2 * px5g - Embedded x509 key and certificate generator based on PolarSSL
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
5 * Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License, version 2.1 as published by the Free Software Foundation.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
22 #include <sys/types.h>
23 #include <sys/random.h>
35 #include <mbedtls/bignum.h>
36 #include <mbedtls/entropy.h>
37 #include <mbedtls/x509_crt.h>
38 #include <mbedtls/ecp.h>
39 #include <mbedtls/rsa.h>
40 #include <mbedtls/pk.h>
42 #define PX5G_VERSION "0.2"
43 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
44 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
46 static char buf
[16384];
48 static int _urandom(void *ctx
, unsigned char *out
, size_t len
)
52 ret
= getrandom(out
, len
, 0);
53 if (ret
< 0 || (size_t)ret
!= len
)
54 return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED
;
59 static void write_file(const char *path
, size_t len
, bool pem
, bool cert
)
61 mode_t mode
= S_IRUSR
| S_IWUSR
;
62 const char *buf_start
= buf
;
63 int fd
= STDERR_FILENO
;
68 buf_start
+= sizeof(buf
) - len
;
71 fprintf(stderr
, "No data to write\n");
76 mode
|= S_IRGRP
| S_IROTH
;
79 fd
= open(path
, O_WRONLY
| O_CREAT
| O_TRUNC
, mode
);
82 fprintf(stderr
, "error: I/O error\n");
86 written
= write(fd
, buf_start
, len
);
88 fprintf(stderr
, "writing key failed with: %s\n", strerror(errno
));
93 fprintf(stderr
, "syncing key failed with: %s\n", strerror(errno
));
100 static mbedtls_ecp_group_id
ecp_curve(const char *name
)
102 const mbedtls_ecp_curve_info
*curve_info
;
104 if (!strcmp(name
, "P-256"))
105 return MBEDTLS_ECP_DP_SECP256R1
;
106 else if (!strcmp(name
, "P-384"))
107 return MBEDTLS_ECP_DP_SECP384R1
;
108 else if (!strcmp(name
, "P-521"))
109 return MBEDTLS_ECP_DP_SECP521R1
;
110 curve_info
= mbedtls_ecp_curve_info_from_name(name
);
111 if (curve_info
== NULL
)
112 return MBEDTLS_ECP_DP_NONE
;
114 return curve_info
->grp_id
;
117 static void write_key(mbedtls_pk_context
*key
, const char *path
, bool pem
)
122 if (mbedtls_pk_write_key_pem(key
, (void *) buf
, sizeof(buf
)) == 0)
125 len
= mbedtls_pk_write_key_der(key
, (void *) buf
, sizeof(buf
));
130 write_file(path
, len
, pem
, false);
133 static void gen_key(mbedtls_pk_context
*key
, bool rsa
, int ksize
, int exp
,
134 mbedtls_ecp_group_id curve
, bool pem
)
136 mbedtls_pk_init(key
);
138 fprintf(stderr
, "Generating RSA private key, %i bit long modulus\n", ksize
);
139 mbedtls_pk_setup(key
, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA
));
140 if (!mbedtls_rsa_gen_key(mbedtls_pk_rsa(*key
), _urandom
, NULL
, ksize
, exp
))
143 fprintf(stderr
, "Generating EC private key\n");
144 mbedtls_pk_setup(key
, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY
));
145 if (!mbedtls_ecp_gen_key(curve
, mbedtls_pk_ec(*key
), _urandom
, NULL
))
148 fprintf(stderr
, "error: key generation failed\n");
152 int dokey(bool rsa
, char **arg
)
154 mbedtls_pk_context key
;
155 unsigned int ksize
= 512;
159 mbedtls_ecp_group_id curve
= MBEDTLS_ECP_DP_SECP256R1
;
161 while (*arg
&& **arg
== '-') {
162 if (!strcmp(*arg
, "-out") && arg
[1]) {
165 } else if (!strcmp(*arg
, "-3")) {
167 } else if (!strcmp(*arg
, "-der")) {
174 ksize
= (unsigned int)atoi(*arg
);
176 curve
= ecp_curve((const char *)*arg
);
177 if (curve
== MBEDTLS_ECP_DP_NONE
) {
178 fprintf(stderr
, "error: invalid curve name: %s\n", *arg
);
183 gen_key(&key
, rsa
, ksize
, exp
, curve
, pem
);
184 write_key(&key
, path
, pem
);
186 mbedtls_pk_free(&key
);
191 int selfsigned(char **arg
)
193 mbedtls_pk_context key
;
194 mbedtls_x509write_cert cert
;
198 unsigned int ksize
= 512;
200 unsigned int days
= 30;
201 char *keypath
= NULL
, *certpath
= NULL
;
203 time_t from
= time(NULL
), to
;
204 char fstr
[20], tstr
[20], sstr
[17];
207 mbedtls_ecp_group_id curve
= MBEDTLS_ECP_DP_SECP256R1
;
209 while (*arg
&& **arg
== '-') {
210 if (!strcmp(*arg
, "-der")) {
212 } else if (!strcmp(*arg
, "-newkey") && arg
[1]) {
213 if (!strncmp(arg
[1], "rsa:", 4)) {
215 ksize
= (unsigned int)atoi(arg
[1] + 4);
216 } else if (!strcmp(arg
[1], "ec")) {
219 fprintf(stderr
, "error: invalid algorithm\n");
223 } else if (!strcmp(*arg
, "-days") && arg
[1]) {
224 days
= (unsigned int)atoi(arg
[1]);
226 } else if (!strcmp(*arg
, "-pkeyopt") && arg
[1]) {
227 if (strncmp(arg
[1], "ec_paramgen_curve:", 18)) {
228 fprintf(stderr
, "error: invalid pkey option: %s\n", arg
[1]);
231 curve
= ecp_curve((const char *)(arg
[1] + 18));
232 if (curve
== MBEDTLS_ECP_DP_NONE
) {
233 fprintf(stderr
, "error: invalid curve name: %s\n", arg
[1] + 18);
237 } else if (!strcmp(*arg
, "-keyout") && arg
[1]) {
240 } else if (!strcmp(*arg
, "-out") && arg
[1]) {
243 } else if (!strcmp(*arg
, "-subj") && arg
[1]) {
244 if (arg
[1][0] != '/' || strchr(arg
[1], ';')) {
245 fprintf(stderr
, "error: invalid subject");
248 subject
= calloc(strlen(arg
[1]) + 1, 1);
249 char *oldc
= arg
[1] + 1, *newc
= subject
, *delim
;
251 delim
= strchr(oldc
, '=');
253 fprintf(stderr
, "error: invalid subject");
256 memcpy(newc
, oldc
, delim
- oldc
+ 1);
257 newc
+= delim
- oldc
+ 1;
260 delim
= strchr(oldc
, '/');
262 delim
= arg
[1] + strlen(arg
[1]);
264 memcpy(newc
, oldc
, delim
- oldc
);
265 newc
+= delim
- oldc
;
273 gen_key(&key
, rsa
, ksize
, exp
, curve
, pem
);
276 write_key(&key
, keypath
, pem
);
278 from
= (from
< 1000000000) ? 1000000000 : from
;
279 strftime(fstr
, sizeof(fstr
), "%Y%m%d%H%M%S", gmtime(&from
));
280 to
= from
+ 60 * 60 * 24 * days
;
283 strftime(tstr
, sizeof(tstr
), "%Y%m%d%H%M%S", gmtime(&to
));
285 fprintf(stderr
, "Generating selfsigned certificate with subject '%s'"
286 " and validity %s-%s\n", subject
, fstr
, tstr
);
288 mbedtls_x509write_crt_init(&cert
);
289 mbedtls_x509write_crt_set_md_alg(&cert
, MBEDTLS_MD_SHA256
);
290 mbedtls_x509write_crt_set_issuer_key(&cert
, &key
);
291 mbedtls_x509write_crt_set_subject_key(&cert
, &key
);
292 mbedtls_x509write_crt_set_subject_name(&cert
, subject
);
293 mbedtls_x509write_crt_set_issuer_name(&cert
, subject
);
294 mbedtls_x509write_crt_set_validity(&cert
, fstr
, tstr
);
295 mbedtls_x509write_crt_set_basic_constraints(&cert
, 0, -1);
296 mbedtls_x509write_crt_set_subject_key_identifier(&cert
);
297 mbedtls_x509write_crt_set_authority_key_identifier(&cert
);
299 _urandom(NULL
, (void *) buf
, 8);
300 for (len
= 0; len
< 8; len
++)
301 sprintf(sstr
+ len
*2, "%02x", (unsigned char) buf
[len
]);
303 mbedtls_mpi_init(&serial
);
304 mbedtls_mpi_read_string(&serial
, 16, sstr
);
305 mbedtls_x509write_crt_set_serial(&cert
, &serial
);
308 if (mbedtls_x509write_crt_pem(&cert
, (void *) buf
, sizeof(buf
), _urandom
, NULL
) < 0) {
309 fprintf(stderr
, "Failed to generate certificate\n");
315 len
= mbedtls_x509write_crt_der(&cert
, (void *) buf
, sizeof(buf
), _urandom
, NULL
);
317 fprintf(stderr
, "Failed to generate certificate: %d\n", len
);
321 write_file(certpath
, len
, pem
, true);
323 mbedtls_x509write_crt_free(&cert
);
324 mbedtls_mpi_free(&serial
);
325 mbedtls_pk_free(&key
);
330 int main(int argc
, char *argv
[])
334 } else if (!strcmp(argv
[1], "eckey")) {
335 return dokey(false, argv
+2);
336 } else if (!strcmp(argv
[1], "rsakey")) {
337 return dokey(true, argv
+2);
338 } else if (!strcmp(argv
[1], "selfsigned")) {
339 return selfsigned(argv
+2);
343 "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION
"\n" PX5G_COPY
344 "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
345 fprintf(stderr
, "Usage: %s [eckey|rsakey|selfsigned]\n", *argv
);