static void
print_certificate_info (gnutls_x509_crt crt, FILE *out, unsigned int all)
{
+ gnutls_datum_t out;
int ret;
- unsigned int i, indx, j, version;
- unsigned int critical, key_usage, bits;
- time_t tim;
- char serial[40];
- size_t serial_size = sizeof (serial), dn_size, size;
- const char *cprint;
- char dn[256];
- char oid[128] = "";
- char old_oid[128] = "";
- char *tmp;
-
- fprintf (out, "\n\nX.509 certificate info:\n\n");
-
- version = gnutls_x509_crt_get_version (crt);
- fprintf (out, "Version: %d\n", version);
-
- /* serial number
- */
- if (gnutls_x509_crt_get_serial (crt, serial, &serial_size) >= 0)
- {
- fprintf (out, "Serial Number (hex): %s\n",
- raw_to_string (serial, serial_size));
- }
-
- /* Subject
- */
- dn_size = sizeof (dn);
- ret = gnutls_x509_crt_get_dn (crt, dn, &dn_size);
- if (ret >= 0)
- fprintf (out, "Subject: %s\n", dn);
- else
- fprintf (stderr, "get_dn: %s\n", gnutls_strerror (ret));
-
- /* Issuer
- */
- if (all)
- {
- dn_size = sizeof (dn);
- ret = gnutls_x509_crt_get_issuer_dn (crt, dn, &dn_size);
- if (ret >= 0)
- fprintf (out, "Issuer: %s\n", dn);
- else
- fprintf (stderr, "get_issuer_dn: %s\n", gnutls_strerror (ret));
-
-
- /* signature algorithm
- */
- fprintf (out, "Signature Algorithm: ");
- ret = gnutls_x509_crt_get_signature_algorithm (crt);
-
- cprint = gnutls_sign_algorithm_get_name (ret);
- if (cprint == NULL)
- cprint = UNKNOWN;
- fprintf (out, "%s\n", cprint);
- if (ret == GNUTLS_SIGN_RSA_MD5 || ret == GNUTLS_SIGN_RSA_MD2)
- {
- fprintf (stderr,
- "Warning: certificate uses a broken signature algorithm that can be forged.\n");
- }
- }
-
- /* Validity
- */
- fprintf (out, "Validity:\n");
-
- tim = gnutls_x509_crt_get_activation_time (crt);
- tmp = asctime (gmtime (&tim));
- tmp[strlen(tmp)-1] = '\0';
- fprintf (out, "\tNot Before: %s UTC\n", tmp);
-
- tim = gnutls_x509_crt_get_expiration_time (crt);
- tmp = asctime (gmtime (&tim));
- tmp[strlen(tmp)-1] = '\0';
- fprintf (out, "\tNot After: %s UTC\n", tmp);
-
- /* Public key algorithm
- */
- fprintf (out, "Subject Public Key Info:\n");
- ret = gnutls_x509_crt_get_pk_algorithm (crt, &bits);
- fprintf (out, "\tPublic Key Algorithm: ");
-
- cprint = gnutls_pk_algorithm_get_name (ret);
- if (cprint == NULL)
- cprint = UNKNOWN;
- fprintf (out, "%s", cprint);
- if (ret >= 0 && bits)
- fprintf (out, " (%u bits)", bits);
- fprintf (out, "\n");
-
- /* Print the raw public keys
- */
- if (all)
- {
- if (ret == GNUTLS_PK_RSA)
- {
- gnutls_datum m, e;
-
- ret = gnutls_x509_crt_get_pk_rsa_raw (crt, &m, &e);
- if (ret < 0)
- {
- fprintf (stderr, "Error in key RSA data export: %s\n",
- gnutls_strerror (ret));
- }
-
- fprintf (outfile, "modulus:");
- print_hex_datum (&m);
- fprintf (outfile, "public exponent:");
- print_hex_datum (&e);
-
- }
- else if (ret == GNUTLS_PK_DSA)
- {
- gnutls_datum p, q, g, y;
-
- ret = gnutls_x509_crt_get_pk_dsa_raw (crt, &p, &q, &g, &y);
- if (ret < 0)
- {
- fprintf (stderr, "Error in key DSA data export: %s\n",
- gnutls_strerror (ret));
- }
-
- fprintf (outfile, "public key:");
- print_hex_datum (&y);
- fprintf (outfile, "p:");
- print_hex_datum (&p);
- fprintf (outfile, "q:");
- print_hex_datum (&q);
- fprintf (outfile, "g:");
- print_hex_datum (&g);
- }
- }
-
- if (version >= 3)
- fprintf (out, "\nX.509 Extensions:\n");
-
- /* subject alternative name
- */
- for (i = 0; !(ret < 0); i++)
- {
- size = sizeof (buffer);
- ret =
- gnutls_x509_crt_get_subject_alt_name (crt, i, buffer, &size,
- &critical);
-
- if (i == 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "\tSubject Alternative name:");
- if (critical)
- fprintf (out, " (critical)");
- fprintf (out, "\n");
- }
-
- if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "\t\tFound unsupported alternative name.\n");
- }
- else
- switch (ret)
- {
- case GNUTLS_SAN_DNSNAME:
- fprintf (out, "\t\tDNSname: %s\n", buffer);
- break;
- case GNUTLS_SAN_RFC822NAME:
- fprintf (out, "\t\tRFC822name: %s\n", buffer);
- break;
- case GNUTLS_SAN_URI:
- fprintf (out, "\t\tURI: %s\n", buffer);
- break;
- case GNUTLS_SAN_IPADDRESS:
- fprintf (out, "\t\tIPAddress: %s\n", buffer);
- break;
- case GNUTLS_SAN_OTHERNAME:
- fprintf (out, "\t\totherName:\n\t\t\tDER: ");
- for (j = 0; j < size; j++)
- {
- fprintf (out, "%.2x", (unsigned char) buffer[j]);
- }
- fprintf (out, "\n\t\t\tASCII: ");
- for (j = 0; j < size; j++)
- {
- if (isprint (buffer[j]))
- fprintf (out, "%c", (unsigned char) buffer[j]);
- else
- fprintf (out, ".");
- }
- fprintf (out, "\n");
-
- size = sizeof (buffer);
- ret = gnutls_x509_crt_get_subject_alt_othername_oid
- (crt, i, buffer, &size);
- if (ret < 0)
- fprintf (out, "\t\t\tError decoding otherName OID: %s\n",
- gnutls_strerror (ret));
- else
- {
- fprintf (out, "\t\t\tOID: %.*s", size, buffer);
- if (ret == GNUTLS_SAN_OTHERNAME_XMPP)
- fprintf (out, " (id-on-xmppAddr)");
- fprintf (out, "\n");
- }
- break;
- }
- }
-
- /* CRL dist points.
- */
- ret = 0;
- for (i = 0; !(ret < 0); i++)
- {
- size = sizeof (buffer);
- ret =
- gnutls_x509_crt_get_crl_dist_points (crt, i, buffer, &size,
- NULL, &critical);
-
- if (i == 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "\tCRL Distribution points:");
- if (critical)
- fprintf (out, " (critical)");
- fprintf (out, "\n");
- }
-
- if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "\t\tError decoding: %s\n", gnutls_strerror (ret));
- }
- else
- switch (ret)
- {
- case GNUTLS_SAN_DNSNAME:
- fprintf (out, "\t\tDNSname: %s\n", buffer);
- break;
- case GNUTLS_SAN_RFC822NAME:
- fprintf (out, "\t\tRFC822name: %s\n", buffer);
- break;
- case GNUTLS_SAN_URI:
- fprintf (out, "\t\tURI: %s\n", buffer);
- break;
- case GNUTLS_SAN_IPADDRESS:
- fprintf (out, "\t\tIPAddress: %s\n", buffer);
- break;
- }
- }
-
- {
- int pathlen;
- char *policyLanguage;
- char *policy;
- size_t npolicy;
- ret = gnutls_x509_crt_get_proxy (crt, &critical,
- &pathlen, &policyLanguage,
- &policy, &npolicy);
- if (!ret)
- {
- fprintf (out, "\tProxy Certificate Information: ");
- if (critical)
- fprintf (out, "(critical)\n");
- else
- fprintf (out, "\n");
- if (pathlen >= 0)
- fprintf (out, "\t\tPath Length Constraint: %d\n", pathlen);
- fprintf (out, "\t\tPolicy Language: ");
- if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.1") == 0)
- fprintf (out, "id-ppl-inheritALL\n");
- else if (strcmp (policyLanguage, "1.3.6.1.5.5.7.21.2") == 0)
- fprintf (out, "id-ppl-independent\n");
- else
- fprintf (out, "%s\n", policyLanguage);
- if (npolicy)
- fprintf (out, "\t\tPolicy Language: %.*s\n", npolicy, policy);
- }
- }
-
- {
- /* check for basicConstraints
- */
- int pathlen;
- ret = gnutls_x509_crt_get_basic_constraints (crt, &critical, NULL,
- &pathlen);
- if (ret >= 0)
- {
- fprintf (out, "\tBasic Constraints:");
- if (critical)
- fprintf (out, " (critical)");
- fprintf (out, "\n");
-
- if (ret == 0)
- fprintf (out, "\t\tCA:FALSE\n");
- else
- fprintf (out, "\t\tCA:TRUE\n");
-
- if (pathlen >= 0)
- fprintf (out, "\t\tpathLenConstraint: %d\n", pathlen);
- }
- }
-
- /* Key Usage.
- */
- ret = gnutls_x509_crt_get_key_usage (crt, &key_usage, &critical);
-
- if (ret >= 0)
- {
- fprintf (out, "\tKey usage: %s\n", critical ? "(critical)" : "");
- print_key_usage (key_usage, out);
- }
-
- /* Key Purpose identifiers.
- */
- i = 0;
-
- size = sizeof (buffer);
- if ((ret =
- gnutls_x509_crt_get_key_purpose_oid (crt, 0, buffer, &size,
- &critical)) >= 0)
- {
- fprintf (out, "\tKey purpose OIDs: %s\n", critical ? "(critical)" : "");
- do
- {
- size = sizeof (buffer);
- ret =
- gnutls_x509_crt_get_key_purpose_oid (crt, i, buffer, &size,
- &critical);
-
- if (ret >= 0)
- {
- print_key_purpose (buffer, out);
- }
- i++;
- }
- while (ret >= 0);
- }
-
- /* Subject Key ID
- */
- size = sizeof (buffer);
- ret = gnutls_x509_crt_get_subject_key_id (crt, buffer, &size, &critical);
-
- if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "Error getting subject key id: %s\n",
- gnutls_strerror (ret));
- }
-
- if (ret >= 0)
- {
- fprintf (out, "\tSubject Key ID: %s\n\t\t%s\n",
- critical ? "(critical)" : "", raw_to_string (buffer, size));
- }
-
- /* Authority Key ID
- */
- size = sizeof (buffer);
- ret = gnutls_x509_crt_get_authority_key_id (crt, buffer, &size, &critical);
-
- if (ret < 0 && ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
- {
- fprintf (out, "Error getting authority key id: %s\n",
- gnutls_strerror (ret));
- }
-
- if (ret >= 0)
- {
- fprintf (out, "\tAuthority Key ID: %s\n\t\t%s\n",
- critical ? "(critical)" : "", raw_to_string (buffer, size));
- }
-
- /* other extensions:
- */
- indx = 0;
- ret = 0;
- for (i = 0; !(ret < 0); i++)
- {
-
- size = sizeof (oid);
- ret = gnutls_x509_crt_get_extension_oid (crt, i, oid, &size);
- if (ret >= 0)
- {
- if (known_oid (oid))
- continue;
-
- if (strcmp (oid, old_oid) == 0)
- {
- indx++;
- }
- else
- {
- indx = 0;
- }
-
- fprintf (out, "\t%s: ", oid);
-
- size = sizeof (buffer);
- ret =
- gnutls_x509_crt_get_extension_by_oid (crt, oid, indx,
- buffer, &size, &critical);
-
- if (ret >= 0)
- {
- if (critical)
- fprintf (out, "(critical)\n");
- else
- fprintf (out, "\n");
-
- fprintf (out, "\t\tDER Data: ");
- for (j = 0; j < size; j++)
- {
- fprintf (out, "%.2x", (unsigned char) buffer[j]);
- }
- fprintf (out, "\n");
- fprintf (out, "\t\tASCII: ");
- for (j = 0; j < size; j++)
- {
- if (isprint (buffer[j]))
- fprintf (out, "%c", (unsigned char) buffer[j]);
- else
- fprintf (out, ".");
- }
- fprintf (out, "\n");
- }
-
- ret = 0;
- strcpy (old_oid, oid);
- }
- }
-
-
-
- /* fingerprint
- */
- fprintf (out, "\nOther information:\n");
if (all)
- {
- size = sizeof (buffer);
- if ((ret =
- gnutls_x509_crt_get_fingerprint (crt, GNUTLS_DIG_MD5, buffer,
- &size)) < 0)
- {
- fprintf (out, "Error in fingerprint calculation: %s\n",
- gnutls_strerror (ret));
- }
- else
- {
- fprintf (out, "\tMD5 Fingerprint: %s\n",
- raw_to_string (buffer, size));
- }
-
- size = sizeof (buffer);
- if ((ret =
- gnutls_x509_crt_get_fingerprint (crt, GNUTLS_DIG_SHA1, buffer,
- &size)) < 0)
- {
- fprintf (out, "Error in fingerprint calculation: %s\n",
- gnutls_strerror (ret));
- }
- else
- {
- fprintf (out, "\tSHA1 Fingerprint: %s\n",
- raw_to_string (buffer, size));
- }
-
- }
-
- size = sizeof (buffer);
- if ((ret = gnutls_x509_crt_get_key_id (crt, 0, buffer, &size)) < 0)
- {
- fprintf (out, "Error in key id calculation: %s\n",
- gnutls_strerror (ret));
- }
+ ret = gnutls_x509_crt_print (crt, GNUTLS_X509_CRT_FULL, &out);
else
+ ret = gnutls_x509_crt_print (crt, GNUTLS_X509_CRT_UNSIGNED_FULL, &out);
+ if (ret == 0)
{
- fprintf (out, "\tPublic Key ID: %s\n", raw_to_string (buffer, size));
+ fprintf (out, "%s\n", out.data);
+ gnutls_free (out.data);
}
- fprintf (out, "\n");
-
if (out == stderr && batch == 0) /* interactive */
if (read_yesno ("Is the above information ok? (Y/N): ") == 0)
{
projects / thirdparty / gnutls.git / commitdiff
