOperation'

[58] Fix | Delete

|| $r eq 'certificateHold' || $r eq 'removeFromCRL') {

[59] Fix | Delete

return 1;

[60] Fix | Delete

}

[61] Fix | Delete

print STDERR "Invalid CRL reason; must be one of:\n";

[62] Fix | Delete

print STDERR " unspecified, keyCompromise, CACompromise,\n";

[63] Fix | Delete

print STDERR " affiliationChanged, superseded, cessationOfOperation\n";

[64] Fix | Delete

print STDERR " certificateHold, removeFromCRL";

[65] Fix | Delete

exit 1;

[66] Fix | Delete

}

[67] Fix | Delete

[68] Fix | Delete

# Copy a PEM-format file; return like exit status (zero means ok)

[69] Fix | Delete

sub copy_pemfile

[70] Fix | Delete

{

[71] Fix | Delete

my ($infile, $outfile, $bound) = @_;

[72] Fix | Delete

my $found = 0;

[73] Fix | Delete

[74] Fix | Delete

open IN, $infile || die "Cannot open $infile, $!";

[75] Fix | Delete

open OUT, ">$outfile" || die "Cannot write to $outfile, $!";

[76] Fix | Delete

while (<IN>) {

[77] Fix | Delete

$found = 1 if /^-----BEGIN.*$bound/;

[78] Fix | Delete

print OUT $_ if $found;

[79] Fix | Delete

$found = 2, last if /^-----END.*$bound/;

[80] Fix | Delete

}

[81] Fix | Delete

close IN;

[82] Fix | Delete

close OUT;

[83] Fix | Delete

return $found == 2 ? 0 : 1;

[84] Fix | Delete

}

[85] Fix | Delete

[86] Fix | Delete

# Wrapper around system; useful for debugging. Returns just the exit status

[87] Fix | Delete

sub run

[88] Fix | Delete

{

[89] Fix | Delete

my $cmd = shift;

[90] Fix | Delete

print "====\n$cmd\n" if $verbose;

[91] Fix | Delete

my $status = system($cmd);

[92] Fix | Delete

print "==> $status\n====\n" if $verbose;

[93] Fix | Delete

return $status >> 8;

[94] Fix | Delete

}

[95] Fix | Delete

[96] Fix | Delete

[97] Fix | Delete

if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {

[98] Fix | Delete

[99] Fix | Delete

print STDERR " CA -pkcs12 [certname]\n";

[100] Fix | Delete

print STDERR " CA -crl|-revoke cert-filename [reason]\n";

[101] Fix | Delete

exit 0;

[102] Fix | Delete

}

[103] Fix | Delete

if ($WHAT eq '-newcert' ) {

[104] Fix | Delete

# create a certificate

[105] Fix | Delete

$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS");

[106] Fix | Delete

print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;

[107] Fix | Delete

} elsif ($WHAT eq '-newreq' ) {

[108] Fix | Delete

# create a certificate request

[109] Fix | Delete

$RET = run("$REQ -new -keyout $NEWKEY -out $NEWREQ $DAYS");

[110] Fix | Delete

print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;

[111] Fix | Delete

} elsif ($WHAT eq '-newreq-nodes' ) {

[112] Fix | Delete

# create a certificate request

[113] Fix | Delete

$RET = run("$REQ -new -nodes -keyout $NEWKEY -out $NEWREQ $DAYS");

[114] Fix | Delete

print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;

[115] Fix | Delete

} elsif ($WHAT eq '-newca' ) {

[116] Fix | Delete

# create the directory hierarchy

[117] Fix | Delete

mkdir ${CATOP}, $DIRMODE;

[118] Fix | Delete

mkdir "${CATOP}/certs", $DIRMODE;

[119] Fix | Delete

mkdir "${CATOP}/crl", $DIRMODE ;

[120] Fix | Delete

mkdir "${CATOP}/newcerts", $DIRMODE;

[121] Fix | Delete

mkdir "${CATOP}/private", $DIRMODE;

[122] Fix | Delete

open OUT, ">${CATOP}/index.txt";

[123] Fix | Delete

close OUT;

[124] Fix | Delete

open OUT, ">${CATOP}/crlnumber";

[125] Fix | Delete

print OUT "01\n";

[126] Fix | Delete

close OUT;

[127] Fix | Delete

# ask user for existing CA certificate

[128] Fix | Delete

print "CA certificate filename (or enter to create)\n";

[129] Fix | Delete

$FILE = "" unless defined($FILE = <STDIN>);

[130] Fix | Delete

$FILE =~ s{\R$}{};

[131] Fix | Delete

if ($FILE ne "") {

[132] Fix | Delete

copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");

[133] Fix | Delete

copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");

[134] Fix | Delete

} else {

[135] Fix | Delete

print "Making CA certificate ...\n";

[136] Fix | Delete

$RET = run("$REQ -new -keyout"

[137] Fix | Delete

. " ${CATOP}/private/$CAKEY"

[138] Fix | Delete

. " -out ${CATOP}/$CAREQ");

[139] Fix | Delete

$RET = run("$CA -create_serial"

[140] Fix | Delete

. " -out ${CATOP}/$CACERT $CADAYS -batch"

[141] Fix | Delete

. " -keyfile ${CATOP}/private/$CAKEY -selfsign"

[142] Fix | Delete

. " -extensions v3_ca"

[143] Fix | Delete

. " -infiles ${CATOP}/$CAREQ") if $RET == 0;

[144] Fix | Delete

print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;

[145] Fix | Delete

}

[146] Fix | Delete

} elsif ($WHAT eq '-pkcs12' ) {

[147] Fix | Delete

my $cname = $ARGV[0];

[148] Fix | Delete

$cname = "My Certificate" unless defined $cname;

[149] Fix | Delete

$RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"

[150] Fix | Delete

. " -certfile ${CATOP}/$CACERT"

[151] Fix | Delete

. " -out $NEWP12"

[152] Fix | Delete

. " -export -name \"$cname\"");

[153] Fix | Delete

print "PKCS #12 file is in $NEWP12\n" if $RET == 0;

[154] Fix | Delete

} elsif ($WHAT eq '-xsign' ) {

[155] Fix | Delete

$RET = run("$CA -policy policy_anything -infiles $NEWREQ");

[156] Fix | Delete

} elsif ($WHAT eq '-sign' ) {

[157] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT -infiles $NEWREQ");

[158] Fix | Delete

print "Signed certificate is in $NEWCERT\n" if $RET == 0;

[159] Fix | Delete

} elsif ($WHAT eq '-signCA' ) {

[160] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT"

[161] Fix | Delete

. " -extensions v3_ca -infiles $NEWREQ");

[162] Fix | Delete

print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;

[163] Fix | Delete

} elsif ($WHAT eq '-signcert' ) {

[164] Fix | Delete

$RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"

[165] Fix | Delete

. " -out tmp.pem");

[166] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT"

[167] Fix | Delete

. " -infiles tmp.pem") if $RET == 0;

[168] Fix | Delete

print "Signed certificate is in $NEWCERT\n" if $RET == 0;

[169] Fix | Delete

} elsif ($WHAT eq '-verify' ) {

[170] Fix | Delete

my @files = @ARGV ? @ARGV : ( $NEWCERT );

[171] Fix | Delete

my $file;

[172] Fix | Delete

foreach $file (@files) {

[173] Fix | Delete

my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file");

[174] Fix | Delete

$RET = $status if $status != 0;

[175] Fix | Delete

}

[176] Fix | Delete

} elsif ($WHAT eq '-crl' ) {

[177] Fix | Delete

$RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL");

[178] Fix | Delete

print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;

[179] Fix | Delete

} elsif ($WHAT eq '-revoke' ) {

[180] Fix | Delete

my $cname = $ARGV[0];

[181] Fix | Delete

if (!defined $cname) {

[182] Fix | Delete

print "Certificate filename is required; reason optional.\n";

[183] Fix | Delete

exit 1;

[184] Fix | Delete

}

[185] Fix | Delete

my $reason = $ARGV[1];

[186] Fix | Delete

$reason = " -crl_reason $reason"

[187] Fix | Delete

if defined $reason && crl_reason_ok($reason);

[188] Fix | Delete

$RET = run("$CA -revoke \"$cname\"" . $reason);

[189] Fix | Delete

} else {

[190] Fix | Delete

print STDERR "Unknown arg \"$WHAT\"\n";

[191] Fix | Delete

print STDERR "Use -help for help.\n";

[192] Fix | Delete

exit 1;

[193] Fix | Delete

}

[194] Fix | Delete

[195] Fix | Delete

exit $RET;

[196] Fix | Delete

[197] Fix | Delete