blob: 0f588cc8cfab453049368b6cf599b8db077ad560 [file] [log] [blame]
Juan Castillo11abdcd2014-10-21 11:30:42 +01001/*
Justin Chadwellfa3ec4c2019-08-12 12:19:21 +01002 * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved.
Juan Castillo11abdcd2014-10-21 11:30:42 +01003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Juan Castillo11abdcd2014-10-21 11:30:42 +01005 */
6
Juan Castillo212f7382015-12-15 16:37:57 +00007#include <assert.h>
8#include <ctype.h>
Juan Castillo11abdcd2014-10-21 11:30:42 +01009#include <getopt.h>
10#include <stdio.h>
11#include <stdlib.h>
12#include <string.h>
13
14#include <openssl/conf.h>
15#include <openssl/engine.h>
16#include <openssl/err.h>
17#include <openssl/pem.h>
18#include <openssl/sha.h>
19#include <openssl/x509v3.h>
20
Masahiro Yamadaa27c1662017-05-22 12:11:24 +090021#if USE_TBBR_DEFS
22#include <tbbr_oid.h>
23#else
24#include <platform_oid.h>
25#endif
26
Juan Castillo11abdcd2014-10-21 11:30:42 +010027#include "cert.h"
Juan Castillo1218dd52015-07-03 16:23:16 +010028#include "cmd_opt.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010029#include "debug.h"
30#include "ext.h"
31#include "key.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010032#include "sha.h"
Juan Castilloe6d30e92015-06-12 11:27:59 +010033#include "tbbr/tbb_cert.h"
Isla Mitchell99305012017-07-11 14:54:08 +010034#include "tbbr/tbb_ext.h"
Juan Castilloe6d30e92015-06-12 11:27:59 +010035#include "tbbr/tbb_key.h"
Juan Castillo11abdcd2014-10-21 11:30:42 +010036
37/*
38 * Helper macros to simplify the code. This macro assigns the return value of
39 * the 'fn' function to 'v' and exits if the value is NULL.
40 */
41#define CHECK_NULL(v, fn) \
42 do { \
43 v = fn; \
44 if (v == NULL) { \
45 ERROR("NULL object at %s:%d\n", __FILE__, __LINE__); \
46 exit(1); \
47 } \
48 } while (0)
49
50/*
51 * This macro assigns the NID corresponding to 'oid' to 'v' and exits if the
52 * NID is undefined.
53 */
54#define CHECK_OID(v, oid) \
55 do { \
56 v = OBJ_txt2nid(oid); \
57 if (v == NID_undef) { \
58 ERROR("Cannot find TBB extension %s\n", oid); \
59 exit(1); \
60 } \
61 } while (0)
62
63#define MAX_FILENAME_LEN 1024
64#define VAL_DAYS 7300
65#define ID_TO_BIT_MASK(id) (1 << id)
Juan Castillof9f39c32015-06-01 16:34:23 +010066#define NUM_ELEM(x) ((sizeof(x)) / (sizeof(x[0])))
Juan Castillo212f7382015-12-15 16:37:57 +000067#define HELP_OPT_MAX_LEN 128
Juan Castillo11abdcd2014-10-21 11:30:42 +010068
69/* Global options */
Juan Castillof9f39c32015-06-01 16:34:23 +010070static int key_alg;
Qixiang Xu76a5a9b2017-11-09 13:51:58 +080071static int hash_alg;
Juan Castillo11abdcd2014-10-21 11:30:42 +010072static int new_keys;
73static int save_keys;
74static int print_cert;
Juan Castillo11abdcd2014-10-21 11:30:42 +010075
Juan Castillo11abdcd2014-10-21 11:30:42 +010076/* Info messages created in the Makefile */
77extern const char build_msg[];
78extern const char platform_msg[];
79
80
81static char *strdup(const char *str)
82{
83 int n = strlen(str) + 1;
84 char *dup = malloc(n);
85 if (dup) {
86 strcpy(dup, str);
87 }
88 return dup;
89}
90
Juan Castillof9f39c32015-06-01 16:34:23 +010091static const char *key_algs_str[] = {
92 [KEY_ALG_RSA] = "rsa",
Soby Mathew2fd70f62017-08-31 11:50:29 +010093 [KEY_ALG_RSA_1_5] = "rsa_1_5",
Juan Castilloa2224ab2015-06-30 13:36:57 +010094#ifndef OPENSSL_NO_EC
Juan Castillof9f39c32015-06-01 16:34:23 +010095 [KEY_ALG_ECDSA] = "ecdsa"
Juan Castilloa2224ab2015-06-30 13:36:57 +010096#endif /* OPENSSL_NO_EC */
Juan Castillof9f39c32015-06-01 16:34:23 +010097};
98
Qixiang Xu76a5a9b2017-11-09 13:51:58 +080099static const char *hash_algs_str[] = {
100 [HASH_ALG_SHA256] = "sha256",
101 [HASH_ALG_SHA384] = "sha384",
102 [HASH_ALG_SHA512] = "sha512",
103};
104
Juan Castillo1218dd52015-07-03 16:23:16 +0100105static void print_help(const char *cmd, const struct option *long_opt)
Juan Castillo11abdcd2014-10-21 11:30:42 +0100106{
Juan Castillo212f7382015-12-15 16:37:57 +0000107 int rem, i = 0;
108 const struct option *opt;
109 char line[HELP_OPT_MAX_LEN];
110 char *p;
111
112 assert(cmd != NULL);
113 assert(long_opt != NULL);
114
Juan Castillo11abdcd2014-10-21 11:30:42 +0100115 printf("\n\n");
116 printf("The certificate generation tool loads the binary images and\n"
117 "optionally the RSA keys, and outputs the key and content\n"
118 "certificates properly signed to implement the chain of trust.\n"
119 "If keys are provided, they must be in PEM format.\n"
120 "Certificates are generated in DER format.\n");
121 printf("\n");
Juan Castillo212f7382015-12-15 16:37:57 +0000122 printf("Usage:\n");
123 printf("\t%s [OPTIONS]\n\n", cmd);
124
125 printf("Available options:\n");
Juan Castillo212f7382015-12-15 16:37:57 +0000126 opt = long_opt;
127 while (opt->name) {
128 p = line;
129 rem = HELP_OPT_MAX_LEN;
130 if (isalpha(opt->val)) {
131 /* Short format */
132 sprintf(p, "-%c,", (char)opt->val);
133 p += 3;
134 rem -= 3;
135 }
136 snprintf(p, rem, "--%s %s", opt->name,
137 (opt->has_arg == required_argument) ? "<arg>" : "");
138 printf("\t%-32s %s\n", line, cmd_opt_get_help_msg(i));
139 opt++;
140 i++;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100141 }
142 printf("\n");
Juan Castillo11abdcd2014-10-21 11:30:42 +0100143}
144
Juan Castillof9f39c32015-06-01 16:34:23 +0100145static int get_key_alg(const char *key_alg_str)
146{
147 int i;
148
149 for (i = 0 ; i < NUM_ELEM(key_algs_str) ; i++) {
150 if (0 == strcmp(key_alg_str, key_algs_str[i])) {
151 return i;
152 }
153 }
154
155 return -1;
156}
157
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800158static int get_hash_alg(const char *hash_alg_str)
159{
160 int i;
161
162 for (i = 0 ; i < NUM_ELEM(hash_algs_str) ; i++) {
163 if (0 == strcmp(hash_alg_str, hash_algs_str[i])) {
164 return i;
165 }
166 }
167
168 return -1;
169}
170
Juan Castillo11abdcd2014-10-21 11:30:42 +0100171static void check_cmd_params(void)
172{
Juan Castillo86958fd2015-07-08 12:11:38 +0100173 cert_t *cert;
174 ext_t *ext;
175 key_t *key;
176 int i, j;
177
Juan Castillof9f39c32015-06-01 16:34:23 +0100178 /* Only save new keys */
179 if (save_keys && !new_keys) {
180 ERROR("Only new keys can be saved to disk\n");
181 exit(1);
182 }
183
Juan Castillo86958fd2015-07-08 12:11:38 +0100184 /* Check that all required options have been specified in the
185 * command line */
186 for (i = 0; i < num_certs; i++) {
187 cert = &certs[i];
188 if (cert->fn == NULL) {
189 /* Certificate not requested. Skip to the next one */
190 continue;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100191 }
192
Juan Castillo86958fd2015-07-08 12:11:38 +0100193 /* Check that all parameters required to create this certificate
194 * have been specified in the command line */
195 for (j = 0; j < cert->num_ext; j++) {
196 ext = &extensions[cert->ext[j]];
197 switch (ext->type) {
Juan Castillo43529982016-01-22 11:05:24 +0000198 case EXT_TYPE_NVCOUNTER:
199 /* Counter value must be specified */
200 if ((!ext->optional) && (ext->arg == NULL)) {
201 ERROR("Value for '%s' not specified\n",
202 ext->ln);
203 exit(1);
204 }
205 break;
Juan Castillo86958fd2015-07-08 12:11:38 +0100206 case EXT_TYPE_PKEY:
207 /* Key filename must be specified */
Juan Castillo43529982016-01-22 11:05:24 +0000208 key = &keys[ext->attr.key];
Juan Castillo86958fd2015-07-08 12:11:38 +0100209 if (!new_keys && key->fn == NULL) {
210 ERROR("Key '%s' required by '%s' not "
211 "specified\n", key->desc,
212 cert->cn);
213 exit(1);
214 }
215 break;
216 case EXT_TYPE_HASH:
Yatharth Kochar5752b592015-08-21 15:30:55 +0100217 /*
218 * Binary image must be specified
219 * unless it is explicitly made optional.
220 */
Juan Castillo43529982016-01-22 11:05:24 +0000221 if ((!ext->optional) && (ext->arg == NULL)) {
Juan Castillo86958fd2015-07-08 12:11:38 +0100222 ERROR("Image for '%s' not specified\n",
223 ext->ln);
224 exit(1);
225 }
226 break;
227 default:
Juan Castillo43529982016-01-22 11:05:24 +0000228 ERROR("Unknown extension type '%d' in '%s'\n",
229 ext->type, ext->ln);
Juan Castillo86958fd2015-07-08 12:11:38 +0100230 exit(1);
231 break;
232 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100233 }
234 }
235}
236
Juan Castillo212f7382015-12-15 16:37:57 +0000237/* Common command line options */
238static const cmd_opt_t common_cmd_opt[] = {
239 {
240 { "help", no_argument, NULL, 'h' },
241 "Print this message and exit"
242 },
243 {
244 { "key-alg", required_argument, NULL, 'a' },
Soby Mathew2fd70f62017-08-31 11:50:29 +0100245 "Key algorithm: 'rsa' (default) - RSAPSS scheme as per \
246PKCS#1 v2.1, 'rsa_1_5' - RSA PKCS#1 v1.5, 'ecdsa'"
Juan Castillo212f7382015-12-15 16:37:57 +0000247 },
248 {
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800249 { "hash-alg", required_argument, NULL, 's' },
250 "Hash algorithm : 'sha256' (default), 'sha384', 'sha512'"
251 },
252 {
Juan Castillo212f7382015-12-15 16:37:57 +0000253 { "save-keys", no_argument, NULL, 'k' },
254 "Save key pairs into files. Filenames must be provided"
255 },
256 {
257 { "new-keys", no_argument, NULL, 'n' },
258 "Generate new key pairs if no key files are provided"
259 },
260 {
261 { "print-cert", no_argument, NULL, 'p' },
262 "Print the certificates in the standard output"
263 }
264};
265
Juan Castillo11abdcd2014-10-21 11:30:42 +0100266int main(int argc, char *argv[])
267{
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900268 STACK_OF(X509_EXTENSION) * sk;
Michalis Pappas38628942017-10-06 16:11:44 +0800269 X509_EXTENSION *cert_ext = NULL;
Masahiro Yamada48cb5e52017-02-06 19:47:44 +0900270 ext_t *ext;
271 key_t *key;
272 cert_t *cert;
273 FILE *file;
Juan Castillo43529982016-01-22 11:05:24 +0000274 int i, j, ext_nid, nvctr;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100275 int c, opt_idx = 0;
Juan Castillo1218dd52015-07-03 16:23:16 +0100276 const struct option *cmd_opt;
277 const char *cur_opt;
Juan Castillof9f39c32015-06-01 16:34:23 +0100278 unsigned int err_code;
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800279 unsigned char md[SHA512_DIGEST_LENGTH];
280 unsigned int md_len;
Juan Castilloac402932015-03-05 14:30:00 +0000281 const EVP_MD *md_info;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100282
283 NOTICE("CoT Generation Tool: %s\n", build_msg);
284 NOTICE("Target platform: %s\n", platform_msg);
285
Juan Castillof9f39c32015-06-01 16:34:23 +0100286 /* Set default options */
287 key_alg = KEY_ALG_RSA;
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800288 hash_alg = HASH_ALG_SHA256;
Juan Castillof9f39c32015-06-01 16:34:23 +0100289
Juan Castillo1218dd52015-07-03 16:23:16 +0100290 /* Add common command line options */
Juan Castillo212f7382015-12-15 16:37:57 +0000291 for (i = 0; i < NUM_ELEM(common_cmd_opt); i++) {
292 cmd_opt_add(&common_cmd_opt[i]);
293 }
Juan Castillo1218dd52015-07-03 16:23:16 +0100294
295 /* Initialize the certificates */
296 if (cert_init() != 0) {
297 ERROR("Cannot initialize certificates\n");
298 exit(1);
299 }
300
301 /* Initialize the keys */
302 if (key_init() != 0) {
303 ERROR("Cannot initialize keys\n");
304 exit(1);
305 }
306
307 /* Initialize the new types and register OIDs for the extensions */
308 if (ext_init() != 0) {
309 ERROR("Cannot initialize TBB extensions\n");
310 exit(1);
311 }
312
313 /* Get the command line options populated during the initialization */
314 cmd_opt = cmd_opt_get_array();
315
Juan Castillo11abdcd2014-10-21 11:30:42 +0100316 while (1) {
317 /* getopt_long stores the option index here. */
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800318 c = getopt_long(argc, argv, "a:hknps:", cmd_opt, &opt_idx);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100319
320 /* Detect the end of the options. */
321 if (c == -1) {
322 break;
323 }
324
325 switch (c) {
Juan Castillof9f39c32015-06-01 16:34:23 +0100326 case 'a':
327 key_alg = get_key_alg(optarg);
328 if (key_alg < 0) {
329 ERROR("Invalid key algorithm '%s'\n", optarg);
330 exit(1);
331 }
332 break;
Juan Castillo11abdcd2014-10-21 11:30:42 +0100333 case 'h':
Juan Castillo1218dd52015-07-03 16:23:16 +0100334 print_help(argv[0], cmd_opt);
Roberto Vargas58a5b2b2018-06-27 08:23:22 +0100335 exit(0);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100336 case 'k':
337 save_keys = 1;
338 break;
339 case 'n':
340 new_keys = 1;
341 break;
342 case 'p':
343 print_cert = 1;
344 break;
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800345 case 's':
346 hash_alg = get_hash_alg(optarg);
347 if (hash_alg < 0) {
348 ERROR("Invalid hash algorithm '%s'\n", optarg);
349 exit(1);
350 }
351 break;
Juan Castillo1218dd52015-07-03 16:23:16 +0100352 case CMD_OPT_EXT:
353 cur_opt = cmd_opt_get_name(opt_idx);
354 ext = ext_get_by_opt(cur_opt);
Juan Castillo43529982016-01-22 11:05:24 +0000355 ext->arg = strdup(optarg);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100356 break;
Juan Castillo1218dd52015-07-03 16:23:16 +0100357 case CMD_OPT_KEY:
358 cur_opt = cmd_opt_get_name(opt_idx);
359 key = key_get_by_opt(cur_opt);
360 key->fn = strdup(optarg);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100361 break;
Juan Castillo1218dd52015-07-03 16:23:16 +0100362 case CMD_OPT_CERT:
363 cur_opt = cmd_opt_get_name(opt_idx);
364 cert = cert_get_by_opt(cur_opt);
365 cert->fn = strdup(optarg);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100366 break;
367 case '?':
368 default:
Juan Castillo212f7382015-12-15 16:37:57 +0000369 print_help(argv[0], cmd_opt);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100370 exit(1);
371 }
372 }
373
Juan Castillo11abdcd2014-10-21 11:30:42 +0100374 /* Check command line arguments */
375 check_cmd_params();
376
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800377 /* Indicate SHA as image hash algorithm in the certificate
Juan Castilloac402932015-03-05 14:30:00 +0000378 * extension */
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800379 if (hash_alg == HASH_ALG_SHA384) {
380 md_info = EVP_sha384();
381 md_len = SHA384_DIGEST_LENGTH;
382 } else if (hash_alg == HASH_ALG_SHA512) {
383 md_info = EVP_sha512();
384 md_len = SHA512_DIGEST_LENGTH;
385 } else {
386 md_info = EVP_sha256();
387 md_len = SHA256_DIGEST_LENGTH;
388 }
Juan Castilloac402932015-03-05 14:30:00 +0000389
Juan Castillo11abdcd2014-10-21 11:30:42 +0100390 /* Load private keys from files (or generate new ones) */
Juan Castilloe6d30e92015-06-12 11:27:59 +0100391 for (i = 0 ; i < num_keys ; i++) {
Masahiro Yamadabccb1092017-02-06 21:15:01 +0900392 if (!key_new(&keys[i])) {
393 ERROR("Failed to allocate key container\n");
394 exit(1);
395 }
396
Juan Castillof9f39c32015-06-01 16:34:23 +0100397 /* First try to load the key from disk */
398 if (key_load(&keys[i], &err_code)) {
399 /* Key loaded successfully */
400 continue;
401 }
402
403 /* Key not loaded. Check the error code */
Masahiro Yamadabccb1092017-02-06 21:15:01 +0900404 if (err_code == KEY_ERR_LOAD) {
Juan Castillof9f39c32015-06-01 16:34:23 +0100405 /* File exists, but it does not contain a valid private
406 * key. Abort. */
407 ERROR("Error loading '%s'\n", keys[i].fn);
408 exit(1);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100409 }
Juan Castillof9f39c32015-06-01 16:34:23 +0100410
411 /* File does not exist, could not be opened or no filename was
412 * given */
413 if (new_keys) {
414 /* Try to create a new key */
415 NOTICE("Creating new key for '%s'\n", keys[i].desc);
416 if (!key_create(&keys[i], key_alg)) {
417 ERROR("Error creating key '%s'\n", keys[i].desc);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100418 exit(1);
419 }
Juan Castillof9f39c32015-06-01 16:34:23 +0100420 } else {
421 if (err_code == KEY_ERR_OPEN) {
422 ERROR("Error opening '%s'\n", keys[i].fn);
423 } else {
424 ERROR("Key '%s' not specified\n", keys[i].desc);
425 }
426 exit(1);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100427 }
428 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100429
Juan Castilloe6d30e92015-06-12 11:27:59 +0100430 /* Create the certificates */
431 for (i = 0 ; i < num_certs ; i++) {
Juan Castillo11abdcd2014-10-21 11:30:42 +0100432
Juan Castilloe6d30e92015-06-12 11:27:59 +0100433 cert = &certs[i];
Juan Castillo11abdcd2014-10-21 11:30:42 +0100434
Juan Castilloe6d30e92015-06-12 11:27:59 +0100435 /* Create a new stack of extensions. This stack will be used
436 * to create the certificate */
Juan Castillo11abdcd2014-10-21 11:30:42 +0100437 CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
Juan Castillo11abdcd2014-10-21 11:30:42 +0100438
Juan Castilloe6d30e92015-06-12 11:27:59 +0100439 for (j = 0 ; j < cert->num_ext ; j++) {
Juan Castillo11abdcd2014-10-21 11:30:42 +0100440
Juan Castilloe6d30e92015-06-12 11:27:59 +0100441 ext = &extensions[cert->ext[j]];
Juan Castillo11abdcd2014-10-21 11:30:42 +0100442
Juan Castilloe6d30e92015-06-12 11:27:59 +0100443 /* Get OpenSSL internal ID for this extension */
444 CHECK_OID(ext_nid, ext->oid);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100445
Juan Castilloe6d30e92015-06-12 11:27:59 +0100446 /*
447 * Three types of extensions are currently supported:
448 * - EXT_TYPE_NVCOUNTER
449 * - EXT_TYPE_HASH
450 * - EXT_TYPE_PKEY
451 */
452 switch (ext->type) {
453 case EXT_TYPE_NVCOUNTER:
Yatharth Kochar79f86402016-06-22 14:49:27 +0100454 if (ext->arg) {
455 nvctr = atoi(ext->arg);
456 CHECK_NULL(cert_ext, ext_new_nvcounter(ext_nid,
Juan Castillo43529982016-01-22 11:05:24 +0000457 EXT_CRIT, nvctr));
Yatharth Kochar79f86402016-06-22 14:49:27 +0100458 }
Juan Castilloe6d30e92015-06-12 11:27:59 +0100459 break;
460 case EXT_TYPE_HASH:
Juan Castillo43529982016-01-22 11:05:24 +0000461 if (ext->arg == NULL) {
Yatharth Kochar5752b592015-08-21 15:30:55 +0100462 if (ext->optional) {
463 /* Include a hash filled with zeros */
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800464 memset(md, 0x0, SHA512_DIGEST_LENGTH);
Yatharth Kochar5752b592015-08-21 15:30:55 +0100465 } else {
466 /* Do not include this hash in the certificate */
467 break;
468 }
469 } else {
470 /* Calculate the hash of the file */
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800471 if (!sha_file(hash_alg, ext->arg, md)) {
Yatharth Kochar5752b592015-08-21 15:30:55 +0100472 ERROR("Cannot calculate hash of %s\n",
Juan Castillo43529982016-01-22 11:05:24 +0000473 ext->arg);
Yatharth Kochar5752b592015-08-21 15:30:55 +0100474 exit(1);
475 }
Juan Castilloe6d30e92015-06-12 11:27:59 +0100476 }
477 CHECK_NULL(cert_ext, ext_new_hash(ext_nid,
478 EXT_CRIT, md_info, md,
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800479 md_len));
Juan Castilloe6d30e92015-06-12 11:27:59 +0100480 break;
481 case EXT_TYPE_PKEY:
482 CHECK_NULL(cert_ext, ext_new_key(ext_nid,
Juan Castillo43529982016-01-22 11:05:24 +0000483 EXT_CRIT, keys[ext->attr.key].key));
Juan Castilloe6d30e92015-06-12 11:27:59 +0100484 break;
485 default:
Juan Castillo43529982016-01-22 11:05:24 +0000486 ERROR("Unknown extension type '%d' in %s\n",
487 ext->type, cert->cn);
Juan Castilloe6d30e92015-06-12 11:27:59 +0100488 exit(1);
489 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100490
Juan Castilloe6d30e92015-06-12 11:27:59 +0100491 /* Push the extension into the stack */
492 sk_X509_EXTENSION_push(sk, cert_ext);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100493 }
Juan Castillo11abdcd2014-10-21 11:30:42 +0100494
Soby Mathew2fd70f62017-08-31 11:50:29 +0100495 /* Create certificate. Signed with corresponding key */
Qixiang Xu76a5a9b2017-11-09 13:51:58 +0800496 if (cert->fn && !cert_new(key_alg, hash_alg, cert, VAL_DAYS, 0, sk)) {
Juan Castilloe6d30e92015-06-12 11:27:59 +0100497 ERROR("Cannot create %s\n", cert->cn);
Juan Castillo11abdcd2014-10-21 11:30:42 +0100498 exit(1);
499 }
500
501 sk_X509_EXTENSION_free(sk);
502 }
503
Juan Castillo11abdcd2014-10-21 11:30:42 +0100504
505 /* Print the certificates */
506 if (print_cert) {
Juan Castilloe6d30e92015-06-12 11:27:59 +0100507 for (i = 0 ; i < num_certs ; i++) {
Juan Castillo11abdcd2014-10-21 11:30:42 +0100508 if (!certs[i].x) {
509 continue;
510 }
511 printf("\n\n=====================================\n\n");
512 X509_print_fp(stdout, certs[i].x);
513 }
514 }
515
516 /* Save created certificates to files */
Juan Castilloe6d30e92015-06-12 11:27:59 +0100517 for (i = 0 ; i < num_certs ; i++) {
Juan Castillo11abdcd2014-10-21 11:30:42 +0100518 if (certs[i].x && certs[i].fn) {
519 file = fopen(certs[i].fn, "w");
520 if (file != NULL) {
521 i2d_X509_fp(file, certs[i].x);
522 fclose(file);
523 } else {
524 ERROR("Cannot create file %s\n", certs[i].fn);
525 }
526 }
527 }
528
529 /* Save keys */
530 if (save_keys) {
Juan Castilloe6d30e92015-06-12 11:27:59 +0100531 for (i = 0 ; i < num_keys ; i++) {
Juan Castillo11abdcd2014-10-21 11:30:42 +0100532 if (!key_store(&keys[i])) {
533 ERROR("Cannot save %s\n", keys[i].desc);
534 }
535 }
536 }
537
Juan Castillo11abdcd2014-10-21 11:30:42 +0100538#ifndef OPENSSL_NO_ENGINE
539 ENGINE_cleanup();
540#endif
541 CRYPTO_cleanup_all_ex_data();
542
543 return 0;
544}