1 /*
2 * Certificate generation and signing
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #if !defined(MBEDTLS_CONFIG_FILE)
9 #include "mbedtls/config.h"
10 #else
11 #include MBEDTLS_CONFIG_FILE
12 #endif
13
14 #include "mbedtls/platform.h"
15
16 #if !defined(MBEDTLS_X509_CRT_WRITE_C) || \
17 !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(MBEDTLS_FS_IO) || \
18 !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_CTR_DRBG_C) || \
19 !defined(MBEDTLS_ERROR_C) || !defined(MBEDTLS_SHA256_C) || \
20 !defined(MBEDTLS_PEM_WRITE_C)
main(void)21 int main(void)
22 {
23 mbedtls_printf("MBEDTLS_X509_CRT_WRITE_C and/or MBEDTLS_X509_CRT_PARSE_C and/or "
24 "MBEDTLS_FS_IO and/or MBEDTLS_SHA256_C and/or "
25 "MBEDTLS_ENTROPY_C and/or MBEDTLS_CTR_DRBG_C and/or "
26 "MBEDTLS_ERROR_C not defined.\n");
27 mbedtls_exit(0);
28 }
29 #else
30
31 #include "mbedtls/x509_crt.h"
32 #include "mbedtls/x509_csr.h"
33 #include "mbedtls/entropy.h"
34 #include "mbedtls/ctr_drbg.h"
35 #include "mbedtls/md.h"
36 #include "mbedtls/error.h"
37
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <string.h>
41
42 #if defined(MBEDTLS_X509_CSR_PARSE_C)
43 #define USAGE_CSR \
44 " request_file=%%s default: (empty)\n" \
45 " If request_file is specified, subject_key,\n" \
46 " subject_pwd and subject_name are ignored!\n"
47 #else
48 #define USAGE_CSR ""
49 #endif /* MBEDTLS_X509_CSR_PARSE_C */
50
51 #define DFL_ISSUER_CRT ""
52 #define DFL_REQUEST_FILE ""
53 #define DFL_SUBJECT_KEY "subject.key"
54 #define DFL_ISSUER_KEY "ca.key"
55 #define DFL_SUBJECT_PWD ""
56 #define DFL_ISSUER_PWD ""
57 #define DFL_OUTPUT_FILENAME "cert.crt"
58 #define DFL_SUBJECT_NAME "CN=Cert,O=mbed TLS,C=UK"
59 #define DFL_ISSUER_NAME "CN=CA,O=mbed TLS,C=UK"
60 #define DFL_NOT_BEFORE "20010101000000"
61 #define DFL_NOT_AFTER "20301231235959"
62 #define DFL_SERIAL "1"
63 #define DFL_SELFSIGN 0
64 #define DFL_IS_CA 0
65 #define DFL_MAX_PATHLEN -1
66 #define DFL_KEY_USAGE 0
67 #define DFL_NS_CERT_TYPE 0
68 #define DFL_VERSION 3
69 #define DFL_AUTH_IDENT 1
70 #define DFL_SUBJ_IDENT 1
71 #define DFL_CONSTRAINTS 1
72 #define DFL_DIGEST MBEDTLS_MD_SHA256
73
74 #define USAGE \
75 "\n usage: cert_write param=<>...\n" \
76 "\n acceptable parameters:\n" \
77 USAGE_CSR \
78 " subject_key=%%s default: subject.key\n" \
79 " subject_pwd=%%s default: (empty)\n" \
80 " subject_name=%%s default: CN=Cert,O=mbed TLS,C=UK\n" \
81 "\n" \
82 " issuer_crt=%%s default: (empty)\n" \
83 " If issuer_crt is specified, issuer_name is\n" \
84 " ignored!\n" \
85 " issuer_name=%%s default: CN=CA,O=mbed TLS,C=UK\n" \
86 "\n" \
87 " selfsign=%%d default: 0 (false)\n" \
88 " If selfsign is enabled, issuer_name and\n" \
89 " issuer_key are required (issuer_crt and\n" \
90 " subject_* are ignored\n" \
91 " issuer_key=%%s default: ca.key\n" \
92 " issuer_pwd=%%s default: (empty)\n" \
93 " output_file=%%s default: cert.crt\n" \
94 " serial=%%s default: 1\n" \
95 " not_before=%%s default: 20010101000000\n" \
96 " not_after=%%s default: 20301231235959\n" \
97 " is_ca=%%d default: 0 (disabled)\n" \
98 " max_pathlen=%%d default: -1 (none)\n" \
99 " md=%%s default: SHA256\n" \
100 " Supported values (if enabled):\n" \
101 " MD2, MD4, MD5, RIPEMD160, SHA1,\n" \
102 " SHA224, SHA256, SHA384, SHA512\n" \
103 " version=%%d default: 3\n" \
104 " Possible values: 1, 2, 3\n" \
105 " subject_identifier=%%s default: 1\n" \
106 " Possible values: 0, 1\n" \
107 " (Considered for v3 only)\n" \
108 " authority_identifier=%%s default: 1\n" \
109 " Possible values: 0, 1\n" \
110 " (Considered for v3 only)\n" \
111 " basic_constraints=%%d default: 1\n" \
112 " Possible values: 0, 1\n" \
113 " (Considered for v3 only)\n" \
114 " key_usage=%%s default: (empty)\n" \
115 " Comma-separated-list of values:\n" \
116 " digital_signature\n" \
117 " non_repudiation\n" \
118 " key_encipherment\n" \
119 " data_encipherment\n" \
120 " key_agreement\n" \
121 " key_cert_sign\n" \
122 " crl_sign\n" \
123 " (Considered for v3 only)\n" \
124 " ns_cert_type=%%s default: (empty)\n" \
125 " Comma-separated-list of values:\n" \
126 " ssl_client\n" \
127 " ssl_server\n" \
128 " email\n" \
129 " object_signing\n" \
130 " ssl_ca\n" \
131 " email_ca\n" \
132 " object_signing_ca\n" \
133 "\n"
134
135
136 /*
137 * global options
138 */
139 struct options {
140 const char *issuer_crt; /* filename of the issuer certificate */
141 const char *request_file; /* filename of the certificate request */
142 const char *subject_key; /* filename of the subject key file */
143 const char *issuer_key; /* filename of the issuer key file */
144 const char *subject_pwd; /* password for the subject key file */
145 const char *issuer_pwd; /* password for the issuer key file */
146 const char *output_file; /* where to store the constructed CRT */
147 const char *subject_name; /* subject name for certificate */
148 const char *issuer_name; /* issuer name for certificate */
149 const char *not_before; /* validity period not before */
150 const char *not_after; /* validity period not after */
151 const char *serial; /* serial number string */
152 int selfsign; /* selfsign the certificate */
153 int is_ca; /* is a CA certificate */
154 int max_pathlen; /* maximum CA path length */
155 int authority_identifier; /* add authority identifier to CRT */
156 int subject_identifier; /* add subject identifier to CRT */
157 int basic_constraints; /* add basic constraints ext to CRT */
158 int version; /* CRT version */
159 mbedtls_md_type_t md; /* Hash used for signing */
160 unsigned char key_usage; /* key usage flags */
161 unsigned char ns_cert_type; /* NS cert type */
162 } opt;
163
write_certificate(mbedtls_x509write_cert * crt,const char * output_file,int (* f_rng)(void *,unsigned char *,size_t),void * p_rng)164 int write_certificate(mbedtls_x509write_cert *crt, const char *output_file,
165 int (*f_rng)(void *, unsigned char *, size_t),
166 void *p_rng)
167 {
168 int ret;
169 FILE *f;
170 unsigned char output_buf[4096];
171 size_t len = 0;
172
173 memset(output_buf, 0, 4096);
174 if ((ret = mbedtls_x509write_crt_pem(crt, output_buf, 4096,
175 f_rng, p_rng)) < 0) {
176 return ret;
177 }
178
179 len = strlen((char *) output_buf);
180
181 if ((f = fopen(output_file, "w")) == NULL) {
182 return -1;
183 }
184
185 if (fwrite(output_buf, 1, len, f) != len) {
186 fclose(f);
187 return -1;
188 }
189
190 fclose(f);
191
192 return 0;
193 }
194
main(int argc,char * argv[])195 int main(int argc, char *argv[])
196 {
197 int ret = 1;
198 int exit_code = MBEDTLS_EXIT_FAILURE;
199 mbedtls_x509_crt issuer_crt;
200 mbedtls_pk_context loaded_issuer_key, loaded_subject_key;
201 mbedtls_pk_context *issuer_key = &loaded_issuer_key,
202 *subject_key = &loaded_subject_key;
203 char buf[1024];
204 char issuer_name[256];
205 int i;
206 char *p, *q, *r;
207 #if defined(MBEDTLS_X509_CSR_PARSE_C)
208 char subject_name[256];
209 mbedtls_x509_csr csr;
210 #endif
211 mbedtls_x509write_cert crt;
212 mbedtls_mpi serial;
213 mbedtls_entropy_context entropy;
214 mbedtls_ctr_drbg_context ctr_drbg;
215 const char *pers = "crt example app";
216
217 /*
218 * Set to sane values
219 */
220 mbedtls_x509write_crt_init(&crt);
221 mbedtls_pk_init(&loaded_issuer_key);
222 mbedtls_pk_init(&loaded_subject_key);
223 mbedtls_mpi_init(&serial);
224 mbedtls_ctr_drbg_init(&ctr_drbg);
225 mbedtls_entropy_init(&entropy);
226 #if defined(MBEDTLS_X509_CSR_PARSE_C)
227 mbedtls_x509_csr_init(&csr);
228 #endif
229 mbedtls_x509_crt_init(&issuer_crt);
230 memset(buf, 0, 1024);
231
232 #if defined(MBEDTLS_USE_PSA_CRYPTO)
233 psa_status_t status = psa_crypto_init();
234 if (status != PSA_SUCCESS) {
235 mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n",
236 (int) status);
237 goto exit;
238 }
239 #endif /* MBEDTLS_USE_PSA_CRYPTO */
240
241 if (argc < 2) {
242 usage:
243 mbedtls_printf(USAGE);
244 goto exit;
245 }
246
247 opt.issuer_crt = DFL_ISSUER_CRT;
248 opt.request_file = DFL_REQUEST_FILE;
249 opt.subject_key = DFL_SUBJECT_KEY;
250 opt.issuer_key = DFL_ISSUER_KEY;
251 opt.subject_pwd = DFL_SUBJECT_PWD;
252 opt.issuer_pwd = DFL_ISSUER_PWD;
253 opt.output_file = DFL_OUTPUT_FILENAME;
254 opt.subject_name = DFL_SUBJECT_NAME;
255 opt.issuer_name = DFL_ISSUER_NAME;
256 opt.not_before = DFL_NOT_BEFORE;
257 opt.not_after = DFL_NOT_AFTER;
258 opt.serial = DFL_SERIAL;
259 opt.selfsign = DFL_SELFSIGN;
260 opt.is_ca = DFL_IS_CA;
261 opt.max_pathlen = DFL_MAX_PATHLEN;
262 opt.key_usage = DFL_KEY_USAGE;
263 opt.ns_cert_type = DFL_NS_CERT_TYPE;
264 opt.version = DFL_VERSION - 1;
265 opt.md = DFL_DIGEST;
266 opt.subject_identifier = DFL_SUBJ_IDENT;
267 opt.authority_identifier = DFL_AUTH_IDENT;
268 opt.basic_constraints = DFL_CONSTRAINTS;
269
270 for (i = 1; i < argc; i++) {
271
272 p = argv[i];
273 if ((q = strchr(p, '=')) == NULL) {
274 goto usage;
275 }
276 *q++ = '\0';
277
278 if (strcmp(p, "request_file") == 0) {
279 opt.request_file = q;
280 } else if (strcmp(p, "subject_key") == 0) {
281 opt.subject_key = q;
282 } else if (strcmp(p, "issuer_key") == 0) {
283 opt.issuer_key = q;
284 } else if (strcmp(p, "subject_pwd") == 0) {
285 opt.subject_pwd = q;
286 } else if (strcmp(p, "issuer_pwd") == 0) {
287 opt.issuer_pwd = q;
288 } else if (strcmp(p, "issuer_crt") == 0) {
289 opt.issuer_crt = q;
290 } else if (strcmp(p, "output_file") == 0) {
291 opt.output_file = q;
292 } else if (strcmp(p, "subject_name") == 0) {
293 opt.subject_name = q;
294 } else if (strcmp(p, "issuer_name") == 0) {
295 opt.issuer_name = q;
296 } else if (strcmp(p, "not_before") == 0) {
297 opt.not_before = q;
298 } else if (strcmp(p, "not_after") == 0) {
299 opt.not_after = q;
300 } else if (strcmp(p, "serial") == 0) {
301 opt.serial = q;
302 } else if (strcmp(p, "authority_identifier") == 0) {
303 opt.authority_identifier = atoi(q);
304 if (opt.authority_identifier != 0 &&
305 opt.authority_identifier != 1) {
306 mbedtls_printf("Invalid argument for option %s\n", p);
307 goto usage;
308 }
309 } else if (strcmp(p, "subject_identifier") == 0) {
310 opt.subject_identifier = atoi(q);
311 if (opt.subject_identifier != 0 &&
312 opt.subject_identifier != 1) {
313 mbedtls_printf("Invalid argument for option %s\n", p);
314 goto usage;
315 }
316 } else if (strcmp(p, "basic_constraints") == 0) {
317 opt.basic_constraints = atoi(q);
318 if (opt.basic_constraints != 0 &&
319 opt.basic_constraints != 1) {
320 mbedtls_printf("Invalid argument for option %s\n", p);
321 goto usage;
322 }
323 } else if (strcmp(p, "md") == 0) {
324 const mbedtls_md_info_t *md_info =
325 mbedtls_md_info_from_string(q);
326 if (md_info == NULL) {
327 mbedtls_printf("Invalid argument for option %s\n", p);
328 goto usage;
329 }
330 opt.md = mbedtls_md_get_type(md_info);
331 } else if (strcmp(p, "version") == 0) {
332 opt.version = atoi(q);
333 if (opt.version < 1 || opt.version > 3) {
334 mbedtls_printf("Invalid argument for option %s\n", p);
335 goto usage;
336 }
337 opt.version--;
338 } else if (strcmp(p, "selfsign") == 0) {
339 opt.selfsign = atoi(q);
340 if (opt.selfsign < 0 || opt.selfsign > 1) {
341 mbedtls_printf("Invalid argument for option %s\n", p);
342 goto usage;
343 }
344 } else if (strcmp(p, "is_ca") == 0) {
345 opt.is_ca = atoi(q);
346 if (opt.is_ca < 0 || opt.is_ca > 1) {
347 mbedtls_printf("Invalid argument for option %s\n", p);
348 goto usage;
349 }
350 } else if (strcmp(p, "max_pathlen") == 0) {
351 opt.max_pathlen = atoi(q);
352 if (opt.max_pathlen < -1 || opt.max_pathlen > 127) {
353 mbedtls_printf("Invalid argument for option %s\n", p);
354 goto usage;
355 }
356 } else if (strcmp(p, "key_usage") == 0) {
357 while (q != NULL) {
358 if ((r = strchr(q, ',')) != NULL) {
359 *r++ = '\0';
360 }
361
362 if (strcmp(q, "digital_signature") == 0) {
363 opt.key_usage |= MBEDTLS_X509_KU_DIGITAL_SIGNATURE;
364 } else if (strcmp(q, "non_repudiation") == 0) {
365 opt.key_usage |= MBEDTLS_X509_KU_NON_REPUDIATION;
366 } else if (strcmp(q, "key_encipherment") == 0) {
367 opt.key_usage |= MBEDTLS_X509_KU_KEY_ENCIPHERMENT;
368 } else if (strcmp(q, "data_encipherment") == 0) {
369 opt.key_usage |= MBEDTLS_X509_KU_DATA_ENCIPHERMENT;
370 } else if (strcmp(q, "key_agreement") == 0) {
371 opt.key_usage |= MBEDTLS_X509_KU_KEY_AGREEMENT;
372 } else if (strcmp(q, "key_cert_sign") == 0) {
373 opt.key_usage |= MBEDTLS_X509_KU_KEY_CERT_SIGN;
374 } else if (strcmp(q, "crl_sign") == 0) {
375 opt.key_usage |= MBEDTLS_X509_KU_CRL_SIGN;
376 } else {
377 mbedtls_printf("Invalid argument for option %s\n", p);
378 goto usage;
379 }
380
381 q = r;
382 }
383 } else if (strcmp(p, "ns_cert_type") == 0) {
384 while (q != NULL) {
385 if ((r = strchr(q, ',')) != NULL) {
386 *r++ = '\0';
387 }
388
389 if (strcmp(q, "ssl_client") == 0) {
390 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT;
391 } else if (strcmp(q, "ssl_server") == 0) {
392 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_SERVER;
393 } else if (strcmp(q, "email") == 0) {
394 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL;
395 } else if (strcmp(q, "object_signing") == 0) {
396 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING;
397 } else if (strcmp(q, "ssl_ca") == 0) {
398 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_SSL_CA;
399 } else if (strcmp(q, "email_ca") == 0) {
400 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_EMAIL_CA;
401 } else if (strcmp(q, "object_signing_ca") == 0) {
402 opt.ns_cert_type |= MBEDTLS_X509_NS_CERT_TYPE_OBJECT_SIGNING_CA;
403 } else {
404 mbedtls_printf("Invalid argument for option %s\n", p);
405 goto usage;
406 }
407
408 q = r;
409 }
410 } else {
411 goto usage;
412 }
413 }
414
415 mbedtls_printf("\n");
416
417 /*
418 * 0. Seed the PRNG
419 */
420 mbedtls_printf(" . Seeding the random number generator...");
421 fflush(stdout);
422
423 if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
424 (const unsigned char *) pers,
425 strlen(pers))) != 0) {
426 mbedtls_strerror(ret, buf, 1024);
427 mbedtls_printf(" failed\n ! mbedtls_ctr_drbg_seed returned %d - %s\n",
428 ret, buf);
429 goto exit;
430 }
431
432 mbedtls_printf(" ok\n");
433
434 // Parse serial to MPI
435 //
436 mbedtls_printf(" . Reading serial number...");
437 fflush(stdout);
438
439 if ((ret = mbedtls_mpi_read_string(&serial, 10, opt.serial)) != 0) {
440 mbedtls_strerror(ret, buf, 1024);
441 mbedtls_printf(" failed\n ! mbedtls_mpi_read_string "
442 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
443 goto exit;
444 }
445
446 mbedtls_printf(" ok\n");
447
448 // Parse issuer certificate if present
449 //
450 if (!opt.selfsign && strlen(opt.issuer_crt)) {
451 /*
452 * 1.0.a. Load the certificates
453 */
454 mbedtls_printf(" . Loading the issuer certificate ...");
455 fflush(stdout);
456
457 if ((ret = mbedtls_x509_crt_parse_file(&issuer_crt, opt.issuer_crt)) != 0) {
458 mbedtls_strerror(ret, buf, 1024);
459 mbedtls_printf(" failed\n ! mbedtls_x509_crt_parse_file "
460 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
461 goto exit;
462 }
463
464 ret = mbedtls_x509_dn_gets(issuer_name, sizeof(issuer_name),
465 &issuer_crt.subject);
466 if (ret < 0) {
467 mbedtls_strerror(ret, buf, 1024);
468 mbedtls_printf(" failed\n ! mbedtls_x509_dn_gets "
469 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
470 goto exit;
471 }
472
473 opt.issuer_name = issuer_name;
474
475 mbedtls_printf(" ok\n");
476 }
477
478 #if defined(MBEDTLS_X509_CSR_PARSE_C)
479 // Parse certificate request if present
480 //
481 if (!opt.selfsign && strlen(opt.request_file)) {
482 /*
483 * 1.0.b. Load the CSR
484 */
485 mbedtls_printf(" . Loading the certificate request ...");
486 fflush(stdout);
487
488 if ((ret = mbedtls_x509_csr_parse_file(&csr, opt.request_file)) != 0) {
489 mbedtls_strerror(ret, buf, 1024);
490 mbedtls_printf(" failed\n ! mbedtls_x509_csr_parse_file "
491 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
492 goto exit;
493 }
494
495 ret = mbedtls_x509_dn_gets(subject_name, sizeof(subject_name),
496 &csr.subject);
497 if (ret < 0) {
498 mbedtls_strerror(ret, buf, 1024);
499 mbedtls_printf(" failed\n ! mbedtls_x509_dn_gets "
500 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
501 goto exit;
502 }
503
504 opt.subject_name = subject_name;
505 subject_key = &csr.pk;
506
507 mbedtls_printf(" ok\n");
508 }
509 #endif /* MBEDTLS_X509_CSR_PARSE_C */
510
511 /*
512 * 1.1. Load the keys
513 */
514 if (!opt.selfsign && !strlen(opt.request_file)) {
515 mbedtls_printf(" . Loading the subject key ...");
516 fflush(stdout);
517
518 ret = mbedtls_pk_parse_keyfile(&loaded_subject_key, opt.subject_key,
519 opt.subject_pwd);
520 if (ret != 0) {
521 mbedtls_strerror(ret, buf, 1024);
522 mbedtls_printf(" failed\n ! mbedtls_pk_parse_keyfile "
523 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
524 goto exit;
525 }
526
527 mbedtls_printf(" ok\n");
528 }
529
530 mbedtls_printf(" . Loading the issuer key ...");
531 fflush(stdout);
532
533 ret = mbedtls_pk_parse_keyfile(&loaded_issuer_key, opt.issuer_key,
534 opt.issuer_pwd);
535 if (ret != 0) {
536 mbedtls_strerror(ret, buf, 1024);
537 mbedtls_printf(" failed\n ! mbedtls_pk_parse_keyfile "
538 "returned -x%02x - %s\n\n", (unsigned int) -ret, buf);
539 goto exit;
540 }
541
542 // Check if key and issuer certificate match
543 //
544 if (strlen(opt.issuer_crt)) {
545 if (mbedtls_pk_check_pair(&issuer_crt.pk, issuer_key) != 0) {
546 mbedtls_printf(" failed\n ! issuer_key does not match "
547 "issuer certificate\n\n");
548 goto exit;
549 }
550 }
551
552 mbedtls_printf(" ok\n");
553
554 if (opt.selfsign) {
555 opt.subject_name = opt.issuer_name;
556 subject_key = issuer_key;
557 }
558
559 mbedtls_x509write_crt_set_subject_key(&crt, subject_key);
560 mbedtls_x509write_crt_set_issuer_key(&crt, issuer_key);
561
562 /*
563 * 1.0. Check the names for validity
564 */
565 if ((ret = mbedtls_x509write_crt_set_subject_name(&crt, opt.subject_name)) != 0) {
566 mbedtls_strerror(ret, buf, 1024);
567 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_subject_name "
568 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
569 goto exit;
570 }
571
572 if ((ret = mbedtls_x509write_crt_set_issuer_name(&crt, opt.issuer_name)) != 0) {
573 mbedtls_strerror(ret, buf, 1024);
574 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_issuer_name "
575 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
576 goto exit;
577 }
578
579 mbedtls_printf(" . Setting certificate values ...");
580 fflush(stdout);
581
582 mbedtls_x509write_crt_set_version(&crt, opt.version);
583 mbedtls_x509write_crt_set_md_alg(&crt, opt.md);
584
585 ret = mbedtls_x509write_crt_set_serial(&crt, &serial);
586 if (ret != 0) {
587 mbedtls_strerror(ret, buf, 1024);
588 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_serial "
589 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
590 goto exit;
591 }
592
593 ret = mbedtls_x509write_crt_set_validity(&crt, opt.not_before, opt.not_after);
594 if (ret != 0) {
595 mbedtls_strerror(ret, buf, 1024);
596 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_validity "
597 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
598 goto exit;
599 }
600
601 mbedtls_printf(" ok\n");
602
603 if (opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
604 opt.basic_constraints != 0) {
605 mbedtls_printf(" . Adding the Basic Constraints extension ...");
606 fflush(stdout);
607
608 ret = mbedtls_x509write_crt_set_basic_constraints(&crt, opt.is_ca,
609 opt.max_pathlen);
610 if (ret != 0) {
611 mbedtls_strerror(ret, buf, 1024);
612 mbedtls_printf(" failed\n ! x509write_crt_set_basic_constraints "
613 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
614 goto exit;
615 }
616
617 mbedtls_printf(" ok\n");
618 }
619
620 #if defined(MBEDTLS_SHA1_C)
621 if (opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
622 opt.subject_identifier != 0) {
623 mbedtls_printf(" . Adding the Subject Key Identifier ...");
624 fflush(stdout);
625
626 ret = mbedtls_x509write_crt_set_subject_key_identifier(&crt);
627 if (ret != 0) {
628 mbedtls_strerror(ret, buf, 1024);
629 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_subject"
630 "_key_identifier returned -0x%04x - %s\n\n",
631 (unsigned int) -ret, buf);
632 goto exit;
633 }
634
635 mbedtls_printf(" ok\n");
636 }
637
638 if (opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
639 opt.authority_identifier != 0) {
640 mbedtls_printf(" . Adding the Authority Key Identifier ...");
641 fflush(stdout);
642
643 ret = mbedtls_x509write_crt_set_authority_key_identifier(&crt);
644 if (ret != 0) {
645 mbedtls_strerror(ret, buf, 1024);
646 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_authority_"
647 "key_identifier returned -0x%04x - %s\n\n",
648 (unsigned int) -ret, buf);
649 goto exit;
650 }
651
652 mbedtls_printf(" ok\n");
653 }
654 #endif /* MBEDTLS_SHA1_C */
655
656 if (opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
657 opt.key_usage != 0) {
658 mbedtls_printf(" . Adding the Key Usage extension ...");
659 fflush(stdout);
660
661 ret = mbedtls_x509write_crt_set_key_usage(&crt, opt.key_usage);
662 if (ret != 0) {
663 mbedtls_strerror(ret, buf, 1024);
664 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_key_usage "
665 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
666 goto exit;
667 }
668
669 mbedtls_printf(" ok\n");
670 }
671
672 if (opt.version == MBEDTLS_X509_CRT_VERSION_3 &&
673 opt.ns_cert_type != 0) {
674 mbedtls_printf(" . Adding the NS Cert Type extension ...");
675 fflush(stdout);
676
677 ret = mbedtls_x509write_crt_set_ns_cert_type(&crt, opt.ns_cert_type);
678 if (ret != 0) {
679 mbedtls_strerror(ret, buf, 1024);
680 mbedtls_printf(" failed\n ! mbedtls_x509write_crt_set_ns_cert_type "
681 "returned -0x%04x - %s\n\n", (unsigned int) -ret, buf);
682 goto exit;
683 }
684
685 mbedtls_printf(" ok\n");
686 }
687
688 /*
689 * 1.2. Writing the certificate
690 */
691 mbedtls_printf(" . Writing the certificate...");
692 fflush(stdout);
693
694 if ((ret = write_certificate(&crt, opt.output_file,
695 mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
696 mbedtls_strerror(ret, buf, 1024);
697 mbedtls_printf(" failed\n ! write_certificate -0x%04x - %s\n\n",
698 (unsigned int) -ret, buf);
699 goto exit;
700 }
701
702 mbedtls_printf(" ok\n");
703
704 exit_code = MBEDTLS_EXIT_SUCCESS;
705
706 exit:
707 #if defined(MBEDTLS_X509_CSR_PARSE_C)
708 mbedtls_x509_csr_free(&csr);
709 #endif /* MBEDTLS_X509_CSR_PARSE_C */
710 mbedtls_x509_crt_free(&issuer_crt);
711 mbedtls_x509write_crt_free(&crt);
712 mbedtls_pk_free(&loaded_subject_key);
713 mbedtls_pk_free(&loaded_issuer_key);
714 mbedtls_mpi_free(&serial);
715 mbedtls_ctr_drbg_free(&ctr_drbg);
716 mbedtls_entropy_free(&entropy);
717 #if defined(MBEDTLS_USE_PSA_CRYPTO)
718 mbedtls_psa_crypto_free();
719 #endif /* MBEDTLS_USE_PSA_CRYPTO */
720
721 #if defined(_WIN32)
722 mbedtls_printf(" + Press Enter to exit this program.\n");
723 fflush(stdout); getchar();
724 #endif
725
726 mbedtls_exit(exit_code);
727 }
728 #endif /* MBEDTLS_X509_CRT_WRITE_C && MBEDTLS_X509_CRT_PARSE_C &&
729 MBEDTLS_FS_IO && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C &&
730 MBEDTLS_ERROR_C && MBEDTLS_PEM_WRITE_C */
731