1 // Copyright 2012 Google Inc. All Rights Reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 // Utilities for converting SSL certificates using OpenSSL functions.
16
17 #include "polo/util/certificateutil.h"
18
19 #include <glog/logging.h>
20
21 namespace polo {
22 namespace util {
23
X509FromPEM(std::string pem)24 X509* CertificateUtil::X509FromPEM(std::string pem) {
25 BIO* bio = BIO_new_mem_buf(&pem[0], pem.size());
26 X509* x509 = PEM_read_bio_X509(bio, NULL, 0, NULL);
27 BIO_free(bio);
28
29 // Ensure that the certificate is not expired.
30 if (X509_cmp_current_time(X509_get_notBefore(x509)) > 0
31 || X509_cmp_current_time(X509_get_notAfter(x509)) < 0) {
32 LOG(ERROR) << "Expired certificate";
33 X509_free(x509);
34 return NULL;
35 }
36
37 return x509;
38 }
39
X509ToPEM(X509 * x509)40 std::string CertificateUtil::X509ToPEM(X509* x509) {
41 BIO* bio = BIO_new(BIO_s_mem());
42 PEM_write_bio_X509(bio, x509);
43 BIO_flush(bio);
44
45 char* data = NULL;
46 size_t data_size = BIO_get_mem_data(bio, &data);
47
48 std::string pem(data, data_size);
49 BIO_free(bio);
50
51 return pem;
52 }
53
PKEYFromPEM(std::string pem,std::string passphrase)54 EVP_PKEY* CertificateUtil::PKEYFromPEM(std::string pem,
55 std::string passphrase) {
56 BIO* bio = BIO_new_mem_buf(&pem[0], pem.size());
57 EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bio, NULL, 0, &passphrase[0]);
58 BIO_free(bio);
59
60 return pkey;
61 }
62
PKEYToPEM(EVP_PKEY * pkey,std::string passphrase)63 std::string CertificateUtil::PKEYToPEM(EVP_PKEY* pkey,
64 std::string passphrase) {
65 BIO* bio = BIO_new(BIO_s_mem());
66 PEM_write_bio_PrivateKey(bio, pkey, EVP_des_ede3_cbc(), NULL, 0, 0,
67 &passphrase[0]);
68 BIO_flush(bio);
69
70 char* data = NULL;
71 int data_size = BIO_get_mem_data(bio, &data);
72
73 std::string pem(data, data_size);
74 BIO_free(bio);
75
76 return pem;
77 }
78
GeneratePrivateKey()79 EVP_PKEY* CertificateUtil::GeneratePrivateKey() {
80 EVP_PKEY* pkey = EVP_PKEY_new();
81 RSA* rsa = RSA_generate_key(1025, RSA_F4, NULL, NULL);
82 EVP_PKEY_assign_RSA(pkey, rsa);
83 return pkey;
84 }
85
GenerateSelfSignedCert(EVP_PKEY * pkey,std::string subject_name,uint32_t days)86 X509* CertificateUtil::GenerateSelfSignedCert(EVP_PKEY* pkey,
87 std::string subject_name,
88 uint32_t days) {
89 X509* x509 = X509_new();
90 X509_set_version(x509, 2);
91 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
92 X509_gmtime_adj(X509_get_notBefore(x509), 0);
93 X509_gmtime_adj(X509_get_notAfter(x509), (int64_t) 60 * 60 * 24 * days);
94 X509_set_pubkey(x509, pkey);
95
96 X509_NAME* name = X509_get_subject_name(x509);
97 X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC,
98 (unsigned char*) &subject_name[0], -1, -1, 0);
99
100 X509_set_issuer_name(x509, name);
101 X509_sign(x509, pkey, EVP_sha256());
102
103 return x509;
104 }
105
106 } // namespace util
107 } // namespace polo
108