generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

add -rmd option to set OCSP response signing digest

Browse Source
This commit is contained in:
Dr. Stephen Henson 2012-12-16 00:10:03 +00:00
parent e9754726d2
commit bbdfbacdef
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
apps/ocsp.c
View File

@ -105,7 +105,7 @@ static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
long maxage); long maxage);
static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, CA_DB *db, static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, CA_DB *db,
X509 *ca, X509 *rcert, EVP_PKEY *rkey, X509 *ca, X509 *rcert, EVP_PKEY *rkey, const EVP_MD *md,
STACK_OF(X509) *rother, unsigned long flags, STACK_OF(X509) *rother, unsigned long flags,
int nmin, int ndays, int badsig); int nmin, int ndays, int badsig);
@ -166,7 +166,7 @@ int MAIN(int argc, char **argv)
char *rca_filename = NULL; char *rca_filename = NULL;
CA_DB *rdb = NULL; CA_DB *rdb = NULL;
int nmin = 0, ndays = -1; int nmin = 0, ndays = -1;
const EVP_MD *cert_id_md = NULL; const EVP_MD *cert_id_md = NULL, *rsign_md = NULL;
if (bio_err == NULL) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE); if (bio_err == NULL) bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
@ -568,6 +568,17 @@ int MAIN(int argc, char **argv)
} }
else badarg = 1; else badarg = 1;
} }
else if (!strcmp(*args, "-rmd"))
{
if (args[1])
{
args++;
rsign_md = EVP_get_digestbyname(*args);
if (!rsign_md)
badarg = 1;
}
else badarg = 1;
}
else if ((cert_id_md = EVP_get_digestbyname((*args)+1))==NULL) else if ((cert_id_md = EVP_get_digestbyname((*args)+1))==NULL)
{ {
badarg = 1; badarg = 1;
@ -777,7 +788,7 @@ int MAIN(int argc, char **argv)
if (rdb) if (rdb)
{ {
i = make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey, rother, rflags, nmin, ndays, badsig); i = make_ocsp_response(&resp, req, rdb, rca_cert, rsigner, rkey,rsign_md, rother, rflags, nmin, ndays, badsig);
if (cbio) if (cbio)
send_ocsp_response(cbio, resp); send_ocsp_response(cbio, resp);
} }
@ -1083,7 +1094,8 @@ static int print_ocsp_summary(BIO *out, OCSP_BASICRESP *bs, OCSP_REQUEST *req,
static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, CA_DB *db, static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, CA_DB *db,
X509 *ca, X509 *rcert, EVP_PKEY *rkey, X509 *ca, X509 *rcert,
EVP_PKEY *rkey, const EVP_MD *rmd,
STACK_OF(X509) *rother, unsigned long flags, STACK_OF(X509) *rother, unsigned long flags,
int nmin, int ndays, int badsig) int nmin, int ndays, int badsig)
{ {
@ -1174,7 +1186,7 @@ static int make_ocsp_response(OCSP_RESPONSE **resp, OCSP_REQUEST *req, CA_DB *db
OCSP_copy_nonce(bs, req); OCSP_copy_nonce(bs, req);
OCSP_basic_sign(bs, rcert, rkey, NULL, rother, flags); OCSP_basic_sign(bs, rcert, rkey, rmd, rother, flags);
if (badsig) if (badsig)
bs->signature->data[bs->signature->length -1] ^= 0x1; bs->signature->data[bs->signature->length -1] ^= 0x1;