Home | History | Annotate | Download | only in cert 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "net/cert/x509_util.h"
      6 
      7 #include "base/basictypes.h"
      8 #include "base/memory/scoped_ptr.h"
      9 #include "base/time/time.h"
     10 #include "crypto/ec_private_key.h"
     11 #include "crypto/rsa_private_key.h"
     12 #include "net/cert/x509_certificate.h"
     13 
     14 namespace net {
     15 
     16 namespace x509_util {
     17 
     18 // RSA keys created by CreateKeyAndSelfSignedCert will be of this length.
     19 static const uint16 kRSAKeyLength = 1024;
     20 
     21 // Certificates made by CreateKeyAndSelfSignedCert and
     22 //  CreateKeyAndDomainBoundCertEC will be signed using this digest algorithm.
     23 static const DigestAlgorithm kSignatureDigestAlgorithm = DIGEST_SHA256;
     24 
     25 ClientCertSorter::ClientCertSorter() : now_(base::Time::Now()) {}
     26 
     27 bool ClientCertSorter::operator()(
     28     const scoped_refptr<X509Certificate>& a,
     29     const scoped_refptr<X509Certificate>& b) const {
     30   // Certificates that are null are sorted last.
     31   if (!a.get() || !b.get())
     32     return a.get() && !b.get();
     33 
     34   // Certificates that are expired/not-yet-valid are sorted last.
     35   bool a_is_valid = now_ >= a->valid_start() && now_ <= a->valid_expiry();
     36   bool b_is_valid = now_ >= b->valid_start() && now_ <= b->valid_expiry();
     37   if (a_is_valid != b_is_valid)
     38     return a_is_valid && !b_is_valid;
     39 
     40   // Certificates with longer expirations appear as higher priority (less
     41   // than) certificates with shorter expirations.
     42   if (a->valid_expiry() != b->valid_expiry())
     43     return a->valid_expiry() > b->valid_expiry();
     44 
     45   // If the expiration dates are equivalent, certificates that were issued
     46   // more recently should be prioritized over older certificates.
     47   if (a->valid_start() != b->valid_start())
     48     return a->valid_start() > b->valid_start();
     49 
     50   // Otherwise, prefer client certificates with shorter chains.
     51   const X509Certificate::OSCertHandles& a_intermediates =
     52       a->GetIntermediateCertificates();
     53   const X509Certificate::OSCertHandles& b_intermediates =
     54       b->GetIntermediateCertificates();
     55   return a_intermediates.size() < b_intermediates.size();
     56 }
     57 
     58 bool CreateKeyAndDomainBoundCertEC(const std::string& domain,
     59                                    uint32 serial_number,
     60                                    base::Time not_valid_before,
     61                                    base::Time not_valid_after,
     62                                    scoped_ptr<crypto::ECPrivateKey>* key,
     63                                    std::string* der_cert) {
     64   scoped_ptr<crypto::ECPrivateKey> new_key(crypto::ECPrivateKey::Create());
     65   if (!new_key.get())
     66     return false;
     67 
     68   bool success = CreateDomainBoundCertEC(new_key.get(),
     69                                          kSignatureDigestAlgorithm,
     70                                          domain,
     71                                          serial_number,
     72                                          not_valid_before,
     73                                          not_valid_after,
     74                                          der_cert);
     75   if (success)
     76     key->reset(new_key.release());
     77 
     78   return success;
     79 }
     80 
     81 bool CreateKeyAndSelfSignedCert(const std::string& subject,
     82                                 uint32 serial_number,
     83                                 base::Time not_valid_before,
     84                                 base::Time not_valid_after,
     85                                 scoped_ptr<crypto::RSAPrivateKey>* key,
     86                                 std::string* der_cert) {
     87   scoped_ptr<crypto::RSAPrivateKey> new_key(
     88       crypto::RSAPrivateKey::Create(kRSAKeyLength));
     89   if (!new_key.get())
     90     return false;
     91 
     92   bool success = CreateSelfSignedCert(new_key.get(),
     93                                       kSignatureDigestAlgorithm,
     94                                       subject,
     95                                       serial_number,
     96                                       not_valid_before,
     97                                       not_valid_after,
     98                                       der_cert);
     99   if (success)
    100     key->reset(new_key.release());
    101 
    102   return success;
    103 }
    104 
    105 }  // namespace x509_util
    106 
    107 }  // namespace net
    108