summaryrefslogtreecommitdiffstats
path: root/apps/x509.c
AgeCommit message (Collapse)Author
2020-07-01Improve documentation, layout, and code comments regarding self-issued certs ↵Dr. David von Oheimb
etc. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10587)
2020-05-15Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.cDr. David von Oheimb
This also adds the more flexible and general load_key_cert_crl() as well as helper functions get_passwd(), cleanse(), and clear_free() to be used also in apps/cmp.c etc. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11755)
2020-04-24Clean up the use of ERR_print_errors() in apps.c and in four appsDr. David von Oheimb
Also make sure that all error messages in apps.c consistently begin upper-case. Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c} Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940)
2020-04-24Add function load_csr(file,format,desc) to apps/lib/apps.cDavid von Oheimb
Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940)
2020-04-24In OpenSSL builds, declare STACK for datatypes ...Rich Salz
... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
2020-04-23Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
2020-04-20Fix descriptions of credentials and verification options for various appsDr. David von Oheimb
fix doc of s_client and s_server credentials and verification options fix doc of verification options also for s_time, x509, crl, req, ts, and verify correcting and extending texts regarding untrusted and trusted certs, making the order of options in the docs and help texts more consistent, etc. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11273)
2020-03-15APPS: Remove all traces of special SM2 treatment.Richard Levitte
SM2 IDs are now passed entirely as '-pkeyopt', '-sigopt' or '-vfyopt' values, just like any other valid option. Fixes #11293 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> (Merged from https://github.com/openssl/openssl/pull/11302)
2020-03-07cmdline app: add provider commandline options.Pauli
Add a -provider option to allow providers to be loaded. This option can be specified multiple times. Add a -provider_path option to allow the path to providers to be specified. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11167)
2020-02-26apps x509: restrict CAkeyform option to OPT_FMT_PDEBastian Germann
CAkeyform may be set to PEM, DER or ENGINE, but the current options are not using the proper optionformat 'E' (OPT_FMT_PDE) for this. Set the valtype for CAkeyform to 'E' and use OPT_FMT_PDE when extracting the option value. This amends 0ab6fc79a9a ("Fix regression on x509 keyform argument") which did the same thing for keyform and changed the manpage synopsis entries for both keyform and CAkeyform but did not change the option section. Hence, change the option section for both of them. CLA: trivial Co-developed-by: Torben Hohn <torben.hohn@linutronix.de> Signed-off-by: Torben Hohn <torben.hohn@linutronix.de> Signed-off-by: Bastian Germann <bage@linutronix.de> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11085)
2020-02-14apps x509: passing PKCS#11 URL as -signkeyBastian Germann
OpenSSL 1.1.0 has extended option checking, and rejects passing a PKCS#11 engine URL to "-signkey" option. The actual code is ready to take it. Change the option parsing to allow an engine URL to be passed and modify the manpage accordingly. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11086)
2019-12-19Fix regression on x509 keyform argumentJussi Keranen
In OpenSSL pre 1.1.0, 'openssl x509 -keyform engine' was possible and supported. In 1.1.0, type of keyform argument is OPT_FMT_PEMDER which doesn't support engine. This changes type of keyform argument to OPT_FMT_PDE which means PEM, DER or engine and updates the manpage including keyform and CAkeyform. This restores the pre 1.1.0 behavior. This issue is very similar than https://github.com/openssl/openssl/issues/4366 CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10609)
2019-11-08Add "sections" to -help outputRich Salz
Remove "Valid options" label, since all commands have sections (and [almost] always the first one is "General options"). Have "list --options" ignore section headers Reformat ts's additional help Add output section Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9953)
2019-03-19Add -new and -subj options to x509 app for direct cert generationDavid von Oheimb
Complete and improve error output of parse_name() in apps/apps.c Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8193)
2019-02-25fix x509 -force_pubkey option to take effect with cert input or ↵David von Oheimb
self-signing; improve its doc Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8165)
2018-12-06Following the license change, modify the boilerplates in apps/Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7765)
2018-11-02apps: Stop pretending to care about Netscape keysRichard Levitte
The documentation says some commands care, but the code says differently. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7440)
2018-06-24Support directories with "." in x509_load_serial()Ana María Martínez Gómez
Use `strrchr` to get a pointer to the last occurrence of `.` in the path string, instead of the first one with `strchr`. This prevent the path to be wrongly split if it contains several `.`, and not only the one for the extension. Fixes https://github.com/openssl/openssl/issues/6489. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6566)
2018-03-26Previously this x509 command line was working, restore thatBernd Edlinger
openssl x509 -in server.pem -signkey privkey.pem -out server.pem Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5746)
2018-02-13Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-01-31apps: Don't include progs.h in apps.hRichard Levitte
Everything in apps includes apps.h, because that one declares apps internal library routines. However, progs.h doesn't declare library routines, but rather the main commands and their options, and there's no reason why the library modules should include it. So, remove the inclusion of progs.h from apps.h and add that inclusion in all command source files. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5222)
2017-11-02Fix small but important regressionRichard Levitte
In OpenSSL pre 1.1.0, 'openssl x509 -CAkeyformat engine' was possible and supported. In 1.1.0, a small typo ('F' instead of 'f') removed that possibility. This restores the pre 1.1.0 behavior. Fixes #4366 Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4643)
2017-08-01Add '-ext' option to display extensions in 'x509'Paul Yang
This is to address issue #3932. Support comma-separated string to specify what extensions to be displayed. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4016) Remove redundant variable [to be squashed]
2017-07-16Standardize apps use of -rand, etc.Rich Salz
Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3862)
2017-07-14Fix #946 Add -preserve_dates to x509 appTodd Short
Add the -preserve_dates dates option to preserve dates when signing a certificate. Prevent -days and -preserve_dates being used simultaneously Fixes #946 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/946)
2017-07-06Bounds check string functions in apps.Pauli
This includes strcat, strcpy and sprintf. In the x509 app, the code has been cleaned up as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3868)
2017-07-05Undo commit d420ac2Rich Salz
[extended tests] Original text: Use BUF_strlcpy() instead of strcpy(). Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3701)
2017-06-12Clean up a bundle of codingstyle stuff in apps directoryPaul Yang
Mostly braces and NULL pointer check and also copyright year bump Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3657)
2017-04-25Switch command-line utils to new nameopt API.Dmitry Belyavskiy
The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
2016-10-19If an engine comes up explicitely, it must also come down explicitelyRichard Levitte
In apps/apps.c, one can set up an engine with setup_engine(). However, we freed the structural reference immediately, which means that for engines that don't already have a structural reference somewhere else (because it's a built in engine), we end up returning an invalid reference. Instead, the function release_engine() is added, and called at the end of the routines that call setup_engine(). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-10-14Constify command optionsFdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1694)
2016-09-19Fix various missing option help messages ...FdaSilvaYY
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1585)
2016-08-24Clarify the error messages in 08f6ae5b28Matt Caswell
Ensure it is clear to the user why there has been an error. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24Fix some resource leaks in the appsMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-19Constify certificate and CRL time routines.Dr. Stephen Henson
Update certificate and CRL time routines to match new standard. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Set certificate times in one function.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-17Constify char* input parameters in apps codeFdaSilvaYY
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-17Constify X509_get0_signature()Dr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-17Corrupt signature in place.Dr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-16Corrupt signature earlier.Dr. Stephen Henson
If -badsig is selected corrupt the signature before printing out any details so the output reflects the modified signature. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-16Add ASN1_STRING_get0_data(), deprecate ASN1_STRING_data().Dr. Stephen Henson
Deprecate the function ASN1_STRING_data() and replace with a new function ASN1_STRING_get0_data() which returns a constant pointer. Update library to use new function. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-20RT3136: Remove space after issuer/subjectJiri Horky
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-06-15Deal with the consequences of constifying gettersRichard Levitte
Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-06-15Constify X509_TRUST_add method.FdaSilvaYY
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1215)
2016-06-01Ensure an ASN1_OBJECT is freed in error pathsMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-19Check that the obtained public key is validMatt Caswell
In the X509 app check that the obtained public key is valid before we attempt to use it. Issue reported by Yuan Jochen Kang. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-17Copyright consolidation 01/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-04GH932: Add more help messages to some apps options.FdaSilvaYY
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-21Fix some code maintenance issuesMatt Caswell
Various instances of variables being written to, but then never read. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-15Make many X509_xxx types opaque.Rich Salz
Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 23:12:10 +0000