2 * px5g - Embedded x509 key and certificate generator based on PolarSSL
4 * Copyright (C) 2009 Steven Barth <steven@midlink.org>
5 * Copyright (C) 2014 Felix Fietkau <nbd@nbd.name>
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License, version 2.1 as published by the Free Software Foundation.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
22 #include <sys/types.h>
34 #include <mbedtls/bignum.h>
35 #include <mbedtls/x509_crt.h>
36 #include <mbedtls/rsa.h>
37 #include <mbedtls/pk.h>
38 #define lib_wrapper(x) mbedtls_##x
39 #define MD_SHA256 MBEDTLS_MD_SHA256
41 #include <polarssl/bignum.h>
42 #include <polarssl/x509_crt.h>
43 #include <polarssl/rsa.h>
44 #define lib_wrapper(x) x
45 #define MD_SHA256 POLARSSL_MD_SHA256
48 #define PX5G_VERSION "0.2"
49 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
50 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
52 static int urandom_fd
;
53 static char buf
[16384];
55 static int _urandom(void *ctx
, unsigned char *out
, size_t len
)
57 read(urandom_fd
, out
, len
);
61 static void write_file(const char *path
, int len
, bool pem
)
64 const char *buf_start
= buf
;
67 buf_start
+= sizeof(buf
) - len
;
70 fprintf(stderr
, "No data to write\n");
75 fprintf(stderr
, "error: I/O error\n");
82 fwrite(buf_start
, 1, len
, f
);
86 static void write_key(lib_wrapper(pk_context
) *key
, const char *path
, bool pem
)
91 if (lib_wrapper(pk_write_key_pem(key
, (void *) buf
, sizeof(buf
)) == 0))
94 len
= lib_wrapper(pk_write_key_der(key
, (void *) buf
, sizeof(buf
)));
99 write_file(path
, len
, pem
);
102 static void gen_key(lib_wrapper(pk_context
) *key
, int ksize
, int exp
, bool pem
)
104 lib_wrapper(pk_init(key
));
105 fprintf(stderr
, "Generating RSA private key, %i bit long modulus\n", ksize
);
107 mbedtls_pk_setup(key
, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA
));
108 if (mbedtls_rsa_gen_key(mbedtls_pk_rsa(*key
), _urandom
, NULL
, ksize
, exp
)) {
110 pk_init_ctx(key
, lib_wrapper(pk_info_from_type(POLARSSL_PK_RSA
)));
111 if (rsa_gen_key(pk_rsa(*key
), _urandom
, NULL
, ksize
, exp
)) {
113 fprintf(stderr
, "error: key generation failed\n");
118 int rsakey(char **arg
)
120 lib_wrapper(pk_context
) key
;
121 unsigned int ksize
= 512;
126 while (*arg
&& **arg
== '-') {
127 if (!strcmp(*arg
, "-out") && arg
[1]) {
130 } else if (!strcmp(*arg
, "-3")) {
132 } else if (!strcmp(*arg
, "-der")) {
139 ksize
= (unsigned int)atoi(*arg
);
141 gen_key(&key
, ksize
, exp
, pem
);
142 write_key(&key
, path
, pem
);
144 lib_wrapper(pk_free(&key
));
149 int selfsigned(char **arg
)
151 lib_wrapper(pk_context
) key
;
152 lib_wrapper(x509write_cert
) cert
;
153 lib_wrapper(mpi
) serial
;
156 unsigned int ksize
= 512;
158 unsigned int days
= 30;
159 char *keypath
= NULL
, *certpath
= NULL
;
161 time_t from
= time(NULL
), to
;
162 char fstr
[20], tstr
[20], sstr
[17];
165 while (*arg
&& **arg
== '-') {
166 if (!strcmp(*arg
, "-der")) {
168 } else if (!strcmp(*arg
, "-newkey") && arg
[1]) {
169 if (strncmp(arg
[1], "rsa:", 4)) {
170 fprintf(stderr
, "error: invalid algorithm");
173 ksize
= (unsigned int)atoi(arg
[1] + 4);
175 } else if (!strcmp(*arg
, "-days") && arg
[1]) {
176 days
= (unsigned int)atoi(arg
[1]);
178 } else if (!strcmp(*arg
, "-keyout") && arg
[1]) {
181 } else if (!strcmp(*arg
, "-out") && arg
[1]) {
184 } else if (!strcmp(*arg
, "-subj") && arg
[1]) {
185 if (arg
[1][0] != '/' || strchr(arg
[1], ';')) {
186 fprintf(stderr
, "error: invalid subject");
189 subject
= calloc(strlen(arg
[1]) + 1, 1);
190 char *oldc
= arg
[1] + 1, *newc
= subject
, *delim
;
192 delim
= strchr(oldc
, '=');
194 fprintf(stderr
, "error: invalid subject");
197 memcpy(newc
, oldc
, delim
- oldc
+ 1);
198 newc
+= delim
- oldc
+ 1;
201 delim
= strchr(oldc
, '/');
203 delim
= arg
[1] + strlen(arg
[1]);
205 memcpy(newc
, oldc
, delim
- oldc
);
206 newc
+= delim
- oldc
;
215 gen_key(&key
, ksize
, exp
, pem
);
218 write_key(&key
, keypath
, pem
);
220 from
= (from
< 1000000000) ? 1000000000 : from
;
221 strftime(fstr
, sizeof(fstr
), "%Y%m%d%H%M%S", gmtime(&from
));
222 to
= from
+ 60 * 60 * 24 * days
;
225 strftime(tstr
, sizeof(tstr
), "%Y%m%d%H%M%S", gmtime(&to
));
227 fprintf(stderr
, "Generating selfsigned certificate with subject '%s'"
228 " and validity %s-%s\n", subject
, fstr
, tstr
);
230 lib_wrapper(x509write_crt_init(&cert
));
231 lib_wrapper(x509write_crt_set_md_alg(&cert
, MD_SHA256
));
232 lib_wrapper(x509write_crt_set_issuer_key(&cert
, &key
));
233 lib_wrapper(x509write_crt_set_subject_key(&cert
, &key
));
234 lib_wrapper(x509write_crt_set_subject_name(&cert
, subject
));
235 lib_wrapper(x509write_crt_set_issuer_name(&cert
, subject
));
236 lib_wrapper(x509write_crt_set_validity(&cert
, fstr
, tstr
));
237 lib_wrapper(x509write_crt_set_basic_constraints(&cert
, 0, -1));
238 lib_wrapper(x509write_crt_set_subject_key_identifier(&cert
));
239 lib_wrapper(x509write_crt_set_authority_key_identifier(&cert
));
241 _urandom(NULL
, buf
, 8);
242 for (len
= 0; len
< 8; len
++)
243 sprintf(sstr
+ len
*2, "%02x", (unsigned char) buf
[len
]);
245 lib_wrapper(mpi_init(&serial
));
246 lib_wrapper(mpi_read_string(&serial
, 16, sstr
));
247 lib_wrapper(x509write_crt_set_serial(&cert
, &serial
));
250 if (lib_wrapper(x509write_crt_pem(&cert
, (void *) buf
, sizeof(buf
), _urandom
, NULL
) < 0)) {
251 fprintf(stderr
, "Failed to generate certificate\n");
257 len
= lib_wrapper(x509write_crt_der(&cert
, (void *) buf
, sizeof(buf
), _urandom
, NULL
));
259 fprintf(stderr
, "Failed to generate certificate: %d\n", len
);
263 write_file(certpath
, len
, pem
);
265 lib_wrapper(x509write_crt_free(&cert
));
266 lib_wrapper(mpi_free(&serial
));
267 lib_wrapper(pk_free(&key
));
272 int main(int argc
, char *argv
[])
274 urandom_fd
= open("/dev/urandom", O_RDONLY
);
278 } else if (!strcmp(argv
[1], "rsakey")) {
279 return rsakey(argv
+2);
280 } else if (!strcmp(argv
[1], "selfsigned")) {
281 return selfsigned(argv
+2);
285 "PX5G X.509 Certificate Generator Utility v" PX5G_VERSION
"\n" PX5G_COPY
286 "\nbased on PolarSSL by Christophe Devine and Paul Bakker\n\n");
287 fprintf(stderr
, "Usage: %s [rsakey|selfsigned]\n", *argv
);