FreeRDP
Loading...
Searching...
No Matches
makecert.c
1
20#include <errno.h>
21
22#include <winpr/assert.h>
23#include <winpr/crt.h>
24#include <winpr/path.h>
25#include <winpr/file.h>
26#include <winpr/cmdline.h>
27#include <winpr/sysinfo.h>
28#include <winpr/crypto.h>
29
30#ifdef WITH_OPENSSL
31#include <openssl/crypto.h>
32#include <openssl/conf.h>
33#include <openssl/pem.h>
34#include <openssl/err.h>
35#include <openssl/rsa.h>
36#include <openssl/pkcs12.h>
37#include <openssl/x509v3.h>
38#include <openssl/bn.h>
39#endif
40
41#include <winpr/tools/makecert.h>
42
43struct S_MAKECERT_CONTEXT
44{
45 int argc;
46 char** argv;
47
48#ifdef WITH_OPENSSL
49 X509* x509;
50 EVP_PKEY* pkey;
51 PKCS12* pkcs12;
52#endif
53
54 BOOL live;
55 BOOL silent;
56
57 BOOL crtFormat;
58 BOOL pemFormat;
59 BOOL pfxFormat;
60
61 char* password;
62
63 char* output_file;
64 char* output_path;
65 char* default_name;
66 char* common_name;
67
68 int duration_years;
69 int duration_months;
70};
71
72static char* makecert_read_str(BIO* bio, size_t* pOffset)
73{
74 int status = -1;
75 size_t offset = 0;
76 size_t length = 0;
77 char* x509_str = nullptr;
78
79 while (offset >= length)
80 {
81 size_t readBytes = 0;
82 char* new_str = nullptr;
83 size_t new_len = length + 2048ull;
84
85 if (new_len > INT_MAX)
86 {
87 status = -1;
88 break;
89 }
90
91 new_str = (char*)realloc(x509_str, new_len);
92
93 if (!new_str)
94 {
95 status = -1;
96 break;
97 }
98
99 length = new_len;
100 x509_str = new_str;
101 ERR_clear_error();
102#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
103 status = BIO_read_ex(bio, &x509_str[offset], length - offset, &readBytes);
104#else
105 status = BIO_read(bio, &x509_str[offset], length - offset);
106 readBytes = status;
107#endif
108 if (status <= 0)
109 break;
110
111 offset += readBytes;
112 }
113
114 if (status < 0)
115 {
116 free(x509_str);
117 if (pOffset)
118 *pOffset = 0;
119 return nullptr;
120 }
121
122 x509_str[offset] = '\0';
123 if (pOffset)
124 *pOffset = offset + 1;
125 return x509_str;
126}
127
128static int makecert_print_command_line_help(COMMAND_LINE_ARGUMENT_A* args, int argc, char** argv)
129{
130 char* str = nullptr;
131 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
132
133 if (!argv || (argc < 1))
134 return -1;
135
136 printf("Usage: %s [options] [output file]\n", argv[0]);
137 printf("\n");
138 arg = args;
139
140 do
141 {
142 if (arg->Flags & COMMAND_LINE_VALUE_FLAG)
143 {
144 printf(" %s", "-");
145 printf("%-20s", arg->Name);
146 printf("\t%s\n", arg->Text);
147 }
148 else if ((arg->Flags & COMMAND_LINE_VALUE_REQUIRED) ||
149 (arg->Flags & COMMAND_LINE_VALUE_OPTIONAL))
150 {
151 printf(" %s", "-");
152
153 if (arg->Format)
154 {
155 size_t length = strlen(arg->Name) + strlen(arg->Format) + 2;
156 str = malloc(length + 1);
157
158 if (!str)
159 return -1;
160
161 (void)sprintf_s(str, length + 1, "%s %s", arg->Name, arg->Format);
162 (void)printf("%-20s", str);
163 free(str);
164 }
165 else
166 {
167 printf("%-20s", arg->Name);
168 }
169
170 printf("\t%s\n", arg->Text);
171 }
172 } while ((arg = CommandLineFindNextArgumentA(arg)) != nullptr);
173
174 return 1;
175}
176
177#ifdef WITH_OPENSSL
178static int x509_add_ext(X509* cert, int nid, char* value)
179{
180 X509V3_CTX ctx;
181 X509_EXTENSION* ext = nullptr;
182
183 if (!cert || !value)
184 return 0;
185
186 X509V3_set_ctx_nodb(&ctx) X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);
187 ext = X509V3_EXT_conf_nid(nullptr, &ctx, nid, value);
188
189 if (!ext)
190 return 0;
191
192 X509_add_ext(cert, ext, -1);
193 X509_EXTENSION_free(ext);
194 return 1;
195}
196#endif
197
198static char* x509_name_parse(char* name, char* txt, size_t* length)
199{
200 char* p = nullptr;
201 char* entry = nullptr;
202
203 if (!name || !txt || !length)
204 return nullptr;
205
206 p = strstr(name, txt);
207
208 if (!p)
209 return nullptr;
210
211 entry = p + strlen(txt) + 1;
212 p = strchr(entry, '=');
213
214 if (!p)
215 *length = strlen(entry);
216 else
217 *length = (size_t)(p - entry);
218
219 return entry;
220}
221
222static char* get_name(COMPUTER_NAME_FORMAT type)
223{
224 DWORD nSize = 0;
225
226 if (GetComputerNameExA(type, nullptr, &nSize))
227 return nullptr;
228
229 if (GetLastError() != ERROR_MORE_DATA)
230 return nullptr;
231
232 char* computerName = calloc(1, nSize);
233
234 if (!computerName)
235 return nullptr;
236
237 if (!GetComputerNameExA(type, computerName, &nSize))
238 {
239 free(computerName);
240 return nullptr;
241 }
242
243 return computerName;
244}
245
246static char* x509_get_default_name(void)
247{
248 char* computerName = get_name(ComputerNamePhysicalDnsFullyQualified);
249 if (!computerName)
250 computerName = get_name(ComputerNamePhysicalNetBIOS);
251 return computerName;
252}
253
254static int command_line_pre_filter(void* pvctx, int index, int argc, LPSTR* argv)
255{
256 MAKECERT_CONTEXT* context = pvctx;
257 if (!context || !argv || (index < 0) || (argc < 0))
258 return -1;
259
260 if (index == (argc - 1))
261 {
262 if (argv[index][0] != '-')
263 {
264 context->output_file = _strdup(argv[index]);
265
266 if (!context->output_file)
267 return -1;
268
269 return 1;
270 }
271 }
272
273 return 0;
274}
275
276static int makecert_context_parse_arguments(MAKECERT_CONTEXT* context,
277 COMMAND_LINE_ARGUMENT_A* args, int argc, char** argv)
278{
279 int status = 0;
280 DWORD flags = 0;
281 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
282
283 if (!context || !argv || (argc < 0))
284 return -1;
285
290 CommandLineClearArgumentsA(args);
291 flags = COMMAND_LINE_SEPARATOR_SPACE | COMMAND_LINE_SIGIL_DASH;
292 status = CommandLineParseArgumentsA(argc, argv, args, flags, context, command_line_pre_filter,
293 nullptr);
294
295 if (status & COMMAND_LINE_STATUS_PRINT_HELP)
296 {
297 makecert_print_command_line_help(args, argc, argv);
298 return 0;
299 }
300
301 arg = args;
302 errno = 0;
303
304 do
305 {
306 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
307 continue;
308
309 CommandLineSwitchStart(arg)
310 /* Basic Options */
311 CommandLineSwitchCase(arg, "silent")
312 {
313 context->silent = TRUE;
314 }
315 CommandLineSwitchCase(arg, "live")
316 {
317 context->live = TRUE;
318 }
319 CommandLineSwitchCase(arg, "format")
320 {
321 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
322 continue;
323
324 if (strcmp(arg->Value, "crt") == 0)
325 {
326 context->crtFormat = TRUE;
327 context->pemFormat = FALSE;
328 context->pfxFormat = FALSE;
329 }
330 else if (strcmp(arg->Value, "pem") == 0)
331 {
332 context->crtFormat = FALSE;
333 context->pemFormat = TRUE;
334 context->pfxFormat = FALSE;
335 }
336 else if (strcmp(arg->Value, "pfx") == 0)
337 {
338 context->crtFormat = FALSE;
339 context->pemFormat = FALSE;
340 context->pfxFormat = TRUE;
341 }
342 else
343 return -1;
344 }
345 CommandLineSwitchCase(arg, "path")
346 {
347 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
348 continue;
349
350 context->output_path = _strdup(arg->Value);
351
352 if (!context->output_path)
353 return -1;
354 }
355 CommandLineSwitchCase(arg, "p")
356 {
357 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
358 continue;
359
360 context->password = _strdup(arg->Value);
361
362 if (!context->password)
363 return -1;
364 }
365 CommandLineSwitchCase(arg, "n")
366 {
367 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
368 continue;
369
370 context->common_name = _strdup(arg->Value);
371
372 if (!context->common_name)
373 return -1;
374 }
375 CommandLineSwitchCase(arg, "y")
376 {
377 long val = 0;
378
379 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
380 continue;
381
382 val = strtol(arg->Value, nullptr, 0);
383
384 if ((errno != 0) || (val < 0) || (val > INT32_MAX))
385 return -1;
386
387 context->duration_years = (int)val;
388 }
389 CommandLineSwitchCase(arg, "m")
390 {
391 long val = 0;
392
393 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
394 continue;
395
396 val = strtol(arg->Value, nullptr, 0);
397
398 if ((errno != 0) || (val < 0))
399 return -1;
400
401 context->duration_months = (int)val;
402 }
403 CommandLineSwitchDefault(arg)
404 {
405 }
406 CommandLineSwitchEnd(arg)
407 } while ((arg = CommandLineFindNextArgumentA(arg)) != nullptr);
408
409 return 1;
410}
411
412int makecert_context_set_output_file_name(MAKECERT_CONTEXT* context, const char* name)
413{
414 if (!context)
415 return -1;
416
417 free(context->output_file);
418 context->output_file = nullptr;
419
420 if (name)
421 context->output_file = _strdup(name);
422
423 if (!context->output_file)
424 return -1;
425
426 return 1;
427}
428
429int makecert_context_output_certificate_file(MAKECERT_CONTEXT* context, const char* path)
430{
431#ifdef WITH_OPENSSL
432 FILE* fp = nullptr;
433 int status = 0;
434 size_t length = 0;
435 size_t offset = 0;
436 char* filename = nullptr;
437 char* fullpath = nullptr;
438 char* ext = nullptr;
439 int ret = -1;
440 BIO* bio = nullptr;
441 char* x509_str = nullptr;
442
443 if (!context)
444 return -1;
445
446 if (!context->output_file)
447 {
448 context->output_file = _strdup(context->default_name);
449
450 if (!context->output_file)
451 return -1;
452 }
453
454 /*
455 * Output Certificate File
456 */
457 length = strlen(context->output_file);
458 filename = malloc(length + 8);
459
460 if (!filename)
461 return -1;
462
463 if (context->crtFormat)
464 ext = "crt";
465 else if (context->pemFormat)
466 ext = "pem";
467 else if (context->pfxFormat)
468 ext = "pfx";
469 else
470 goto out_fail;
471
472 (void)sprintf_s(filename, length + 8, "%s.%s", context->output_file, ext);
473
474 if (path)
475 fullpath = GetCombinedPath(path, filename);
476 else
477 fullpath = _strdup(filename);
478
479 if (!fullpath)
480 goto out_fail;
481
482 fp = winpr_fopen(fullpath, "w+");
483
484 if (fp)
485 {
486 if (context->pfxFormat)
487 {
488 if (!context->password)
489 {
490 context->password = _strdup("password");
491
492 if (!context->password)
493 goto out_fail;
494
495 printf("Using default export password \"password\"\n");
496 }
497
498#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
499 OpenSSL_add_all_algorithms();
500 OpenSSL_add_all_ciphers();
501 OpenSSL_add_all_digests();
502#else
503 OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS |
504 OPENSSL_INIT_LOAD_CONFIG,
505 nullptr);
506#endif
507 context->pkcs12 = PKCS12_create(context->password, context->default_name, context->pkey,
508 context->x509, nullptr, 0, 0, 0, 0, 0);
509
510 if (!context->pkcs12)
511 goto out_fail;
512
513 bio = BIO_new(BIO_s_mem());
514
515 if (!bio)
516 goto out_fail;
517
518 status = i2d_PKCS12_bio(bio, context->pkcs12);
519
520 if (status != 1)
521 goto out_fail;
522
523 x509_str = makecert_read_str(bio, &offset);
524
525 if (!x509_str)
526 goto out_fail;
527
528 length = offset;
529
530 if (fwrite((void*)x509_str, length, 1, fp) != 1)
531 goto out_fail;
532 }
533 else
534 {
535 bio = BIO_new(BIO_s_mem());
536
537 if (!bio)
538 goto out_fail;
539
540 if (!PEM_write_bio_X509(bio, context->x509))
541 goto out_fail;
542
543 x509_str = makecert_read_str(bio, &offset);
544
545 if (!x509_str)
546 goto out_fail;
547
548 length = offset;
549
550 if (fwrite(x509_str, length, 1, fp) != 1)
551 goto out_fail;
552
553 free(x509_str);
554 x509_str = nullptr;
555 BIO_free_all(bio);
556 bio = nullptr;
557
558 if (context->pemFormat)
559 {
560 bio = BIO_new(BIO_s_mem());
561
562 if (!bio)
563 goto out_fail;
564
565 status = PEM_write_bio_PrivateKey(bio, context->pkey, nullptr, nullptr, 0, nullptr,
566 nullptr);
567
568 if (status < 0)
569 goto out_fail;
570
571 x509_str = makecert_read_str(bio, &offset);
572 if (!x509_str)
573 goto out_fail;
574
575 length = offset;
576
577 if (fwrite(x509_str, length, 1, fp) != 1)
578 goto out_fail;
579 }
580 }
581 }
582
583 ret = 1;
584out_fail:
585 BIO_free_all(bio);
586
587 if (fp)
588 (void)fclose(fp);
589
590 free(x509_str);
591 free(filename);
592 free(fullpath);
593 return ret;
594#else
595 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
596 return -1;
597#endif
598}
599
600int makecert_context_output_private_key_file(MAKECERT_CONTEXT* context, const char* path)
601{
602#ifdef WITH_OPENSSL
603 FILE* fp = nullptr;
604 size_t length = 0;
605 size_t offset = 0;
606 char* filename = nullptr;
607 char* fullpath = nullptr;
608 int ret = -1;
609 BIO* bio = nullptr;
610 char* x509_str = nullptr;
611
612 if (!context->crtFormat)
613 return 1;
614
615 if (!context->output_file)
616 {
617 context->output_file = _strdup(context->default_name);
618
619 if (!context->output_file)
620 return -1;
621 }
622
626 length = strlen(context->output_file);
627 filename = malloc(length + 8);
628
629 if (!filename)
630 return -1;
631
632 (void)sprintf_s(filename, length + 8, "%s.key", context->output_file);
633
634 if (path)
635 fullpath = GetCombinedPath(path, filename);
636 else
637 fullpath = _strdup(filename);
638
639 if (!fullpath)
640 goto out_fail;
641
642 fp = winpr_fopen(fullpath, "w+");
643
644 if (!fp)
645 goto out_fail;
646
647 bio = BIO_new(BIO_s_mem());
648
649 if (!bio)
650 goto out_fail;
651
652 if (!PEM_write_bio_PrivateKey(bio, context->pkey, nullptr, nullptr, 0, nullptr, nullptr))
653 goto out_fail;
654
655 x509_str = makecert_read_str(bio, &offset);
656
657 if (!x509_str)
658 goto out_fail;
659
660 length = offset;
661
662 if (fwrite((void*)x509_str, length, 1, fp) != 1)
663 goto out_fail;
664
665 ret = 1;
666out_fail:
667
668 if (fp)
669 (void)fclose(fp);
670
671 BIO_free_all(bio);
672 free(x509_str);
673 free(filename);
674 free(fullpath);
675 return ret;
676#else
677 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
678 return -1;
679#endif
680}
681
682#ifdef WITH_OPENSSL
683static BOOL makecert_create_rsa(EVP_PKEY** ppkey, size_t key_length)
684{
685 BOOL rc = FALSE;
686
687 WINPR_ASSERT(ppkey);
688
689#if !defined(OPENSSL_VERSION_MAJOR) || (OPENSSL_VERSION_MAJOR < 3)
690 RSA* rsa = nullptr;
691#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
692 rsa = RSA_generate_key(key_length, RSA_F4, nullptr, nullptr);
693#else
694 {
695 BIGNUM* bn = BN_secure_new();
696
697 if (!bn)
698 return FALSE;
699
700 rsa = RSA_new();
701
702 if (!rsa)
703 {
704 BN_clear_free(bn);
705 return FALSE;
706 }
707
708 BN_set_word(bn, RSA_F4);
709 const int res = RSA_generate_key_ex(rsa, key_length, bn, nullptr);
710 BN_clear_free(bn);
711
712 if (res != 1)
713 return FALSE;
714 }
715#endif
716
717 if (!EVP_PKEY_assign_RSA(*ppkey, rsa))
718 {
719 RSA_free(rsa);
720 return FALSE;
721 }
722 rc = TRUE;
723#else
724 EVP_PKEY_CTX* pctx = EVP_PKEY_CTX_new_from_name(nullptr, "RSA", nullptr);
725 if (!pctx)
726 return FALSE;
727
728 if (EVP_PKEY_keygen_init(pctx) != 1)
729 goto fail;
730
731 {
732 WINPR_ASSERT(key_length <= UINT_MAX);
733 unsigned int keylen = (unsigned int)key_length;
734 const OSSL_PARAM params[] = { OSSL_PARAM_construct_uint("bits", &keylen),
735 OSSL_PARAM_construct_end() };
736 if (EVP_PKEY_CTX_set_params(pctx, params) != 1)
737 goto fail;
738 }
739
740 if (EVP_PKEY_generate(pctx, ppkey) != 1)
741 goto fail;
742
743 rc = TRUE;
744fail:
745 EVP_PKEY_CTX_free(pctx);
746#endif
747 return rc;
748}
749#endif
750
751int makecert_context_process(MAKECERT_CONTEXT* context, int argc, char** argv)
752{
753 COMMAND_LINE_ARGUMENT_A args[] = {
754 /* Custom Options */
755
756 { "rdp", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
757 "Unsupported - Generate certificate with required options for RDP usage." },
758 { "silent", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
759 "Silently generate certificate without verbose output." },
760 { "live", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
761 "Generate certificate live in memory when used as a library." },
762 { "format", COMMAND_LINE_VALUE_REQUIRED, "<crt|pem|pfx>", nullptr, nullptr, -1, nullptr,
763 "Specify certificate file format" },
764 { "path", COMMAND_LINE_VALUE_REQUIRED, "<path>", nullptr, nullptr, -1, nullptr,
765 "Specify certificate file output path" },
766 { "p", COMMAND_LINE_VALUE_REQUIRED, "<password>", nullptr, nullptr, -1, nullptr,
767 "Specify certificate export password" },
768
769 /* Basic Options */
770
771 { "n", COMMAND_LINE_VALUE_REQUIRED, "<name>", nullptr, nullptr, -1, nullptr,
772 "Specifies the subject's certificate name. This name must conform to the X.500 standard. "
773 "The simplest method is to specify the name in double quotes, preceded by CN=; for "
774 "example, "
775 "-n \"CN=myName\"." },
776 { "pe", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
777 "Unsupported - Marks the generated private key as exportable. This allows the private "
778 "key to "
779 "be included in the certificate." },
780 { "sk", COMMAND_LINE_VALUE_REQUIRED, "<keyname>", nullptr, nullptr, -1, nullptr,
781 "Unsupported - Specifies the subject's key container location, which contains the "
782 "private "
783 "key. "
784 "If a key container does not exist, it will be created." },
785 { "sr", COMMAND_LINE_VALUE_REQUIRED, "<location>", nullptr, nullptr, -1, nullptr,
786 "Unsupported - Specifies the subject's certificate store location. location can be "
787 "either "
788 "currentuser (the default) or localmachine." },
789 { "ss", COMMAND_LINE_VALUE_REQUIRED, "<store>", nullptr, nullptr, -1, nullptr,
790 "Unsupported - Specifies the subject's certificate store name that stores the output "
791 "certificate." },
792 { "#", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
793 "Specifies a serial number from 1 to 2,147,483,647. The default is a unique value "
794 "generated "
795 "by Makecert.exe." },
796 { "$", COMMAND_LINE_VALUE_REQUIRED, "<authority>", nullptr, nullptr, -1, nullptr,
797 "Unsupported - Specifies the signing authority of the certificate, which must be set to "
798 "either commercial "
799 "(for certificates used by commercial software publishers) or individual (for "
800 "certificates "
801 "used by individual software publishers)." },
802
803 /* Extended Options */
804
805 { "a", COMMAND_LINE_VALUE_REQUIRED, "<algorithm>", nullptr, nullptr, -1, nullptr,
806 "Specifies the signature algorithm. algorithm must be md5, sha1, sha256 (the default), "
807 "sha384, or sha512." },
808 { "b", COMMAND_LINE_VALUE_REQUIRED, "<mm/dd/yyyy>", nullptr, nullptr, -1, nullptr,
809 "Unsupported - Specifies the start of the validity period. Defaults to the current "
810 "date." },
811 { "crl", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
812 "Unsupported - Generates a certificate relocation list (CRL) instead of a certificate." },
813 { "cy", COMMAND_LINE_VALUE_REQUIRED, "<certType>", nullptr, nullptr, -1, nullptr,
814 "Unsupported - Specifies the certificate type. Valid values are end for end-entity and "
815 "authority for certification authority." },
816 { "e", COMMAND_LINE_VALUE_REQUIRED, "<mm/dd/yyyy>", nullptr, nullptr, -1, nullptr,
817 "Unsupported - Specifies the end of the validity period. Defaults to 12/31/2039 11:59:59 "
818 "GMT." },
819 { "eku", COMMAND_LINE_VALUE_REQUIRED, "<oid[,oid…]>", nullptr, nullptr, -1, nullptr,
820 "Unsupported - Inserts a list of comma-separated, enhanced key usage object identifiers "
821 "(OIDs) into the certificate." },
822 { "h", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
823 "Unsupported - Specifies the maximum height of the tree below this certificate." },
824 { "ic", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
825 "Unsupported - Specifies the issuer's certificate file." },
826 { "ik", COMMAND_LINE_VALUE_REQUIRED, "<keyName>", nullptr, nullptr, -1, nullptr,
827 "Unsupported - Specifies the issuer's key container name." },
828 { "iky", COMMAND_LINE_VALUE_REQUIRED, "<keyType>", nullptr, nullptr, -1, nullptr,
829 "Unsupported - Specifies the issuer's key type, which must be one of the following: "
830 "signature (which indicates that the key is used for a digital signature), "
831 "exchange (which indicates that the key is used for key encryption and key exchange), "
832 "or an integer that represents a provider type. "
833 "By default, you can pass 1 for an exchange key or 2 for a signature key." },
834 { "in", COMMAND_LINE_VALUE_REQUIRED, "<name>", nullptr, nullptr, -1, nullptr,
835 "Unsupported - Specifies the issuer's certificate common name." },
836 { "ip", COMMAND_LINE_VALUE_REQUIRED, "<provider>", nullptr, nullptr, -1, nullptr,
837 "Unsupported - Specifies the issuer's CryptoAPI provider name. For information about the "
838 "CryptoAPI provider name, see the –sp option." },
839 { "ir", COMMAND_LINE_VALUE_REQUIRED, "<location>", nullptr, nullptr, -1, nullptr,
840 "Unsupported - Specifies the location of the issuer's certificate store. location can be "
841 "either currentuser (the default) or localmachine." },
842 { "is", COMMAND_LINE_VALUE_REQUIRED, "<store>", nullptr, nullptr, -1, nullptr,
843 "Unsupported - Specifies the issuer's certificate store name." },
844 { "iv", COMMAND_LINE_VALUE_REQUIRED, "<pvkFile>", nullptr, nullptr, -1, nullptr,
845 "Unsupported - Specifies the issuer's .pvk private key file." },
846 { "iy", COMMAND_LINE_VALUE_REQUIRED, "<type>", nullptr, nullptr, -1, nullptr,
847 "Unsupported - Specifies the issuer's CryptoAPI provider type. For information about the "
848 "CryptoAPI provider type, see the –sy option." },
849 { "l", COMMAND_LINE_VALUE_REQUIRED, "<link>", nullptr, nullptr, -1, nullptr,
850 "Unsupported - Links to policy information (for example, to a URL)." },
851 { "len", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
852 "Specifies the generated key length, in bits." },
853 { "m", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
854 "Specifies the duration, in months, of the certificate validity period." },
855 { "y", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
856 "Specifies the duration, in years, of the certificate validity period." },
857 { "nscp", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
858 "Unsupported - Includes the Netscape client-authorization extension." },
859 { "r", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
860 "Unsupported - Creates a self-signed certificate." },
861 { "sc", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
862 "Unsupported - Specifies the subject's certificate file." },
863 { "sky", COMMAND_LINE_VALUE_REQUIRED, "<keyType>", nullptr, nullptr, -1, nullptr,
864 "Unsupported - Specifies the subject's key type, which must be one of the following: "
865 "signature (which indicates that the key is used for a digital signature), "
866 "exchange (which indicates that the key is used for key encryption and key exchange), "
867 "or an integer that represents a provider type. "
868 "By default, you can pass 1 for an exchange key or 2 for a signature key." },
869 { "sp", COMMAND_LINE_VALUE_REQUIRED, "<provider>", nullptr, nullptr, -1, nullptr,
870 "Unsupported - Specifies the subject's CryptoAPI provider name, which must be defined in "
871 "the "
872 "registry subkeys of "
873 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider. If both –sp "
874 "and "
875 "–sy are present, "
876 "the type of the CryptoAPI provider must correspond to the Type value of the provider's "
877 "subkey." },
878 { "sv", COMMAND_LINE_VALUE_REQUIRED, "<pvkFile>", nullptr, nullptr, -1, nullptr,
879 "Unsupported - Specifies the subject's .pvk private key file. The file is created if "
880 "none "
881 "exists." },
882 { "sy", COMMAND_LINE_VALUE_REQUIRED, "<type>", nullptr, nullptr, -1, nullptr,
883 "Unsupported - Specifies the subject's CryptoAPI provider type, which must be defined in "
884 "the "
885 "registry subkeys of "
886 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types. If "
887 "both "
888 "–sy and –sp are present, "
889 "the name of the CryptoAPI provider must correspond to the Name value of the provider "
890 "type "
891 "subkey." },
892 { "tbs", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
893 "Unsupported - Specifies the certificate or CRL file to be signed." },
894
895 /* Help */
896
897 { "?", COMMAND_LINE_VALUE_FLAG | COMMAND_LINE_PRINT_HELP, nullptr, nullptr, nullptr, -1,
898 "help", "print help" },
899 { "!", COMMAND_LINE_VALUE_FLAG | COMMAND_LINE_PRINT_HELP, nullptr, nullptr, nullptr, -1,
900 "help-ext", "print extended help" },
901 { nullptr, 0, nullptr, nullptr, nullptr, -1, nullptr, nullptr }
902 };
903#ifdef WITH_OPENSSL
904 size_t length = 0;
905 char* entry = nullptr;
906 int key_length = 0;
907 long serial = 0;
908 X509_NAME* name = nullptr;
909 const EVP_MD* md = nullptr;
910 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
911 int ret = 0;
912 ret = makecert_context_parse_arguments(context, args, argc, argv);
913
914 if (ret < 1)
915 {
916 return ret;
917 }
918
919 if (!context->default_name && !context->common_name)
920 {
921 context->default_name = x509_get_default_name();
922
923 if (!context->default_name)
924 return -1;
925 }
926 else
927 {
928 context->default_name = _strdup(context->common_name);
929
930 if (!context->default_name)
931 return -1;
932 }
933
934 if (!context->common_name)
935 {
936 context->common_name = _strdup(context->default_name);
937
938 if (!context->common_name)
939 return -1;
940 }
941
942 if (!context->pkey)
943 context->pkey = EVP_PKEY_new();
944
945 if (!context->pkey)
946 return -1;
947
948 if (!context->x509)
949 context->x509 = X509_new();
950
951 if (!context->x509)
952 return -1;
953
954 key_length = 2048;
955 arg = CommandLineFindArgumentA(args, "len");
956
957 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
958 {
959 unsigned long val = strtoul(arg->Value, nullptr, 0);
960
961 if ((errno != 0) || (val > INT_MAX))
962 return -1;
963 key_length = (int)val;
964 }
965
966 if (!makecert_create_rsa(&context->pkey, WINPR_ASSERTING_INT_CAST(size_t, key_length)))
967 return -1;
968
969 X509_set_version(context->x509, 2);
970 arg = CommandLineFindArgumentA(args, "#");
971
972 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
973 {
974 serial = strtol(arg->Value, nullptr, 0);
975
976 if (errno != 0)
977 return -1;
978 }
979 else
980 serial = (long)GetTickCount64();
981
982 ASN1_INTEGER_set(X509_get_serialNumber(context->x509), serial);
983 {
984 ASN1_TIME* before = nullptr;
985 ASN1_TIME* after = nullptr;
986#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
987 before = X509_get_notBefore(context->x509);
988 after = X509_get_notAfter(context->x509);
989#else
990 before = X509_getm_notBefore(context->x509);
991 after = X509_getm_notAfter(context->x509);
992#endif
993 X509_gmtime_adj(before, 0);
994
995 long duration = context->duration_months * 31l + context->duration_years * 365l;
996 duration *= 60l * 60l * 24l;
997 X509_gmtime_adj(after, duration);
998 }
999 X509_set_pubkey(context->x509, context->pkey);
1000 name = X509_get_subject_name(context->x509);
1001 arg = CommandLineFindArgumentA(args, "n");
1002
1003 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
1004 {
1005 entry = x509_name_parse(arg->Value, "C", &length);
1006
1007 if (entry)
1008 X509_NAME_add_entry_by_txt(name, "C", MBSTRING_UTF8, (const unsigned char*)entry,
1009 (int)length, -1, 0);
1010
1011 entry = x509_name_parse(arg->Value, "ST", &length);
1012
1013 if (entry)
1014 X509_NAME_add_entry_by_txt(name, "ST", MBSTRING_UTF8, (const unsigned char*)entry,
1015 (int)length, -1, 0);
1016
1017 entry = x509_name_parse(arg->Value, "L", &length);
1018
1019 if (entry)
1020 X509_NAME_add_entry_by_txt(name, "L", MBSTRING_UTF8, (const unsigned char*)entry,
1021 (int)length, -1, 0);
1022
1023 entry = x509_name_parse(arg->Value, "O", &length);
1024
1025 if (entry)
1026 X509_NAME_add_entry_by_txt(name, "O", MBSTRING_UTF8, (const unsigned char*)entry,
1027 (int)length, -1, 0);
1028
1029 entry = x509_name_parse(arg->Value, "OU", &length);
1030
1031 if (entry)
1032 X509_NAME_add_entry_by_txt(name, "OU", MBSTRING_UTF8, (const unsigned char*)entry,
1033 (int)length, -1, 0);
1034
1035 entry = context->common_name;
1036 length = strlen(entry);
1037 X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_UTF8, (const unsigned char*)entry,
1038 (int)length, -1, 0);
1039 }
1040 else
1041 {
1042 entry = context->common_name;
1043 length = strlen(entry);
1044 X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_UTF8, (const unsigned char*)entry,
1045 (int)length, -1, 0);
1046 }
1047
1048 X509_set_issuer_name(context->x509, name);
1049 x509_add_ext(context->x509, NID_ext_key_usage, "serverAuth");
1050 arg = CommandLineFindArgumentA(args, "a");
1051 md = EVP_sha256();
1052
1053 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
1054 {
1055 md = EVP_get_digestbyname(arg->Value);
1056 if (!md)
1057 return -1;
1058 }
1059
1060 if (!X509_sign(context->x509, context->pkey, md))
1061 return -1;
1062
1067 if (!context->silent)
1068 {
1069 BIO* bio = nullptr;
1070 int status = 0;
1071 char* x509_str = nullptr;
1072 bio = BIO_new(BIO_s_mem());
1073
1074 if (!bio)
1075 return -1;
1076
1077 status = X509_print(bio, context->x509);
1078
1079 if (status < 0)
1080 {
1081 BIO_free_all(bio);
1082 return -1;
1083 }
1084
1085 x509_str = makecert_read_str(bio, nullptr);
1086 if (!x509_str)
1087 {
1088 BIO_free_all(bio);
1089 return -1;
1090 }
1091
1092 printf("%s", x509_str);
1093 free(x509_str);
1094 BIO_free_all(bio);
1095 }
1096
1101 if (!context->live)
1102 {
1103 if (!winpr_PathFileExists(context->output_path))
1104 {
1105 if (!winpr_PathMakePath(context->output_path, nullptr))
1106 return -1;
1107 }
1108
1109 if (makecert_context_output_certificate_file(context, context->output_path) != 1)
1110 return -1;
1111
1112 if (context->crtFormat)
1113 {
1114 if (makecert_context_output_private_key_file(context, context->output_path) < 0)
1115 return -1;
1116 }
1117 }
1118
1119 return 0;
1120#else
1121 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
1122 return -1;
1123#endif
1124}
1125
1126MAKECERT_CONTEXT* makecert_context_new(void)
1127{
1128 MAKECERT_CONTEXT* context = (MAKECERT_CONTEXT*)calloc(1, sizeof(MAKECERT_CONTEXT));
1129
1130 if (context)
1131 {
1132 context->crtFormat = TRUE;
1133 context->duration_years = 1;
1134 }
1135
1136 return context;
1137}
1138
1139void makecert_context_free(MAKECERT_CONTEXT* context)
1140{
1141 if (context)
1142 {
1143 free(context->password);
1144 free(context->default_name);
1145 free(context->common_name);
1146 free(context->output_file);
1147 free(context->output_path);
1148#ifdef WITH_OPENSSL
1149 X509_free(context->x509);
1150 EVP_PKEY_free(context->pkey);
1151#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
1152 CRYPTO_cleanup_all_ex_data();
1153#endif
1154#endif
1155 free(context);
1156 }
1157}
COMMAND_LINE_ARGUMENT_A
Definition winpr/include/winpr/cmdline.h:100