mirror of
https://github.com/openssl/openssl.git
synced 2024-12-09 05:51:54 +08:00
9ab6fc5936
Now that we're using templates, we should warn people not to edit the resulting file. We do it through util/dofile.pl, which is enhanced with an option to tell what file it was called from. We also change the calls so the template files are on the command line instead of being redirected through standard input. That way, we can display something like this (example taken from include/openssl/opensslconf.h): /* WARNING: do not edit! */ /* Generated by Configure from include/openssl/opensslconf.h.in */ Reviewed-by: Rich Salz <rsalz@openssl.org>
190 lines
6.2 KiB
Perl
190 lines
6.2 KiB
Perl
#!{- $config{perl} -}
|
|
#
|
|
# Wrapper around the ca to make it easier to use
|
|
#
|
|
# {- join("\n# ", @autowarntext) -}
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
my $openssl = "openssl";
|
|
if(defined $ENV{'OPENSSL'}) {
|
|
$openssl = $ENV{'OPENSSL'};
|
|
} else {
|
|
$ENV{'OPENSSL'} = $openssl;
|
|
}
|
|
|
|
my $verbose = 1;
|
|
|
|
my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"};
|
|
my $DAYS = "-days 365";
|
|
my $CADAYS = "-days 1095"; # 3 years
|
|
my $REQ = "$openssl req $OPENSSL_CONFIG";
|
|
my $CA = "$openssl ca $OPENSSL_CONFIG";
|
|
my $VERIFY = "$openssl verify";
|
|
my $X509 = "$openssl x509";
|
|
my $PKCS12 = "$openssl pkcs12";
|
|
|
|
# default openssl.cnf file has setup as per the following
|
|
my $CATOP = "./demoCA";
|
|
my $CAKEY = "cakey.pem";
|
|
my $CAREQ = "careq.pem";
|
|
my $CACERT = "cacert.pem";
|
|
my $CACRL = "crl.pem";
|
|
my $DIRMODE = 0777;
|
|
|
|
my $NEWKEY = "newkey.pem";
|
|
my $NEWREQ = "newreq.pem";
|
|
my $NEWCERT = "newcert.pem";
|
|
my $NEWP12 = "newcert.p12";
|
|
my $RET = 0;
|
|
my $WHAT = shift @ARGV;
|
|
my $FILE;
|
|
|
|
# See if reason for a CRL entry is valid; exit if not.
|
|
sub crl_reason_ok
|
|
{
|
|
my $r = shift;
|
|
|
|
if ($r eq 'unspecified' || $r eq 'keyCompromise'
|
|
|| $r eq 'CACompromise' || $r eq 'affiliationChanged'
|
|
|| $r eq 'superseded' || $r eq 'cessationOfOperation'
|
|
|| $r eq 'certificateHold' || $r eq 'removeFromCRL') {
|
|
return 1;
|
|
}
|
|
print STDERR "Invalid CRL reason; must be one of:\n";
|
|
print STDERR " unspecified, keyCompromise, CACompromise,\n";
|
|
print STDERR " affiliationChanged, superseded, cessationOfOperation\n";
|
|
print STDERR " certificateHold, removeFromCRL";
|
|
exit 1;
|
|
}
|
|
|
|
# Copy a PEM-format file; return like exit status (zero means ok)
|
|
sub copy_pemfile
|
|
{
|
|
my ($infile, $outfile, $bound) = @_;
|
|
my $found = 0;
|
|
|
|
open IN, $infile || die "Cannot open $infile, $!";
|
|
open OUT, ">$outfile" || die "Cannot write to $outfile, $!";
|
|
while (<IN>) {
|
|
$found = 1 if /^-----BEGIN.*$bound/;
|
|
print OUT $_ if $found;
|
|
$found = 2, last if /^-----END.*$bound/;
|
|
}
|
|
close IN;
|
|
close OUT;
|
|
return $found == 2 ? 0 : 1;
|
|
}
|
|
|
|
# Wrapper around system; useful for debugging. Returns just the exit status
|
|
sub run
|
|
{
|
|
my $cmd = shift;
|
|
print "====\n$cmd\n" if $verbose;
|
|
my $status = system($cmd);
|
|
print "==> $status\n====\n" if $verbose;
|
|
return $status >> 8;
|
|
}
|
|
|
|
|
|
if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
|
|
print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
|
|
print STDERR " CA -pkcs12 [certname]\n";
|
|
print STDERR " CA -crl|-revoke cert-filename [reason]\n";
|
|
exit 0;
|
|
}
|
|
if ($WHAT eq '-newcert' ) {
|
|
# create a certificate
|
|
$RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS");
|
|
print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-newreq' ) {
|
|
# create a certificate request
|
|
$RET = run("$REQ -new -keyout $NEWKEY -out $NEWREQ $DAYS");
|
|
print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-newreq-nodes' ) {
|
|
# create a certificate request
|
|
$RET = run("$REQ -new -nodes -keyout $NEWKEY -out $NEWREQ $DAYS");
|
|
print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-newca' ) {
|
|
# create the directory hierarchy
|
|
mkdir ${CATOP}, $DIRMODE;
|
|
mkdir "${CATOP}/certs", $DIRMODE;
|
|
mkdir "${CATOP}/crl", $DIRMODE ;
|
|
mkdir "${CATOP}/newcerts", $DIRMODE;
|
|
mkdir "${CATOP}/private", $DIRMODE;
|
|
open OUT, ">${CATOP}/index.txt";
|
|
close OUT;
|
|
open OUT, ">${CATOP}/crlnumber";
|
|
print OUT "01\n";
|
|
close OUT;
|
|
# ask user for existing CA certificate
|
|
print "CA certificate filename (or enter to create)\n";
|
|
$FILE = <STDIN>;
|
|
chop $FILE if $FILE;
|
|
if ($FILE) {
|
|
copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
|
|
copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
|
|
} else {
|
|
print "Making CA certificate ...\n";
|
|
$RET = run("$REQ -new -keyout"
|
|
. " ${CATOP}/private/$CAKEY"
|
|
. " -out ${CATOP}/$CAREQ");
|
|
$RET = run("$CA -create_serial"
|
|
. " -out ${CATOP}/$CACERT $CADAYS -batch"
|
|
. " -keyfile ${CATOP}/private/$CAKEY -selfsign"
|
|
. " -extensions v3_ca"
|
|
. " -infiles ${CATOP}/$CAREQ") if $RET == 0;
|
|
print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
|
|
}
|
|
} elsif ($WHAT eq '-pkcs12' ) {
|
|
my $cname = $ARGV[1];
|
|
$cname = "My Certificate" unless defined $cname;
|
|
$RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
|
|
. " -certfile ${CATOP}/$CACERT"
|
|
. " -out $NEWP12"
|
|
. " -export -name \"$cname\"");
|
|
print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-xsign' ) {
|
|
$RET = run("$CA -policy policy_anything -infiles $NEWREQ");
|
|
} elsif ($WHAT eq '-sign' ) {
|
|
$RET = run("$CA -policy policy_anything -out $NEWCERT -infiles $NEWREQ");
|
|
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-signCA' ) {
|
|
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
|
. " -extensions v3_ca -infiles $NEWREQ");
|
|
print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-signcert' ) {
|
|
$RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
|
|
. " -out tmp.pem");
|
|
$RET = run("$CA -policy policy_anything -out $NEWCERT"
|
|
. " -infiles tmp.pem") if $RET == 0;
|
|
print "Signed certificate is in $NEWCERT\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-verify' ) {
|
|
my @files = @ARGV ? @ARGV : ( $NEWCERT );
|
|
my $file;
|
|
foreach $file (@files) {
|
|
my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file");
|
|
$RET = $status if $status != 0;
|
|
}
|
|
} elsif ($WHAT eq '-crl' ) {
|
|
$RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL");
|
|
print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;
|
|
} elsif ($WHAT eq '-revoke' ) {
|
|
my $cname = $ARGV[1];
|
|
if (!defined $cname) {
|
|
print "Certificate filename is required; reason optional.\n";
|
|
exit 1;
|
|
}
|
|
my $reason = $ARGV[2];
|
|
$reason = " -crl_reason $reason"
|
|
if defined $reason && crl_reason_ok($reason);
|
|
$RET = run("$CA -revoke \"$cname\"" . $reason);
|
|
} else {
|
|
print STDERR "Unknown arg \"$WHAT\"\n";
|
|
print STDERR "Use -help for help.\n";
|
|
exit 1;
|
|
}
|
|
|
|
exit $RET;
|