]>
Commit | Line | Data |
---|---|---|
b1322259 | 1 | /* |
fecb3aae | 2 | * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. |
d02b48c6 | 3 | * |
3e4b43b9 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
b1322259 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
d02b48c6 RE |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
b39fc560 | 11 | #include "internal/cryptlib.h" |
ec577822 BM |
12 | #include <openssl/buffer.h> |
13 | #include <openssl/bn.h> | |
ec577822 BM |
14 | #include <openssl/objects.h> |
15 | #include <openssl/x509.h> | |
16 | #include <openssl/x509v3.h> | |
25f2138b | 17 | #include "crypto/asn1.h" |
31b28ad9 | 18 | #include "crypto/x509.h" |
d02b48c6 | 19 | |
79b2a2f2 DDO |
20 | void OSSL_STACK_OF_X509_free(STACK_OF(X509) *certs) |
21 | { | |
22 | sk_X509_pop_free(certs, X509_free); | |
23 | } | |
24 | ||
4b618848 | 25 | #ifndef OPENSSL_NO_STDIO |
6b691a5c | 26 | int X509_print_fp(FILE *fp, X509 *x) |
0f113f3e MC |
27 | { |
28 | return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); | |
29 | } | |
d0c98589 | 30 | |
0f113f3e MC |
31 | int X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, |
32 | unsigned long cflag) | |
33 | { | |
34 | BIO *b; | |
35 | int ret; | |
36 | ||
37 | if ((b = BIO_new(BIO_s_file())) == NULL) { | |
9311d0c4 | 38 | ERR_raise(ERR_LIB_X509, ERR_R_BUF_LIB); |
26a7d938 | 39 | return 0; |
0f113f3e MC |
40 | } |
41 | BIO_set_fp(b, fp, BIO_NOCLOSE); | |
42 | ret = X509_print_ex(b, x, nmflag, cflag); | |
43 | BIO_free(b); | |
26a7d938 | 44 | return ret; |
0f113f3e | 45 | } |
d02b48c6 RE |
46 | #endif |
47 | ||
6b691a5c | 48 | int X509_print(BIO *bp, X509 *x) |
d0c98589 | 49 | { |
0f113f3e | 50 | return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT); |
d0c98589 DSH |
51 | } |
52 | ||
0f113f3e MC |
53 | int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, |
54 | unsigned long cflag) | |
55 | { | |
56 | long l; | |
57 | int ret = 0, i; | |
36699c12 | 58 | char mlch = ' '; |
02db7354 | 59 | int nmindent = 0, printok = 0; |
0f113f3e MC |
60 | EVP_PKEY *pkey = NULL; |
61 | const char *neg; | |
62 | ||
63 | if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) { | |
64 | mlch = '\n'; | |
65 | nmindent = 12; | |
66 | } | |
67 | ||
2126ca3d | 68 | if (nmflags == XN_FLAG_COMPAT) |
02db7354 | 69 | printok = 1; |
0f113f3e | 70 | |
0f113f3e MC |
71 | if (!(cflag & X509_FLAG_NO_HEADER)) { |
72 | if (BIO_write(bp, "Certificate:\n", 13) <= 0) | |
73 | goto err; | |
74 | if (BIO_write(bp, " Data:\n", 10) <= 0) | |
75 | goto err; | |
76 | } | |
77 | if (!(cflag & X509_FLAG_NO_VERSION)) { | |
78 | l = X509_get_version(x); | |
cdf63a37 | 79 | if (l >= X509_VERSION_1 && l <= X509_VERSION_3) { |
676befbe KR |
80 | if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n", "", l + 1, (unsigned long)l) <= 0) |
81 | goto err; | |
82 | } else { | |
83 | if (BIO_printf(bp, "%8sVersion: Unknown (%ld)\n", "", l) <= 0) | |
84 | goto err; | |
85 | } | |
0f113f3e MC |
86 | } |
87 | if (!(cflag & X509_FLAG_NO_SERIAL)) { | |
1337a3a9 | 88 | const ASN1_INTEGER *bs = X509_get0_serialNumber(x); |
0f113f3e MC |
89 | |
90 | if (BIO_write(bp, " Serial Number:", 22) <= 0) | |
91 | goto err; | |
92 | ||
0f113f3e | 93 | if (bs->length <= (int)sizeof(long)) { |
4336de0c DSH |
94 | ERR_set_mark(); |
95 | l = ASN1_INTEGER_get(bs); | |
96 | ERR_pop_to_mark(); | |
97 | } else { | |
98 | l = -1; | |
99 | } | |
100 | if (l != -1) { | |
244d7b28 | 101 | unsigned long ul; |
0f113f3e | 102 | if (bs->type == V_ASN1_NEG_INTEGER) { |
244d7b28 | 103 | ul = 0 - (unsigned long)l; |
0f113f3e | 104 | neg = "-"; |
c4a60150 | 105 | } else { |
244d7b28 | 106 | ul = l; |
0f113f3e | 107 | neg = ""; |
c4a60150 | 108 | } |
244d7b28 | 109 | if (BIO_printf(bp, " %s%lu (%s0x%lx)\n", neg, ul, neg, ul) <= 0) |
0f113f3e MC |
110 | goto err; |
111 | } else { | |
112 | neg = (bs->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : ""; | |
113 | if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0) | |
114 | goto err; | |
115 | ||
116 | for (i = 0; i < bs->length; i++) { | |
117 | if (BIO_printf(bp, "%02x%c", bs->data[i], | |
118 | ((i + 1 == bs->length) ? '\n' : ':')) <= 0) | |
119 | goto err; | |
120 | } | |
121 | } | |
122 | ||
123 | } | |
124 | ||
125 | if (!(cflag & X509_FLAG_NO_SIGNAME)) { | |
8900f3e3 | 126 | const X509_ALGOR *tsig_alg = X509_get0_tbs_sigalg(x); |
e6cccb5f YL |
127 | |
128 | if (BIO_puts(bp, " ") <= 0) | |
129 | goto err; | |
699f1635 | 130 | if (X509_signature_print(bp, tsig_alg, NULL) <= 0) |
0f113f3e | 131 | goto err; |
0f113f3e MC |
132 | } |
133 | ||
134 | if (!(cflag & X509_FLAG_NO_ISSUER)) { | |
135 | if (BIO_printf(bp, " Issuer:%c", mlch) <= 0) | |
136 | goto err; | |
137 | if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags) | |
02db7354 | 138 | < printok) |
0f113f3e MC |
139 | goto err; |
140 | if (BIO_write(bp, "\n", 1) <= 0) | |
141 | goto err; | |
142 | } | |
143 | if (!(cflag & X509_FLAG_NO_VALIDITY)) { | |
144 | if (BIO_write(bp, " Validity\n", 17) <= 0) | |
145 | goto err; | |
146 | if (BIO_write(bp, " Not Before: ", 24) <= 0) | |
147 | goto err; | |
8c5bff22 | 148 | if (ossl_asn1_time_print_ex(bp, X509_get0_notBefore(x), ASN1_DTFLGS_RFC822) == 0) |
0f113f3e MC |
149 | goto err; |
150 | if (BIO_write(bp, "\n Not After : ", 25) <= 0) | |
151 | goto err; | |
8c5bff22 | 152 | if (ossl_asn1_time_print_ex(bp, X509_get0_notAfter(x), ASN1_DTFLGS_RFC822) == 0) |
0f113f3e MC |
153 | goto err; |
154 | if (BIO_write(bp, "\n", 1) <= 0) | |
155 | goto err; | |
156 | } | |
157 | if (!(cflag & X509_FLAG_NO_SUBJECT)) { | |
158 | if (BIO_printf(bp, " Subject:%c", mlch) <= 0) | |
159 | goto err; | |
160 | if (X509_NAME_print_ex | |
02db7354 | 161 | (bp, X509_get_subject_name(x), nmindent, nmflags) < printok) |
0f113f3e MC |
162 | goto err; |
163 | if (BIO_write(bp, "\n", 1) <= 0) | |
164 | goto err; | |
165 | } | |
166 | if (!(cflag & X509_FLAG_NO_PUBKEY)) { | |
699f1635 DSH |
167 | X509_PUBKEY *xpkey = X509_get_X509_PUBKEY(x); |
168 | ASN1_OBJECT *xpoid; | |
169 | X509_PUBKEY_get0_param(&xpoid, NULL, NULL, NULL, xpkey); | |
0f113f3e MC |
170 | if (BIO_write(bp, " Subject Public Key Info:\n", 33) <= 0) |
171 | goto err; | |
172 | if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0) | |
173 | goto err; | |
699f1635 | 174 | if (i2a_ASN1_OBJECT(bp, xpoid) <= 0) |
0f113f3e MC |
175 | goto err; |
176 | if (BIO_puts(bp, "\n") <= 0) | |
177 | goto err; | |
178 | ||
c01ff880 | 179 | pkey = X509_get0_pubkey(x); |
0f113f3e MC |
180 | if (pkey == NULL) { |
181 | BIO_printf(bp, "%12sUnable to load Public Key\n", ""); | |
182 | ERR_print_errors(bp); | |
183 | } else { | |
184 | EVP_PKEY_print_public(bp, pkey, 16, NULL); | |
0f113f3e MC |
185 | } |
186 | } | |
187 | ||
188 | if (!(cflag & X509_FLAG_NO_IDS)) { | |
8900f3e3 DSH |
189 | const ASN1_BIT_STRING *iuid, *suid; |
190 | X509_get0_uids(x, &iuid, &suid); | |
699f1635 | 191 | if (iuid != NULL) { |
0f113f3e MC |
192 | if (BIO_printf(bp, "%8sIssuer Unique ID: ", "") <= 0) |
193 | goto err; | |
699f1635 | 194 | if (!X509_signature_dump(bp, iuid, 12)) |
0f113f3e MC |
195 | goto err; |
196 | } | |
699f1635 | 197 | if (suid != NULL) { |
0f113f3e MC |
198 | if (BIO_printf(bp, "%8sSubject Unique ID: ", "") <= 0) |
199 | goto err; | |
699f1635 | 200 | if (!X509_signature_dump(bp, suid, 12)) |
0f113f3e MC |
201 | goto err; |
202 | } | |
203 | } | |
204 | ||
076bf8c2 DDO |
205 | if (!(cflag & X509_FLAG_NO_EXTENSIONS) |
206 | && !X509V3_extensions_print(bp, "X509v3 extensions", | |
207 | X509_get0_extensions(x), cflag, 8)) | |
208 | goto err; | |
0f113f3e MC |
209 | |
210 | if (!(cflag & X509_FLAG_NO_SIGDUMP)) { | |
8adc1cb8 DSH |
211 | const X509_ALGOR *sig_alg; |
212 | const ASN1_BIT_STRING *sig; | |
699f1635 DSH |
213 | X509_get0_signature(&sig, &sig_alg, x); |
214 | if (X509_signature_print(bp, sig_alg, sig) <= 0) | |
0f113f3e MC |
215 | goto err; |
216 | } | |
217 | if (!(cflag & X509_FLAG_NO_AUX)) { | |
699f1635 | 218 | if (!X509_aux_print(bp, x, 0)) |
0f113f3e MC |
219 | goto err; |
220 | } | |
221 | ret = 1; | |
222 | err: | |
26a7d938 | 223 | return ret; |
0f113f3e MC |
224 | } |
225 | ||
226 | int X509_ocspid_print(BIO *bp, X509 *x) | |
227 | { | |
228 | unsigned char *der = NULL; | |
229 | unsigned char *dertmp; | |
230 | int derlen; | |
231 | int i; | |
232 | unsigned char SHA1md[SHA_DIGEST_LENGTH]; | |
699f1635 | 233 | ASN1_BIT_STRING *keybstr; |
8cc86b81 | 234 | const X509_NAME *subj; |
192d5008 | 235 | EVP_MD *md = NULL; |
0f113f3e | 236 | |
192d5008 P |
237 | if (x == NULL || bp == NULL) |
238 | return 0; | |
0f113f3e MC |
239 | /* |
240 | * display the hash of the subject as it would appear in OCSP requests | |
241 | */ | |
242 | if (BIO_printf(bp, " Subject OCSP hash: ") <= 0) | |
243 | goto err; | |
699f1635 DSH |
244 | subj = X509_get_subject_name(x); |
245 | derlen = i2d_X509_NAME(subj, NULL); | |
42e7d2f1 SL |
246 | if (derlen <= 0) |
247 | goto err; | |
b196e7d9 | 248 | if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL) |
0f113f3e | 249 | goto err; |
699f1635 | 250 | i2d_X509_NAME(subj, &dertmp); |
0f113f3e | 251 | |
192d5008 P |
252 | md = EVP_MD_fetch(x->libctx, SN_sha1, x->propq); |
253 | if (md == NULL) | |
254 | goto err; | |
255 | if (!EVP_Digest(der, derlen, SHA1md, NULL, md, NULL)) | |
0f113f3e MC |
256 | goto err; |
257 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { | |
258 | if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) | |
259 | goto err; | |
260 | } | |
261 | OPENSSL_free(der); | |
262 | der = NULL; | |
263 | ||
264 | /* | |
265 | * display the hash of the public key as it would appear in OCSP requests | |
266 | */ | |
267 | if (BIO_printf(bp, "\n Public key OCSP hash: ") <= 0) | |
268 | goto err; | |
269 | ||
699f1635 DSH |
270 | keybstr = X509_get0_pubkey_bitstr(x); |
271 | ||
272 | if (keybstr == NULL) | |
273 | goto err; | |
274 | ||
17ebf85a | 275 | if (!EVP_Digest(ASN1_STRING_get0_data(keybstr), |
192d5008 | 276 | ASN1_STRING_length(keybstr), SHA1md, NULL, md, NULL)) |
0f113f3e MC |
277 | goto err; |
278 | for (i = 0; i < SHA_DIGEST_LENGTH; i++) { | |
279 | if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0) | |
280 | goto err; | |
281 | } | |
282 | BIO_printf(bp, "\n"); | |
192d5008 | 283 | EVP_MD_free(md); |
0f113f3e | 284 | |
208fb891 | 285 | return 1; |
0f113f3e | 286 | err: |
b548a1f1 | 287 | OPENSSL_free(der); |
192d5008 | 288 | EVP_MD_free(md); |
26a7d938 | 289 | return 0; |
0f113f3e | 290 | } |
eb64730b | 291 | |
fa1ba589 | 292 | int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent) |
de487514 | 293 | { |
0f113f3e MC |
294 | const unsigned char *s; |
295 | int i, n; | |
296 | ||
297 | n = sig->length; | |
298 | s = sig->data; | |
299 | for (i = 0; i < n; i++) { | |
300 | if ((i % 18) == 0) { | |
a4c467c9 | 301 | if (i > 0 && BIO_write(bp, "\n", 1) <= 0) |
0f113f3e MC |
302 | return 0; |
303 | if (BIO_indent(bp, indent, indent) <= 0) | |
304 | return 0; | |
305 | } | |
306 | if (BIO_printf(bp, "%02x%s", s[i], ((i + 1) == n) ? "" : ":") <= 0) | |
307 | return 0; | |
308 | } | |
309 | if (BIO_write(bp, "\n", 1) != 1) | |
310 | return 0; | |
311 | ||
312 | return 1; | |
de487514 DSH |
313 | } |
314 | ||
5e6089f0 MC |
315 | int X509_signature_print(BIO *bp, const X509_ALGOR *sigalg, |
316 | const ASN1_STRING *sig) | |
fa1ba589 | 317 | { |
0f113f3e | 318 | int sig_nid; |
5743d126 DO |
319 | int indent = 4; |
320 | if (BIO_printf(bp, "%*sSignature Algorithm: ", indent, "") <= 0) | |
0f113f3e MC |
321 | return 0; |
322 | if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0) | |
323 | return 0; | |
324 | ||
5743d126 DO |
325 | if (sig && BIO_printf(bp, "\n%*sSignature Value:", indent, "") <= 0) |
326 | return 0; | |
0f113f3e MC |
327 | sig_nid = OBJ_obj2nid(sigalg->algorithm); |
328 | if (sig_nid != NID_undef) { | |
329 | int pkey_nid, dig_nid; | |
330 | const EVP_PKEY_ASN1_METHOD *ameth; | |
331 | if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) { | |
332 | ameth = EVP_PKEY_asn1_find(NULL, pkey_nid); | |
333 | if (ameth && ameth->sig_print) | |
5743d126 | 334 | return ameth->sig_print(bp, sigalg, sig, indent + 4, 0); |
0f113f3e MC |
335 | } |
336 | } | |
a4c467c9 DO |
337 | if (BIO_write(bp, "\n", 1) != 1) |
338 | return 0; | |
0f113f3e | 339 | if (sig) |
5743d126 | 340 | return X509_signature_dump(bp, sig, indent + 4); |
0f113f3e | 341 | return 1; |
fa1ba589 | 342 | } |
699f1635 DSH |
343 | |
344 | int X509_aux_print(BIO *out, X509 *x, int indent) | |
345 | { | |
346 | char oidstr[80], first; | |
347 | STACK_OF(ASN1_OBJECT) *trust, *reject; | |
348 | const unsigned char *alias, *keyid; | |
349 | int keyidlen; | |
350 | int i; | |
351 | if (X509_trusted(x) == 0) | |
352 | return 1; | |
353 | trust = X509_get0_trust_objects(x); | |
354 | reject = X509_get0_reject_objects(x); | |
355 | if (trust) { | |
356 | first = 1; | |
357 | BIO_printf(out, "%*sTrusted Uses:\n%*s", indent, "", indent + 2, ""); | |
358 | for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++) { | |
359 | if (!first) | |
360 | BIO_puts(out, ", "); | |
361 | else | |
362 | first = 0; | |
cbe29648 | 363 | OBJ_obj2txt(oidstr, sizeof(oidstr), |
699f1635 DSH |
364 | sk_ASN1_OBJECT_value(trust, i), 0); |
365 | BIO_puts(out, oidstr); | |
366 | } | |
367 | BIO_puts(out, "\n"); | |
368 | } else | |
369 | BIO_printf(out, "%*sNo Trusted Uses.\n", indent, ""); | |
370 | if (reject) { | |
371 | first = 1; | |
372 | BIO_printf(out, "%*sRejected Uses:\n%*s", indent, "", indent + 2, ""); | |
373 | for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++) { | |
374 | if (!first) | |
375 | BIO_puts(out, ", "); | |
376 | else | |
377 | first = 0; | |
cbe29648 | 378 | OBJ_obj2txt(oidstr, sizeof(oidstr), |
699f1635 DSH |
379 | sk_ASN1_OBJECT_value(reject, i), 0); |
380 | BIO_puts(out, oidstr); | |
381 | } | |
382 | BIO_puts(out, "\n"); | |
383 | } else | |
384 | BIO_printf(out, "%*sNo Rejected Uses.\n", indent, ""); | |
c5dc9ab9 | 385 | alias = X509_alias_get0(x, &i); |
699f1635 | 386 | if (alias) |
c5dc9ab9 | 387 | BIO_printf(out, "%*sAlias: %.*s\n", indent, "", i, alias); |
699f1635 DSH |
388 | keyid = X509_keyid_get0(x, &keyidlen); |
389 | if (keyid) { | |
390 | BIO_printf(out, "%*sKey Id: ", indent, ""); | |
391 | for (i = 0; i < keyidlen; i++) | |
392 | BIO_printf(out, "%s%02X", i ? ":" : "", keyid[i]); | |
393 | BIO_write(out, "\n", 1); | |
394 | } | |
395 | return 1; | |
396 | } | |
31b28ad9 DDO |
397 | |
398 | /* | |
399 | * Helper functions for improving certificate verification error diagnostics | |
400 | */ | |
401 | ||
4669015d | 402 | int ossl_x509_print_ex_brief(BIO *bio, X509 *cert, unsigned long neg_cflags) |
31b28ad9 DDO |
403 | { |
404 | unsigned long flags = ASN1_STRFLGS_RFC2253 | ASN1_STRFLGS_ESC_QUOTE | | |
405 | XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN; | |
406 | ||
407 | if (cert == NULL) | |
408 | return BIO_printf(bio, " (no certificate)\n") > 0; | |
409 | if (BIO_printf(bio, " certificate\n") <= 0 | |
410 | || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_SUBJECT)) | |
411 | return 0; | |
412 | if (X509_check_issued((X509 *)cert, cert) == X509_V_OK) { | |
413 | if (BIO_printf(bio, " self-issued\n") <= 0) | |
414 | return 0; | |
415 | } else { | |
416 | if (BIO_printf(bio, " ") <= 0 | |
417 | || !X509_print_ex(bio, cert, flags, ~X509_FLAG_NO_ISSUER)) | |
418 | return 0; | |
419 | } | |
420 | if (!X509_print_ex(bio, cert, flags, | |
421 | ~(X509_FLAG_NO_SERIAL | X509_FLAG_NO_VALIDITY))) | |
422 | return 0; | |
423 | if (X509_cmp_current_time(X509_get0_notBefore(cert)) > 0) | |
424 | if (BIO_printf(bio, " not yet valid\n") <= 0) | |
425 | return 0; | |
426 | if (X509_cmp_current_time(X509_get0_notAfter(cert)) < 0) | |
427 | if (BIO_printf(bio, " no more valid\n") <= 0) | |
428 | return 0; | |
076bf8c2 DDO |
429 | return X509_print_ex(bio, cert, flags, |
430 | ~neg_cflags & ~X509_FLAG_EXTENSIONS_ONLY_KID); | |
31b28ad9 DDO |
431 | } |
432 | ||
433 | static int print_certs(BIO *bio, const STACK_OF(X509) *certs) | |
434 | { | |
435 | int i; | |
436 | ||
437 | if (certs == NULL || sk_X509_num(certs) <= 0) | |
438 | return BIO_printf(bio, " (no certificates)\n") >= 0; | |
439 | ||
440 | for (i = 0; i < sk_X509_num(certs); i++) { | |
441 | X509 *cert = sk_X509_value(certs, i); | |
076bf8c2 DDO |
442 | |
443 | if (cert != NULL) { | |
4669015d | 444 | if (!ossl_x509_print_ex_brief(bio, cert, 0)) |
076bf8c2 DDO |
445 | return 0; |
446 | if (!X509V3_extensions_print(bio, NULL, | |
447 | X509_get0_extensions(cert), | |
448 | X509_FLAG_EXTENSIONS_ONLY_KID, 8)) | |
449 | return 0; | |
450 | } | |
31b28ad9 DDO |
451 | } |
452 | return 1; | |
453 | } | |
454 | ||
455 | static int print_store_certs(BIO *bio, X509_STORE *store) | |
456 | { | |
457 | if (store != NULL) { | |
458 | STACK_OF(X509) *certs = X509_STORE_get1_all_certs(store); | |
459 | int ret = print_certs(bio, certs); | |
460 | ||
79b2a2f2 | 461 | OSSL_STACK_OF_X509_free(certs); |
31b28ad9 DDO |
462 | return ret; |
463 | } else { | |
464 | return BIO_printf(bio, " (no trusted store)\n") >= 0; | |
465 | } | |
466 | } | |
467 | ||
468 | /* Extend the error queue with details on a failed cert verification */ | |
469 | int X509_STORE_CTX_print_verify_cb(int ok, X509_STORE_CTX *ctx) | |
470 | { | |
471 | if (ok == 0 && ctx != NULL) { | |
472 | int cert_error = X509_STORE_CTX_get_error(ctx); | |
31b28ad9 DDO |
473 | BIO *bio = BIO_new(BIO_s_mem()); /* may be NULL */ |
474 | ||
ecf60b9e | 475 | if (bio == NULL) |
318e9799 | 476 | return 0; |
278260bf | 477 | BIO_printf(bio, "%s at depth = %d error = %d (%s)\n", |
31b28ad9 | 478 | X509_STORE_CTX_get0_parent_ctx(ctx) != NULL |
278260bf DDO |
479 | ? "CRL path validation" |
480 | : "Certificate verification", | |
481 | X509_STORE_CTX_get_error_depth(ctx), | |
482 | cert_error, X509_verify_cert_error_string(cert_error)); | |
483 | { | |
484 | X509_STORE *ts = X509_STORE_CTX_get0_store(ctx); | |
485 | X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts); | |
486 | char *str; | |
487 | int idx = 0; | |
488 | ||
489 | switch (cert_error) { | |
490 | case X509_V_ERR_HOSTNAME_MISMATCH: | |
491 | BIO_printf(bio, "Expected hostname(s) = "); | |
492 | while ((str = X509_VERIFY_PARAM_get0_host(vpm, idx++)) != NULL) | |
493 | BIO_printf(bio, "%s%s", idx == 1 ? "" : ", ", str); | |
494 | BIO_printf(bio, "\n"); | |
495 | break; | |
496 | case X509_V_ERR_EMAIL_MISMATCH: | |
497 | str = X509_VERIFY_PARAM_get0_email(vpm); | |
498 | if (str != NULL) | |
499 | BIO_printf(bio, "Expected email address = %s\n", str); | |
500 | break; | |
501 | case X509_V_ERR_IP_ADDRESS_MISMATCH: | |
502 | str = X509_VERIFY_PARAM_get1_ip_asc(vpm); | |
503 | if (str != NULL) | |
504 | BIO_printf(bio, "Expected IP address = %s\n", str); | |
505 | OPENSSL_free(str); | |
506 | break; | |
507 | default: | |
508 | break; | |
509 | } | |
510 | } | |
511 | ||
512 | BIO_printf(bio, "Failure for:\n"); | |
4669015d SL |
513 | ossl_x509_print_ex_brief(bio, X509_STORE_CTX_get_current_cert(ctx), |
514 | X509_FLAG_NO_EXTENSIONS); | |
31b28ad9 DDO |
515 | if (cert_error == X509_V_ERR_CERT_UNTRUSTED |
516 | || cert_error == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT | |
517 | || cert_error == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN | |
518 | || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT | |
519 | || cert_error == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY | |
520 | || cert_error == X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER | |
521 | || cert_error == X509_V_ERR_STORE_LOOKUP) { | |
278260bf | 522 | BIO_printf(bio, "Non-trusted certs:\n"); |
31b28ad9 | 523 | print_certs(bio, X509_STORE_CTX_get0_untrusted(ctx)); |
278260bf | 524 | BIO_printf(bio, "Certs in trust store:\n"); |
31b28ad9 DDO |
525 | print_store_certs(bio, X509_STORE_CTX_get0_store(ctx)); |
526 | } | |
9311d0c4 | 527 | ERR_raise(ERR_LIB_X509, X509_R_CERTIFICATE_VERIFICATION_FAILED); |
31b28ad9 DDO |
528 | ERR_add_error_mem_bio("\n", bio); |
529 | BIO_free(bio); | |
530 | } | |
531 | ||
31b28ad9 DDO |
532 | return ok; |
533 | } |