scepclient: Option added to read self-signed certificate from a file.

diff --git a/src/scepclient/scepclient.8 b/src/scepclient/scepclient.8
index 1bcc4ef44d6cc38dc5006d04a9b84a744a679705..89f86e371673cb9f7bd0920d21ff2ef3a6426a1f 100644 (file)
--- a/src/scepclient/scepclient.8
+++ b/src/scepclient/scepclient.8
@@ -73,7 +73,7 @@ The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
 .B \-i, \-\-in \fItype\fP[=\fIfilename\fP]
 .RS 4
 Input file for certificate enrollment. This option can be specified multiple times to specify input files for every \fItype\fP.
-Input files can bei either DER or PEM encoded.
+Input files can be either DER or PEM encoded.
 .PP
 Supported values for \fItype\fP:
 .IP "\fBpkcs1\fP" 12
@@ -88,6 +88,11 @@ The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
 CA certificate to check signature of SCEP reply. Has to be specified for certificate enrollment.
 .br
 The default \fIfilename\fP is $CONFDIR/ipsec.d/cacerts/caCert.der.
+.IP "\fBcert-self\fP" 12
+Certificate to be used in the SCEP request.  If it is not specified a
+self-signed certificate is generated automatically.
+.br
+The default \fIfilename\fP is $CONFDIR/ipsec.d/certs/selfCert.der.
 .RE
 .PP
 .B \-k, \-\-keylength \fIbits\fP

diff --git a/src/scepclient/scepclient.c b/src/scepclient/scepclient.c
index 2df6d7a5f5537cb3def9b79e7a5793111100cefa..40fbc85029ee1db3064f91b629b7ae2a3d2dec8b 100644 (file)
--- a/src/scepclient/scepclient.c
+++ b/src/scepclient/scepclient.c
@@ -317,9 +317,12 @@ static void usage(const char *message)
                " --version (-v)                    show version and exit\n"
                " --quiet (-q)                      do not write log output to stderr\n"
                " --in (-i) <type>[=<filename>]     use <filename> of <type> for input \n"
-               "                                   <type> = pkcs1 | cacert-enc | cacert-sig\n"
-               "                                   - if no pkcs1 input is defined, a \n"
-               "                                     RSA key will be generated\n"
+               "                                   <type> = pkcs1 | cacert-enc | cacert-sig |\n"
+               "                                            cert-self\n"
+               "                                   - if no pkcs1 input is defined, an RSA\n"
+               "                                     key will be generated\n"
+               "                                   - if no cert-self input is defined, a\n"
+               "                                     self-signed certificate will be generated\n"
                "                                   - if no filename is given, default is used\n"
                " --out (-o) <type>[=<filename>]    write output of <type> to <filename>\n"
                "                                   multiple outputs are allowed\n"
@@ -389,7 +392,7 @@ int main(int argc, char **argv)
                CERT_SELF  =  0x08,
                CERT       =  0x10,
                CACERT_ENC =  0x20,
-               CACERT_SIG =  0x40
+               CACERT_SIG =  0x40,
        } scep_filetype_t;
 
        /* filetype to read from, defaults to "generate a key" */
@@ -400,6 +403,7 @@ int main(int argc, char **argv)
 
        /* input files */
        char *file_in_pkcs1      = DEFAULT_FILENAME_PKCS1;
+       char *file_in_cert_self  = DEFAULT_FILENAME_CERT_SELF;
        char *file_in_cacert_enc = DEFAULT_FILENAME_CACERT_ENC;
        char *file_in_cacert_sig = DEFAULT_FILENAME_CACERT_SIG;
 
@@ -560,7 +564,13 @@ int main(int argc, char **argv)
                                {
                                        filetype_in |= CACERT_SIG;
                                        if (filename)
-                                                file_in_cacert_sig = filename;
+                                               file_in_cacert_sig = filename;
+                               }
+                               else if (strcaseeq("cert-self", optarg))
+                               {
+                                       filetype_in |= CERT_SELF;
+                                       if (filename)
+                                               file_in_cert_self = filename;
                                }
                                else
                                {
@@ -1110,22 +1120,39 @@ int main(int argc, char **argv)
        scep_generate_transaction_id(public_key, &transID, &serialNumber);
        DBG1(DBG_APP, "  transaction ID: %.*s", (int)transID.len, transID.ptr);
 
-       notBefore = notBefore ? notBefore : time(NULL);
-       notAfter  = notAfter  ? notAfter  : (notBefore + validity);
-
-       /* generate a self-signed X.509 certificate */
-       x509_signer = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-                                                                        BUILD_SIGNING_KEY, private_key,
-                                                                        BUILD_PUBLIC_KEY, public_key,
-                                                                        BUILD_SUBJECT, subject,
-                                                                        BUILD_NOT_BEFORE_TIME, notBefore,
-                                                                        BUILD_NOT_AFTER_TIME, notAfter,
-                                                                        BUILD_SERIAL, serialNumber,
-                                                                        BUILD_SUBJECT_ALTNAMES, subjectAltNames,
-                                                                        BUILD_END);
-       if (!x509_signer)
+       /*
+        * read or generate self-signed X.509 certificate
+        */
+       if (filetype_in & CERT_SELF)
+       {
+               char path[PATH_MAX];
+
+               join_paths(path, sizeof(path), HOST_CERT_PATH, file_in_cert_self);
+
+               x509_signer = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+                                                                                BUILD_FROM_FILE, path, BUILD_END);
+               if (!x509_signer)
+               {
+                       exit_scepclient("could not read certificate file '%s'", path);
+               }
+       }
+       else
        {
-               exit_scepclient("generating certificate failed");
+               notBefore = notBefore ? notBefore : time(NULL);
+               notAfter  = notAfter  ? notAfter  : (notBefore + validity);
+               x509_signer = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
+                                                                                BUILD_SIGNING_KEY, private_key,
+                                                                                BUILD_PUBLIC_KEY, public_key,
+                                                                                BUILD_SUBJECT, subject,
+                                                                                BUILD_NOT_BEFORE_TIME, notBefore,
+                                                                                BUILD_NOT_AFTER_TIME, notAfter,
+                                                                                BUILD_SERIAL, serialNumber,
+                                                                                BUILD_SUBJECT_ALTNAMES, subjectAltNames,
+                                                                                BUILD_END);
+               if (!x509_signer)
+               {
+                       exit_scepclient("generating certificate failed");
+               }
        }
 
        /*