| 2217 | } |
| 2218 | |
| 2219 | apr_status_t md_cert_get_ari_cert_id(const char **pari_cert_id, |
| 2220 | const md_cert_t *cert, apr_pool_t *p) |
| 2221 | { |
| 2222 | #if OPENSSL_VERSION_NUMBER >= 0x10100000L |
| 2223 | md_data_t akid_buf, ser_buf; |
| 2224 | AUTHORITY_KEYID *s_aki; |
| 2225 | const ASN1_INTEGER *aki; |
| 2226 | const ASN1_INTEGER *serial; |
| 2227 | BIGNUM *bn; |
| 2228 | int i = -1, sder_len; |
| 2229 | unsigned char *ucp, sbuf[256]; |
| 2230 | |
| 2231 | *pari_cert_id = NULL; |
| 2232 | s_aki = X509_get_ext_d2i(cert->x509, NID_authority_key_identifier, &i, NULL); |
| 2233 | if (s_aki == NULL) { |
| 2234 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, |
| 2235 | "cert has no authority key id extension"); |
| 2236 | return APR_ENOENT; |
| 2237 | } |
| 2238 | aki = s_aki->keyid; |
| 2239 | if (aki == NULL) { |
| 2240 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, |
| 2241 | "cert has no authority key id in extension"); |
| 2242 | return APR_ENOENT; |
| 2243 | } |
| 2244 | akid_buf.len = (apr_size_t)ASN1_STRING_length(aki); |
| 2245 | akid_buf.data = (const char *)ASN1_STRING_get0_data(aki); |
| 2246 | akid_buf.free_data = NULL; |
| 2247 | |
| 2248 | serial = X509_get0_serialNumber(cert->x509); |
| 2249 | if (!serial) { |
| 2250 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, |
| 2251 | "cert has no serial number"); |
| 2252 | return APR_ENOENT; |
| 2253 | } |
| 2254 | memset(&ser_buf, 0, sizeof(ser_buf)); |
| 2255 | bn = ASN1_INTEGER_to_BN(serial, NULL); |
| 2256 | sder_len = BN_bn2bin(bn, sbuf); |
| 2257 | BN_free(bn); |
| 2258 | if (sder_len < 1) |
| 2259 | return APR_EINVAL; |
| 2260 | ser_buf.len = (apr_size_t)sder_len; |
| 2261 | ser_buf.data = (const char *)sbuf; |
| 2262 | (void)ucp; |
| 2263 | |
| 2264 | *pari_cert_id = apr_psprintf(p, "%s.%s", |
| 2265 | md_util_base64url_encode(&akid_buf, p), |
| 2266 | md_util_base64url_encode(&ser_buf, p)); |
| 2267 | return APR_SUCCESS; |
| 2268 | #else |
| 2269 | *pari_cert_id = NULL; |
| 2270 | (void)cert; |
| 2271 | (void)p; |
| 2272 | return APR_ENOTIMPL; |
| 2273 | #endif |
| 2274 | } |
| 2275 |
no test coverage detected