#!/usr/bin/env perl

[0] Fix | Delete

# Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.

[1] Fix | Delete

#

[2] Fix | Delete

# Licensed under the OpenSSL license (the "License"). You may not use

[3] Fix | Delete

# this file except in compliance with the License. You can obtain a copy

[4] Fix | Delete

# in the file LICENSE in the source distribution or at

[5] Fix | Delete

# https://www.openssl.org/source/license.html

[6] Fix | Delete

[7] Fix | Delete

#

[8] Fix | Delete

# Wrapper around the ca to make it easier to use

[9] Fix | Delete

#

[10] Fix | Delete

# WARNING: do not edit!

[11] Fix | Delete

# Generated by Makefile from apps/CA.pl.in

[12] Fix | Delete

[13] Fix | Delete

use strict;

[14] Fix | Delete

use warnings;

[15] Fix | Delete

[16] Fix | Delete

my $openssl = "openssl";

[17] Fix | Delete

if(defined $ENV{'OPENSSL'}) {

[18] Fix | Delete

$openssl = $ENV{'OPENSSL'};

[19] Fix | Delete

} else {

[20] Fix | Delete

$ENV{'OPENSSL'} = $openssl;

[21] Fix | Delete

}

[22] Fix | Delete

[23] Fix | Delete

my $verbose = 1;

[24] Fix | Delete

[25] Fix | Delete

my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} || "";

[26] Fix | Delete

my $DAYS = "-days 365";

[27] Fix | Delete

my $CADAYS = "-days 1095"; # 3 years

[28] Fix | Delete

my $REQ = "$openssl req $OPENSSL_CONFIG";

[29] Fix | Delete

my $CA = "$openssl ca $OPENSSL_CONFIG";

[30] Fix | Delete

my $VERIFY = "$openssl verify";

[31] Fix | Delete

my $X509 = "$openssl x509";

[32] Fix | Delete

my $PKCS12 = "$openssl pkcs12";

[33] Fix | Delete

[34] Fix | Delete

# default openssl.cnf file has setup as per the following

[35] Fix | Delete

my $CATOP = "/etc/pki/CA";

[36] Fix | Delete

my $CAKEY = "cakey.pem";

[37] Fix | Delete

my $CAREQ = "careq.pem";

[38] Fix | Delete

my $CACERT = "cacert.pem";

[39] Fix | Delete

my $CACRL = "crl.pem";

[40] Fix | Delete

my $DIRMODE = 0777;

[41] Fix | Delete

[42] Fix | Delete

my $NEWKEY = "newkey.pem";

[43] Fix | Delete

my $NEWREQ = "newreq.pem";

[44] Fix | Delete

my $NEWCERT = "newcert.pem";

[45] Fix | Delete

my $NEWP12 = "newcert.p12";

[46] Fix | Delete

my $RET = 0;

[47] Fix | Delete

my $WHAT = shift @ARGV || "";

[48] Fix | Delete

my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");

[49] Fix | Delete

my %EXTRA = extra_args(\@ARGV, "-extra-");

[50] Fix | Delete

my $FILE;

[51] Fix | Delete

[52] Fix | Delete

sub extra_args {

[53] Fix | Delete

my ($args_ref, $arg_prefix) = @_;

[54] Fix | Delete

my %eargs = map {

[55] Fix | Delete

if ($_ < $#$args_ref) {

[56] Fix | Delete

my ($arg, $value) = splice(@$args_ref, $_, 2);

[57] Fix | Delete

$arg =~ s/$arg_prefix//;

[58] Fix | Delete

($arg, $value);

[59] Fix | Delete

} else {

[60] Fix | Delete

();

[61] Fix | Delete

}

[62] Fix | Delete

} reverse grep($$args_ref[$_] =~ /$arg_prefix/, 0..$#$args_ref);

[63] Fix | Delete

my %empty = map { ($_, "") } @OPENSSL_CMDS;

[64] Fix | Delete

return (%empty, %eargs);

[65] Fix | Delete

}

[66] Fix | Delete

[67] Fix | Delete

# See if reason for a CRL entry is valid; exit if not.

[68] Fix | Delete

sub crl_reason_ok

[69] Fix | Delete

{

[70] Fix | Delete

my $r = shift;

[71] Fix | Delete

[72] Fix | Delete

if ($r eq 'unspecified' || $r eq 'keyCompromise'

[73] Fix | Delete

|| $r eq 'CACompromise' || $r eq 'affiliationChanged'

[74] Fix | Delete

|| $r eq 'superseded' || $r eq 'cessationOfOperation'

[75] Fix | Delete

|| $r eq 'certificateHold' || $r eq 'removeFromCRL') {

[76] Fix | Delete

return 1;

[77] Fix | Delete

}

[78] Fix | Delete

print STDERR "Invalid CRL reason; must be one of:\n";

[79] Fix | Delete

print STDERR " unspecified, keyCompromise, CACompromise,\n";

[80] Fix | Delete

print STDERR " affiliationChanged, superseded, cessationOfOperation\n";

[81] Fix | Delete

print STDERR " certificateHold, removeFromCRL";

[82] Fix | Delete

exit 1;

[83] Fix | Delete

}

[84] Fix | Delete

[85] Fix | Delete

# Copy a PEM-format file; return like exit status (zero means ok)

[86] Fix | Delete

sub copy_pemfile

[87] Fix | Delete

{

[88] Fix | Delete

my ($infile, $outfile, $bound) = @_;

[89] Fix | Delete

my $found = 0;

[90] Fix | Delete

[91] Fix | Delete

open IN, $infile || die "Cannot open $infile, $!";

[92] Fix | Delete

open OUT, ">$outfile" || die "Cannot write to $outfile, $!";

[93] Fix | Delete

while (<IN>) {

[94] Fix | Delete

$found = 1 if /^-----BEGIN.*$bound/;

[95] Fix | Delete

print OUT $_ if $found;

[96] Fix | Delete

$found = 2, last if /^-----END.*$bound/;

[97] Fix | Delete

}

[98] Fix | Delete

close IN;

[99] Fix | Delete

close OUT;

[100] Fix | Delete

return $found == 2 ? 0 : 1;

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

# Wrapper around system; useful for debugging. Returns just the exit status

[104] Fix | Delete

sub run

[105] Fix | Delete

{

[106] Fix | Delete

my $cmd = shift;

[107] Fix | Delete

print "====\n$cmd\n" if $verbose;

[108] Fix | Delete

my $status = system($cmd);

[109] Fix | Delete

print "==> $status\n====\n" if $verbose;

[110] Fix | Delete

return $status >> 8;

[111] Fix | Delete

}

[112] Fix | Delete

[113] Fix | Delete

[114] Fix | Delete

if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {

[115] Fix | Delete

print STDERR "usage: CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd extra-params]\n";

[116] Fix | Delete

print STDERR " CA.pl -pkcs12 [-extra-pkcs12 extra-params] [certname]\n";

[117] Fix | Delete

print STDERR " CA.pl -verify [-extra-verify extra-params] certfile ...\n";

[118] Fix | Delete

print STDERR " CA.pl -revoke [-extra-ca extra-params] certfile [reason]\n";

[119] Fix | Delete

exit 0;

[120] Fix | Delete

}

[121] Fix | Delete

if ($WHAT eq '-newcert' ) {

[122] Fix | Delete

# create a certificate

[123] Fix | Delete

$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS $EXTRA{req}");

[124] Fix | Delete

print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;

[125] Fix | Delete

} elsif ($WHAT eq '-precert' ) {

[126] Fix | Delete

# create a pre-certificate

[127] Fix | Delete

$RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS");

[128] Fix | Delete

print "Pre-cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;

[129] Fix | Delete

} elsif ($WHAT =~ /^\-newreq(\-nodes)?$/ ) {

[130] Fix | Delete

# create a certificate request

[131] Fix | Delete

$RET = run("$REQ -new $1 -keyout $NEWKEY -out $NEWREQ $DAYS $EXTRA{req}");

[132] Fix | Delete

print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;

[133] Fix | Delete

} elsif ($WHAT eq '-newca' ) {

[134] Fix | Delete

# create the directory hierarchy

[135] Fix | Delete

mkdir ${CATOP}, $DIRMODE;

[136] Fix | Delete

mkdir "${CATOP}/certs", $DIRMODE;

[137] Fix | Delete

mkdir "${CATOP}/crl", $DIRMODE ;

[138] Fix | Delete

mkdir "${CATOP}/newcerts", $DIRMODE;

[139] Fix | Delete

mkdir "${CATOP}/private", $DIRMODE;

[140] Fix | Delete

open OUT, ">${CATOP}/index.txt";

[141] Fix | Delete

close OUT;

[142] Fix | Delete

open OUT, ">${CATOP}/crlnumber";

[143] Fix | Delete

print OUT "01\n";

[144] Fix | Delete

close OUT;

[145] Fix | Delete

# ask user for existing CA certificate

[146] Fix | Delete

print "CA certificate filename (or enter to create)\n";

[147] Fix | Delete

$FILE = "" unless defined($FILE = <STDIN>);

[148] Fix | Delete

$FILE =~ s{\R$}{};

[149] Fix | Delete

if ($FILE ne "") {

[150] Fix | Delete

copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");

[151] Fix | Delete

copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");

[152] Fix | Delete

} else {

[153] Fix | Delete

print "Making CA certificate ...\n";

[154] Fix | Delete

$RET = run("$REQ -new -keyout"

[155] Fix | Delete

. " ${CATOP}/private/$CAKEY"

[156] Fix | Delete

. " -out ${CATOP}/$CAREQ $EXTRA{req}");

[157] Fix | Delete

$RET = run("$CA -create_serial"

[158] Fix | Delete

. " -out ${CATOP}/$CACERT $CADAYS -batch"

[159] Fix | Delete

. " -keyfile ${CATOP}/private/$CAKEY -selfsign"

[160] Fix | Delete

. " -extensions v3_ca $EXTRA{ca}"

[161] Fix | Delete

. " -infiles ${CATOP}/$CAREQ") if $RET == 0;

[162] Fix | Delete

print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;

[163] Fix | Delete

}

[164] Fix | Delete

} elsif ($WHAT eq '-pkcs12' ) {

[165] Fix | Delete

my $cname = $ARGV[0];

[166] Fix | Delete

$cname = "My Certificate" unless defined $cname;

[167] Fix | Delete

$RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"

[168] Fix | Delete

. " -certfile ${CATOP}/$CACERT"

[169] Fix | Delete

. " -out $NEWP12"

[170] Fix | Delete

. " -export -name \"$cname\" $EXTRA{pkcs12}");

[171] Fix | Delete

print "PKCS #12 file is in $NEWP12\n" if $RET == 0;

[172] Fix | Delete

} elsif ($WHAT eq '-xsign' ) {

[173] Fix | Delete

$RET = run("$CA -policy policy_anything $EXTRA{ca} -infiles $NEWREQ");

[174] Fix | Delete

} elsif ($WHAT eq '-sign' ) {

[175] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT $EXTRA{ca} -infiles $NEWREQ");

[176] Fix | Delete

print "Signed certificate is in $NEWCERT\n" if $RET == 0;

[177] Fix | Delete

} elsif ($WHAT eq '-signCA' ) {

[178] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT"

[179] Fix | Delete

. " -extensions v3_ca $EXTRA{ca} -infiles $NEWREQ");

[180] Fix | Delete

print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;

[181] Fix | Delete

} elsif ($WHAT eq '-signcert' ) {

[182] Fix | Delete

$RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"

[183] Fix | Delete

. " -out tmp.pem $EXTRA{x509}");

[184] Fix | Delete

$RET = run("$CA -policy policy_anything -out $NEWCERT"

[185] Fix | Delete

. "$EXTRA{ca} -infiles tmp.pem") if $RET == 0;

[186] Fix | Delete

print "Signed certificate is in $NEWCERT\n" if $RET == 0;

[187] Fix | Delete

} elsif ($WHAT eq '-verify' ) {

[188] Fix | Delete

my @files = @ARGV ? @ARGV : ( $NEWCERT );

[189] Fix | Delete

my $file;

[190] Fix | Delete

foreach $file (@files) {

[191] Fix | Delete

my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file $EXTRA{verify}");

[192] Fix | Delete

$RET = $status if $status != 0;

[193] Fix | Delete

}

[194] Fix | Delete

} elsif ($WHAT eq '-crl' ) {

[195] Fix | Delete

$RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL $EXTRA{ca}");

[196] Fix | Delete

print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;

[197] Fix | Delete

} elsif ($WHAT eq '-revoke' ) {

[198] Fix | Delete

my $cname = $ARGV[0];

[199] Fix | Delete

if (!defined $cname) {

[200] Fix | Delete

print "Certificate filename is required; reason optional.\n";

[201] Fix | Delete

exit 1;

[202] Fix | Delete

}

[203] Fix | Delete

my $reason = $ARGV[1];

[204] Fix | Delete

$reason = " -crl_reason $reason"

[205] Fix | Delete

if defined $reason && crl_reason_ok($reason);

[206] Fix | Delete

$RET = run("$CA -revoke \"$cname\"" . $reason . $EXTRA{ca});

[207] Fix | Delete

} else {

[208] Fix | Delete

print STDERR "Unknown arg \"$WHAT\"\n";

[209] Fix | Delete

print STDERR "Use -help for help.\n";

[210] Fix | Delete

exit 1;

[211] Fix | Delete

}

[212] Fix | Delete

[213] Fix | Delete

exit $RET;

[214] Fix | Delete

[215] Fix | Delete