Commit e40b7abe authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Allows PKCS#12 password to be placed on command line and add allow config 

file name for 'ca' to come from the environment.
parent 7e797a06

CHANGES

+12 −0
Original line number Diff line number Diff line
@@ -5,6 +5,18 @@ 


 Changes between 0.9.2b and 0.9.3



  *) Allow PKCS#12 password to be set from the command line or the

     environment. Let 'ca' get its config file name from the environment

     variables "OPENSSL_CONF" or "SSLEAY_CONF" (for consistency with 'req'

     and 'x509').

     [Steve Henson]



  *) Allow certificate policies extension to use an IA5STRING for the

     organization field. This is contrary to the PKIX definition but

     VeriSign uses it and IE5 only recognises this form. Document 'x509'

     extension option.

     [Steve Henson]



  *) Add PEDANTIC compiler flag to allow compilation with gcc -pedantic,

     without disallowing inline assembler and the like for non-pedantic builds.

     [Ben Laurie]

apps/ca.c

+2 −0
Original line number Diff line number Diff line
@@ -390,6 +390,8 @@ bad: 
	ERR_load_crypto_strings();



	/*****************************************************************/

	if (configfile == NULL) configfile = getenv("OPENSSL_CONF");

	if (configfile == NULL) configfile = getenv("SSLEAY_CONF");

	if (configfile == NULL)

		{

		/* We will just use 'buf[0]' as a temporary buffer.  */

apps/pkcs12.c

+34 −7
Original line number Diff line number Diff line
@@ -105,7 +105,9 @@ int MAIN(int argc, char **argv) 
    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;

    int ret = 1;

    int macver = 1;

    int noprompt = 0;

    STACK *canames = NULL;

    char *cpass = NULL, *mpass = NULL;



    apps_startup();
@@ -170,6 +172,22 @@ int MAIN(int argc, char **argv) 
			args++;	

			outfile = *args;

		    } else badarg = 1;

		} else if (!strcmp (*args, "-envpass")) {

		    if (args[1]) {

			args++;	

			if(!(cpass = getenv(*args))) {

				BIO_printf(bio_err,

				 "Can't read environment variable %s\n", *args);

				goto end;

			}

			noprompt = 1;

		    } else badarg = 1;

		} else if (!strcmp (*args, "-password")) {

		    if (args[1]) {

			args++;	

			cpass = *args;

		    	noprompt = 1;

		    } else badarg = 1;

		} else badarg = 1;



	} else badarg = 1;
@@ -206,9 +224,17 @@ int MAIN(int argc, char **argv) 
	BIO_printf (bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\n");

	BIO_printf (bio_err, "-keyex        set MS key exchange type\n");

	BIO_printf (bio_err, "-keysig       set MS key signature type\n");

	BIO_printf (bio_err, "-password p   set import/export password (NOT RECOMMENDED)\n");

	BIO_printf (bio_err, "-envpass p    set import/export password from environment\n");

    	goto end;

    }



    if(cpass) mpass = cpass;

    else {

	cpass = pass;

	mpass = macpass;

    }



    ERR_load_crypto_strings();



    in = BIO_new (BIO_s_file());
@@ -344,13 +370,14 @@ if (export_cert) { 


	if (canames) sk_free(canames);



	if(EVP_read_pw_string (pass, 50, "Enter Export Password:", 1)) {

	if(!noprompt &&

		EVP_read_pw_string(pass, 50, "Enter Export Password:", 1)) {

	    BIO_printf (bio_err, "Can't read Password\n");

	    goto end;

        }

	if (!twopass) strcpy(macpass, pass);

	/* Turn certbags into encrypted authsafe */

	authsafe = PKCS12_pack_p7encdata (cert_pbe, pass, -1, NULL, 0,

	authsafe = PKCS12_pack_p7encdata (cert_pbe, cpass, -1, NULL, 0,

								 iter, bags);

	sk_pop_free(bags, PKCS12_SAFEBAG_free);
@@ -367,7 +394,7 @@ if (export_cert) { 
	EVP_PKEY_free(key);

	if(keytype) PKCS8_add_keyusage(p8, keytype);

	bag = PKCS12_MAKE_SHKEYBAG (NID_pbe_WithSHA1And3_Key_TripleDES_CBC,

			pass, -1, NULL, 0, iter, p8);

			cpass, -1, NULL, 0, iter, p8);

	PKCS8_PRIV_KEY_INFO_free(p8);

        if (name) PKCS12_add_friendlyname (bag, name, -1);

	PKCS12_add_localkeyid (bag, keyid, keyidlen);
@@ -384,7 +411,7 @@ if (export_cert) { 


	sk_pop_free(safes, PKCS7_free);



	PKCS12_set_mac (p12, macpass, -1, NULL, 0, maciter, NULL);

	PKCS12_set_mac (p12, mpass, -1, NULL, 0, maciter, NULL);



	i2d_PKCS12_bio (out, p12);
@@ -400,7 +427,7 @@ if (export_cert) { 
	goto end;

    }



    if(EVP_read_pw_string (pass, 50, "Enter Import Password:", 0)) {

    if(!noprompt && EVP_read_pw_string(pass, 50, "Enter Import Password:", 0)) {

	BIO_printf (bio_err, "Can't read Password\n");

	goto end;

    }
@@ -409,14 +436,14 @@ if (export_cert) { 


    if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);

    if(macver) {

	if (!PKCS12_verify_mac (p12, macpass, -1)) {

	if (!PKCS12_verify_mac (p12, mpass, -1)) {

	    BIO_printf (bio_err, "Mac verify errror: invalid password?\n");

	    ERR_print_errors (bio_err);

	    goto end;

	} else BIO_printf (bio_err, "MAC verified OK\n");

    }



    if (!dump_certs_keys_p12 (out, p12, pass, -1, options)) {

    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options)) {

	BIO_printf(bio_err, "Error outputting keys and certificates\n");

	ERR_print_errors (bio_err);

	goto end;

crypto/x509v3/v3_cpols.c

+14 −9
Original line number Diff line number Diff line
@@ -69,8 +69,8 @@ static int i2r_certpol(X509V3_EXT_METHOD *method, STACK_OF(POLICYINFO) *pol, BIO 
static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, X509V3_CTX *ctx, char *value);

static void print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals, int indent);

static void print_notice(BIO *out, USERNOTICE *notice, int indent);

static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs);

static POLICYQUALINFO *notice_section(X509V3_CTX *ctx, STACK *unot);

static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs, int ia5org);

static POLICYQUALINFO *notice_section(X509V3_CTX *ctx, STACK *unot, int ia5org);

static STACK *nref_nos(STACK *nos);



X509V3_EXT_METHOD v3_cpols = {
@@ -96,9 +96,10 @@ static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, 
	ASN1_OBJECT *pobj;

	STACK *vals;

	CONF_VALUE *cnf;

	int i;

	int i, ia5org;

	pols = sk_POLICYINFO_new_null();

	vals =  X509V3_parse_list(value);

	ia5org = 0;

	for(i = 0; i < sk_num(vals); i++) {

		cnf = (CONF_VALUE *)sk_value(vals, i);

		if(cnf->value || !cnf->name ) {
@@ -107,7 +108,10 @@ static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, 
			goto err;

		}

		pstr = cnf->name;

		if(*pstr == '@') {

		if(!strcmp(pstr,"ia5org")) {

			ia5org = 1;

			continue;

		} else if(*pstr == '@') {

			STACK *polsect;

			polsect = X509V3_get_section(ctx, pstr + 1);

			if(!polsect) {
@@ -116,7 +120,7 @@ static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, 
				X509V3_conf_err(cnf);

				goto err;

			}

			pol = policy_section(ctx, polsect);

			pol = policy_section(ctx, polsect, ia5org);

			X509V3_section_free(ctx, polsect);

			if(!pol) goto err;

		} else {
@@ -137,7 +141,7 @@ static STACK_OF(POLICYINFO) *r2i_certpol(X509V3_EXT_METHOD *method, 
	return NULL;

}



static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs)

static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs, int ia5org)

{

	int i;

	CONF_VALUE *cnf;
@@ -179,7 +183,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs) 
				X509V3_conf_err(cnf);

				goto err;

			}

			qual = notice_section(ctx, unot);

			qual = notice_section(ctx, unot, ia5org);

			X509V3_section_free(ctx, unot);

			if(!qual) goto err;

			if(!sk_POLICYQUALINFO_push(pol->qualifiers, qual))
@@ -208,7 +212,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx, STACK *polstrs) 
	

}



static POLICYQUALINFO *notice_section(X509V3_CTX *ctx, STACK *unot)

static POLICYQUALINFO *notice_section(X509V3_CTX *ctx, STACK *unot, int ia5org)

{

	int i;

	CONF_VALUE *cnf;
@@ -230,7 +234,8 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx, STACK *unot) 
				if(!(nref = NOTICEREF_new())) goto merr;

				not->noticeref = nref;

			} else nref = not->noticeref;

			nref->organization = ASN1_VISIBLESTRING_new();

			if(ia5org) nref->organization = ASN1_IA5STRING_new();

			else nref->organization = ASN1_VISIBLESTRING_new();

			if(!ASN1_STRING_set(nref->organization, cnf->value,

						 strlen(cnf->value))) goto merr;

		} else if(!strcmp(cnf->name, "noticeNumbers")) {

doc/openssl.txt

+34 −4
Original line number Diff line number Diff line
@@ -98,6 +98,15 @@ indicates which section contains the extensions. In the case of 'req' the 
extension section is used when the -x509 option is present to create a

self signed root certificate.



The 'x509' utility also supports extensions when it signs a certificate.

The -config option is used to set the configuration file containing the

extensions. In this case a line with:



extensions = extension_section



in the nameless (default) section is used. If no such line is include then

it uses the default section.



You can also add extensions to CRLs: a line



crl_extensions = crl_extension_section
@@ -108,6 +117,17 @@ issuerAltName and authorityKeyIdentifier make any real sense. Note: these are 
CRL extensions NOT CRL *entry* extensions which cannot currently be generated.

CRL entry extensions can be displayed.



NB. At this time Netscape Communicator rejects V2 CRLs: to get an old V1 CRL

you should comment out the crl_extensions line in the configuration file.



As with all configuration files you can use the inbuilt environment expansion

to allow the values to be passed in the environment. Therefore if you have

several extension sections used for different purposes you can have a line:



x509_extensions = $ENV::ENV_EXT



and set the ENV_EXT environment variable before calling the relevant utility.



EXTENSION SYNTAX.



Extensions have the basic form:
@@ -298,7 +318,10 @@ This is a RAW extension. It attempts to display the contents of this extension: 
unfortuntately this extension is often improperly encoded.



The certificate policies extension will rarely be used in practice: few

software packages interpret it correctly or at all.

software packages interpret it correctly or at all. IE5 does partially

support this extension: but it needs the 'ia5org' option because it will

only correctly support a broken encoding. Of the options below only the

policy OID, explicitText and CPS options are displayed with IE5.



All the fields of this extension can be set by using the appropriate syntax.
@@ -325,11 +348,13 @@ The value of the userNotice qualifier is specified in the relevant section. This 
section can include explicitText, organization and noticeNumbers options. 

explicitText and organization are text strings, noticeNumbers is a comma

separated list of numbers. The organization and noticeNumbers options (if

included) must BOTH be present.

included) must BOTH be present. If you use the userNotice option with IE5 then

you need the 'ia5org' option at the top level to modify the encoding: otherwise

it will not be interpreted properly.



Example:



certificatePolicies=1.2.3.4,1.5.6.7.8,@polsect

certificatePolicies=ia5org,1.2.3.4,1.5.6.7.8,@polsect



[polsect]
@@ -344,6 +369,10 @@ explicitText="Explicit Text Here" 
organization="Organisation Name"

noticeNumbers=1,2,3,4



TECHNICAL NOTE: the ia5org option changes the type of the 'organization' field,

according to PKIX it should be of type DisplayText but Verisign uses an 

IA5STRING and IE5 needs this too.



Display only extensions.



Some extensions are only partially supported and currently are only displayed
@@ -374,7 +403,8 @@ private key and certificate pair. 


No special initialisation is needed for the internal PKCS#12 library: the 

standard SSLeay_add_all_algorithms() is sufficient. If you do not wish to

add all algorithms then you can manually initialise the PKCS#12 library with:

add all algorithms (you should at least add SHA1 though) then you can manually

initialise the PKCS#12 library with:



PKSC12_PBE_add();