Jerome Poichet | 7c99785 | 2014-05-20 10:50:05 -0700 | [diff] [blame^] | 1 | // Copyright 2012 Google Inc. All Rights Reserved. |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | // Utilities for converting SSL certificates using OpenSSL functions. |
| 16 | |
| 17 | #include "polo/util/certificateutil.h" |
| 18 | |
| 19 | #include <glog/logging.h> |
| 20 | |
| 21 | namespace polo { |
| 22 | namespace util { |
| 23 | |
| 24 | X509* CertificateUtil::X509FromPEM(std::string pem) { |
| 25 | BIO* bio = BIO_new_mem_buf(&pem[0], pem.size()); |
| 26 | X509* x509 = PEM_read_bio_X509(bio, NULL, 0, NULL); |
| 27 | BIO_free(bio); |
| 28 | |
| 29 | // Ensure that the certificate is not expired. |
| 30 | if (X509_cmp_current_time(X509_get_notBefore(x509)) > 0 |
| 31 | || X509_cmp_current_time(X509_get_notAfter(x509)) < 0) { |
| 32 | LOG(ERROR) << "Expired certificate"; |
| 33 | X509_free(x509); |
| 34 | return NULL; |
| 35 | } |
| 36 | |
| 37 | return x509; |
| 38 | } |
| 39 | |
| 40 | std::string CertificateUtil::X509ToPEM(X509* x509) { |
| 41 | BIO* bio = BIO_new(BIO_s_mem()); |
| 42 | PEM_write_bio_X509(bio, x509); |
| 43 | BIO_flush(bio); |
| 44 | |
| 45 | char* data = NULL; |
| 46 | size_t data_size = BIO_get_mem_data(bio, &data); |
| 47 | |
| 48 | std::string pem(data, data_size); |
| 49 | BIO_free(bio); |
| 50 | |
| 51 | return pem; |
| 52 | } |
| 53 | |
| 54 | EVP_PKEY* CertificateUtil::PKEYFromPEM(std::string pem, |
| 55 | std::string passphrase) { |
| 56 | BIO* bio = BIO_new_mem_buf(&pem[0], pem.size()); |
| 57 | EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bio, NULL, 0, &passphrase[0]); |
| 58 | BIO_free(bio); |
| 59 | |
| 60 | return pkey; |
| 61 | } |
| 62 | |
| 63 | std::string CertificateUtil::PKEYToPEM(EVP_PKEY* pkey, |
| 64 | std::string passphrase) { |
| 65 | BIO* bio = BIO_new(BIO_s_mem()); |
| 66 | PEM_write_bio_PrivateKey(bio, pkey, EVP_des_ede3_cbc(), NULL, 0, 0, |
| 67 | &passphrase[0]); |
| 68 | BIO_flush(bio); |
| 69 | |
| 70 | char* data = NULL; |
| 71 | int data_size = BIO_get_mem_data(bio, &data); |
| 72 | |
| 73 | std::string pem(data, data_size); |
| 74 | BIO_free(bio); |
| 75 | |
| 76 | return pem; |
| 77 | } |
| 78 | |
| 79 | EVP_PKEY* CertificateUtil::GeneratePrivateKey() { |
| 80 | EVP_PKEY* pkey = EVP_PKEY_new(); |
| 81 | RSA* rsa = RSA_generate_key(1025, RSA_F4, NULL, NULL); |
| 82 | EVP_PKEY_assign_RSA(pkey, rsa); |
| 83 | return pkey; |
| 84 | } |
| 85 | |
| 86 | X509* CertificateUtil::GenerateSelfSignedCert(EVP_PKEY* pkey, |
| 87 | std::string subject_name, |
| 88 | uint32_t days) { |
| 89 | X509* x509 = X509_new(); |
| 90 | X509_set_version(x509, 2); |
| 91 | ASN1_INTEGER_set(X509_get_serialNumber(x509), 0); |
| 92 | X509_gmtime_adj(X509_get_notBefore(x509), 0); |
| 93 | X509_gmtime_adj(X509_get_notAfter(x509), (int64_t) 60 * 60 * 24 * days); |
| 94 | X509_set_pubkey(x509, pkey); |
| 95 | |
| 96 | X509_NAME* name = X509_get_subject_name(x509); |
| 97 | X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, |
| 98 | (unsigned char*) &subject_name[0], -1, -1, 0); |
| 99 | |
| 100 | X509_set_issuer_name(x509, name); |
| 101 | X509_sign(x509, pkey, EVP_sha256()); |
| 102 | |
| 103 | return x509; |
| 104 | } |
| 105 | |
| 106 | } // namespace util |
| 107 | } // namespace polo |