certtool: allow setting arbitrary key purpose object identifiers.

diff --git a/NEWS b/NEWS
index 527f33893eb3a983658b9acb9845a757f3d4fdee..45dc287c75be341d4c097cbe9aa5d60b8385c24d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ See the end for copying conditions.
 
 * Version 2.7.2 (unreleased)
 
+** certtool: allow setting arbitrary key purpose object identifiers.
+
 ** libgnutls: Fix detection of C99 macros, to make debug logging work again.
 
 ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits.

diff --git a/doc/certtool.cfg b/doc/certtool.cfg
index 7d44d98fc24f3156b398b64ce3be39e17823bac7..635c347d083e6cc5d8683860f3316c87fe3225ee 100644 (file)
--- a/doc/certtool.cfg
+++ b/doc/certtool.cfg
@@ -110,3 +110,6 @@ signing_key
 
 # A name for a PKCS #12 key
 #pkcs12_key_name = "Anonymous key"
+
+#a space separated list of key purpose OIDs to be added
+#key_purpose_oids = "1.3.6.1.5.5.7.3.1"

diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index 7ac21650e3e11f193dc173429cd489cd35a56543..fc77307c533e023d72433e97cba6eeec484822a7 100644 (file)
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -72,6 +72,7 @@ typedef struct _cfg_ctx
   int code_sign_key;
   int ocsp_sign_key;
   int time_stamping_key;
+  char** key_purpose_oids;
   int crl_next_update;
   int crl_number;
   int crq_extensions;
@@ -121,6 +122,8 @@ template_parse (const char *template)
 
     {NULL, '\0', "dn_oid", CFG_STR + CFG_MULTI_SEPARATED,
      (void *) &cfg.dn_oid, 0},
+    {NULL, '\0', "key_purpose_oids", CFG_STR + CFG_MULTI_SEPARATED,
+     (void *) &cfg.key_purpose_oids, 0},
 
     {NULL, '\0', "crl_dist_points", CFG_STR,
      (void *) &cfg.crl_dist_points, 0},
@@ -584,6 +587,28 @@ get_oid_crt_set (gnutls_x509_crt_t crt)
            }
        }
     }
+}
+
+void
+get_key_purpose_set (gnutls_x509_crt_t crt)
+{
+  int ret, i;
+
+  if (batch)
+    {
+      if (!cfg.key_purpose_oids)
+       return;
+      for (i = 0; cfg.key_purpose_oids[i] != NULL; i ++)
+       {
+         ret = gnutls_x509_crt_set_key_purpose_oid (crt, cfg.key_purpose_oids[i], 0);
+
+         if (ret < 0)
+           {
+             fprintf (stderr, "set_key_purpose_oid (%s): %s\n",  cfg.key_purpose_oids[i], gnutls_strerror (ret));
+             exit (1);
+           }
+       }
+    }
 
 }
 

diff --git a/src/certtool.c b/src/certtool.c
index 33e8db0abcb736b474dfc1263ae817ac3660928a..0388b2bbd6dadefe0e641fc828c63940ccdc4f3e 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -304,6 +304,7 @@ generate_certificate (gnutls_x509_privkey_t * ret_key,
          get_cn_crt_set (crt);
          get_uid_crt_set (crt);
          get_oid_crt_set (crt);
+         get_key_purpose_set( crt);
 
          if (!batch)
            fprintf (stderr,