| 1945 | } |
| 1946 | |
| 1947 | static apr_status_t mk_x509(X509 **px, md_pkey_t *pkey, const char *cn, |
| 1948 | apr_interval_time_t valid_for, apr_pool_t *p) |
| 1949 | { |
| 1950 | X509 *x = NULL; |
| 1951 | X509_NAME *n = NULL; |
| 1952 | BIGNUM *big_rnd = NULL; |
| 1953 | ASN1_INTEGER *asn1_rnd = NULL; |
| 1954 | unsigned char rnd[20]; |
| 1955 | int days; |
| 1956 | apr_status_t rv; |
| 1957 | |
| 1958 | if (NULL == (x = X509_new()) |
| 1959 | || NULL == (n = X509_NAME_new())) { |
| 1960 | rv = APR_ENOMEM; |
| 1961 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: openssl alloc X509 things", cn); |
| 1962 | goto out; |
| 1963 | } |
| 1964 | |
| 1965 | if (APR_SUCCESS != (rv = md_rand_bytes(rnd, sizeof(rnd), p)) |
| 1966 | || !(big_rnd = BN_bin2bn(rnd, sizeof(rnd), NULL)) |
| 1967 | || !(asn1_rnd = BN_to_ASN1_INTEGER(big_rnd, NULL))) { |
| 1968 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: setup random serial", cn); |
| 1969 | rv = APR_EGENERAL; goto out; |
| 1970 | } |
| 1971 | if (!X509_set_serialNumber(x, asn1_rnd)) { |
| 1972 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: set serial number", cn); |
| 1973 | rv = APR_EGENERAL; goto out; |
| 1974 | } |
| 1975 | if (1 != X509_set_version(x, 2L)) { |
| 1976 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: setting x.509v3", cn); |
| 1977 | rv = APR_EGENERAL; goto out; |
| 1978 | } |
| 1979 | /* set common name and issuer */ |
| 1980 | if (!X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (const unsigned char*)cn, -1, -1, 0) |
| 1981 | || !X509_set_subject_name(x, n) |
| 1982 | || !X509_set_issuer_name(x, n)) { |
| 1983 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "%s: name add entry", cn); |
| 1984 | rv = APR_EGENERAL; goto out; |
| 1985 | } |
| 1986 | /* cert are unconstrained (but not very trustworthy) */ |
| 1987 | if (APR_SUCCESS != (rv = add_ext(x, NID_basic_constraints, "critical,CA:FALSE", p))) { |
| 1988 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: set basic constraints ext", cn); |
| 1989 | goto out; |
| 1990 | } |
| 1991 | /* add our key */ |
| 1992 | if (!X509_set_pubkey(x, pkey->pkey)) { |
| 1993 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, "%s: set pkey in x509", cn); |
| 1994 | rv = APR_EGENERAL; goto out; |
| 1995 | } |
| 1996 | /* validity */ |
| 1997 | days = (int)((apr_time_sec(valid_for) + MD_SECS_PER_DAY - 1)/ MD_SECS_PER_DAY); |
| 1998 | if (!X509_set_notBefore(x, ASN1_TIME_set(NULL, time(NULL)))) { |
| 1999 | rv = APR_EGENERAL; goto out; |
| 2000 | } |
| 2001 | if (!X509_set_notAfter(x, ASN1_TIME_adj(NULL, time(NULL), days, 0))) { |
| 2002 | rv = APR_EGENERAL; goto out; |
| 2003 | } |
| 2004 |
no test coverage detected