FreeRDP
Loading...
Searching...
No Matches
makecert.c
1
20#include <errno.h>
21
22#include <winpr/assert.h>
23#include <winpr/crt.h>
24#include <winpr/path.h>
25#include <winpr/file.h>
26#include <winpr/cmdline.h>
27#include <winpr/sysinfo.h>
28#include <winpr/crypto.h>
29#include <winpr/print.h>
30
31#ifdef WITH_OPENSSL
32#include <openssl/crypto.h>
33#include <openssl/conf.h>
34#include <openssl/pem.h>
35#include <openssl/err.h>
36#include <openssl/rsa.h>
37#include <openssl/pkcs12.h>
38#include <openssl/x509v3.h>
39#include <openssl/bn.h>
40#endif
41
42#include <winpr/tools/makecert.h>
43
44#if !defined(_WIN32)
45#include <sys/stat.h>
46#endif
47
48struct S_MAKECERT_CONTEXT
49{
50 int argc;
51 char** argv;
52
53#ifdef WITH_OPENSSL
54 X509* x509;
55 EVP_PKEY* pkey;
56 PKCS12* pkcs12;
57#endif
58
59 BOOL live;
60 BOOL silent;
61
62 BOOL crtFormat;
63 BOOL pemFormat;
64 BOOL pfxFormat;
65
66 char* password;
67
68 char* output_file;
69 char* output_path;
70 char* default_name;
71 char* common_name;
72
73 int duration_years;
74 int duration_months;
75};
76
77WINPR_ATTR_NODISCARD
78static BOOL utils_set_umask(void)
79{
80#if !defined(_WIN32)
81 (void)umask(S_IRWXG | S_IRWXO);
82#endif
83 return TRUE;
84}
85
86WINPR_ATTR_MALLOC(winpr_zfree, 1)
87static char* makecert_read_str(BIO* bio, size_t* pOffset)
88{
89 int status = -1;
90 size_t offset = 0;
91 size_t length = 0;
92 char* x509_str = nullptr;
93
94 while (offset >= length)
95 {
96 size_t readBytes = 0;
97 char* new_str = nullptr;
98 size_t new_len = length + 2048ull;
99
100 if (new_len > INT_MAX)
101 {
102 status = -1;
103 break;
104 }
105
106 new_str = (char*)realloc(x509_str, new_len);
107
108 if (!new_str)
109 {
110 status = -1;
111 break;
112 }
113
114 length = new_len;
115 x509_str = new_str;
116 ERR_clear_error();
117#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
118 status = BIO_read_ex(bio, &x509_str[offset], length - offset, &readBytes);
119#else
120 status = BIO_read(bio, &x509_str[offset], length - offset);
121 readBytes = status;
122#endif
123 if (status <= 0)
124 break;
125
126 offset += readBytes;
127 }
128
129 if (status < 0)
130 {
131 free(x509_str);
132 if (pOffset)
133 *pOffset = 0;
134 return nullptr;
135 }
136
137 x509_str[offset] = '\0';
138 if (pOffset)
139 *pOffset = offset + 1;
140 return x509_str;
141}
142
143static int makecert_print_command_line_help(COMMAND_LINE_ARGUMENT_A* args, int argc, char** argv)
144{
145 char* str = nullptr;
146 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
147
148 if (!argv || (argc < 1))
149 return -1;
150
151 printf("Usage: %s [options] [output file]\n", argv[0]);
152 printf("\n");
153 arg = args;
154
155 do
156 {
157 if (arg->Flags & COMMAND_LINE_VALUE_FLAG)
158 {
159 printf(" %s", "-");
160 printf("%-20s", arg->Name);
161 printf("\t%s\n", arg->Text);
162 }
163 else if ((arg->Flags & COMMAND_LINE_VALUE_REQUIRED) ||
164 (arg->Flags & COMMAND_LINE_VALUE_OPTIONAL))
165 {
166 printf(" %s", "-");
167
168 if (arg->Format)
169 {
170 size_t length = strlen(arg->Name) + strlen(arg->Format) + 2;
171 str = malloc(length + 1);
172
173 if (!str)
174 return -1;
175
176 (void)sprintf_s(str, length + 1, "%s %s", arg->Name, arg->Format);
177 (void)printf("%-20s", str);
178 free(str);
179 }
180 else
181 {
182 printf("%-20s", arg->Name);
183 }
184
185 printf("\t%s\n", arg->Text);
186 }
187 } while ((arg = CommandLineFindNextArgumentA(arg)) != nullptr);
188
189 return 1;
190}
191
192#ifdef WITH_OPENSSL
193WINPR_ATTR_NODISCARD
194static int x509_add_ext(X509* cert, int nid, char* value)
195{
196 X509V3_CTX ctx;
197 X509_EXTENSION* ext = nullptr;
198
199 if (!cert || !value)
200 return 0;
201
202 X509V3_set_ctx_nodb(&ctx) X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);
203 ext = X509V3_EXT_conf_nid(nullptr, &ctx, nid, value);
204
205 if (!ext)
206 return 0;
207
208 X509_add_ext(cert, ext, -1);
209 X509_EXTENSION_free(ext);
210 return 1;
211}
212#endif
213
214WINPR_ATTR_NODISCARD
215static char* x509_name_parse(char* name, char* txt, size_t* length)
216{
217 char* p = nullptr;
218 char* entry = nullptr;
219
220 if (!name || !txt || !length)
221 return nullptr;
222
223 p = strstr(name, txt);
224
225 if (!p)
226 return nullptr;
227
228 entry = p + strlen(txt) + 1;
229 p = strchr(entry, '=');
230
231 if (!p)
232 *length = strlen(entry);
233 else
234 *length = (size_t)(p - entry);
235
236 return entry;
237}
238
239WINPR_ATTR_MALLOC(free, 1)
240static char* get_name(COMPUTER_NAME_FORMAT type)
241{
242 DWORD nSize = 0;
243
244 if (GetComputerNameExA(type, nullptr, &nSize))
245 return nullptr;
246
247 if (GetLastError() != ERROR_MORE_DATA)
248 return nullptr;
249
250 char* computerName = calloc(1, nSize);
251
252 if (!computerName)
253 return nullptr;
254
255 if (!GetComputerNameExA(type, computerName, &nSize))
256 {
257 free(computerName);
258 return nullptr;
259 }
260
261 return computerName;
262}
263
264WINPR_ATTR_MALLOC(free, 1)
265static char* x509_get_default_name(void)
266{
267 char* computerName = get_name(ComputerNamePhysicalDnsFullyQualified);
268 if (!computerName)
269 computerName = get_name(ComputerNamePhysicalNetBIOS);
270 return computerName;
271}
272
273WINPR_ATTR_NODISCARD
274static int command_line_pre_filter(void* pvctx, int index, int argc, LPSTR* argv)
275{
276 MAKECERT_CONTEXT* context = pvctx;
277 if (!context || !argv || (index < 0) || (argc < 0))
278 return -1;
279
280 if (index == (argc - 1))
281 {
282 if (argv[index][0] != '-')
283 {
284 context->output_file = _strdup(argv[index]);
285
286 if (!context->output_file)
287 return -1;
288
289 return 1;
290 }
291 }
292
293 return 0;
294}
295
296WINPR_ATTR_NODISCARD
297static int makecert_context_parse_arguments(MAKECERT_CONTEXT* context,
298 COMMAND_LINE_ARGUMENT_A* args, int argc, char** argv)
299{
300 int status = 0;
301 DWORD flags = 0;
302 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
303
304 if (!context || !argv || (argc < 0))
305 return -1;
306
311 CommandLineClearArgumentsA(args);
312 flags = COMMAND_LINE_SEPARATOR_SPACE | COMMAND_LINE_SIGIL_DASH;
313 status = CommandLineParseArgumentsA(argc, argv, args, flags, context, command_line_pre_filter,
314 nullptr);
315
316 if (status & COMMAND_LINE_STATUS_PRINT_HELP)
317 {
318 makecert_print_command_line_help(args, argc, argv);
319 return 0;
320 }
321
322 arg = args;
323 errno = 0;
324
325 do
326 {
327 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
328 continue;
329
330 CommandLineSwitchStart(arg)
331 /* Basic Options */
332 CommandLineSwitchCase(arg, "silent")
333 {
334 context->silent = TRUE;
335 }
336 CommandLineSwitchCase(arg, "live")
337 {
338 context->live = TRUE;
339 }
340 CommandLineSwitchCase(arg, "format")
341 {
342 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
343 continue;
344
345 if (strcmp(arg->Value, "crt") == 0)
346 {
347 context->crtFormat = TRUE;
348 context->pemFormat = FALSE;
349 context->pfxFormat = FALSE;
350 }
351 else if (strcmp(arg->Value, "pem") == 0)
352 {
353 context->crtFormat = FALSE;
354 context->pemFormat = TRUE;
355 context->pfxFormat = FALSE;
356 }
357 else if (strcmp(arg->Value, "pfx") == 0)
358 {
359 context->crtFormat = FALSE;
360 context->pemFormat = FALSE;
361 context->pfxFormat = TRUE;
362 }
363 else
364 return -1;
365 }
366 CommandLineSwitchCase(arg, "path")
367 {
368 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
369 continue;
370
371 context->output_path = _strdup(arg->Value);
372
373 if (!context->output_path)
374 return -1;
375 }
376 CommandLineSwitchCase(arg, "p")
377 {
378 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
379 continue;
380
381 context->password = _strdup(arg->Value);
382
383 if (!context->password)
384 return -1;
385 }
386 CommandLineSwitchCase(arg, "n")
387 {
388 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
389 continue;
390
391 context->common_name = _strdup(arg->Value);
392
393 if (!context->common_name)
394 return -1;
395 }
396 CommandLineSwitchCase(arg, "y")
397 {
398 long val = 0;
399
400 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
401 continue;
402
403 val = strtol(arg->Value, nullptr, 0);
404
405 if ((errno != 0) || (val < 0) || (val > INT32_MAX))
406 return -1;
407
408 context->duration_years = (int)val;
409 }
410 CommandLineSwitchCase(arg, "m")
411 {
412 long val = 0;
413
414 if (!(arg->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
415 continue;
416
417 val = strtol(arg->Value, nullptr, 0);
418
419 if ((errno != 0) || (val < 0))
420 return -1;
421
422 context->duration_months = (int)val;
423 }
424 CommandLineSwitchDefault(arg)
425 {
426 }
427 CommandLineSwitchEnd(arg)
428 } while ((arg = CommandLineFindNextArgumentA(arg)) != nullptr);
429
430 return 1;
431}
432
433int makecert_context_set_output_file_name(MAKECERT_CONTEXT* context, const char* name)
434{
435 if (!context)
436 return -1;
437
438 free(context->output_file);
439 context->output_file = nullptr;
440
441 if (name)
442 context->output_file = _strdup(name);
443
444 if (!context->output_file)
445 return -1;
446
447 return 1;
448}
449
450int makecert_context_output_certificate_file(MAKECERT_CONTEXT* context, const char* path)
451{
452#ifdef WITH_OPENSSL
453 FILE* fp = nullptr;
454 int status = 0;
455 size_t offset = 0;
456 char* fullpath = nullptr;
457 char* ext = nullptr;
458 int ret = -1;
459 BIO* bio = nullptr;
460 char* x509_str = nullptr;
461
462 if (!context)
463 return -1;
464
465 if (!context->output_file)
466 {
467 context->output_file = _strdup(context->default_name);
468
469 if (!context->output_file)
470 return -1;
471 }
472
473 /*
474 * Output Certificate File
475 */
476 size_t length = strlen(context->output_file);
477 char* filename = malloc(length + 8);
478
479 if (!filename)
480 return -1;
481
482 if (context->crtFormat)
483 ext = "crt";
484 else if (context->pemFormat)
485 ext = "pem";
486 else if (context->pfxFormat)
487 ext = "pfx";
488 else
489 goto out_fail;
490
491 (void)sprintf_s(filename, length + 8, "%s.%s", context->output_file, ext);
492
493 if (path)
494 fullpath = GetCombinedPath(path, filename);
495 else
496 fullpath = _strdup(filename);
497
498 if (!fullpath)
499 goto out_fail;
500
501 fp = winpr_fopen(fullpath, "w+");
502
503 if (fp)
504 {
505 if (context->pfxFormat)
506 {
507 if (!context->password)
508 {
509 BYTE random[32] = WINPR_C_ARRAY_INIT;
510 if (winpr_RAND(random, sizeof(random)) < 0)
511 goto out_fail;
512
513 context->password = winpr_BinToHexString(random, sizeof(random), FALSE);
514
515 if (!context->password)
516 goto out_fail;
517
518 printf("Using random export password \"%s\"\n", context->password);
519 }
520
521#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
522 OpenSSL_add_all_algorithms();
523 OpenSSL_add_all_ciphers();
524 OpenSSL_add_all_digests();
525#else
526 if (OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS |
527 OPENSSL_INIT_LOAD_CONFIG,
528 nullptr) != 1)
529 goto out_fail;
530#endif
531 context->pkcs12 = PKCS12_create(context->password, context->default_name, context->pkey,
532 context->x509, nullptr, 0, 0, 0, 0, 0);
533
534 if (!context->pkcs12)
535 goto out_fail;
536
537 bio = BIO_new(BIO_s_mem());
538
539 if (!bio)
540 goto out_fail;
541
542 status = i2d_PKCS12_bio(bio, context->pkcs12);
543
544 if (status != 1)
545 goto out_fail;
546
547 x509_str = makecert_read_str(bio, &offset);
548
549 if (!x509_str)
550 goto out_fail;
551
552 length = offset;
553
554 if (fwrite((void*)x509_str, length, 1, fp) != 1)
555 goto out_fail;
556 }
557 else
558 {
559 bio = BIO_new(BIO_s_mem());
560
561 if (!bio)
562 goto out_fail;
563
564 if (!PEM_write_bio_X509(bio, context->x509))
565 goto out_fail;
566
567 x509_str = makecert_read_str(bio, &offset);
568
569 if (!x509_str)
570 goto out_fail;
571
572 length = offset;
573
574 if (fwrite(x509_str, length, 1, fp) != 1)
575 goto out_fail;
576
577 free(x509_str);
578 x509_str = nullptr;
579 BIO_free_all(bio);
580 bio = nullptr;
581
582 if (context->pemFormat)
583 {
584 bio = BIO_new(BIO_s_mem());
585
586 if (!bio)
587 goto out_fail;
588
589 status = PEM_write_bio_PrivateKey(bio, context->pkey, nullptr, nullptr, 0, nullptr,
590 nullptr);
591
592 if (status < 0)
593 goto out_fail;
594
595 x509_str = makecert_read_str(bio, &offset);
596 if (!x509_str)
597 goto out_fail;
598
599 length = offset;
600
601 if (fwrite(x509_str, length, 1, fp) != 1)
602 goto out_fail;
603 }
604 }
605 }
606
607 ret = 1;
608out_fail:
609 BIO_free_all(bio);
610
611 if (fp)
612 (void)fclose(fp);
613
614 free(x509_str);
615 free(filename);
616 free(fullpath);
617 return ret;
618#else
619 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
620 return -1;
621#endif
622}
623
624int makecert_context_output_private_key_file(MAKECERT_CONTEXT* context, const char* path)
625{
626#ifdef WITH_OPENSSL
627 FILE* fp = nullptr;
628 size_t length = 0;
629 size_t offset = 0;
630 char* filename = nullptr;
631 char* fullpath = nullptr;
632 int ret = -1;
633 BIO* bio = nullptr;
634 char* x509_str = nullptr;
635
636 if (!context->crtFormat)
637 return 1;
638
639 if (!context->output_file)
640 {
641 context->output_file = _strdup(context->default_name);
642
643 if (!context->output_file)
644 return -1;
645 }
646
650 length = strlen(context->output_file);
651 filename = malloc(length + 8);
652
653 if (!filename)
654 return -1;
655
656 (void)sprintf_s(filename, length + 8, "%s.key", context->output_file);
657
658 if (path)
659 fullpath = GetCombinedPath(path, filename);
660 else
661 fullpath = _strdup(filename);
662
663 if (!fullpath)
664 goto out_fail;
665
666 fp = winpr_fopen(fullpath, "w+");
667
668 if (!fp)
669 goto out_fail;
670
671 bio = BIO_new(BIO_s_mem());
672
673 if (!bio)
674 goto out_fail;
675
676 if (!PEM_write_bio_PrivateKey(bio, context->pkey, nullptr, nullptr, 0, nullptr, nullptr))
677 goto out_fail;
678
679 x509_str = makecert_read_str(bio, &offset);
680
681 if (!x509_str)
682 goto out_fail;
683
684 length = offset;
685
686 if (fwrite((void*)x509_str, length, 1, fp) != 1)
687 goto out_fail;
688
689 ret = 1;
690out_fail:
691
692 if (fp)
693 (void)fclose(fp);
694
695 BIO_free_all(bio);
696 free(x509_str);
697 free(filename);
698 free(fullpath);
699 return ret;
700#else
701 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
702 return -1;
703#endif
704}
705
706#ifdef WITH_OPENSSL
707WINPR_ATTR_NODISCARD
708static BOOL makecert_create_rsa(EVP_PKEY** ppkey, size_t key_length)
709{
710 BOOL rc = FALSE;
711
712 WINPR_ASSERT(ppkey);
713
714#if !defined(OPENSSL_VERSION_MAJOR) || (OPENSSL_VERSION_MAJOR < 3)
715 RSA* rsa = nullptr;
716#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
717 rsa = RSA_generate_key(key_length, RSA_F4, nullptr, nullptr);
718#else
719 {
720 BIGNUM* bn = BN_secure_new();
721
722 if (!bn)
723 return FALSE;
724
725 rsa = RSA_new();
726
727 if (!rsa)
728 {
729 BN_clear_free(bn);
730 return FALSE;
731 }
732
733 BN_set_word(bn, RSA_F4);
734 const int res = RSA_generate_key_ex(rsa, key_length, bn, nullptr);
735 BN_clear_free(bn);
736
737 if (res != 1)
738 return FALSE;
739 }
740#endif
741
742 if (!EVP_PKEY_assign_RSA(*ppkey, rsa))
743 {
744 RSA_free(rsa);
745 return FALSE;
746 }
747 rc = TRUE;
748#else
749 EVP_PKEY_CTX* pctx = EVP_PKEY_CTX_new_from_name(nullptr, "RSA", nullptr);
750 if (!pctx)
751 return FALSE;
752
753 if (EVP_PKEY_keygen_init(pctx) != 1)
754 goto fail;
755
756 {
757 WINPR_ASSERT(key_length <= UINT_MAX);
758 unsigned int keylen = (unsigned int)key_length;
759 const OSSL_PARAM params[] = { OSSL_PARAM_construct_uint("bits", &keylen),
760 OSSL_PARAM_construct_end() };
761 if (EVP_PKEY_CTX_set_params(pctx, params) != 1)
762 goto fail;
763 }
764
765 if (EVP_PKEY_generate(pctx, ppkey) != 1)
766 goto fail;
767
768 rc = TRUE;
769fail:
770 EVP_PKEY_CTX_free(pctx);
771#endif
772 return rc;
773}
774#endif
775
776int makecert_context_process(MAKECERT_CONTEXT* context, int argc, char** argv)
777{
778 COMMAND_LINE_ARGUMENT_A args[] = {
779 /* Custom Options */
780
781 { "rdp", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
782 "Unsupported - Generate certificate with required options for RDP usage." },
783 { "silent", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
784 "Silently generate certificate without verbose output." },
785 { "live", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
786 "Generate certificate live in memory when used as a library." },
787 { "format", COMMAND_LINE_VALUE_REQUIRED, "<crt|pem|pfx>", nullptr, nullptr, -1, nullptr,
788 "Specify certificate file format" },
789 { "path", COMMAND_LINE_VALUE_REQUIRED, "<path>", nullptr, nullptr, -1, nullptr,
790 "Specify certificate file output path" },
791 { "p", COMMAND_LINE_VALUE_REQUIRED, "<password>", nullptr, nullptr, -1, nullptr,
792 "Specify certificate export password" },
793
794 /* Basic Options */
795
796 { "n", COMMAND_LINE_VALUE_REQUIRED, "<name>", nullptr, nullptr, -1, nullptr,
797 "Specifies the subject's certificate name. This name must conform to the X.500 standard. "
798 "The simplest method is to specify the name in double quotes, preceded by CN=; for "
799 "example, "
800 "-n \"CN=myName\"." },
801 { "pe", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
802 "Unsupported - Marks the generated private key as exportable. This allows the private "
803 "key to "
804 "be included in the certificate." },
805 { "sk", COMMAND_LINE_VALUE_REQUIRED, "<keyname>", nullptr, nullptr, -1, nullptr,
806 "Unsupported - Specifies the subject's key container location, which contains the "
807 "private "
808 "key. "
809 "If a key container does not exist, it will be created." },
810 { "sr", COMMAND_LINE_VALUE_REQUIRED, "<location>", nullptr, nullptr, -1, nullptr,
811 "Unsupported - Specifies the subject's certificate store location. location can be "
812 "either "
813 "currentuser (the default) or localmachine." },
814 { "ss", COMMAND_LINE_VALUE_REQUIRED, "<store>", nullptr, nullptr, -1, nullptr,
815 "Unsupported - Specifies the subject's certificate store name that stores the output "
816 "certificate." },
817 { "#", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
818 "Specifies a serial number from 1 to 2,147,483,647. The default is a unique value "
819 "generated "
820 "by Makecert.exe." },
821 { "$", COMMAND_LINE_VALUE_REQUIRED, "<authority>", nullptr, nullptr, -1, nullptr,
822 "Unsupported - Specifies the signing authority of the certificate, which must be set to "
823 "either commercial "
824 "(for certificates used by commercial software publishers) or individual (for "
825 "certificates "
826 "used by individual software publishers)." },
827
828 /* Extended Options */
829
830 { "a", COMMAND_LINE_VALUE_REQUIRED, "<algorithm>", nullptr, nullptr, -1, nullptr,
831 "Specifies the signature algorithm. algorithm must be md5, sha1, sha256 (the default), "
832 "sha384, or sha512." },
833 { "b", COMMAND_LINE_VALUE_REQUIRED, "<mm/dd/yyyy>", nullptr, nullptr, -1, nullptr,
834 "Unsupported - Specifies the start of the validity period. Defaults to the current "
835 "date." },
836 { "crl", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
837 "Unsupported - Generates a certificate relocation list (CRL) instead of a certificate." },
838 { "cy", COMMAND_LINE_VALUE_REQUIRED, "<certType>", nullptr, nullptr, -1, nullptr,
839 "Unsupported - Specifies the certificate type. Valid values are end for end-entity and "
840 "authority for certification authority." },
841 { "e", COMMAND_LINE_VALUE_REQUIRED, "<mm/dd/yyyy>", nullptr, nullptr, -1, nullptr,
842 "Unsupported - Specifies the end of the validity period. Defaults to 12/31/2039 11:59:59 "
843 "GMT." },
844 { "eku", COMMAND_LINE_VALUE_REQUIRED, "<oid[,oid…]>", nullptr, nullptr, -1, nullptr,
845 "Unsupported - Inserts a list of comma-separated, enhanced key usage object identifiers "
846 "(OIDs) into the certificate." },
847 { "h", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
848 "Unsupported - Specifies the maximum height of the tree below this certificate." },
849 { "ic", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
850 "Unsupported - Specifies the issuer's certificate file." },
851 { "ik", COMMAND_LINE_VALUE_REQUIRED, "<keyName>", nullptr, nullptr, -1, nullptr,
852 "Unsupported - Specifies the issuer's key container name." },
853 { "iky", COMMAND_LINE_VALUE_REQUIRED, "<keyType>", nullptr, nullptr, -1, nullptr,
854 "Unsupported - Specifies the issuer's key type, which must be one of the following: "
855 "signature (which indicates that the key is used for a digital signature), "
856 "exchange (which indicates that the key is used for key encryption and key exchange), "
857 "or an integer that represents a provider type. "
858 "By default, you can pass 1 for an exchange key or 2 for a signature key." },
859 { "in", COMMAND_LINE_VALUE_REQUIRED, "<name>", nullptr, nullptr, -1, nullptr,
860 "Unsupported - Specifies the issuer's certificate common name." },
861 { "ip", COMMAND_LINE_VALUE_REQUIRED, "<provider>", nullptr, nullptr, -1, nullptr,
862 "Unsupported - Specifies the issuer's CryptoAPI provider name. For information about the "
863 "CryptoAPI provider name, see the –sp option." },
864 { "ir", COMMAND_LINE_VALUE_REQUIRED, "<location>", nullptr, nullptr, -1, nullptr,
865 "Unsupported - Specifies the location of the issuer's certificate store. location can be "
866 "either currentuser (the default) or localmachine." },
867 { "is", COMMAND_LINE_VALUE_REQUIRED, "<store>", nullptr, nullptr, -1, nullptr,
868 "Unsupported - Specifies the issuer's certificate store name." },
869 { "iv", COMMAND_LINE_VALUE_REQUIRED, "<pvkFile>", nullptr, nullptr, -1, nullptr,
870 "Unsupported - Specifies the issuer's .pvk private key file." },
871 { "iy", COMMAND_LINE_VALUE_REQUIRED, "<type>", nullptr, nullptr, -1, nullptr,
872 "Unsupported - Specifies the issuer's CryptoAPI provider type. For information about the "
873 "CryptoAPI provider type, see the –sy option." },
874 { "l", COMMAND_LINE_VALUE_REQUIRED, "<link>", nullptr, nullptr, -1, nullptr,
875 "Unsupported - Links to policy information (for example, to a URL)." },
876 { "len", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
877 "Specifies the generated key length, in bits." },
878 { "m", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
879 "Specifies the duration, in months, of the certificate validity period." },
880 { "y", COMMAND_LINE_VALUE_REQUIRED, "<number>", nullptr, nullptr, -1, nullptr,
881 "Specifies the duration, in years, of the certificate validity period." },
882 { "nscp", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
883 "Unsupported - Includes the Netscape client-authorization extension." },
884 { "r", COMMAND_LINE_VALUE_FLAG, nullptr, nullptr, nullptr, -1, nullptr,
885 "Unsupported - Creates a self-signed certificate." },
886 { "sc", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
887 "Unsupported - Specifies the subject's certificate file." },
888 { "sky", COMMAND_LINE_VALUE_REQUIRED, "<keyType>", nullptr, nullptr, -1, nullptr,
889 "Unsupported - Specifies the subject's key type, which must be one of the following: "
890 "signature (which indicates that the key is used for a digital signature), "
891 "exchange (which indicates that the key is used for key encryption and key exchange), "
892 "or an integer that represents a provider type. "
893 "By default, you can pass 1 for an exchange key or 2 for a signature key." },
894 { "sp", COMMAND_LINE_VALUE_REQUIRED, "<provider>", nullptr, nullptr, -1, nullptr,
895 "Unsupported - Specifies the subject's CryptoAPI provider name, which must be defined in "
896 "the "
897 "registry subkeys of "
898 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider. If both –sp "
899 "and "
900 "–sy are present, "
901 "the type of the CryptoAPI provider must correspond to the Type value of the provider's "
902 "subkey." },
903 { "sv", COMMAND_LINE_VALUE_REQUIRED, "<pvkFile>", nullptr, nullptr, -1, nullptr,
904 "Unsupported - Specifies the subject's .pvk private key file. The file is created if "
905 "none "
906 "exists." },
907 { "sy", COMMAND_LINE_VALUE_REQUIRED, "<type>", nullptr, nullptr, -1, nullptr,
908 "Unsupported - Specifies the subject's CryptoAPI provider type, which must be defined in "
909 "the "
910 "registry subkeys of "
911 "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types. If "
912 "both "
913 "–sy and –sp are present, "
914 "the name of the CryptoAPI provider must correspond to the Name value of the provider "
915 "type "
916 "subkey." },
917 { "tbs", COMMAND_LINE_VALUE_REQUIRED, "<file>", nullptr, nullptr, -1, nullptr,
918 "Unsupported - Specifies the certificate or CRL file to be signed." },
919
920 /* Help */
921
922 { "?", COMMAND_LINE_VALUE_FLAG | COMMAND_LINE_PRINT_HELP, nullptr, nullptr, nullptr, -1,
923 "help", "print help" },
924 { "!", COMMAND_LINE_VALUE_FLAG | COMMAND_LINE_PRINT_HELP, nullptr, nullptr, nullptr, -1,
925 "help-ext", "print extended help" },
926 { nullptr, 0, nullptr, nullptr, nullptr, -1, nullptr, nullptr }
927 };
928#ifdef WITH_OPENSSL
929 long serial = 0;
930 X509_NAME* name = nullptr;
931 const EVP_MD* md = nullptr;
932 const COMMAND_LINE_ARGUMENT_A* arg = nullptr;
933 int ret = makecert_context_parse_arguments(context, args, argc, argv);
934
935 if (ret < 1)
936 {
937 return ret;
938 }
939
940 if (!context->default_name && !context->common_name)
941 {
942 context->default_name = x509_get_default_name();
943
944 if (!context->default_name)
945 return -1;
946 }
947 else
948 {
949 context->default_name = _strdup(context->common_name);
950
951 if (!context->default_name)
952 return -1;
953 }
954
955 if (!context->common_name)
956 {
957 context->common_name = _strdup(context->default_name);
958
959 if (!context->common_name)
960 return -1;
961 }
962
963 if (!context->pkey)
964 context->pkey = EVP_PKEY_new();
965
966 if (!context->pkey)
967 return -1;
968
969 if (!context->x509)
970 context->x509 = X509_new();
971
972 if (!context->x509)
973 return -1;
974
975 size_t key_length = 2048;
976 arg = CommandLineFindArgumentA(args, "len");
977
978 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
979 {
980 unsigned long val = strtoul(arg->Value, nullptr, 0);
981
982 if ((errno != 0) || (val > INT_MAX))
983 return -1;
984 key_length = val;
985 }
986
987 if (!makecert_create_rsa(&context->pkey, key_length))
988 return -1;
989
990 if (X509_set_version(context->x509, 2) != 1)
991 return -1;
992
993 arg = CommandLineFindArgumentA(args, "#");
994
995 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
996 {
997 serial = strtol(arg->Value, nullptr, 0);
998
999 if (errno != 0)
1000 return -1;
1001 }
1002 else
1003 serial = (long)GetTickCount64();
1004
1005 if (ASN1_INTEGER_set(X509_get_serialNumber(context->x509), serial) != 1)
1006 return -1;
1007
1008 {
1009 ASN1_TIME* before = nullptr;
1010 ASN1_TIME* after = nullptr;
1011#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
1012 before = X509_get_notBefore(context->x509);
1013 after = X509_get_notAfter(context->x509);
1014#else
1015 before = X509_getm_notBefore(context->x509);
1016 after = X509_getm_notAfter(context->x509);
1017#endif
1018 X509_gmtime_adj(before, 0);
1019
1020 long duration = context->duration_months * 31l + context->duration_years * 365l;
1021 duration *= 60l * 60l * 24l;
1022 X509_gmtime_adj(after, duration);
1023 }
1024 if (X509_set_pubkey(context->x509, context->pkey) != 1)
1025 return -1;
1026
1027 name = X509_get_subject_name(context->x509);
1028 arg = CommandLineFindArgumentA(args, "n");
1029
1030 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
1031 {
1032 size_t length = 0;
1033 char* entry = x509_name_parse(arg->Value, "C", &length);
1034
1035 if (entry)
1036 {
1037 if (length > INT32_MAX)
1038 return -1;
1039 if (X509_NAME_add_entry_by_txt(name, "C", MBSTRING_UTF8, (const unsigned char*)entry,
1040 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1041 return -1;
1042 }
1043
1044 entry = x509_name_parse(arg->Value, "ST", &length);
1045
1046 if (entry)
1047 {
1048 if (length > INT32_MAX)
1049 return -1;
1050 if (X509_NAME_add_entry_by_txt(name, "ST", MBSTRING_UTF8, (const unsigned char*)entry,
1051 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1052 return -1;
1053 }
1054
1055 entry = x509_name_parse(arg->Value, "L", &length);
1056
1057 if (entry)
1058 {
1059 if (length > INT32_MAX)
1060 return -1;
1061 if (X509_NAME_add_entry_by_txt(name, "L", MBSTRING_UTF8, (const unsigned char*)entry,
1062 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1063 return -1;
1064 }
1065
1066 entry = x509_name_parse(arg->Value, "O", &length);
1067
1068 if (entry)
1069 {
1070 if (length > INT32_MAX)
1071 return -1;
1072 if (X509_NAME_add_entry_by_txt(name, "O", MBSTRING_UTF8, (const unsigned char*)entry,
1073 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1074 return -1;
1075 }
1076
1077 entry = x509_name_parse(arg->Value, "OU", &length);
1078
1079 if (entry)
1080 {
1081 if (length > INT32_MAX)
1082 return -1;
1083 if (X509_NAME_add_entry_by_txt(name, "OU", MBSTRING_UTF8, (const unsigned char*)entry,
1084 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1085 return -1;
1086 }
1087
1088 entry = context->common_name;
1089 length = strlen(entry);
1090 if (length > INT32_MAX)
1091 return -1;
1092
1093 if (X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_UTF8, (const unsigned char*)entry,
1094 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1095 return -1;
1096 }
1097 else
1098 {
1099 char* entry = context->common_name;
1100 const size_t length = strlen(entry);
1101 if (length > INT32_MAX)
1102 return -1;
1103 if (X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_UTF8, (const unsigned char*)entry,
1104 WINPR_ASSERTING_INT_CAST(int, length), -1, 0) != 1)
1105 return -1;
1106 }
1107
1108 if (X509_set_issuer_name(context->x509, name) != 1)
1109 return -1;
1110
1111 if (x509_add_ext(context->x509, NID_ext_key_usage, "serverAuth") != 1)
1112 return -1;
1113
1114 arg = CommandLineFindArgumentA(args, "a");
1115 md = EVP_sha256();
1116
1117 if (arg->Flags & COMMAND_LINE_VALUE_PRESENT)
1118 {
1119 md = EVP_get_digestbyname(arg->Value);
1120 if (!md)
1121 return -1;
1122 }
1123
1124 if (!X509_sign(context->x509, context->pkey, md))
1125 return -1;
1126
1131 if (!context->silent)
1132 {
1133 BIO* bio = BIO_new(BIO_s_mem());
1134
1135 if (!bio)
1136 return -1;
1137
1138 const int status = X509_print(bio, context->x509);
1139
1140 if (status < 0)
1141 {
1142 BIO_free_all(bio);
1143 return -1;
1144 }
1145
1146 char* x509_str = makecert_read_str(bio, nullptr);
1147 if (!x509_str)
1148 {
1149 BIO_free_all(bio);
1150 return -1;
1151 }
1152
1153 printf("%s", x509_str);
1154 free(x509_str);
1155 BIO_free_all(bio);
1156 }
1157
1162 if (!context->live)
1163 {
1164 if (!winpr_PathFileExists(context->output_path))
1165 {
1166 if (!winpr_PathMakePath(context->output_path, nullptr))
1167 return -1;
1168 }
1169
1170 if (makecert_context_output_certificate_file(context, context->output_path) != 1)
1171 return -1;
1172
1173 if (context->crtFormat)
1174 {
1175 if (makecert_context_output_private_key_file(context, context->output_path) < 0)
1176 return -1;
1177 }
1178 }
1179
1180 return 0;
1181#else
1182 WLog_ERR(TAG, "%s only supported with OpenSSL", __func__);
1183 return -1;
1184#endif
1185}
1186
1187MAKECERT_CONTEXT* makecert_context_new(void)
1188{
1189 if (!utils_set_umask())
1190 return nullptr;
1191
1192 MAKECERT_CONTEXT* context = (MAKECERT_CONTEXT*)calloc(1, sizeof(MAKECERT_CONTEXT));
1193
1194 if (context)
1195 {
1196 context->crtFormat = TRUE;
1197 context->duration_years = 1;
1198 }
1199
1200 return context;
1201}
1202
1203void makecert_context_free(MAKECERT_CONTEXT* context)
1204{
1205 if (context)
1206 {
1207 winpr_zfree(context->password);
1208 free(context->default_name);
1209 free(context->common_name);
1210 free(context->output_file);
1211 free(context->output_path);
1212#ifdef WITH_OPENSSL
1213 X509_free(context->x509);
1214 EVP_PKEY_free(context->pkey);
1215#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
1216 CRYPTO_cleanup_all_ex_data();
1217#endif
1218#endif
1219 free(context);
1220 }
1221}
COMMAND_LINE_ARGUMENT_A
Definition winpr/include/winpr/cmdline.h:100