Botan 1.10.17

x509self.cpp
Go to the documentation of this file.
1 /*
2 * PKCS #10/Self Signed Cert Creation
3 * (C) 1999-2008 Jack Lloyd
4 *
5 * Distributed under the terms of the Botan license
6 */
7
8 #include <botan/x509self.h>
9 #include <botan/x509_ext.h>
10 #include <botan/x509_ca.h>
11 #include <botan/der_enc.h>
12 #include <botan/oids.h>
13 #include <botan/pipe.h>
14 #include <memory>
15
16 namespace Botan {
17
18 namespace {
19
20 /*
21 * Load information from the X509_Cert_Options
22 */
23 void load_info(const X509_Cert_Options& opts, X509_DN& subject_dn,
24 AlternativeName& subject_alt)
25 {
26 subject_dn.add_attribute("X520.CommonName", opts.common_name);
27 subject_dn.add_attribute("X520.Country", opts.country);
28 subject_dn.add_attribute("X520.State", opts.state);
29 subject_dn.add_attribute("X520.Locality", opts.locality);
30 subject_dn.add_attribute("X520.Organization", opts.organization);
31 subject_dn.add_attribute("X520.OrganizationalUnit", opts.org_unit);
32 subject_dn.add_attribute("X520.SerialNumber", opts.serial_number);
33 subject_alt = AlternativeName(opts.email, opts.uri, opts.dns, opts.ip);
34 subject_alt.add_othername(OIDS::lookup("PKIX.XMPPAddr"),
35 opts.xmpp, UTF8_STRING);
36 }
37
38 }
39
40 namespace X509 {
41
42 /*
43 * Create a new self-signed X.509 certificate
44 */
45 X509_Certificate create_self_signed_cert(const X509_Cert_Options& opts,
46 const Private_Key& key,
47 const std::string& hash_fn,
48 RandomNumberGenerator& rng)
49 {
50 AlgorithmIdentifier sig_algo;
51 X509_DN subject_dn;
52 AlternativeName subject_alt;
53
54 opts.sanity_check();
55
56 MemoryVector<byte> pub_key = X509::BER_encode(key);
57 std::auto_ptr<PK_Signer> signer(choose_sig_format(key, hash_fn, sig_algo));
58 load_info(opts, subject_dn, subject_alt);
59
60 Key_Constraints constraints;
61 if(opts.is_CA)
62 constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
63 else
64 constraints = find_constraints(key, opts.constraints);
65
66 Extensions extensions;
67
68 extensions.add(
69 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit),
70 true);
71
72 extensions.add(new Cert_Extension::Key_Usage(constraints), true);
73
74 extensions.add(new Cert_Extension::Subject_Key_ID(pub_key));
75
76 extensions.add(
77 new Cert_Extension::Subject_Alternative_Name(subject_alt));
78
79 extensions.add(
80 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
81
82 return X509_CA::make_cert(signer.get(), rng, sig_algo, pub_key,
83 opts.start, opts.end,
84 subject_dn, subject_dn,
85 extensions);
86 }
87
88 /*
89 * Create a PKCS #10 certificate request
90 */
91 PKCS10_Request create_cert_req(const X509_Cert_Options& opts,
92 const Private_Key& key,
93 const std::string& hash_fn,
94 RandomNumberGenerator& rng)
95 {
96 AlgorithmIdentifier sig_algo;
97 X509_DN subject_dn;
98 AlternativeName subject_alt;
99
100 opts.sanity_check();
101
102 MemoryVector<byte> pub_key = X509::BER_encode(key);
103 std::auto_ptr<PK_Signer> signer(choose_sig_format(key, hash_fn, sig_algo));
104 load_info(opts, subject_dn, subject_alt);
105
106 const size_t PKCS10_VERSION = 0;
107
108 Extensions extensions;
109
110 extensions.add(
111 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit));
112 extensions.add(
113 new Cert_Extension::Key_Usage(
114 opts.is_CA ? Key_Constraints(KEY_CERT_SIGN | CRL_SIGN) :
115 find_constraints(key, opts.constraints)
116 )
117 );
118 extensions.add(
119 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
120 extensions.add(
121 new Cert_Extension::Subject_Alternative_Name(subject_alt));
122
123 DER_Encoder tbs_req;
124
125 tbs_req.start_cons(SEQUENCE)
126 .encode(PKCS10_VERSION)
127 .encode(subject_dn)
128 .raw_bytes(pub_key)
129 .start_explicit(0);
130
131 if(opts.challenge != "")
132 {
133 ASN1_String challenge(opts.challenge, DIRECTORY_STRING);
134
135 tbs_req.encode(
136 Attribute("PKCS9.ChallengePassword",
137 DER_Encoder().encode(challenge).get_contents()
138 )
139 );
140 }
141
142 tbs_req.encode(
143 Attribute("PKCS9.ExtensionRequest",
144 DER_Encoder()
145 .start_cons(SEQUENCE)
146 .encode(extensions)
147 .end_cons()
148 .get_contents()
149 )
150 )
151 .end_explicit()
152 .end_cons();
153
154 DataSource_Memory source(
155 X509_Object::make_signed(signer.get(),
156 rng,
157 sig_algo,
158 tbs_req.get_contents())
159 );
160
161 return PKCS10_Request(source);
162 }
163
164 }
165
166 }
Botan::Cert_Extension::Key_Usage
Definition: x509_ext.h:121
Botan::X509::create_cert_req
PKCS10_Request create_cert_req(const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
Definition: x509self.cpp:91
Botan::DER_Encoder::get_contents
SecureVector< byte > get_contents()
Definition: der_enc.cpp:122
Botan::X509_CA::make_cert
static X509_Certificate make_cert(PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &sig_algo, const MemoryRegion< byte > &pub_key, const X509_Time &not_before, const X509_Time &not_after, const X509_DN &issuer_dn, const X509_DN &subject_dn, const Extensions &extensions)
Definition: x509_ca.cpp:90
Botan::DER_Encoder::raw_bytes
DER_Encoder & raw_bytes(const byte val[], size_t len)
Definition: der_enc.cpp:188
Botan::RandomNumberGenerator
Definition: rng.h:20
Botan::Private_Key
Definition: pk_keys.h:86
Botan::X509::BER_encode
MemoryVector< byte > BER_encode(const Public_Key &key)
Definition: x509_key.cpp:21
Botan::Cert_Extension::Subject_Alternative_Name
Definition: x509_ext.h:218
Botan::Extensions
Definition: x509_ext.h:66
Botan::DER_Encoder::end_explicit
DER_Encoder & end_explicit()
Definition: der_enc.cpp:172
Botan::Cert_Extension::Extended_Key_Usage
Definition: x509_ext.h:242
Botan::Cert_Extension::Subject_Key_ID
Definition: x509_ext.h:144
Botan::DER_Encoder::start_explicit
DER_Encoder & start_explicit(u16bit type_tag)
Definition: der_enc.cpp:159
Botan::DER_Encoder::end_cons
DER_Encoder & end_cons()
Definition: der_enc.cpp:145
Botan::Cert_Extension::Basic_Constraints
Definition: x509_ext.h:95
Botan::X509_Cert_Options::path_limit
size_t path_limit
Definition: x509self.h:105
Botan::ASN1_String
Definition: asn1_str.h:18
Botan::Extensions::add
void add(Certificate_Extension *extn, bool critical=false)
Definition: x509_ext.cpp:77
Botan::DER_Encoder::encode
DER_Encoder & encode(bool b)
Definition: der_enc.cpp:209
Botan::DER_Encoder
Definition: der_enc.h:22
Botan::CRL_SIGN
Definition: pubkey_enums.h:26
Botan::X509_Certificate
Definition: x509cert.h:23
Botan::X509::find_constraints
Key_Constraints find_constraints(const Public_Key &pub_key, Key_Constraints limits)
Definition: x509_key.cpp:113
Botan::OIDS::lookup
std::string lookup(const OID &oid)
Definition: oids.cpp:31
Botan::X509_Cert_Options::is_CA
bool is_CA
Definition: x509self.h:100
Botan::X509::encode
void encode(const Public_Key &key, Pipe &pipe, X509_Encoding encoding=PEM)
Definition: x509_key.h:87
Botan::X509_Cert_Options::constraints
Key_Constraints constraints
Definition: x509self.h:110
Botan::X509_DN
Definition: x509_dn.h:21
Botan::X509_Cert_Options::sanity_check
void sanity_check() const
Definition: x509opt.cpp:67
Botan::SEQUENCE
Definition: asn1_int.h:35
Botan::PKCS10_Request
Definition: pkcs10.h:22
Botan
Definition: algo_base.h:14
Botan::MemoryVector< byte >
Botan::DIRECTORY_STRING
Definition: asn1_int.h:50
Botan::X509_Object::make_signed
static MemoryVector< byte > make_signed(class PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &alg_id, const MemoryRegion< byte > &tbs)
Definition: x509_obj.cpp:204
Botan::DataSource_Memory
Definition: data_src.h:94
Botan::UTF8_STRING
Definition: asn1_int.h:38
Botan::AlgorithmIdentifier
Definition: alg_id.h:20
Botan::X509_Cert_Options::end
X509_Time end
Definition: x509self.h:95
Botan::DER_Encoder::start_cons
DER_Encoder & start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: der_enc.cpp:135
Botan::X509_Cert_Options
Definition: x509self.h:20
Botan::X509_Cert_Options::start
X509_Time start
Definition: x509self.h:91
Botan::Key_Constraints
Key_Constraints
Definition: pubkey_enums.h:18
Botan::X509_Cert_Options::ex_constraints
std::vector< OID > ex_constraints
Definition: x509self.h:115
Botan::Attribute
Definition: asn1_obj.h:24
Botan::KEY_CERT_SIGN
Definition: pubkey_enums.h:25
Botan::X509_Cert_Options::challenge
std::string challenge
Definition: x509self.h:86
Botan::AlternativeName
Definition: asn1_obj.h:68
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:218
Botan::X509::create_self_signed_cert
X509_Certificate create_self_signed_cert(const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
Definition: x509self.cpp:45