1 // Copyright 2012 Google Inc. All Rights Reserved. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 // Utilities for converting SSL certificates using OpenSSL functions. 16 17 #include "polo/util/certificateutil.h" 18 19 #include <glog/logging.h> 20 21 namespace polo { 22 namespace util { 23 24 X509* CertificateUtil::X509FromPEM(std::string pem) { 25 BIO* bio = BIO_new_mem_buf(&pem[0], pem.size()); 26 X509* x509 = PEM_read_bio_X509(bio, NULL, 0, NULL); 27 BIO_free(bio); 28 29 // Ensure that the certificate is not expired. 30 if (X509_cmp_current_time(X509_get_notBefore(x509)) > 0 31 || X509_cmp_current_time(X509_get_notAfter(x509)) < 0) { 32 LOG(ERROR) << "Expired certificate"; 33 X509_free(x509); 34 return NULL; 35 } 36 37 return x509; 38 } 39 40 std::string CertificateUtil::X509ToPEM(X509* x509) { 41 BIO* bio = BIO_new(BIO_s_mem()); 42 PEM_write_bio_X509(bio, x509); 43 BIO_flush(bio); 44 45 char* data = NULL; 46 size_t data_size = BIO_get_mem_data(bio, &data); 47 48 std::string pem(data, data_size); 49 BIO_free(bio); 50 51 return pem; 52 } 53 54 EVP_PKEY* CertificateUtil::PKEYFromPEM(std::string pem, 55 std::string passphrase) { 56 BIO* bio = BIO_new_mem_buf(&pem[0], pem.size()); 57 EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bio, NULL, 0, &passphrase[0]); 58 BIO_free(bio); 59 60 return pkey; 61 } 62 63 std::string CertificateUtil::PKEYToPEM(EVP_PKEY* pkey, 64 std::string passphrase) { 65 BIO* bio = BIO_new(BIO_s_mem()); 66 PEM_write_bio_PrivateKey(bio, pkey, EVP_des_ede3_cbc(), NULL, 0, 0, 67 &passphrase[0]); 68 BIO_flush(bio); 69 70 char* data = NULL; 71 int data_size = BIO_get_mem_data(bio, &data); 72 73 std::string pem(data, data_size); 74 BIO_free(bio); 75 76 return pem; 77 } 78 79 EVP_PKEY* CertificateUtil::GeneratePrivateKey() { 80 EVP_PKEY* pkey = EVP_PKEY_new(); 81 RSA* rsa = RSA_generate_key(1025, RSA_F4, NULL, NULL); 82 EVP_PKEY_assign_RSA(pkey, rsa); 83 return pkey; 84 } 85 86 X509* CertificateUtil::GenerateSelfSignedCert(EVP_PKEY* pkey, 87 std::string subject_name, 88 uint32_t days) { 89 X509* x509 = X509_new(); 90 X509_set_version(x509, 2); 91 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0); 92 X509_gmtime_adj(X509_get_notBefore(x509), 0); 93 X509_gmtime_adj(X509_get_notAfter(x509), (int64_t) 60 * 60 * 24 * days); 94 X509_set_pubkey(x509, pkey); 95 96 X509_NAME* name = X509_get_subject_name(x509); 97 X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, 98 (unsigned char*) &subject_name[0], -1, -1, 0); 99 100 X509_set_issuer_name(x509, name); 101 X509_sign(x509, pkey, EVP_sha256()); 102 103 return x509; 104 } 105 106 } // namespace util 107 } // namespace polo 108
