blob: 23e816b3352df8788c4cad96fcfa505df78a803a [file] [log] [blame]
Paul Bakkerbdb912d2012-02-13 23:11:30 +00001/*
2 * Certificate request generation
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerbdb912d2012-02-13 23:11:30 +000018 */
19
Bence Szépkútic662b362021-05-27 11:25:03 +020020#include "mbedtls/build_info.h"
Paul Bakkerbdb912d2012-02-13 23:11:30 +000021
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000022#include "mbedtls/platform.h"
Andrzej Kurek0af32482023-04-07 03:10:28 -040023/* md.h is included this early since MD_CAN_XXX macros are defined there. */
Andrzej Kurek1b75e5f2023-04-04 09:55:06 -040024#include "mbedtls/md.h"
Rich Evansf90016a2015-01-19 14:26:37 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if !defined(MBEDTLS_X509_CSR_WRITE_C) || !defined(MBEDTLS_FS_IO) || \
Manuel Pégourié-Gonnard93302422023-03-21 17:23:08 +010027 !defined(MBEDTLS_PK_PARSE_C) || !defined(MBEDTLS_MD_CAN_SHA256) || \
Simon Butcher203a6932016-10-07 15:00:17 +010028 !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \
29 !defined(MBEDTLS_PEM_WRITE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +010030int main(void)
Manuel Pégourié-Gonnard8d649c62015-03-31 15:10:03 +020031{
Gilles Peskine449bd832023-01-11 14:50:10 +010032 mbedtls_printf("MBEDTLS_X509_CSR_WRITE_C and/or MBEDTLS_FS_IO and/or "
Manuel Pégourié-Gonnard93302422023-03-21 17:23:08 +010033 "MBEDTLS_PK_PARSE_C and/or MBEDTLS_MD_CAN_SHA256 and/or "
Gilles Peskine449bd832023-01-11 14:50:10 +010034 "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C "
35 "not defined.\n");
36 mbedtls_exit(0);
Manuel Pégourié-Gonnard8d649c62015-03-31 15:10:03 +020037}
38#else
39
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000040#include "mbedtls/x509_csr.h"
41#include "mbedtls/entropy.h"
42#include "mbedtls/ctr_drbg.h"
43#include "mbedtls/error.h"
Paul Bakkerbdb912d2012-02-13 23:11:30 +000044
Rich Evans18b78c72015-02-11 14:06:19 +000045#include <stdio.h>
46#include <stdlib.h>
47#include <string.h>
Rich Evans18b78c72015-02-11 14:06:19 +000048
49#define DFL_FILENAME "keyfile.key"
Hanno Becker56e84632018-11-01 14:10:23 +000050#define DFL_PASSWORD NULL
Rich Evans18b78c72015-02-11 14:06:19 +000051#define DFL_DEBUG_LEVEL 0
52#define DFL_OUTPUT_FILENAME "cert.req"
53#define DFL_SUBJECT_NAME "CN=Cert,O=mbed TLS,C=UK"
54#define DFL_KEY_USAGE 0
Andres Amaya Garcia7067f812018-09-26 10:51:16 +010055#define DFL_FORCE_KEY_USAGE 0
Rich Evans18b78c72015-02-11 14:06:19 +000056#define DFL_NS_CERT_TYPE 0
Andres Amaya Garcia7067f812018-09-26 10:51:16 +010057#define DFL_FORCE_NS_CERT_TYPE 0
Hanno Beckerf7457332018-10-08 17:14:42 +010058#define DFL_MD_ALG MBEDTLS_MD_SHA256
Rich Evans18b78c72015-02-11 14:06:19 +000059
60#define USAGE \
61 "\n usage: cert_req param=<>...\n" \
62 "\n acceptable parameters:\n" \
63 " filename=%%s default: keyfile.key\n" \
Hanno Becker56e84632018-11-01 14:10:23 +000064 " password=%%s default: NULL\n" \
Rich Evans18b78c72015-02-11 14:06:19 +000065 " debug_level=%%d default: 0 (disabled)\n" \
66 " output_file=%%s default: cert.req\n" \
67 " subject_name=%%s default: CN=Cert,O=mbed TLS,C=UK\n" \
Hannes Tschofenig6b108602022-12-28 18:38:53 +010068 " san=%%s default: (none)\n" \
Andrzej Kurekf70f4602023-04-24 18:39:53 -040069 " Semicolon-separated-list of values:\n" \
Hannes Tschofenig6b108602022-12-28 18:38:53 +010070 " DNS:value\n" \
71 " URI:value\n" \
Przemek Stekiel6cb59c52023-03-06 09:57:16 +010072 " IP:value (Only IPv4 is supported)\n" \
Rich Evans18b78c72015-02-11 14:06:19 +000073 " key_usage=%%s default: (empty)\n" \
74 " Comma-separated-list of values:\n" \
75 " digital_signature\n" \
76 " non_repudiation\n" \
77 " key_encipherment\n" \
78 " data_encipherment\n" \
79 " key_agreement\n" \
Jonathan Leroy81962c32015-10-10 21:42:29 +020080 " key_cert_sign\n" \
Rich Evans18b78c72015-02-11 14:06:19 +000081 " crl_sign\n" \
Andres Amaya Garcia7067f812018-09-26 10:51:16 +010082 " force_key_usage=0/1 default: off\n" \
83 " Add KeyUsage even if it is empty\n" \
Rich Evans18b78c72015-02-11 14:06:19 +000084 " ns_cert_type=%%s default: (empty)\n" \
85 " Comma-separated-list of values:\n" \
86 " ssl_client\n" \
87 " ssl_server\n" \
88 " email\n" \
89 " object_signing\n" \
90 " ssl_ca\n" \
91 " email_ca\n" \
92 " object_signing_ca\n" \
Andres Amaya Garcia7067f812018-09-26 10:51:16 +010093 " force_ns_cert_type=0/1 default: off\n" \
94 " Add NsCertType even if it is empty\n" \
Hanno Beckerf7457332018-10-08 17:14:42 +010095 " md=%%s default: SHA256\n" \
96 " possible values:\n" \
TRodziewicz10e8cf52021-05-31 17:58:57 +020097 " MD5, RIPEMD160, SHA1,\n" \
Gilles Peskine384e2742020-08-21 19:51:13 +020098 " SHA224, SHA256, SHA384, SHA512\n" \
Rich Evans18b78c72015-02-11 14:06:19 +000099 "\n"
100
Simon Butcher63cb97e2018-12-06 17:43:31 +0000101
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000102/*
103 * global options
104 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100105struct options {
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100106 const char *filename; /* filename of the key file */
107 const char *password; /* password for the key file */
108 int debug_level; /* level of debugging */
109 const char *output_file; /* where to store the constructed key file */
110 const char *subject_name; /* subject name for certificate request */
111 mbedtls_x509_san_list *san_list; /* subjectAltName for certificate request */
112 unsigned char key_usage; /* key usage flags */
113 int force_key_usage; /* Force adding the KeyUsage extension */
114 unsigned char ns_cert_type; /* NS cert type */
115 int force_ns_cert_type; /* Force adding NsCertType extension */
116 mbedtls_md_type_t md_alg; /* Hash algorithm used for signature. */
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000117} opt;
118
Gilles Peskine449bd832023-01-11 14:50:10 +0100119int write_certificate_request(mbedtls_x509write_csr *req, const char *output_file,
120 int (*f_rng)(void *, unsigned char *, size_t),
121 void *p_rng)
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000122{
Paul Bakker135f1e92013-08-26 16:54:13 +0200123 int ret;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000124 FILE *f;
125 unsigned char output_buf[4096];
Paul Bakker135f1e92013-08-26 16:54:13 +0200126 size_t len = 0;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000127
Gilles Peskine449bd832023-01-11 14:50:10 +0100128 memset(output_buf, 0, 4096);
129 if ((ret = mbedtls_x509write_csr_pem(req, output_buf, 4096, f_rng, p_rng)) < 0) {
130 return ret;
Paul Bakker0c226102014-04-17 16:02:36 +0200131 }
Paul Bakker135f1e92013-08-26 16:54:13 +0200132
Gilles Peskine449bd832023-01-11 14:50:10 +0100133 len = strlen((char *) output_buf);
Paul Bakker8eabfc12013-08-25 10:18:25 +0200134
Gilles Peskine449bd832023-01-11 14:50:10 +0100135 if ((f = fopen(output_file, "w")) == NULL) {
136 return -1;
137 }
138
139 if (fwrite(output_buf, 1, len, f) != len) {
140 fclose(f);
141 return -1;
142 }
143
144 fclose(f);
145
146 return 0;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000147}
148
Gilles Peskine449bd832023-01-11 14:50:10 +0100149int main(int argc, char *argv[])
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000150{
Andres Amaya Garciaaacd9282018-04-29 21:36:13 +0100151 int ret = 1;
152 int exit_code = MBEDTLS_EXIT_FAILURE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200153 mbedtls_pk_context key;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000154 char buf[1024];
Paul Bakkerc97f9f62013-11-30 15:13:02 +0100155 int i;
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400156 char *p, *q, *r, *subtype_value;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200157 mbedtls_x509write_csr req;
158 mbedtls_entropy_context entropy;
159 mbedtls_ctr_drbg_context ctr_drbg;
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200160 const char *pers = "csr example app";
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100161 mbedtls_x509_san_list *cur, *prev;
Andrzej Kurek0624e462023-05-23 10:57:14 -0400162#if defined(MBEDTLS_X509_CRT_PARSE_C)
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400163 uint8_t ip[4] = { 0 };
Andrzej Kurek0624e462023-05-23 10:57:14 -0400164#endif
Przemek Stekiela0a1c1e2023-04-17 11:10:05 +0200165 /*
166 * Set to sane values
167 */
168 mbedtls_x509write_csr_init(&req);
169 mbedtls_pk_init(&key);
170 mbedtls_ctr_drbg_init(&ctr_drbg);
171 memset(buf, 0, sizeof(buf));
172 mbedtls_entropy_init(&entropy);
173
Przemek Stekiel89c636e2023-04-14 09:26:39 +0200174#if defined(MBEDTLS_USE_PSA_CRYPTO)
175 psa_status_t status = psa_crypto_init();
176 if (status != PSA_SUCCESS) {
177 mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n",
178 (int) status);
179 goto exit;
180 }
181#endif /* MBEDTLS_USE_PSA_CRYPTO */
182
Aditya Deshpande644a5c02023-01-30 15:58:50 +0000183 if (argc < 2) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100184usage:
185 mbedtls_printf(USAGE);
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000186 goto exit;
187 }
188
189 opt.filename = DFL_FILENAME;
Hanno Becker56e84632018-11-01 14:10:23 +0000190 opt.password = DFL_PASSWORD;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000191 opt.debug_level = DFL_DEBUG_LEVEL;
192 opt.output_file = DFL_OUTPUT_FILENAME;
193 opt.subject_name = DFL_SUBJECT_NAME;
Paul Bakker57be6e22013-08-26 14:13:14 +0200194 opt.key_usage = DFL_KEY_USAGE;
Andres Amaya Garcia7067f812018-09-26 10:51:16 +0100195 opt.force_key_usage = DFL_FORCE_KEY_USAGE;
Paul Bakker57be6e22013-08-26 14:13:14 +0200196 opt.ns_cert_type = DFL_NS_CERT_TYPE;
Andres Amaya Garcia7067f812018-09-26 10:51:16 +0100197 opt.force_ns_cert_type = DFL_FORCE_NS_CERT_TYPE;
Hanno Beckerf7457332018-10-08 17:14:42 +0100198 opt.md_alg = DFL_MD_ALG;
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100199 opt.san_list = NULL;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000200
Gilles Peskine449bd832023-01-11 14:50:10 +0100201 for (i = 1; i < argc; i++) {
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000202 p = argv[i];
Gilles Peskine449bd832023-01-11 14:50:10 +0100203 if ((q = strchr(p, '=')) == NULL) {
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000204 goto usage;
Gilles Peskine449bd832023-01-11 14:50:10 +0100205 }
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000206 *q++ = '\0';
Gilles Peskine449bd832023-01-11 14:50:10 +0100207 if (strcmp(p, "filename") == 0) {
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000208 opt.filename = q;
Gilles Peskine449bd832023-01-11 14:50:10 +0100209 } else if (strcmp(p, "password") == 0) {
Hanno Becker56e84632018-11-01 14:10:23 +0000210 opt.password = q;
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 } else if (strcmp(p, "output_file") == 0) {
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000212 opt.output_file = q;
Gilles Peskine449bd832023-01-11 14:50:10 +0100213 } else if (strcmp(p, "debug_level") == 0) {
214 opt.debug_level = atoi(q);
215 if (opt.debug_level < 0 || opt.debug_level > 65535) {
Hanno Beckerf7457332018-10-08 17:14:42 +0100216 goto usage;
217 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100218 } else if (strcmp(p, "subject_name") == 0) {
219 opt.subject_name = q;
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100220 } else if (strcmp(p, "san") == 0) {
221 prev = NULL;
222
223 while (q != NULL) {
Przemek Stekiel68ca81c2023-03-08 15:14:47 +0100224 if ((r = strchr(q, ';')) != NULL) {
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100225 *r++ = '\0';
226 }
227
228 cur = mbedtls_calloc(1, sizeof(mbedtls_x509_san_list));
229 if (cur == NULL) {
230 mbedtls_printf("Not enough memory for subjectAltName list\n");
231 goto usage;
232 }
233
234 cur->next = NULL;
235
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400236 if ((subtype_value = strchr(q, ':')) != NULL) {
237 *subtype_value++ = '\0';
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100238 }
239
240 if (strcmp(q, "URI") == 0) {
241 cur->node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
242 } else if (strcmp(q, "DNS") == 0) {
243 cur->node.type = MBEDTLS_X509_SAN_DNS_NAME;
Przemek Stekiel3a925932023-02-14 13:05:24 +0100244 } else if (strcmp(q, "IP") == 0) {
Andrzej Kurek0624e462023-05-23 10:57:14 -0400245#if defined(MBEDTLS_X509_CRT_PARSE_C)
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400246 size_t ip_len = 0;
Przemek Stekiel3a925932023-02-14 13:05:24 +0100247 cur->node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400248 ip_len = mbedtls_x509_crt_parse_cn_inet_pton(subtype_value, ip);
249 if (ip_len == 0) {
Andrzej Kurek0624e462023-05-23 10:57:14 -0400250 mbedtls_printf("mbedtls_x509_crt_parse_cn_inet_pton failed to parse %s\n",
251 subtype_value);
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400252 goto exit;
253 }
Andrzej Kurek0624e462023-05-23 10:57:14 -0400254#else
255 mbedtls_printf("IP SAN parsing requires MBEDTLS_X509_CRT_PARSE_C to be defined");
256 goto exit;
257#endif
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100258 } else {
259 mbedtls_free(cur);
260 goto usage;
261 }
262
Przemek Stekiel3a925932023-02-14 13:05:24 +0100263 if (strcmp(q, "IP") == 0) {
Andrzej Kurek0624e462023-05-23 10:57:14 -0400264#if defined(MBEDTLS_X509_CRT_PARSE_C)
Przemek Stekiel5a49d3c2023-02-24 13:12:55 +0100265 cur->node.san.unstructured_name.p = (unsigned char *) ip;
266 cur->node.san.unstructured_name.len = sizeof(ip);
Andrzej Kurek0624e462023-05-23 10:57:14 -0400267#endif
Przemek Stekiel3a925932023-02-14 13:05:24 +0100268 } else {
Andrzej Kurekcd17ecf2023-06-05 17:02:17 -0400269 q = subtype_value;
Przemek Stekiel5a49d3c2023-02-24 13:12:55 +0100270 cur->node.san.unstructured_name.p = (unsigned char *) q;
271 cur->node.san.unstructured_name.len = strlen(q);
Przemek Stekiel3a925932023-02-14 13:05:24 +0100272 }
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100273
274 if (prev == NULL) {
275 opt.san_list = cur;
276 } else {
277 prev->next = cur;
278 }
279
280 prev = cur;
281 q = r;
282 }
283
Gilles Peskine449bd832023-01-11 14:50:10 +0100284 } else if (strcmp(p, "md") == 0) {
285 const mbedtls_md_info_t *md_info =
286 mbedtls_md_info_from_string(q);
287 if (md_info == NULL) {
288 mbedtls_printf("Invalid argument for option %s\n", p);
289 goto usage;
290 }
291 opt.md_alg = mbedtls_md_get_type(md_info);
292 } else if (strcmp(p, "key_usage") == 0) {
293 while (q != NULL) {
294 if ((r = strchr(q, ',')) != NULL) {
Paul Bakker57be6e22013-08-26 14:13:14 +0200295 *r++ = '\0';
Gilles Peskine449bd832023-01-11 14:50:10 +0100296 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200297
Gilles Peskine449bd832023-01-11 14:50:10 +0100298 if (strcmp(q, "digital_signature") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299 opt.key_usage |= MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +0100300 } else if (strcmp(q, "non_repudiation") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200301 opt.key_usage |= MBEDTLS_X509_KU_NON_REPUDIATION;
Gilles Peskine449bd832023-01-11 14:50:10 +0100302 } else if (strcmp(q, "key_encipherment") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100303 opt.key_usage |= MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 } else if (strcmp(q, "data_encipherment") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100305 opt.key_usage |= MBEDTLS_X509_KU_DATA_ENCIPHERMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 } else if (strcmp(q, "key_agreement") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100307 opt.key_usage |= MBEDTLS_X509_KU_KEY_AGREEMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 } else if (strcmp(q, "key_cert_sign") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200309 opt.key_usage |= MBEDTLS_X509_KU_KEY_CERT_SIGN;
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 } else if (strcmp(q, "crl_sign") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200311 opt.key_usage |= MBEDTLS_X509_KU_CRL_SIGN;
Gilles Peskine449bd832023-01-11 14:50:10 +0100312 } else {
Paul Bakker57be6e22013-08-26 14:13:14 +0200313 goto usage;
Gilles Peskine449bd832023-01-11 14:50:10 +0100314 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200315
316 q = r;
317 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100318 } else if (strcmp(p, "force_key_usage") == 0) {
319 switch (atoi(q)) {
Andres Amaya Garcia7067f812018-09-26 10:51:16 +0100320 case 0: opt.force_key_usage = 0; break;
321 case 1: opt.force_key_usage = 1; break;
322 default: goto usage;
323 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100324 } else if (strcmp(p, "ns_cert_type") == 0) {
325 while (q != NULL) {
326 if ((r = strchr(q, ',')) != NULL) {
Paul Bakker57be6e22013-08-26 14:13:14 +0200327 *r++ = '\0';
Gilles Peskine449bd832023-01-11 14:50:10 +0100328 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200329
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 if (strcmp(q, "ssl_client") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200331 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT;
Gilles Peskine449bd832023-01-11 14:50:10 +0100332 } else if (strcmp(q, "ssl_server") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100333 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER;
Gilles Peskine449bd832023-01-11 14:50:10 +0100334 } else if (strcmp(q, "email") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200335 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100336 } else if (strcmp(q, "object_signing") == 0) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200337 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING;
Gilles Peskine449bd832023-01-11 14:50:10 +0100338 } else if (strcmp(q, "ssl_ca") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100339 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 } else if (strcmp(q, "email_ca") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100341 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100342 } else if (strcmp(q, "object_signing_ca") == 0) {
Manuel Pégourié-Gonnarde6028c92015-04-20 12:19:02 +0100343 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA;
Gilles Peskine449bd832023-01-11 14:50:10 +0100344 } else {
Paul Bakker57be6e22013-08-26 14:13:14 +0200345 goto usage;
Gilles Peskine449bd832023-01-11 14:50:10 +0100346 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200347
348 q = r;
349 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100350 } else if (strcmp(p, "force_ns_cert_type") == 0) {
351 switch (atoi(q)) {
Andres Amaya Garcia7067f812018-09-26 10:51:16 +0100352 case 0: opt.force_ns_cert_type = 0; break;
353 case 1: opt.force_ns_cert_type = 1; break;
354 default: goto usage;
355 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100356 } else {
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000357 goto usage;
Gilles Peskine449bd832023-01-11 14:50:10 +0100358 }
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000359 }
360
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100361 /* Set the MD algorithm to use for the signature in the CSR */
Gilles Peskine449bd832023-01-11 14:50:10 +0100362 mbedtls_x509write_csr_set_md_alg(&req, opt.md_alg);
Hanno Beckerf7457332018-10-08 17:14:42 +0100363
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100364 /* Set the Key Usage Extension flags in the CSR */
Gilles Peskine449bd832023-01-11 14:50:10 +0100365 if (opt.key_usage || opt.force_key_usage == 1) {
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100366 ret = mbedtls_x509write_csr_set_key_usage(&req, opt.key_usage);
367
368 if (ret != 0) {
369 mbedtls_printf(" failed\n ! mbedtls_x509write_csr_set_key_usage returned %d", ret);
370 goto exit;
371 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100372 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200373
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100374 /* Set the Cert Type flags in the CSR */
Gilles Peskine449bd832023-01-11 14:50:10 +0100375 if (opt.ns_cert_type || opt.force_ns_cert_type == 1) {
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100376 ret = mbedtls_x509write_csr_set_ns_cert_type(&req, opt.ns_cert_type);
377
378 if (ret != 0) {
379 mbedtls_printf(" failed\n ! mbedtls_x509write_csr_set_ns_cert_type returned %d", ret);
380 goto exit;
381 }
382 }
383
384 /* Set the SubjectAltName in the CSR */
385 if (opt.san_list != NULL) {
386 ret = mbedtls_x509write_csr_set_subject_alternative_name(&req, opt.san_list);
387
388 if (ret != 0) {
389 mbedtls_printf(
390 " failed\n ! mbedtls_x509write_csr_set_subject_alternative_name returned %d",
391 ret);
392 goto exit;
393 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100394 }
Paul Bakker57be6e22013-08-26 14:13:14 +0200395
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000396 /*
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200397 * 0. Seed the PRNG
398 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100399 mbedtls_printf(" . Seeding the random number generator...");
400 fflush(stdout);
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200401
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
403 (const unsigned char *) pers,
404 strlen(pers))) != 0) {
405 mbedtls_printf(" failed\n ! mbedtls_ctr_drbg_seed returned %d", ret);
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200406 goto exit;
407 }
408
Gilles Peskine449bd832023-01-11 14:50:10 +0100409 mbedtls_printf(" ok\n");
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200410
411 /*
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000412 * 1.0. Check the subject name for validity
413 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100414 mbedtls_printf(" . Checking subject name...");
415 fflush(stdout);
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200416
Gilles Peskine449bd832023-01-11 14:50:10 +0100417 if ((ret = mbedtls_x509write_csr_set_subject_name(&req, opt.subject_name)) != 0) {
418 mbedtls_printf(" failed\n ! mbedtls_x509write_csr_set_subject_name returned %d", ret);
Paul Bakker8eabfc12013-08-25 10:18:25 +0200419 goto exit;
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000420 }
421
Gilles Peskine449bd832023-01-11 14:50:10 +0100422 mbedtls_printf(" ok\n");
Manuel Pégourié-Gonnardee731792013-09-11 22:48:40 +0200423
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000424 /*
425 * 1.1. Load the key
426 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100427 mbedtls_printf(" . Loading the private key ...");
428 fflush(stdout);
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000429
Gilles Peskine449bd832023-01-11 14:50:10 +0100430 ret = mbedtls_pk_parse_keyfile(&key, opt.filename, opt.password,
431 mbedtls_ctr_drbg_random, &ctr_drbg);
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000432
Gilles Peskine449bd832023-01-11 14:50:10 +0100433 if (ret != 0) {
434 mbedtls_printf(" failed\n ! mbedtls_pk_parse_keyfile returned %d", ret);
Paul Bakker8eabfc12013-08-25 10:18:25 +0200435 goto exit;
436 }
437
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 mbedtls_x509write_csr_set_key(&req, &key);
Paul Bakker8eabfc12013-08-25 10:18:25 +0200439
Gilles Peskine449bd832023-01-11 14:50:10 +0100440 mbedtls_printf(" ok\n");
Paul Bakker8eabfc12013-08-25 10:18:25 +0200441
442 /*
443 * 1.2. Writing the request
444 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 mbedtls_printf(" . Writing the certificate request ...");
446 fflush(stdout);
Paul Bakker8eabfc12013-08-25 10:18:25 +0200447
Gilles Peskine449bd832023-01-11 14:50:10 +0100448 if ((ret = write_certificate_request(&req, opt.output_file,
449 mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
450 mbedtls_printf(" failed\n ! write_certificate_request %d", ret);
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000451 goto exit;
452 }
453
Gilles Peskine449bd832023-01-11 14:50:10 +0100454 mbedtls_printf(" ok\n");
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000455
Andres Amaya Garciaaacd9282018-04-29 21:36:13 +0100456 exit_code = MBEDTLS_EXIT_SUCCESS;
457
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000458exit:
Manuel Pégourié-Gonnard26b4d452013-09-12 06:56:06 +0200459
Gilles Peskine449bd832023-01-11 14:50:10 +0100460 if (exit_code != MBEDTLS_EXIT_SUCCESS) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200461#ifdef MBEDTLS_ERROR_C
Gilles Peskine449bd832023-01-11 14:50:10 +0100462 mbedtls_strerror(ret, buf, sizeof(buf));
463 mbedtls_printf(" - %s\n", buf);
Manuel Pégourié-Gonnard26b4d452013-09-12 06:56:06 +0200464#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200465 mbedtls_printf("\n");
Manuel Pégourié-Gonnard26b4d452013-09-12 06:56:06 +0200466#endif
467 }
468
Gilles Peskine449bd832023-01-11 14:50:10 +0100469 mbedtls_x509write_csr_free(&req);
470 mbedtls_pk_free(&key);
471 mbedtls_ctr_drbg_free(&ctr_drbg);
472 mbedtls_entropy_free(&entropy);
Przemek Stekiel758aef62023-04-19 13:47:43 +0200473#if defined(MBEDTLS_USE_PSA_CRYPTO)
Przemek Stekiela8c560a2023-04-19 10:15:26 +0200474 mbedtls_psa_crypto_free();
Przemek Stekiel758aef62023-04-19 13:47:43 +0200475#endif /* MBEDTLS_USE_PSA_CRYPTO */
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000476
Hannes Tschofenig6b108602022-12-28 18:38:53 +0100477 cur = opt.san_list;
478 while (cur != NULL) {
479 prev = cur;
480 cur = cur->next;
481 mbedtls_free(prev);
482 }
483
484
Gilles Peskine449bd832023-01-11 14:50:10 +0100485 mbedtls_exit(exit_code);
Paul Bakkerbdb912d2012-02-13 23:11:30 +0000486}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200487#endif /* MBEDTLS_X509_CSR_WRITE_C && MBEDTLS_PK_PARSE_C && MBEDTLS_FS_IO &&
Simon Butcher203a6932016-10-07 15:00:17 +0100488 MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C && MBEDTLS_PEM_WRITE_C */