Function makeCertNative

flow/MkCert.cpp:189–254

}

CertAndKeyNative makeCertNative(CertSpecRef spec, CertAndKeyNative issuer) {
	// issuer key/cert must be both set or both null (self-signed case)
	ASSERT(issuer.valid() || issuer.null());

	auto const isSelfSigned = issuer.null();
	auto keypair = makeEcP256();
	auto newX = ::X509_new();
	OSSL_ASSERT(newX);
	auto x509Guard = ScopeExit([&newX]() {
		if (newX)
			::X509_free(newX);
	});
	auto smartX = std::shared_ptr<X509>(newX, &::X509_free);
	newX = nullptr;
	auto x = smartX.get();
	OSSL_ASSERT(0 < ::X509_set_version(x, 2 /*X509_VERSION_3*/));
	auto serialPtr = ::X509_get_serialNumber(x);
	OSSL_ASSERT(serialPtr);
	OSSL_ASSERT(0 < ::ASN1_INTEGER_set(serialPtr, spec.serialNumber));
	auto notBefore = ::X509_getm_notBefore(x);
	OSSL_ASSERT(notBefore);
	OSSL_ASSERT(::X509_gmtime_adj(notBefore, spec.offsetNotBefore));
	auto notAfter = ::X509_getm_notAfter(x);
	OSSL_ASSERT(notAfter);
	OSSL_ASSERT(::X509_gmtime_adj(notAfter, spec.offsetNotAfter));
	OSSL_ASSERT(0 < ::X509_set_pubkey(x, keypair.nativeHandle()));
	auto subjectName = ::X509_get_subject_name(x);
	OSSL_ASSERT(subjectName);
	for (const auto& entry : spec.subjectName) {
		// field names are expected to null-terminate
		auto fieldName = entry.field.toString();
		OSSL_ASSERT(0 <
		            ::X509_NAME_add_entry_by_txt(
		                subjectName, fieldName.c_str(), MBSTRING_ASC, entry.bytes.begin(), entry.bytes.size(), -1, 0));
	}
	auto issuerName = ::X509_get_issuer_name(x);
	OSSL_ASSERT(issuerName);
	OSSL_ASSERT(::X509_set_issuer_name(x, (isSelfSigned ? subjectName : ::X509_get_subject_name(issuer.cert.get()))));
	auto ctx = X509V3_CTX{};
	X509V3_set_ctx_nodb(&ctx);
	::X509V3_set_ctx(&ctx, (isSelfSigned ? x : issuer.cert.get()), x, nullptr, nullptr, 0);
	for (const auto& entry : spec.extensions) {
		// extension field names and values are expected to null-terminate
		auto extName = entry.field.toString();
		auto extValue = entry.bytes.toString();
		auto extNid = ::OBJ_txt2nid(extName.c_str());
		if (extNid == NID_undef) {
			TraceEvent(SevWarnAlways, "MkCertInvalidExtName").suppressFor(10).detail("Name", extName);
			throw tls_error();
		}
#ifdef OPENSSL_IS_BORINGSSL
		auto ext = ::X509V3_EXT_nconf_nid(nullptr, &ctx, extNid, const_cast<char*>(extValue.c_str()));
#else
		auto ext = ::X509V3_EXT_nconf_nid(nullptr, &ctx, extNid, extValue.c_str());
#endif
		OSSL_ASSERT(ext);
		auto extGuard = ScopeExit([ext]() { ::X509_EXTENSION_free(ext); });
		OSSL_ASSERT(::X509_add_ext(x, ext, -1));