usr/src/cmd/cmd-crypto/pktool/gencert.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  *
  21  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  22  */
  23
  24 #include <stdio.h>
  25 #include <string.h>
  26 #include <ctype.h>
  27 #include <malloc.h>
  28 #include <libgen.h>
  29 #include <errno.h>
  30 #include <cryptoutil.h>
  31 #include <security/cryptoki.h>
  32 #include "common.h"
  33
  34 #include <kmfapi.h>
  35
  36 #define SET_VALUE(f, s) \
  37         kmfrv = f; \
  38         if (kmfrv != KMF_OK) { \
  39                 cryptoerror(LOG_STDERR, \
  40                         gettext("Failed to set %s: 0x%02x\n"), \
  41                         s, kmfrv); \
  42                 goto cleanup; \
  43         }
  44
  45 static int
  46 gencert_pkcs11(KMF_HANDLE_T kmfhandle,
  47         char *token, char *subject, char *altname,
  48         KMF_GENERALNAMECHOICES alttype, int altcrit,
  49         char *certlabel, KMF_KEY_ALG keyAlg,
  50         KMF_ALGORITHM_INDEX sigAlg,
  51         int keylen, uint32_t ltime, KMF_BIGINT *serial,
  52         uint16_t kubits, int kucrit, KMF_CREDENTIAL *tokencred,
  53         EKU_LIST *ekulist, KMF_OID *curveoid)
  54 {
  55         KMF_RETURN kmfrv = KMF_OK;
  56         KMF_KEY_HANDLE pubk, prik;
  57         KMF_X509_CERTIFICATE signedCert;
  58         KMF_X509_NAME   certSubject;
  59         KMF_X509_NAME   certIssuer;
  60         KMF_DATA x509DER;
  61         KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
  62         KMF_ATTRIBUTE attrlist[16];
  63         int numattr = 0;
  64         KMF_KEY_ALG keytype;
  65         uint32_t keylength;
  66
  67         (void) memset(&signedCert, 0, sizeof (signedCert));
  68         (void) memset(&certSubject, 0, sizeof (certSubject));
  69         (void) memset(&certIssuer, 0, sizeof (certIssuer));
  70         (void) memset(&x509DER, 0, sizeof (x509DER));
  71
  72         /* If the subject name cannot be parsed, flag it now and exit */
  73         if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
  74                 cryptoerror(LOG_STDERR,
  75                     gettext("Subject name cannot be parsed.\n"));
  76                 return (PK_ERR_USAGE);
  77         }
  78
  79         /* For a self-signed cert, the issuser and subject are the same */
  80         if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
  81                 cryptoerror(LOG_STDERR,
  82                     gettext("Subject name cannot be parsed.\n"));
  83                 return (PK_ERR_USAGE);
  84         }
  85
  86         keylength = keylen; /* bits */
  87         keytype = keyAlg;
  88
  89         /* Select a PKCS11 token */
  90         kmfrv = select_token(kmfhandle, token, FALSE);
  91         if (kmfrv != KMF_OK) {
  92                 return (kmfrv);
  93         }
  94
  95         /*
  96          * Share the "genkeypair" routine for creating the keypair.
  97          */
  98         kmfrv = genkeypair_pkcs11(kmfhandle, token, certlabel,
  99             keytype, keylength, tokencred, curveoid, &prik, &pubk);
 100         if (kmfrv != KMF_OK)
 101                 return (kmfrv);
 102
 103         SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
 104             "keypair");
 105
 106         SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
 107
 108         SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
 109             "serial number");
 110
 111         SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
 112             "validity time");
 113
 114         SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
 115             "signature algorithm");
 116
 117         SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
 118             "subject name");
 119
 120         SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
 121             "issuer name");
 122
 123         if (altname != NULL)
 124                 SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
 125                     alttype, altname), "subjectAltName");
 126
 127         if (kubits != 0)
 128                 SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
 129                     "KeyUsage");
 130
 131         if (ekulist != NULL) {
 132                 int i;
 133                 for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
 134                         SET_VALUE(kmf_add_cert_eku(&signedCert,
 135                             &ekulist->ekulist[i], ekulist->critlist[i]),
 136                             "Extended Key Usage");
 137                 }
 138         }
 139
 140         /*
 141          * Construct attributes for the kmf_sign_cert operation.
 142          */
 143         numattr = 0;
 144         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 145             &kstype, sizeof (kstype));
 146         numattr++;
 147
 148         kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
 149             &prik, sizeof (KMF_KEY_HANDLE_ATTR));
 150         numattr++;
 151
 152         /* cert data that is to be signed */
 153         kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
 154             &signedCert, sizeof (KMF_X509_CERTIFICATE));
 155         numattr++;
 156
 157         /* output buffer for the signed cert */
 158         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 159             &x509DER, sizeof (KMF_DATA));
 160         numattr++;
 161
 162         kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
 163             &sigAlg, sizeof (sigAlg));
 164         numattr++;
 165
 166         if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
 167             KMF_OK) {
 168                 goto cleanup;
 169         }
 170
 171         /*
 172          * Store the cert in the DB.
 173          */
 174         numattr = 0;
 175         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 176             &kstype, sizeof (kstype));
 177         numattr++;
 178         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 179             &x509DER, sizeof (KMF_DATA));
 180         numattr++;
 181
 182         if (certlabel != NULL) {
 183                 kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
 184                     certlabel, strlen(certlabel));
 185                 numattr++;
 186         }
 187
 188         kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
 189
 190 cleanup:
 191         kmf_free_data(&x509DER);
 192         kmf_free_dn(&certSubject);
 193         kmf_free_dn(&certIssuer);
 194
 195         /*
 196          * If kmf_sign_cert or kmf_store_cert failed, then we need to clean up
 197          * the key pair from the token.
 198          */
 199         if (kmfrv != KMF_OK) {
 200                 /* delete the public key */
 201                 numattr = 0;
 202                 kmf_set_attr_at_index(attrlist, numattr,
 203                     KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
 204                 numattr++;
 205
 206                 kmf_set_attr_at_index(attrlist, numattr,
 207                     KMF_KEY_HANDLE_ATTR, &pubk, sizeof (KMF_KEY_HANDLE));
 208                 numattr++;
 209
 210                 if (tokencred != NULL && tokencred->cred != NULL) {
 211                         kmf_set_attr_at_index(attrlist, numattr,
 212                             KMF_CREDENTIAL_ATTR, tokencred,
 213                             sizeof (KMF_CREDENTIAL));
 214                         numattr++;
 215                 }
 216
 217                 (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
 218                     attrlist);
 219
 220                 /* delete the private key */
 221                 numattr = 0;
 222                 kmf_set_attr_at_index(attrlist, numattr,
 223                     KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
 224                 numattr++;
 225
 226                 kmf_set_attr_at_index(attrlist, numattr,
 227                     KMF_KEY_HANDLE_ATTR, &prik, sizeof (KMF_KEY_HANDLE));
 228                 numattr++;
 229
 230                 if (tokencred != NULL && tokencred->cred != NULL) {
 231                         kmf_set_attr_at_index(attrlist, numattr,
 232                             KMF_CREDENTIAL_ATTR, tokencred,
 233                             sizeof (KMF_CREDENTIAL));
 234                         numattr++;
 235                 }
 236
 237                 (void) kmf_delete_key_from_keystore(kmfhandle, numattr,
 238                     attrlist);
 239         }
 240
 241         return (kmfrv);
 242 }
 243
 244 static int
 245 gencert_file(KMF_HANDLE_T kmfhandle,
 246         KMF_KEY_ALG keyAlg, KMF_ALGORITHM_INDEX sigAlg,
 247         int keylen, KMF_ENCODE_FORMAT fmt,
 248         uint32_t ltime, char *subject, char *altname,
 249         KMF_GENERALNAMECHOICES alttype, int altcrit,
 250         KMF_BIGINT *serial, uint16_t kubits, int kucrit,
 251         char *outcert, char *outkey,
 252         EKU_LIST *ekulist)
 253 {
 254         KMF_RETURN kmfrv;
 255         KMF_KEY_HANDLE pubk, prik;
 256         KMF_X509_CERTIFICATE signedCert;
 257         KMF_X509_NAME   certSubject;
 258         KMF_X509_NAME   certIssuer;
 259         KMF_DATA x509DER;
 260         char *fullcertpath = NULL;
 261         char *fullkeypath = NULL;
 262         KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
 263         KMF_ATTRIBUTE attrlist[10];
 264         int numattr = 0;
 265
 266         (void) memset(&signedCert, 0, sizeof (signedCert));
 267         (void) memset(&certSubject, 0, sizeof (certSubject));
 268         (void) memset(&certIssuer, 0, sizeof (certIssuer));
 269         (void) memset(&x509DER, 0, sizeof (x509DER));
 270
 271         if (EMPTYSTRING(outcert) || EMPTYSTRING(outkey)) {
 272                 cryptoerror(LOG_STDERR,
 273                     gettext("No output file was specified for "
 274                     "the cert or key\n"));
 275                 return (PK_ERR_USAGE);
 276         }
 277         fullcertpath = strdup(outcert);
 278         if (verify_file(fullcertpath)) {
 279                 cryptoerror(LOG_STDERR,
 280                     gettext("Cannot write the indicated output "
 281                     "certificate file (%s).\n"), fullcertpath);
 282                 free(fullcertpath);
 283                 return (PK_ERR_USAGE);
 284         }
 285
 286         /* If the subject name cannot be parsed, flag it now and exit */
 287         if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
 288                 cryptoerror(LOG_STDERR,
 289                     gettext("Subject name cannot be parsed (%s)\n"), subject);
 290                 return (PK_ERR_USAGE);
 291         }
 292
 293         /* For a self-signed cert, the issuser and subject are the same */
 294         if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
 295                 cryptoerror(LOG_STDERR,
 296                     gettext("Subject name cannot be parsed (%s)\n"), subject);
 297                 kmf_free_dn(&certSubject);
 298                 return (PK_ERR_USAGE);
 299         }
 300
 301         /*
 302          * Share the "genkeypair" routine for creating the keypair.
 303          */
 304         kmfrv = genkeypair_file(kmfhandle, keyAlg, keylen,
 305             fmt, outkey, &prik, &pubk);
 306         if (kmfrv != KMF_OK)
 307                 return (kmfrv);
 308
 309         SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
 310             "keypair");
 311
 312         SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
 313
 314         SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
 315             "serial number");
 316
 317         SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
 318             "validity time");
 319
 320         SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
 321             "signature algorithm");
 322
 323         SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
 324             "subject name");
 325
 326         SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
 327             "issuer name");
 328
 329         if (altname != NULL)
 330                 SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
 331                     alttype, altname), "subjectAltName");
 332
 333         if (kubits != 0)
 334                 SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
 335                     "KeyUsage");
 336
 337         if (ekulist != NULL) {
 338                 int i;
 339                 for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
 340                         SET_VALUE(kmf_add_cert_eku(&signedCert,
 341                             &ekulist->ekulist[i],
 342                             ekulist->critlist[i]), "Extended Key Usage");
 343                 }
 344         }
 345         /*
 346          * Construct attributes for the kmf_sign_cert operation.
 347          */
 348         numattr = 0;
 349         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 350             &kstype, sizeof (kstype));
 351         numattr++;
 352
 353         kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
 354             &prik, sizeof (KMF_KEY_HANDLE_ATTR));
 355         numattr++;
 356
 357         /* cert data that is to be signed */
 358         kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
 359             &signedCert, sizeof (KMF_X509_CERTIFICATE));
 360         numattr++;
 361
 362         /* output buffer for the signed cert */
 363         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 364             &x509DER, sizeof (KMF_DATA));
 365         numattr++;
 366
 367         kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
 368             &sigAlg, sizeof (sigAlg));
 369         numattr++;
 370
 371         if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
 372             KMF_OK) {
 373                 goto cleanup;
 374         }
 375
 376         /*
 377          * Store the cert in the DB.
 378          */
 379         numattr = 0;
 380         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 381             &kstype, sizeof (kstype));
 382         numattr++;
 383         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 384             &x509DER, sizeof (KMF_DATA));
 385         numattr++;
 386         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_FILENAME_ATTR,
 387             fullcertpath, strlen(fullcertpath));
 388         numattr++;
 389         kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
 390             &fmt, sizeof (fmt));
 391         numattr++;
 392
 393         kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
 394
 395 cleanup:
 396         if (fullkeypath != NULL)
 397                 free(fullkeypath);
 398         if (fullcertpath != NULL)
 399                 free(fullcertpath);
 400
 401         kmf_free_data(&x509DER);
 402         kmf_free_dn(&certSubject);
 403         kmf_free_dn(&certIssuer);
 404         return (kmfrv);
 405 }
 406
 407 static KMF_RETURN
 408 gencert_nss(KMF_HANDLE_T kmfhandle,
 409         char *token, char *subject, char *altname,
 410         KMF_GENERALNAMECHOICES alttype, int altcrit,
 411         char *nickname, char *dir, char *prefix,
 412         KMF_KEY_ALG keyAlg,
 413         KMF_ALGORITHM_INDEX sigAlg,
 414         int keylen, char *trust,
 415         uint32_t ltime, KMF_BIGINT *serial, uint16_t kubits,
 416         int kucrit, KMF_CREDENTIAL *tokencred,
 417         EKU_LIST *ekulist, KMF_OID *curveoid)
 418 {
 419         KMF_RETURN kmfrv;
 420         KMF_KEY_HANDLE pubk, prik;
 421         KMF_X509_CERTIFICATE signedCert;
 422         KMF_X509_NAME   certSubject;
 423         KMF_X509_NAME   certIssuer;
 424         KMF_DATA x509DER;
 425         KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
 426         KMF_ATTRIBUTE attrlist[16];
 427         int numattr = 0;
 428
 429         if (token == NULL)
 430                 token = DEFAULT_NSS_TOKEN;
 431
 432         kmfrv = configure_nss(kmfhandle, dir, prefix);
 433         if (kmfrv != KMF_OK)
 434                 return (kmfrv);
 435
 436         (void) memset(&signedCert, 0, sizeof (signedCert));
 437         (void) memset(&certSubject, 0, sizeof (certSubject));
 438         (void) memset(&certIssuer, 0, sizeof (certIssuer));
 439         (void) memset(&x509DER, 0, sizeof (x509DER));
 440
 441         /* If the subject name cannot be parsed, flag it now and exit */
 442         if (kmf_dn_parser(subject, &certSubject) != KMF_OK) {
 443                 cryptoerror(LOG_STDERR,
 444                     gettext("Subject name cannot be parsed.\n"));
 445                 return (PK_ERR_USAGE);
 446         }
 447
 448         /* For a self-signed cert, the issuser and subject are the same */
 449         if (kmf_dn_parser(subject, &certIssuer) != KMF_OK) {
 450                 cryptoerror(LOG_STDERR,
 451                     gettext("Subject name cannot be parsed.\n"));
 452                 return (PK_ERR_USAGE);
 453         }
 454
 455         kmfrv = genkeypair_nss(kmfhandle, token, nickname, dir,
 456             prefix, keyAlg, keylen, tokencred, curveoid,
 457             &prik, &pubk);
 458         if (kmfrv != KMF_OK)
 459                 return (kmfrv);
 460
 461         SET_VALUE(kmf_set_cert_pubkey(kmfhandle, &pubk, &signedCert),
 462             "keypair");
 463
 464         SET_VALUE(kmf_set_cert_version(&signedCert, 2), "version number");
 465
 466         SET_VALUE(kmf_set_cert_serial(&signedCert, serial),
 467             "serial number");
 468
 469         SET_VALUE(kmf_set_cert_validity(&signedCert, NULL, ltime),
 470             "validity time");
 471
 472         SET_VALUE(kmf_set_cert_sig_alg(&signedCert, sigAlg),
 473             "signature algorithm");
 474
 475         SET_VALUE(kmf_set_cert_subject(&signedCert, &certSubject),
 476             "subject name");
 477
 478         SET_VALUE(kmf_set_cert_issuer(&signedCert, &certIssuer),
 479             "issuer name");
 480
 481         if (altname != NULL)
 482                 SET_VALUE(kmf_set_cert_subject_altname(&signedCert, altcrit,
 483                     alttype, altname), "subjectAltName");
 484
 485         if (kubits)
 486                 SET_VALUE(kmf_set_cert_ku(&signedCert, kucrit, kubits),
 487                     "subjectAltName");
 488
 489         if (ekulist != NULL) {
 490                 int i;
 491                 for (i = 0; kmfrv == KMF_OK && i < ekulist->eku_count; i++) {
 492                         SET_VALUE(kmf_add_cert_eku(&signedCert,
 493                             &ekulist->ekulist[i],
 494                             ekulist->critlist[i]), "Extended Key Usage");
 495                 }
 496         }
 497         /*
 498          * Construct attributes for the kmf_sign_cert operation.
 499          */
 500         numattr = 0;
 501         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 502             &kstype, sizeof (kstype));
 503         numattr++;
 504
 505         kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
 506             &prik, sizeof (KMF_KEY_HANDLE_ATTR));
 507         numattr++;
 508
 509         /* cert data that is to be signed */
 510         kmf_set_attr_at_index(attrlist, numattr, KMF_X509_CERTIFICATE_ATTR,
 511             &signedCert, sizeof (KMF_X509_CERTIFICATE));
 512         numattr++;
 513
 514         /* output buffer for the signed cert */
 515         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 516             &x509DER, sizeof (KMF_DATA));
 517         numattr++;
 518
 519         kmf_set_attr_at_index(attrlist, numattr, KMF_ALGORITHM_INDEX_ATTR,
 520             &sigAlg, sizeof (sigAlg));
 521         numattr++;
 522
 523         if ((kmfrv = kmf_sign_cert(kmfhandle, numattr, attrlist)) !=
 524             KMF_OK) {
 525                 goto cleanup;
 526         }
 527
 528         /*
 529          * Store the cert in the DB.
 530          */
 531         numattr = 0;
 532         kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
 533             &kstype, sizeof (kstype));
 534         numattr++;
 535
 536         kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_DATA_ATTR,
 537             &x509DER, sizeof (KMF_DATA));
 538         numattr++;
 539
 540         if (nickname != NULL) {
 541                 kmf_set_attr_at_index(attrlist, numattr, KMF_CERT_LABEL_ATTR,
 542                     nickname, strlen(nickname));
 543                 numattr++;
 544         }
 545
 546         if (trust != NULL) {
 547                 kmf_set_attr_at_index(attrlist, numattr, KMF_TRUSTFLAG_ATTR,
 548                     trust, strlen(trust));
 549                 numattr++;
 550         }
 551
 552         if (token != NULL) {
 553                 kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
 554                     token, strlen(token));
 555                 numattr++;
 556         }
 557
 558         kmfrv = kmf_store_cert(kmfhandle, numattr, attrlist);
 559
 560 cleanup:
 561         kmf_free_data(&x509DER);
 562         kmf_free_dn(&certSubject);
 563         kmf_free_dn(&certIssuer);
 564         return (kmfrv);
 565 }
 566
 567 int
 568 pk_gencert(int argc, char *argv[])
 569 {
 570         int rv;
 571         int opt;
 572         extern int      optind_av;
 573         extern char     *optarg_av;
 574         KMF_KEYSTORE_TYPE kstype = 0;
 575         char *subject = NULL;
 576         char *tokenname = NULL;
 577         char *dir = NULL;
 578         char *prefix = NULL;
 579         char *keytype = PK_DEFAULT_KEYTYPE;
 580         int keylen = PK_DEFAULT_KEYLENGTH;
 581         char *trust = NULL;
 582         char *lifetime = NULL;
 583         char *certlabel = NULL;
 584         char *outcert = NULL;
 585         char *outkey = NULL;
 586         char *format = NULL;
 587         char *serstr = NULL;
 588         char *altname = NULL;
 589         char *keyusagestr = NULL;
 590         char *ekustr = NULL;
 591         char *hashname = NULL;
 592         KMF_GENERALNAMECHOICES alttype = 0;
 593         KMF_BIGINT serial = { NULL, 0 };
 594         uint32_t ltime;
 595         KMF_HANDLE_T kmfhandle = NULL;
 596         KMF_ENCODE_FORMAT fmt = KMF_FORMAT_ASN1;
 597         KMF_KEY_ALG keyAlg = KMF_RSA;
 598         KMF_ALGORITHM_INDEX sigAlg = KMF_ALGID_SHA1WithRSA;
 599         boolean_t interactive = B_FALSE;
 600         char *subname = NULL;
 601         KMF_CREDENTIAL tokencred = { NULL, 0 };
 602         uint16_t kubits = 0;
 603         int altcrit = 0, kucrit = 0;
 604         EKU_LIST *ekulist = NULL;
 605         KMF_OID *curveoid = NULL; /* ECC */
 606         KMF_OID *hashoid = NULL;
 607         int y_flag = 0;
 608
 609         while ((opt = getopt_av(argc, argv,
 610             "ik:(keystore)s:(subject)n:(nickname)A:(altname)"
 611             "T:(token)d:(dir)p:(prefix)t:(keytype)y:(keylen)"
 612             "r:(trust)L:(lifetime)l:(label)c:(outcert)e:(eku)"
 613             "K:(outkey)S:(serial)F:(format)u:(keyusage)C:(curve)"
 614             "E(listcurves)h:(hash)")) != EOF) {
 615
 616                 if (opt != 'i' && opt != 'E' && EMPTYSTRING(optarg_av))
 617                         return (PK_ERR_USAGE);
 618
 619                 switch (opt) {
 620                         case 'A':
 621                                 altname = optarg_av;
 622                                 break;
 623                         case 'i':
 624                                 if (interactive || subject)
 625                                         return (PK_ERR_USAGE);
 626                                 else
 627                                         interactive = B_TRUE;
 628                                 break;
 629                         case 'k':
 630                                 kstype = KS2Int(optarg_av);
 631                                 if (kstype == 0)
 632                                         return (PK_ERR_USAGE);
 633                                 break;
 634                         case 's':
 635                                 if (interactive || subject)
 636                                         return (PK_ERR_USAGE);
 637                                 else
 638                                         subject = optarg_av;
 639                                 break;
 640                         case 'l':
 641                         case 'n':
 642                                 if (certlabel)
 643                                         return (PK_ERR_USAGE);
 644                                 certlabel = optarg_av;
 645                                 break;
 646                         case 'T':
 647                                 if (tokenname)
 648                                         return (PK_ERR_USAGE);
 649                                 tokenname = optarg_av;
 650                                 break;
 651                         case 'd':
 652                                 if (dir)
 653                                         return (PK_ERR_USAGE);
 654                                 dir = optarg_av;
 655                                 break;
 656                         case 'p':
 657                                 if (prefix)
 658                                         return (PK_ERR_USAGE);
 659                                 prefix = optarg_av;
 660                                 break;
 661                         case 't':
 662                                 keytype = optarg_av;
 663                                 break;
 664                         case 'u':
 665                                 keyusagestr = optarg_av;
 666                                 break;
 667                         case 'y':
 668                                 if (sscanf(optarg_av, "%d",
 669                                     &keylen) != 1) {
 670                                         cryptoerror(LOG_STDERR,
 671                                             gettext("key length must be"
 672                                             "a numeric value (%s)\n"),
 673                                             optarg_av);
 674                                         return (PK_ERR_USAGE);
 675                                 }
 676                                 y_flag++;
 677                                 break;
 678                         case 'r':
 679                                 if (trust)
 680                                         return (PK_ERR_USAGE);
 681                                 trust = optarg_av;
 682                                 break;
 683                         case 'L':
 684                                 if (lifetime)
 685                                         return (PK_ERR_USAGE);
 686                                 lifetime = optarg_av;
 687                                 break;
 688                         case 'c':
 689                                 if (outcert)
 690                                         return (PK_ERR_USAGE);
 691                                 outcert = optarg_av;
 692                                 break;
 693                         case 'K':
 694                                 if (outkey)
 695                                         return (PK_ERR_USAGE);
 696                                 outkey = optarg_av;
 697                                 break;
 698                         case 'S':
 699                                 serstr = optarg_av;
 700                                 break;
 701                         case 'F':
 702                                 if (format)
 703                                         return (PK_ERR_USAGE);
 704                                 format = optarg_av;
 705                                 break;
 706                         case 'e':
 707                                 ekustr = optarg_av;
 708                                 break;
 709                         case 'C':
 710                                 curveoid = ecc_name_to_oid(optarg_av);
 711                                 if (curveoid == NULL) {
 712                                         cryptoerror(LOG_STDERR,
 713                                             gettext("Unrecognized ECC "
 714                                             "curve.\n"));
 715                                         return (PK_ERR_USAGE);
 716                                 }
 717                                 break;
 718                         case 'E':
 719                                 /*
 720                                  * This argument is only to be used
 721                                  * by itself, no other options should
 722                                  * be present.
 723                                  */
 724                                 if (argc != 2) {
 725                                         cryptoerror(LOG_STDERR,
 726                                             gettext("listcurves has no other "
 727                                             "options.\n"));
 728                                         return (PK_ERR_USAGE);
 729                                 }
 730                                 show_ecc_curves();
 731                                 return (0);
 732                         case 'h':
 733                                 hashname = optarg_av;
 734                                 hashoid = ecc_name_to_oid(optarg_av);
 735                                 if (hashoid == NULL) {
 736                                         cryptoerror(LOG_STDERR,
 737                                             gettext("Unrecognized hash.\n"));
 738                                         return (PK_ERR_USAGE);
 739                                 }
 740                                 break;
 741                         default:
 742                                 return (PK_ERR_USAGE);
 743                 }
 744         }
 745
 746         /* No additional args allowed. */
 747         argc -= optind_av;
 748         argv += optind_av;
 749         if (argc) {
 750                 return (PK_ERR_USAGE);
 751         }
 752
 753         if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
 754                 cryptoerror(LOG_STDERR, gettext("Error initializing KMF\n"));
 755                 return (PK_ERR_USAGE);
 756         }
 757
 758         /* Assume keystore = PKCS#11 if not specified. */
 759         if (kstype == 0)
 760                 kstype = KMF_KEYSTORE_PK11TOKEN;
 761
 762         if ((kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN)) {
 763                 if (interactive && EMPTYSTRING(certlabel)) {
 764                         (void) get_certlabel(&certlabel);
 765                 }
 766                 /* It better not be empty now */
 767                 if (EMPTYSTRING(certlabel)) {
 768                         cryptoerror(LOG_STDERR, gettext("A label must be "
 769                             "specified to create a self-signed certificate."
 770                             "\n"));
 771                         return (PK_ERR_USAGE);
 772                 }
 773         } else if (kstype == KMF_KEYSTORE_OPENSSL && EMPTYSTRING(outcert)) {
 774                 cryptoerror(LOG_STDERR, gettext("A certificate filename must "
 775                     "be specified to create a self-signed certificate.\n"));
 776                 return (PK_ERR_USAGE);
 777         }
 778
 779         DIR_OPTION_CHECK(kstype, dir);
 780
 781         if (format && (fmt = Str2Format(format)) == KMF_FORMAT_UNDEF) {
 782                 cryptoerror(LOG_STDERR,
 783                     gettext("Error parsing format string (%s).\n"),
 784                     format);
 785                 return (PK_ERR_USAGE);
 786         }
 787
 788         if (Str2Lifetime(lifetime, &ltime) != 0) {
 789                 cryptoerror(LOG_STDERR,
 790                     gettext("Error parsing lifetime string\n"));
 791                 return (PK_ERR_USAGE);
 792         }
 793
 794         if (Str2KeyType(keytype, hashoid, &keyAlg, &sigAlg) != 0) {
 795                 cryptoerror(LOG_STDERR,
 796                     gettext("Unsupported key/hash combination (%s/%s).\n"),
 797                     keytype, (hashname ? hashname : "none"));
 798                 return (PK_ERR_USAGE);
 799         }
 800         if (curveoid != NULL && keyAlg != KMF_ECDSA) {
 801                 cryptoerror(LOG_STDERR, gettext("EC curves are only "
 802                     "valid for EC keytypes.\n"));
 803                 return (PK_ERR_USAGE);
 804         }
 805         if (keyAlg == KMF_ECDSA && curveoid == NULL) {
 806                 cryptoerror(LOG_STDERR, gettext("A curve must be "
 807                     "specifed when using EC keys.\n"));
 808                 return (PK_ERR_USAGE);
 809         }
 810         /* Adjust default keylength for NSS and DSA */
 811         if (keyAlg == KMF_DSA && !y_flag && kstype == KMF_KEYSTORE_NSS)
 812                 keylen = 1024;
 813
 814         /*
 815          * Check the subject name.
 816          * If interactive is true, get it now interactively.
 817          */
 818         if (interactive) {
 819                 subname = NULL;
 820                 if (get_subname(&subname) != KMF_OK || subname == NULL) {
 821                         cryptoerror(LOG_STDERR, gettext("Failed to get the "
 822                             "subject name interactively.\n"));
 823                         return (PK_ERR_USAGE);
 824                 }
 825                 if (serstr == NULL) {
 826                         (void) get_serial(&serstr);
 827                 }
 828         } else {
 829                 if (EMPTYSTRING(subject)) {
 830                         cryptoerror(LOG_STDERR, gettext("A subject name or "
 831                             "-i must be specified to create a self-signed "
 832                             "certificate.\n"));
 833                         return (PK_ERR_USAGE);
 834                 } else {
 835                         subname = strdup(subject);
 836                         if (subname == NULL) {
 837                                 cryptoerror(LOG_STDERR,
 838                                     gettext("Out of memory.\n"));
 839                                 return (PK_ERR_SYSTEM);
 840                         }
 841                 }
 842         }
 843
 844         if (serstr == NULL) {
 845                 (void) fprintf(stderr, gettext("A serial number "
 846                     "must be specified as a hex number when creating"
 847                     " a self-signed certificate "
 848                     "(ex: serial=0x0102030405feedface)\n"));
 849                 rv = PK_ERR_USAGE;
 850                 goto end;
 851         } else {
 852                 uchar_t *bytes = NULL;
 853                 size_t bytelen;
 854
 855                 rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
 856                 if (rv != KMF_OK || bytes == NULL) {
 857                         (void) fprintf(stderr, gettext("serial number "
 858                             "must be specified as a hex number "
 859                             "(ex: 0x0102030405ffeeddee)\n"));
 860                         rv = PK_ERR_USAGE;
 861                         goto end;
 862                 }
 863                 serial.val = bytes;
 864                 serial.len = bytelen;
 865         }
 866
 867         if (altname != NULL) {
 868                 rv = verify_altname(altname, &alttype, &altcrit);
 869                 if (rv != KMF_OK) {
 870                         (void) fprintf(stderr, gettext("Subject AltName "
 871                             "must be specified as a name=value pair. "
 872                             "See the man page for details.\n"));
 873                         rv = PK_ERR_USAGE;
 874                         goto end;
 875                 } else {
 876                         /* advance the altname past the '=' sign */
 877                         char *p = strchr(altname, '=');
 878                         if (p != NULL)
 879                                 altname = p + 1;
 880                 }
 881         }
 882
 883         if (keyusagestr != NULL) {
 884                 rv = verify_keyusage(keyusagestr, &kubits, &kucrit);
 885                 if (rv != KMF_OK) {
 886                         (void) fprintf(stderr, gettext("KeyUsage "
 887                             "must be specified as a comma-separated list. "
 888                             "See the man page for details.\n"));
 889                         rv = PK_ERR_USAGE;
 890                         goto end;
 891                 }
 892         }
 893         if (ekustr != NULL) {
 894                 rv = verify_ekunames(ekustr, &ekulist);
 895                 if (rv != KMF_OK) {
 896                         (void) fprintf(stderr, gettext("EKUs must "
 897                             "be specified as a comma-separated list. "
 898                             "See the man page for details.\n"));
 899                         rv = PK_ERR_USAGE;
 900                         goto end;
 901                 }
 902         }
 903         if (keyAlg == KMF_ECDSA && kstype == KMF_KEYSTORE_OPENSSL) {
 904                 (void) fprintf(stderr, gettext("ECC certificates are"
 905                     "only supported with the pkcs11 and nss keystores\n"));
 906                 rv = PK_ERR_USAGE;
 907                 goto end;
 908         }
 909
 910         if (kstype == KMF_KEYSTORE_NSS || kstype == KMF_KEYSTORE_PK11TOKEN) {
 911                 if (tokenname == NULL || !strlen(tokenname)) {
 912                         if (kstype == KMF_KEYSTORE_NSS) {
 913                                 tokenname = "internal";
 914                         } else  {
 915                                 tokenname = PK_DEFAULT_PK11TOKEN;
 916                         }
 917                 }
 918
 919                 (void) get_token_password(kstype, tokenname, &tokencred);
 920         }
 921
 922         if (kstype == KMF_KEYSTORE_NSS) {
 923                 if (dir == NULL)
 924                         dir = PK_DEFAULT_DIRECTORY;
 925
 926                 rv = gencert_nss(kmfhandle,
 927                     tokenname, subname, altname, alttype, altcrit,
 928                     certlabel, dir, prefix, keyAlg, sigAlg, keylen,
 929                     trust, ltime, &serial, kubits, kucrit, &tokencred,
 930                     ekulist, curveoid);
 931
 932         } else if (kstype == KMF_KEYSTORE_PK11TOKEN) {
 933                 rv = gencert_pkcs11(kmfhandle,
 934                     tokenname, subname, altname, alttype, altcrit,
 935                     certlabel, keyAlg, sigAlg, keylen, ltime,
 936                     &serial, kubits, kucrit, &tokencred, ekulist,
 937                     curveoid);
 938
 939         } else if (kstype == KMF_KEYSTORE_OPENSSL) {
 940                 rv = gencert_file(kmfhandle,
 941                     keyAlg, sigAlg, keylen, fmt,
 942                     ltime, subname, altname, alttype, altcrit,
 943                     &serial, kubits, kucrit, outcert, outkey,
 944                     ekulist);
 945         }
 946
 947         if (rv != KMF_OK)
 948                 display_error(kmfhandle, rv,
 949                     gettext("Error creating certificate and keypair"));
 950 end:
 951         if (ekulist != NULL)
 952                 free_eku_list(ekulist);
 953         if (subname)
 954                 free(subname);
 955         if (tokencred.cred != NULL)
 956                 free(tokencred.cred);
 957
 958         if (serial.val != NULL)
 959                 free(serial.val);
 960
 961         (void) kmf_finalize(kmfhandle);
 962         return (rv);
 963 }