2 * X.509 base functions for creating certificates / CSRs
4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5 * SPDX-License-Identifier: GPL-2.0
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, write to the Free Software Foundation, Inc.,
19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 * This file is part of mbed TLS (https://tls.mbed.org)
24 #if !defined(MBEDTLS_CONFIG_FILE)
25 #include "mbedtls/config.h"
27 #include MBEDTLS_CONFIG_FILE
30 #if defined(MBEDTLS_X509_CREATE_C)
32 #include "mbedtls/x509.h"
33 #include "mbedtls/asn1write.h"
34 #include "mbedtls/oid.h"
42 } x509_attr_descriptor_t
;
44 #define ADD_STRLEN( s ) s, sizeof( s ) - 1
46 static const x509_attr_descriptor_t x509_attrs
[] =
48 { ADD_STRLEN( "CN" ), MBEDTLS_OID_AT_CN
},
49 { ADD_STRLEN( "commonName" ), MBEDTLS_OID_AT_CN
},
50 { ADD_STRLEN( "C" ), MBEDTLS_OID_AT_COUNTRY
},
51 { ADD_STRLEN( "countryName" ), MBEDTLS_OID_AT_COUNTRY
},
52 { ADD_STRLEN( "O" ), MBEDTLS_OID_AT_ORGANIZATION
},
53 { ADD_STRLEN( "organizationName" ), MBEDTLS_OID_AT_ORGANIZATION
},
54 { ADD_STRLEN( "L" ), MBEDTLS_OID_AT_LOCALITY
},
55 { ADD_STRLEN( "locality" ), MBEDTLS_OID_AT_LOCALITY
},
56 { ADD_STRLEN( "R" ), MBEDTLS_OID_PKCS9_EMAIL
},
57 { ADD_STRLEN( "OU" ), MBEDTLS_OID_AT_ORG_UNIT
},
58 { ADD_STRLEN( "organizationalUnitName" ), MBEDTLS_OID_AT_ORG_UNIT
},
59 { ADD_STRLEN( "ST" ), MBEDTLS_OID_AT_STATE
},
60 { ADD_STRLEN( "stateOrProvinceName" ), MBEDTLS_OID_AT_STATE
},
61 { ADD_STRLEN( "emailAddress" ), MBEDTLS_OID_PKCS9_EMAIL
},
62 { ADD_STRLEN( "serialNumber" ), MBEDTLS_OID_AT_SERIAL_NUMBER
},
63 { ADD_STRLEN( "postalAddress" ), MBEDTLS_OID_AT_POSTAL_ADDRESS
},
64 { ADD_STRLEN( "postalCode" ), MBEDTLS_OID_AT_POSTAL_CODE
},
65 { ADD_STRLEN( "dnQualifier" ), MBEDTLS_OID_AT_DN_QUALIFIER
},
66 { ADD_STRLEN( "title" ), MBEDTLS_OID_AT_TITLE
},
67 { ADD_STRLEN( "surName" ), MBEDTLS_OID_AT_SUR_NAME
},
68 { ADD_STRLEN( "SN" ), MBEDTLS_OID_AT_SUR_NAME
},
69 { ADD_STRLEN( "givenName" ), MBEDTLS_OID_AT_GIVEN_NAME
},
70 { ADD_STRLEN( "GN" ), MBEDTLS_OID_AT_GIVEN_NAME
},
71 { ADD_STRLEN( "initials" ), MBEDTLS_OID_AT_INITIALS
},
72 { ADD_STRLEN( "pseudonym" ), MBEDTLS_OID_AT_PSEUDONYM
},
73 { ADD_STRLEN( "generationQualifier" ), MBEDTLS_OID_AT_GENERATION_QUALIFIER
},
74 { ADD_STRLEN( "domainComponent" ), MBEDTLS_OID_DOMAIN_COMPONENT
},
75 { ADD_STRLEN( "DC" ), MBEDTLS_OID_DOMAIN_COMPONENT
},
79 static const char *x509_at_oid_from_name( const char *name
, size_t name_len
)
81 const x509_attr_descriptor_t
*cur
;
83 for( cur
= x509_attrs
; cur
->name
!= NULL
; cur
++ )
84 if( cur
->name_len
== name_len
&&
85 strncmp( cur
->name
, name
, name_len
) == 0 )
91 int mbedtls_x509_string_to_names( mbedtls_asn1_named_data
**head
, const char *name
)
94 const char *s
= name
, *c
= s
;
95 const char *end
= s
+ strlen( s
);
96 const char *oid
= NULL
;
98 char data
[MBEDTLS_X509_MAX_DN_NAME_SIZE
];
101 /* Clear existing chain if present */
102 mbedtls_asn1_free_named_data_list( head
);
106 if( in_tag
&& *c
== '=' )
108 if( ( oid
= x509_at_oid_from_name( s
, c
- s
) ) == NULL
)
110 ret
= MBEDTLS_ERR_X509_UNKNOWN_OID
;
119 if( !in_tag
&& *c
== '\\' && c
!= end
)
123 /* Check for valid escaped characters */
124 if( c
== end
|| *c
!= ',' )
126 ret
= MBEDTLS_ERR_X509_INVALID_NAME
;
130 else if( !in_tag
&& ( *c
== ',' || c
== end
) )
132 if( mbedtls_asn1_store_named_data( head
, oid
, strlen( oid
),
133 (unsigned char *) data
,
136 return( MBEDTLS_ERR_X509_ALLOC_FAILED
);
139 while( c
< end
&& *(c
+ 1) == ' ' )
146 if( !in_tag
&& s
!= c
+ 1 )
150 if( d
- data
== MBEDTLS_X509_MAX_DN_NAME_SIZE
)
152 ret
= MBEDTLS_ERR_X509_INVALID_NAME
;
165 /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved
166 * to store the critical boolean for us
168 int mbedtls_x509_set_extension( mbedtls_asn1_named_data
**head
, const char *oid
, size_t oid_len
,
169 int critical
, const unsigned char *val
, size_t val_len
)
171 mbedtls_asn1_named_data
*cur
;
173 if( ( cur
= mbedtls_asn1_store_named_data( head
, oid
, oid_len
,
174 NULL
, val_len
+ 1 ) ) == NULL
)
176 return( MBEDTLS_ERR_X509_ALLOC_FAILED
);
179 cur
->val
.p
[0] = critical
;
180 memcpy( cur
->val
.p
+ 1, val
, val_len
);
186 * RelativeDistinguishedName ::=
187 * SET OF AttributeTypeAndValue
189 * AttributeTypeAndValue ::= SEQUENCE {
190 * type AttributeType,
191 * value AttributeValue }
193 * AttributeType ::= OBJECT IDENTIFIER
195 * AttributeValue ::= ANY DEFINED BY AttributeType
197 static int x509_write_name( unsigned char **p
, unsigned char *start
,
198 const char *oid
, size_t oid_len
,
199 const unsigned char *name
, size_t name_len
)
204 // Write PrintableString for all except MBEDTLS_OID_PKCS9_EMAIL
206 if( MBEDTLS_OID_SIZE( MBEDTLS_OID_PKCS9_EMAIL
) == oid_len
&&
207 memcmp( oid
, MBEDTLS_OID_PKCS9_EMAIL
, oid_len
) == 0 )
209 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_ia5_string( p
, start
,
215 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_printable_string( p
, start
,
222 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_oid( p
, start
, oid
, oid_len
) );
224 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, len
) );
225 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_CONSTRUCTED
|
226 MBEDTLS_ASN1_SEQUENCE
) );
228 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, len
) );
229 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_CONSTRUCTED
|
230 MBEDTLS_ASN1_SET
) );
235 int mbedtls_x509_write_names( unsigned char **p
, unsigned char *start
,
236 mbedtls_asn1_named_data
*first
)
240 mbedtls_asn1_named_data
*cur
= first
;
244 MBEDTLS_ASN1_CHK_ADD( len
, x509_write_name( p
, start
, (char *) cur
->oid
.p
,
246 cur
->val
.p
, cur
->val
.len
) );
250 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, len
) );
251 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_CONSTRUCTED
|
252 MBEDTLS_ASN1_SEQUENCE
) );
257 int mbedtls_x509_write_sig( unsigned char **p
, unsigned char *start
,
258 const char *oid
, size_t oid_len
,
259 unsigned char *sig
, size_t size
)
264 if( *p
< start
|| (size_t)( *p
- start
) < size
)
265 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL
);
269 memcpy( *p
, sig
, len
);
272 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL
);
277 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, len
) );
278 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_BIT_STRING
) );
282 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_algorithm_identifier( p
, start
, oid
,
288 static int x509_write_extension( unsigned char **p
, unsigned char *start
,
289 mbedtls_asn1_named_data
*ext
)
294 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_raw_buffer( p
, start
, ext
->val
.p
+ 1,
295 ext
->val
.len
- 1 ) );
296 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, ext
->val
.len
- 1 ) );
297 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_OCTET_STRING
) );
299 if( ext
->val
.p
[0] != 0 )
301 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_bool( p
, start
, 1 ) );
304 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_raw_buffer( p
, start
, ext
->oid
.p
,
306 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, ext
->oid
.len
) );
307 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_OID
) );
309 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_len( p
, start
, len
) );
310 MBEDTLS_ASN1_CHK_ADD( len
, mbedtls_asn1_write_tag( p
, start
, MBEDTLS_ASN1_CONSTRUCTED
|
311 MBEDTLS_ASN1_SEQUENCE
) );
317 * Extension ::= SEQUENCE {
318 * extnID OBJECT IDENTIFIER,
319 * critical BOOLEAN DEFAULT FALSE,
320 * extnValue OCTET STRING
321 * -- contains the DER encoding of an ASN.1 value
322 * -- corresponding to the extension type identified
326 int mbedtls_x509_write_extensions( unsigned char **p
, unsigned char *start
,
327 mbedtls_asn1_named_data
*first
)
331 mbedtls_asn1_named_data
*cur_ext
= first
;
333 while( cur_ext
!= NULL
)
335 MBEDTLS_ASN1_CHK_ADD( len
, x509_write_extension( p
, start
, cur_ext
) );
336 cur_ext
= cur_ext
->next
;
342 #endif /* MBEDTLS_X509_CREATE_C */