📄 certproc.c
字号:
return( FALSE );
if( !certProcess( CRYPT_ALGO_ELGAMAL, "Elgamal", cryptCAKey, FALSE ) )
return( FALSE );
if( !certProcess( CRYPT_ALGO_DH, "Diffie-Hellman", cryptCAKey, FALSE ) )
return( FALSE );
/* Run the test again with a CRMF instead of PKCS #10 request */
if( !certProcess( CRYPT_ALGO_RSA, "RSA", cryptCAKey, TRUE ) )
return( FALSE );
/* Clean up */
cryptDestroyContext( cryptCAKey );
return( TRUE );
}
/****************************************************************************
* *
* CA Certificate Management Test *
* *
****************************************************************************/
/* Since opening the cert store for update creates a log entry each time,
we open it once at the start and then call a series of sub-tests with
the store open throughout the tests. This also allows us to keep the
CA key active througout */
static const CERT_DATA FAR_BSS cert1Data[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Test user 1" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "test1@testusers.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Re-select the subject name after poking around in the altName */
{ CRYPT_CERTINFO_SUBJECTNAME, IS_NUMERIC, CRYPT_UNUSED },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA FAR_BSS revokableCert1Data[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Revoked cert user 1" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "test2@testusers.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Re-select the subject name after poking around in the altName */
{ CRYPT_CERTINFO_SUBJECTNAME, IS_NUMERIC, CRYPT_UNUSED },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA FAR_BSS revokableCert2Data[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Revoked cert user 2" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "revoked1@testusers.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Re-select the subject name after poking around in the altName */
{ CRYPT_CERTINFO_SUBJECTNAME, IS_NUMERIC, CRYPT_UNUSED },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA FAR_BSS expiredCert1Data[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Expired cert user 1" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "revoked2@testusers.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Re-select the subject name after poking around in the altName */
{ CRYPT_CERTINFO_SUBJECTNAME, IS_NUMERIC, CRYPT_UNUSED },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA FAR_BSS expiredCert2Data[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Expired cert user 2" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "expired2@testusers.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Re-select the subject name after poking around in the altName */
{ CRYPT_CERTINFO_SUBJECTNAME, IS_NUMERIC, CRYPT_UNUSED },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA FAR_BSS certCAData[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Test CA user" ) },
/* CA extensions. These should be rejected/stripped by the cert
management code, since new CAs can only be created by the issuing CA
specifying it in the PKI user info */
{ CRYPT_CERTINFO_KEYUSAGE, IS_NUMERIC,
CRYPT_KEYUSAGE_KEYCERTSIGN | CRYPT_KEYUSAGE_CRLSIGN },
{ CRYPT_CERTINFO_CA, IS_NUMERIC, TRUE },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
/* Add a certification request to the cert store */
static int addCertRequest( const CRYPT_KEYSET cryptCertStore,
const CERT_DATA *certReqData,
const BOOLEAN isExpired )
{
CRYPT_CONTEXT cryptContext;
CRYPT_CERTIFICATE cryptCertRequest;
int length, status;
/* Generate a (short) key for the request */
status = cryptCreateContext( &cryptContext, CRYPT_UNUSED,
CRYPT_ALGO_RSA );
if( cryptStatusError( status ) )
return( status );
cryptSetAttributeString( cryptContext, CRYPT_CTXINFO_LABEL,
TEXT( "Private key" ),
paramStrlen( TEXT( "Private key" ) ) );
status = cryptGenerateKey( cryptContext );
if( cryptStatusError( status ) )
{
printf( "Creation of private key for cert failed with error code %d, "
"line %d.\n", status, __LINE__ );
return( FALSE );
}
/* Create the certification request. If we're adding an expiry time
we have to make it a CRMF request since a standard request can't
handle this */
status = cryptCreateCert( &cryptCertRequest, CRYPT_UNUSED, isExpired ? \
CRYPT_CERTTYPE_REQUEST_CERT : CRYPT_CERTTYPE_CERTREQUEST );
if( cryptStatusError( status ) )
{
printf( "cryptCreateCert() failed with error code %d, line %d.\n",
status, __LINE__ );
return( FALSE );
}
status = cryptSetAttribute( cryptCertRequest,
CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, cryptContext );
#ifndef _WIN32_WCE
if( cryptStatusOK( status ) && isExpired )
{
const time_t theTime = time( NULL ) + 5;
/* Set the expiry time to a few seconds after the current time to
ensure that the cert has expired by the time we need it. This
is a tiny bit risky since it requires that the interval between
setting this attribute and the creation of the cert below is
less than five seconds, however there's no easy way to guarantee
the creation of a pre-expired cert since if we set the time too
far back it won't be created */
status = cryptSetAttributeString( cryptCertRequest,
CRYPT_CERTINFO_VALIDTO, &theTime, sizeof( time_t ) );
}
#endif /* _WIN32_WCE */
if( cryptStatusError( status ) )
return( attrErrorExit( cryptCertRequest, "cryptSetAttribute()",
status, __LINE__ ) );
if( !addCertFields( cryptCertRequest, certReqData, __LINE__ ) )
return( FALSE );
status = cryptSignCert( cryptCertRequest, cryptContext );
cryptDestroyContext( cryptContext );
if( cryptStatusError( status ) )
return( attrErrorExit( cryptCertRequest, "cryptSignCert()",
status, __LINE__ ) );
/* Export the request, destroy it, and recreate it by importing it again.
This is just a pedantic check to make sure that we emulate exactly a
real-world scenario of an externally-obtained request */
status = cryptExportCert( certBuffer, BUFFER_SIZE, &length,
CRYPT_CERTFORMAT_CERTIFICATE,
cryptCertRequest );
cryptDestroyCert( cryptCertRequest );
if( cryptStatusOK( status ) )
status = cryptImportCert( certBuffer, length, CRYPT_UNUSED,
&cryptCertRequest );
if( cryptStatusError( status ) )
{
printf( "Couldn't export/re-import cert request, status = %d, "
"line %d.\n", status, __LINE__ );
return( FALSE );
}
/* Add the request to the cert store */
status = cryptCAAddItem( cryptCertStore, cryptCertRequest );
if( cryptStatusError( status ) )
return( extErrorExit( cryptCertStore, "cryptCAAddItem()", status,
__LINE__ ) );
return( cryptCertRequest );
}
/* Add a revocation request to the cert store. This code isn't currently
used because CMP doesn't allow revocation requests to be signed, so we
can't create a signed object to add directly but have to come in via
CMP */
#if 0
static int addRevRequest( const CRYPT_KEYSET cryptCertStore,
const CERT_DATA *certReqData )
{
CRYPT_CERTIFICATE cryptCert, cryptCertRequest;
int i, status;
/* Find the CN of the cert we're revoking and use it to fetch the cert */
for( i = 0; certReqData[ i ].componentType != CRYPT_ATTRIBUTE_NONE; i++ )
if( certReqData[ i ].type == CRYPT_CERTINFO_COMMONNAME )
printf( "Revoking certificate for '%s'.\n",
( char * ) certReqData[ i ].stringValue );
status = cryptGetPublicKey( cryptCertStore, &cryptCert, CRYPT_KEYID_NAME,
certReqData[ i ].stringValue );
if( cryptStatusError( status ) )
return( extErrorExit( cryptCertStore, "cryptGetPublicKey()", status,
__LINE__ ) );
/* Create the revocation request */
status = cryptCreateCert( &cryptCertRequest, CRYPT_UNUSED,
CRYPT_CERTTYPE_REQUEST_REVOCATION );
if( cryptStatusError( status ) )
{
printf( "cryptCreateCert() failed with error code %d, line %d.\n",
status, __LINE__ );
return( FALSE );
}
status = cryptSetAttribute( cryptCertRequest, CRYPT_CERTINFO_CERTIFICATE,
cryptCert );
if( cryptStatusError( status ) )
return( attrErrorExit( cryptCertRequest, "cryptSetAttribute()",
status, __LINE__ ) );
if( !addCertFields( cryptCertRequest, revRequestData, __LINE__ ) )
return( FALSE );
/* Add the request to the cert store */
status = cryptCAAddItem( cryptCertStore, cryptCertRequest );
if( cryptStatusError( status ) )
return( extErrorExit( cryptCertStore, "cryptCAAddItem()", status,
__LINE__ ) );
return( cryptCertRequest );
}
#endif /* 0 */
/* Issue a certificate from a cert request */
static int issueCert( const CRYPT_KEYSET cryptCertStore,
const CRYPT_CONTEXT cryptCAKey,
const CERT_DATA *certReqData, const BOOLEAN isExpired,
const BOOLEAN issueShouldFail )
{
CRYPT_CERTIFICATE cryptCertRequest;
int i, status;
/* Provide some feedback on what we're doing */
for( i = 0; certReqData[ i ].componentType != CRYPT_ATTRIBUTE_NONE; i++ )
if( certReqData[ i ].type == CRYPT_CERTINFO_COMMONNAME )
printf( "Issuing certificate for '%s'.\n",
( char * ) certReqData[ i ].stringValue );
/* Issue the cert via the cert store */
cryptCertRequest = addCertRequest( cryptCertStore, certReqData, isExpired );
if( !cryptCertRequest )
return( FALSE );
status = cryptCACertManagement( NULL, CRYPT_CERTACTION_ISSUE_CERT,
cryptCertStore, cryptCAKey,
cryptCertRequest );
cryptDestroyCert( cryptCertRequest );
if( cryptStatusError( status ) )
{
if( issueShouldFail )
/* If this is a check of the request validity-checking system,
the issue is supposed to fail */
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -