Skip to content

CSR/CA/X509 refactor and extension support #285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aidankeefe2022 wants to merge 3 commits into
base: main
Choose a base branch
from
+4,824 −847
Draft

CSR/CA/X509 refactor and extension support #285

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a4d473
CSR/CA/X509 refactor and extension support
aidankeefe2022 Aug 10, 2026
28c600d
Skoll review fixes and refactors
aidankeefe2022 Aug 24, 2026
466704f
Fix compile error for clang
aidankeefe2022 Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion manpages/wolfssl-ca.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ the configuration file (see -config).
-md digest signing digest to use, e.g. sha256.
.br
.LP
-days n number of days the certificate is valid for.
-days n number of days the certificate is valid for, in the
.br
range [1, 24855].
.br
.LP
-extensions section section of the config file to read extensions from.
Expand Down
83 changes: 72 additions & 11 deletions manpages/wolfssl-req.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,14 @@
.SH NAME
wolfssl-req, req \- generate certificate requests and self-signed certificates
.SH SYNOPSIS
wolfssl req [-new] [-in file] [-out file] [-key file] [-newkey type:bits] [-keyout file] [-inform PEM|DER] [-outform PEM|DER] [-config file] [-days n] [-x509] [-subj name] [-extensions section] [-nodes] [-passout source] [-sha|-sha224|-sha256|-sha384|-sha512] [-verify] [-text] [-noout]
wolfssl req [-new] [-in file] [-out file] [-key file] [-inkey file] [-newkey rsa:bits] [-keyout file] [-inform PEM|DER] [-outform PEM|DER] [-config file] [-days n] [-set_serial n] [-x509] [-CA file] [-CAkey file] [-copy_extensions none|copy|copyall] [-subj name] [-extensions section] [-addext ext] [-nodes] [-passout source] [-sha|-sha224|-sha256|-sha384|-sha512] [-verify] [-text] [-noout]
.SH DESCRIPTION
Creates a PKCS#10 certificate signing request (CSR), or with \-x509 a
self-signed certificate. The signing key may be supplied with \-key or
generated on the fly with \-newkey. Without -subj or -config, subject
fields are collected interactively. Without -keyout, a generated private
key is written to stdout.
self-signed certificate, or with \-CA a certificate issued for an existing
request. The signing key may be supplied with \-key or generated on the
fly with \-newkey. Without -subj or -config, subject fields are collected
interactively. Without -keyout, a generated private key is written to
stdout.
.SH OPTIONS
-new OpenSSL compatibility flag (no-op).
.br
Expand All @@ -24,13 +25,16 @@ key is written to stdout.
-key file private key used to sign the certificate request.
.br
.LP
-newkey type:bits generate the private key to use with the request.
-inkey file alias for -key.
.br
RSA: rsa:2048. Dilithium (with -x509 and certgen):
.LP
-newkey rsa:bits generate the private key to use with the request.
.br
RSA only: rsa:2048, rsa:3072 or rsa:4096. ECC and
.br
dilithium:2, dilithium:3, dilithium:5, or ml-dsa:N.
Dilithium keys must be generated with ecparam or
.br
For ECC keys, generate with ecparam first.
genkey and passed in with -key.
.br
.LP
-keyout file file to output the generated key to.
Expand All @@ -45,12 +49,46 @@ key is written to stdout.
-config file file to parse for certificate configuration.
.br
.LP
-days n number of days the certificate should be valid for.
-days n number of days the certificate should be valid for,
.br
in the range [1, 24855] (default 30). Applies to
.br
-x509 and -CA only; ignored for a plain CSR.
.br
.LP
-set_serial n serial number for the issued certificate. Without it
.br
a random serial number is generated.
.br
.LP
-x509 generate a self-signed certificate instead of a CSR.
.br
.LP
-CA file certificate of the CA that issues the certificate,
.br
signing the request given with -in. Requires -CAkey.
.br
.LP
-CAkey file private key belonging to the certificate given to -CA.
.br
.LP
-copy_extensions arg whether -CA carries the extensions the request asked
.br
for into the issued certificate: none (the default),
.br
or copy/copyall. A request only states what its sender
.br
wants, so by default the issued certificate takes just
.br
the subject name and public key from it and carries no
.br
requested subjectAltName, keyUsage, extendedKeyUsage or
.br
certificate policies. Basic Constraints stays CA:FALSE
.br
either way. Ignored without -CA.
.br
.LP
-subj name subject name in /key=value/... format, e.g.
.br
/C=US/ST=WA/L=Seattle/O=wolfSSL/CN=wolfSSL.
Expand All @@ -59,6 +97,13 @@ key is written to stdout.
-extensions section section of the config file to read extensions from.
.br
.LP
-addext ext add a single extension, e.g.
.br
"subjectAltName=DNS:example.com,IP:192.168.1.2".
.br
Only one -addext may be given.
.br
.LP
-nodes do not encrypt the private key on output. Without
.br
-nodes, generated keys are encrypted and the user is
Expand All @@ -76,7 +121,13 @@ key is written to stdout.
signing digest (default SHA-256 when omitted).
.br
.LP
-verify check the signature on the request.
-verify check the signature on the request. Not needed with
.br
-CA, which always verifies both the request it is
.br
given and the certificate it issues; there -verify
.br
only adds the "verify OK" line to the output.
.br
.LP
-text output human readable text of the request.
Expand All @@ -94,6 +145,16 @@ Create a self-signed certificate valid for 365 days:
wolfssl req -new -x509 -newkey rsa:2048 -nodes -keyout mykey.pem -out mycert.pem -days 365 -subj "/C=US/O=Test/CN=localhost"
.RE
.LP
Issue a certificate for an existing request under a CA:
.RS
wolfssl req -CA ca-cert.pem -CAkey ca-key.pem -in mycsr.pem -days 365 -out mycert.pem
.RE
.LP
The same, carrying the extensions the request asked for:
.RS
wolfssl req -CA ca-cert.pem -CAkey ca-key.pem -copy_extensions copy -in mycsr.pem -out mycert.pem
.RE
.LP
View a CSR in human-readable format:
.RS
wolfssl req -in mycsr.pem -text -noout
Expand Down
28 changes: 17 additions & 11 deletions manpages/wolfssl-x509.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
.SH NAME
wolfssl-x509, x509 \- X.509 certificate processing and conversion
.SH SYNOPSIS
wolfssl x509 [-inform PEM|DER] [-in file] [-outform PEM|DER] [-out file] [-req] [-signkey file] [-extfile file] [-extensions section] [-sha1|-sha224|-sha256|-sha384|-sha512] [-noout] [-text] [-subject] [-issuer] [-serial] [-dates] [-email] [-fingerprint] [-purpose] [-hash] [-modulus] [-pubkey]
wolfssl x509 [-inform PEM|DER] [-in file] [-outform PEM|DER] [-out file] [-req] [-signkey file] [-days n] [-extfile file] [-extensions section] [-sha1|-sha224|-sha256|-sha384|-sha512] [-noout] [-text] [-subject] [-issuer] [-serial] [-dates] [-email] [-fingerprint] [-purpose] [-hash] [-modulus] [-pubkey]
.SH DESCRIPTION
Reads an X.509 certificate and converts it between PEM and DER formats
and/or prints selected fields. By default the (re-encoded) certificate is
Expand Down Expand Up @@ -38,18 +38,21 @@ written to the output.
-signkey file private key used when signing a CSR with -req.
.br
.LP
-extfile file configuration file for extensions. Only takes effect
-days n number of days the re-signed certificate is valid
.br
when both -req and -signkey are also given; otherwise
for, in the range [1, 24855]. Requires -req; see
.br
silently ignored (see NOTES).
NOTES.
.br
.LP
-extensions section section of the config file to use. Only takes effect
-extfile file configuration file for extensions. Requires -req;
.br
when both -req and -signkey are also given; otherwise
see NOTES.
.br
silently ignored (see NOTES).
.LP
-extensions section section of the config file to use. Requires -req;
.br
see NOTES.
.br
.LP
-sha1, -sha224, -sha256, -sha384, -sha512
Expand Down Expand Up @@ -94,10 +97,13 @@ written to the output.
.LP
-pubkey print out the public key.
.SH NOTES
Unless both -req and -signkey are used, -extfile and -extensions are
silently ignored on output: the (re-encoded) certificate is written from
the original input DER, not from any in-memory changes made while parsing
extensions.
-days, -extfile and -extensions alter the certificate, and an altered
certificate is only written out when -req has it re-signed: without a
re-sign the output is written from the original input DER, not from any
in-memory changes. Passing any of the three without -req is therefore an
error ("Altering a Cert requires a resign and -req was not set") and the
command exits non-zero, rather than silently dropping the change as
earlier releases did.
.SH EXAMPLES
View certificate details in human-readable format:
.RS
Expand Down
2 changes: 2 additions & 0 deletions src/clu_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,6 +353,8 @@ int main(int argc, char** argv)
ret = WOLFCLU_FATAL_ERROR;
}

/* WOLFCLU_FAILURE is 0, which the return below would hand back as a
* success status, so fold every non-positive code into one error first */
if (ret <= 0) {
wolfCLU_LogError("Error returned: %d.", ret);
ret = WOLFCLU_FATAL_ERROR;
Expand Down
45 changes: 34 additions & 11 deletions src/x509/clu_ca_setup.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,6 @@ static const struct option ca_options[] = {
{"-in", required_argument, 0, WOLFCLU_INFILE },
{"-out", required_argument, 0, WOLFCLU_OUTFILE },
{"-keyfile", required_argument, 0, WOLFCLU_KEY },
{"-subjkey", required_argument, 0, WOLFCLU_SUBJKEY },
{"-altkey", required_argument, 0, WOLFCLU_ALTKEY },
{"-altpub", required_argument, 0, WOLFCLU_ALTPUB },
{"-cert", required_argument, 0, WOLFCLU_CAFILE },
{"-extensions",required_argument, 0, WOLFCLU_EXTENSIONS},
{"-md", required_argument, 0, WOLFCLU_MD },
Expand All @@ -48,7 +45,12 @@ static const struct option ca_options[] = {
{"-config", required_argument, 0, WOLFCLU_CONFIG },
{"-days", required_argument, 0, WOLFCLU_DAYS },
{"-selfsign", no_argument, 0, WOLFCLU_SELFSIGN },
#if defined(WOLFSSL_DUAL_ALG_CERTS) && defined(HAVE_DILITHIUM)
{"-altextend", no_argument, 0, WOLFCLU_ALTEXTEND },
{"-subjkey", required_argument, 0, WOLFCLU_SUBJKEY },
{"-altkey", required_argument, 0, WOLFCLU_ALTKEY },
{"-altpub", required_argument, 0, WOLFCLU_ALTPUB },
#endif /* WOLFSSL_DUAL_ALG_CERTS && HAVE_DILITHIUM */
{"-h", no_argument, 0, WOLFCLU_HELP },
{"-help", no_argument, 0, WOLFCLU_HELP },

Expand Down Expand Up @@ -120,7 +122,6 @@ int wolfCLU_CASetup(int argc, char** argv)
ret = WOLFCLU_FATAL_ERROR;
}
break;

case WOLFCLU_SELFSIGN:
selfSigned = 1;
break;
Expand Down Expand Up @@ -155,16 +156,16 @@ int wolfCLU_CASetup(int argc, char** argv)
case WOLFCLU_ALTPUB:
altKeyPub = wolfSSL_BIO_new_file(optarg, "rb");
if (altKeyPub == NULL) {
wolfCLU_LogError("Unable to open \
alternate public key file %s", optarg);
wolfCLU_LogError("Unable to open alternate public key "
"file %s", optarg);
ret = WOLFCLU_FATAL_ERROR;
}
break;
#endif /* WOLFSSL_DUAL_ALG_CERTS && HAVE_DILITHIUM */

case WOLFCLU_ALTEXTEND:
altSign = 1;
break;
#endif /* WOLFSSL_DUAL_ALG_CERTS && HAVE_DILITHIUM */

case WOLFCLU_CAFILE:
ca = wolfSSL_X509_load_certificate_file(optarg,
Expand Down Expand Up @@ -205,7 +206,18 @@ int wolfCLU_CASetup(int argc, char** argv)
break;

case WOLFCLU_DAYS:
days = XATOI(optarg);
{
long d = 0;

if (optarg == NULL || wolfCLU_parseDecimalBounded(optarg, 1,
WOLFCLU_MAX_VALIDITY, &d) != WOLFCLU_SUCCESS) {
wolfCLU_LogError("-days expects a positive integer, got %s",
optarg != NULL ? optarg : "(nothing)");
ret = WOLFCLU_FATAL_ERROR;
break;
}
days = (int)d;
}
break;

case WOLFCLU_EXTENSIONS:
Expand Down Expand Up @@ -234,18 +246,18 @@ int wolfCLU_CASetup(int argc, char** argv)
}
}

if (reqIn == NULL && !altSign) {
if (ret == WOLFCLU_SUCCESS && reqIn == NULL && !altSign) {
wolfCLU_LogError("Expecting CSR input");
ret = WOLFCLU_FATAL_ERROR;
}

if (ret == WOLFCLU_SUCCESS && config != NULL) {
signer = wolfCLU_readSignConfig(config, (char*)"ca");
}
else {
else if (ret == WOLFCLU_SUCCESS) {
signer = wolfCLU_CertSignNew();
}
if (signer == NULL) {
if (ret == WOLFCLU_SUCCESS && signer == NULL) {
wolfCLU_LogError("Unable to create a signer struct");
ret = WOLFCLU_FATAL_ERROR;
}
Expand Down Expand Up @@ -310,6 +322,16 @@ int wolfCLU_CASetup(int argc, char** argv)
wolfCLU_GetTypeFromPKEY(pkey));
}
}
else {
if (ca != NULL) {
wolfSSL_X509_free(ca);
ca = NULL;
}
if (pkey != NULL) {
wolfSSL_EVP_PKEY_free(pkey);
pkey = NULL;
}
}

/* default to version 3 which supports extensions */
if (ret == WOLFCLU_SUCCESS &&
Expand Down Expand Up @@ -357,3 +379,4 @@ int wolfCLU_CASetup(int argc, char** argv)
return WOLFCLU_FATAL_ERROR;
#endif
}

Loading
Loading