30 #include <tqstringlist.h>
34 #include "ksslcertificate.h"
35 #include "ksslcertchain.h"
36 #include "ksslutils.h"
38 #include <kstandarddirs.h>
40 #include <tdelocale.h>
41 #include <tqdatetime.h>
42 #include <tdetempfile.h>
44 #include <sys/types.h>
46 #ifdef HAVE_SYS_STAT_H
53 #define crypt _openssl_crypt
54 #include <openssl/ssl.h>
55 #include <openssl/x509.h>
56 #include <openssl/x509v3.h>
57 #include <openssl/x509_vfy.h>
58 #include <openssl/pem.h>
63 #include <tqcstring.h>
65 #include "ksslx509v3.h"
69 static char hv[] = {
'0',
'1',
'2',
'3',
'4',
'5',
'6',
'7',
'8',
'9',
'A',
'B',
'C',
'D',
'E',
'F'};
72 class KSSLCertificatePrivate {
74 KSSLCertificatePrivate() {
75 kossl = KOSSL::self();
76 _lastPurpose = KSSLCertificate::None;
79 ~KSSLCertificatePrivate() {
91 KSSLCertificate::KSSLPurpose _lastPurpose;
95 d =
new KSSLCertificatePrivate;
96 d->m_stateCached =
false;
97 TDEGlobal::dirs()->addResourceType(
"kssl", TDEStandardDirs::kde_default(
"data") +
"kssl");
100 d->m_cert_crl = NULL;
106 d =
new KSSLCertificatePrivate;
107 d->m_stateCached =
false;
108 TDEGlobal::dirs()->addResourceType(
"kssl", TDEStandardDirs::kde_default(
"data") +
"kssl");
111 d->m_cert_crl = NULL;
112 setCert(KOSSL::self()->X509_dup(const_cast<KSSLCertificate&>(x).getCert()));
124 d->kossl->X509_free(d->m_cert);
127 d->kossl->X509_CRL_free(d->m_cert_crl);
144 n->
setCert(KOSSL::self()->X509_dup(x5));
154 if (cert.length() == 0)
157 TQByteArray qba, qbb = cert.copy();
158 KCodecs::base64Decode(qbb, qba);
159 unsigned char *qbap =
reinterpret_cast<unsigned char *
>(qba.data());
160 X509 *x5c = KOSSL::self()->d2i_X509(NULL, &qbap, qba.size());
174 if (cert.length() == 0)
177 TQByteArray qba, qbb = cert.copy();
178 KCodecs::base64Decode(qbb, qba);
179 unsigned char *qbap =
reinterpret_cast<unsigned char *
>(qba.data());
180 X509_CRL *x5c = KOSSL::self()->d2i_X509_CRL(NULL, &qbap, qba.size());
197 char *t = d->kossl->X509_NAME_oneline(d->kossl->X509_get_subject_name(d->m_cert), 0, 0);
201 d->kossl->CRYPTO_free(t);
211 ASN1_INTEGER *aint = d->kossl->X509_get_serialNumber(d->m_cert);
213 rc = ASN1_INTEGER_QString(aint);
228 const ASN1_BIT_STRING *signature = 0L;
229 const X509_ALGOR *sig_alg = 0L;
230 d->kossl->X509_get0_signature(&signature, &sig_alg, d->m_cert);
231 i = d->kossl->OBJ_obj2nid(sig_alg->algorithm);
232 rc = i18n(
"Signature Algorithm: ");
233 rc += (i == NID_undef)?i18n(
"Unknown"):TQString(d->kossl->OBJ_nid2ln(i));
236 rc += i18n(
"Signature Contents:");
237 n = signature->length;
238 s = (
char *)signature->data;
239 for (i = 0; i < n; i++) {
240 if (i%20 != 0) rc +=
":";
242 rc.append(hv[(s[i]&0xf0)>>4]);
243 rc.append(hv[s[i]&0x0f]);
258 STACK *s = d->kossl->X509_get1_email(d->m_cert);
260 for(
int n=0; n < d->kossl->OPENSSL_sk_num(s); n++) {
261 to.append(d->kossl->OPENSSL_sk_value(s,n));
263 d->kossl->X509_email_free(s);
276 int pos = k.findRev(
'(');
278 unsigned int len = k.length();
279 if (k.at(len-1) ==
')') {
280 rc = k.mid(pos+1, len-pos-2);
292 unsigned char md[EVP_MAX_MD_SIZE];
294 if (!d->kossl->X509_digest(d->m_cert, d->kossl->EVP_md5(), md, &n)) {
298 for (
unsigned int j = 0; j < n; j++) {
301 rc.append(hv[(md[j]&0xf0)>>4]);
302 rc.append(hv[md[j]&0x0f]);
317 unsigned char md[EVP_MAX_MD_SIZE];
319 if (!d->kossl->X509_digest(d->m_cert, d->kossl->EVP_md5(), md, &n)) {
323 for (
unsigned int j = 0; j < n; j++) {
324 rc.append(hv[(md[j]&0xf0)>>4]);
325 rc.append(hv[md[j]&0x0f]);
339 EVP_PKEY *pkey = d->kossl->X509_get_pubkey(d->m_cert);
342 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA)
347 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA)
352 d->kossl->EVP_PKEY_free(pkey);
366 EVP_PKEY *pkey = d->kossl->X509_get_pubkey(d->m_cert);
368 rc = i18n(
"Unknown",
"Unknown key algorithm");
370 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_RSA) {
371 rc = i18n(
"Key type: RSA (%1 bit)") +
"\n";
373 RSA *pkey_rsa = d->kossl->EVP_PKEY_get0_RSA(pkey);
374 const BIGNUM *bn_n = 0L;
375 const BIGNUM *bn_e = 0L;
376 d->kossl->RSA_get0_key(pkey_rsa, &bn_n, &bn_e, NULL);
377 x = d->kossl->BN_bn2hex(bn_n);
378 rc += i18n(
"Modulus: ");
379 rc = rc.arg(strlen(x)*4);
380 for (
unsigned int i = 0; i < strlen(x); i++) {
381 if (i%40 != 0 && i%2 == 0)
388 d->kossl->CRYPTO_free(x);
390 x = d->kossl->BN_bn2hex(bn_e);
391 rc += i18n(
"Exponent: 0x") + x +
"\n";
392 d->kossl->CRYPTO_free(x);
396 if (d->kossl->EVP_PKEY_base_id(pkey) == EVP_PKEY_DSA) {
397 rc = i18n(
"Key type: DSA (%1 bit)") +
"\n";
399 DSA *pkey_dsa = d->kossl->EVP_PKEY_get0_DSA(pkey);
400 const BIGNUM *bn_p = 0L;
401 const BIGNUM *bn_q = 0L;
402 const BIGNUM *bn_g = 0L;
403 const BIGNUM *bn_pub_key = 0L;
404 d->kossl->DSA_get0_pqg(pkey_dsa, &bn_p, &bn_q, &bn_g);
405 d->kossl->DSA_get0_key(pkey_dsa, &bn_pub_key, NULL);
407 x = d->kossl->BN_bn2hex(bn_p);
408 rc += i18n(
"Prime: ");
410 rc = rc.arg(strlen(x)*4) ;
411 for (
unsigned int i = 0; i < strlen(x); i++) {
412 if (i%40 != 0 && i%2 == 0)
419 d->kossl->CRYPTO_free(x);
421 x = d->kossl->BN_bn2hex(bn_q);
422 rc += i18n(
"160 bit prime factor: ");
423 for (
unsigned int i = 0; i < strlen(x); i++) {
424 if (i%40 != 0 && i%2 == 0)
431 d->kossl->CRYPTO_free(x);
433 x = d->kossl->BN_bn2hex(bn_g);
434 rc += TQString(
"g: ");
435 for (
unsigned int i = 0; i < strlen(x); i++) {
436 if (i%40 != 0 && i%2 == 0)
443 d->kossl->CRYPTO_free(x);
445 x = d->kossl->BN_bn2hex(bn_pub_key);
446 rc += i18n(
"Public key: ");
447 for (
unsigned int i = 0; i < strlen(x); i++) {
448 if (i%40 != 0 && i%2 == 0)
455 d->kossl->CRYPTO_free(x);
458 d->kossl->EVP_PKEY_free(pkey);
471 char *t = d->kossl->X509_NAME_oneline(d->kossl->X509_get_issuer_name(d->m_cert), 0, 0);
477 d->kossl->CRYPTO_free(t);
483 void KSSLCertificate::setChain(
void *c) {
485 d->_chain.setChain(c);
487 d->m_stateCached =
false;
488 d->m_stateCache = KSSLCertificate::Unknown;
495 d->_extensions.flags = 0;
496 d->kossl->X509_check_purpose(c, -1, 0);
499 kdDebug(7029) <<
"---------------- Certificate ------------------"
504 for (
int j = 0; j < d->kossl->X509_PURPOSE_get_count(); j++) {
505 X509_PURPOSE *ptmp = d->kossl->X509_PURPOSE_get0(j);
506 int id = d->kossl->X509_PURPOSE_get_id(ptmp);
507 for (
int ca = 0; ca < 2; ca++) {
508 int idret = d->kossl->X509_check_purpose(c,
id, ca);
509 if (idret == 1 || idret == 2) {
512 d->_extensions.flags |= (1L <<(
id-1));
513 else d->_extensions.flags |= (1L <<(16+
id-1));
516 d->_extensions.flags &= ~(1L <<(
id-1));
517 else d->_extensions.flags &= ~(1L <<(16+
id-1));
523 kdDebug(7029) <<
"flags: " << TQString::number(c->ex_flags, 2)
524 <<
"\nkeyusage: " << TQString::number(c->ex_kusage, 2)
525 <<
"\nxkeyusage: " << TQString::number(c->ex_xkusage, 2)
526 <<
"\nnscert: " << TQString::number(c->ex_nscert, 2)
528 if (c->ex_flags & EXFLAG_KUSAGE)
529 kdDebug(7029) <<
" --- Key Usage extensions found" << endl;
530 else kdDebug(7029) <<
" --- Key Usage extensions NOT found" << endl;
532 if (c->ex_flags & EXFLAG_XKUSAGE)
533 kdDebug(7029) <<
" --- Extended key usage extensions found" << endl;
534 else kdDebug(7029) <<
" --- Extended key usage extensions NOT found" << endl;
536 if (c->ex_flags & EXFLAG_NSCERT)
537 kdDebug(7029) <<
" --- NS extensions found" << endl;
538 else kdDebug(7029) <<
" --- NS extensions NOT found" << endl;
540 if (d->_extensions.certTypeSSLCA())
541 kdDebug(7029) <<
"NOTE: this is an SSL CA file." << endl;
542 else kdDebug(7029) <<
"NOTE: this is NOT an SSL CA file." << endl;
544 if (d->_extensions.certTypeEmailCA())
545 kdDebug(7029) <<
"NOTE: this is an EMAIL CA file." << endl;
546 else kdDebug(7029) <<
"NOTE: this is NOT an EMAIL CA file." << endl;
548 if (d->_extensions.certTypeCodeCA())
549 kdDebug(7029) <<
"NOTE: this is a CODE CA file." << endl;
550 else kdDebug(7029) <<
"NOTE: this is NOT a CODE CA file." << endl;
552 if (d->_extensions.certTypeSSLClient())
553 kdDebug(7029) <<
"NOTE: this is an SSL client." << endl;
554 else kdDebug(7029) <<
"NOTE: this is NOT an SSL client." << endl;
556 if (d->_extensions.certTypeSSLServer())
557 kdDebug(7029) <<
"NOTE: this is an SSL server." << endl;
558 else kdDebug(7029) <<
"NOTE: this is NOT an SSL server." << endl;
560 if (d->_extensions.certTypeNSSSLServer())
561 kdDebug(7029) <<
"NOTE: this is a NETSCAPE SSL server." << endl;
562 else kdDebug(7029) <<
"NOTE: this is NOT a NETSCAPE SSL server." << endl;
564 if (d->_extensions.certTypeSMIME())
565 kdDebug(7029) <<
"NOTE: this is an SMIME certificate." << endl;
566 else kdDebug(7029) <<
"NOTE: this is NOT an SMIME certificate." << endl;
568 if (d->_extensions.certTypeSMIMEEncrypt())
569 kdDebug(7029) <<
"NOTE: this is an SMIME encrypt cert." << endl;
570 else kdDebug(7029) <<
"NOTE: this is NOT an SMIME encrypt cert." << endl;
572 if (d->_extensions.certTypeSMIMESign())
573 kdDebug(7029) <<
"NOTE: this is an SMIME sign cert." << endl;
574 else kdDebug(7029) <<
"NOTE: this is NOT an SMIME sign cert." << endl;
576 if (d->_extensions.certTypeCRLSign())
577 kdDebug(7029) <<
"NOTE: this is a CRL signer." << endl;
578 else kdDebug(7029) <<
"NOTE: this is NOT a CRL signer." << endl;
580 kdDebug(7029) <<
"-----------------------------------------------"
585 d->m_stateCached =
false;
586 d->m_stateCache = KSSLCertificate::Unknown;
589 void KSSLCertificate::setCRL(X509_CRL *c) {
593 d->_extensions.flags = 0;
596 d->m_stateCached =
false;
597 d->m_stateCache = KSSLCertificate::Unknown;
600 X509 *KSSLCertificate::getCert() {
610 #include "ksslcallback.c"
614 return (
validate(p) == KSSLCertificate::Ok);
619 return isValid(KSSLCertificate::SSLServer);
623 int KSSLCertificate::purposeToOpenSSL(KSSLCertificate::KSSLPurpose p)
const {
626 if (p == KSSLCertificate::SSLServer) {
627 rc = X509_PURPOSE_SSL_SERVER;
628 }
else if (p == KSSLCertificate::SSLClient) {
629 rc = X509_PURPOSE_SSL_CLIENT;
630 }
else if (p == KSSLCertificate::SMIMEEncrypt) {
631 rc = X509_PURPOSE_SMIME_ENCRYPT;
632 }
else if (p == KSSLCertificate::SMIMESign) {
633 rc = X509_PURPOSE_SMIME_SIGN;
634 }
else if (p == KSSLCertificate::Any) {
635 rc = X509_PURPOSE_ANY;
644 return validate(KSSLCertificate::SSLServer);
650 if (result.isEmpty())
651 return KSSLCertificate::Ok;
653 return result.first();
668 KSSLValidationList errors;
669 if (ca || (d->_lastPurpose != purpose)) {
670 d->m_stateCached =
false;
673 if (!d->m_stateCached)
674 d->_lastPurpose = purpose;
677 X509_STORE *certStore;
678 X509_LOOKUP *certLookup;
679 X509_STORE_CTX *certStoreCTX;
683 errors << KSSLCertificate::Unknown;
687 if (d->m_stateCached) {
688 errors << d->m_stateCache;
692 TQStringList qsl = TDEGlobal::dirs()->resourceDirs(
"kssl");
695 errors << KSSLCertificate::NoCARoot;
701 for (TQStringList::Iterator j = qsl.begin(); j != qsl.end(); ++j) {
703 TQString _j = (*j) +
"ca-bundle.crt";
704 if (-1 == stat(_j.ascii(), &sb)) {
708 certStore = d->kossl->X509_STORE_new();
710 errors << KSSLCertificate::Unknown;
714 d->kossl->X509_STORE_set_verify_cb(certStore, X509Callback);
716 certLookup = d->kossl->X509_STORE_add_lookup(certStore, d->kossl->X509_LOOKUP_file());
718 ksslv = KSSLCertificate::Unknown;
719 d->kossl->X509_STORE_free(certStore);
723 if (!d->kossl->X509_LOOKUP_load_file(certLookup, _j.ascii(), X509_FILETYPE_PEM)) {
725 kdDebug(7029) <<
"KSSL couldn't read CA root: "
727 ksslv = KSSLCertificate::ErrorReadingRoot;
728 d->kossl->X509_STORE_free(certStore);
733 certStoreCTX = d->kossl->X509_STORE_CTX_new();
738 kdDebug(7029) <<
"KSSL couldn't create an X509 store context." << endl;
739 d->kossl->X509_STORE_free(certStore);
743 d->kossl->X509_STORE_CTX_init(certStoreCTX, certStore, d->m_cert, NULL);
744 if (d->_chain.isValid()) {
745 d->kossl->X509_STORE_CTX_set0_untrusted(certStoreCTX, (STACK_OF(X509)*)d->_chain.rawChain());
751 d->kossl->X509_STORE_CTX_set_purpose(certStoreCTX, purposeToOpenSSL(purpose));
753 KSSL_X509CallBack_ca = ca ? ca->d->m_cert : 0;
754 KSSL_X509CallBack_ca_found =
false;
756 d->kossl->X509_STORE_CTX_set_error(certStoreCTX, X509_V_OK);
757 d->kossl->X509_verify_cert(certStoreCTX);
758 int errcode = d->kossl->X509_STORE_CTX_get_error(certStoreCTX);
759 if (ca && !KSSL_X509CallBack_ca_found) {
760 ksslv = KSSLCertificate::Irrelevant;
762 ksslv = processError(errcode);
765 if ( (ksslv != KSSLCertificate::Ok) &&
766 (ksslv != KSSLCertificate::Irrelevant) &&
767 purpose == KSSLCertificate::SSLServer) {
768 d->kossl->X509_STORE_CTX_set_purpose(certStoreCTX,
769 X509_PURPOSE_NS_SSL_SERVER);
771 d->kossl->X509_STORE_CTX_set_error(certStoreCTX, X509_V_OK);
772 d->kossl->X509_verify_cert(certStoreCTX);
773 errcode = d->kossl->X509_STORE_CTX_get_error(certStoreCTX);
774 ksslv = processError(errcode);
776 d->kossl->X509_STORE_CTX_free(certStoreCTX);
777 d->kossl->X509_STORE_free(certStore);
788 if (ksslv != NoCARoot && ksslv != InvalidCA) {
789 d->m_stateCached =
true;
790 d->m_stateCache = ksslv;
795 if (ksslv != KSSLCertificate::Ok)
798 errors << KSSLCertificate::NoSSL;
806 return revalidate(KSSLCertificate::SSLServer);
811 d->m_stateCached =
false;
819 rc = KSSLCertificate::Unknown;
823 rc = KSSLCertificate::Ok;
827 case X509_V_ERR_CERT_REJECTED:
828 rc = KSSLCertificate::Rejected;
832 case X509_V_ERR_CERT_UNTRUSTED:
833 rc = KSSLCertificate::Untrusted;
837 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
838 case X509_V_ERR_CERT_SIGNATURE_FAILURE:
839 case X509_V_ERR_CRL_SIGNATURE_FAILURE:
840 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
841 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
842 rc = KSSLCertificate::SignatureFailed;
845 case X509_V_ERR_INVALID_CA:
846 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
847 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
848 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
849 rc = KSSLCertificate::InvalidCA;
853 case X509_V_ERR_INVALID_PURPOSE:
854 rc = KSSLCertificate::InvalidPurpose;
858 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
859 rc = KSSLCertificate::SelfSigned;
862 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
863 rc = KSSLCertificate::SelfSignedChain;
866 case X509_V_ERR_CERT_REVOKED:
867 rc = KSSLCertificate::Revoked;
870 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
871 rc = KSSLCertificate::PathLengthExceeded;
874 case X509_V_ERR_CERT_NOT_YET_VALID:
875 case X509_V_ERR_CERT_HAS_EXPIRED:
876 case X509_V_ERR_CRL_NOT_YET_VALID:
877 case X509_V_ERR_CRL_HAS_EXPIRED:
878 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
879 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
880 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
881 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
882 rc = KSSLCertificate::Expired;
883 kdDebug(7029) <<
"KSSL apparently this is expired. Not after: "
888 case X509_V_ERR_APPLICATION_VERIFICATION:
889 case X509_V_ERR_OUT_OF_MEM:
890 case X509_V_ERR_UNABLE_TO_GET_CRL:
891 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
893 rc = KSSLCertificate::Unknown;
897 d->m_stateCache = rc;
898 d->m_stateCached =
true;
906 return ASN1_UTCTIME_QString(d->kossl->X509_getm_notBefore(d->m_cert));
908 return TQString::null;
915 return ASN1_UTCTIME_QString(d->kossl->X509_getm_notAfter(d->m_cert));
917 return TQString::null;
924 return ASN1_UTCTIME_QDateTime(d->kossl->X509_getm_notBefore(d->m_cert), NULL);
926 return TQDateTime::currentDateTime();
933 return ASN1_UTCTIME_QDateTime(d->kossl->X509_getm_notAfter(d->m_cert), NULL);
935 return TQDateTime::currentDateTime();
942 return ASN1_UTCTIME_QDateTime((ASN1_UTCTIME*)d->kossl->X509_CRL_get0_lastUpdate(d->m_cert_crl), NULL);
944 return TQDateTime::currentDateTime();
951 return ASN1_UTCTIME_QDateTime((ASN1_UTCTIME*)d->kossl->X509_CRL_get0_nextUpdate(d->m_cert_crl), NULL);
953 return TQDateTime::currentDateTime();
959 #ifndef KSSL_HAVE_SSL
962 if (!KOSSL::self()->X509_cmp(x.getCert(), y.getCert()))
return 1;
973 newOne->
setCert(d->kossl->X509_dup(getCert()));
983 return KCodecs::base64Encode(
toDer());
989 case KSSLCertificate::Ok:
990 return i18n(
"The certificate is valid.");
991 case KSSLCertificate::PathLengthExceeded:
992 case KSSLCertificate::ErrorReadingRoot:
993 case KSSLCertificate::NoCARoot:
994 return i18n(
"Certificate signing authority root files could not be found so the certificate is not verified.");
995 case KSSLCertificate::SelfSignedChain:
996 case KSSLCertificate::InvalidCA:
997 return i18n(
"Certificate signing authority is unknown or invalid.");
998 case KSSLCertificate::SelfSigned:
999 return i18n(
"Certificate is self-signed and thus may not be trustworthy.");
1000 case KSSLCertificate::Expired:
1001 return i18n(
"Certificate has expired.");
1002 case KSSLCertificate::Revoked:
1003 return i18n(
"Certificate has been revoked.");
1004 case KSSLCertificate::NoSSL:
1005 return i18n(
"SSL support was not found.");
1006 case KSSLCertificate::Untrusted:
1007 return i18n(
"Signature is untrusted.");
1008 case KSSLCertificate::SignatureFailed:
1009 return i18n(
"Signature test failed.");
1010 case KSSLCertificate::Rejected:
1011 case KSSLCertificate::InvalidPurpose:
1012 return i18n(
"Rejected, possibly due to an invalid purpose.");
1013 case KSSLCertificate::PrivateKeyFailed:
1014 return i18n(
"Private key test failed.");
1015 case KSSLCertificate::InvalidHost:
1016 return i18n(
"The certificate has not been issued for this host.");
1017 case KSSLCertificate::Irrelevant:
1018 return i18n(
"This certificate is not relevant.");
1023 return i18n(
"The certificate is invalid.");
1029 #ifdef KSSL_HAVE_SSL
1030 unsigned int certlen = d->kossl->i2d_X509(getCert(), NULL);
1031 unsigned char *cert =
new unsigned char[certlen];
1032 unsigned char *p = cert;
1034 d->kossl->i2d_X509(getCert(), &p);
1037 qba.duplicate((
const char*)cert, certlen);
1048 const char *header =
"-----BEGIN CERTIFICATE-----\n";
1049 const char *footer =
"-----END CERTIFICATE-----\n";
1053 unsigned int xx = thecert.length() - 1;
1054 for (
unsigned int i = 0; i < xx/64; i++) {
1055 thecert.insert(64*(i+1)+i,
'\n');
1058 thecert.prepend(header);
1060 if (thecert[thecert.length()-1] !=
'\n')
1063 thecert.append(footer);
1065 qba.duplicate(thecert.local8Bit(), thecert.length());
1070 #define NETSCAPE_CERT_HDR "certificate"
1071 #ifdef KSSL_HAVE_SSL
1072 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
1073 typedef struct NETSCAPE_X509_st
1075 ASN1_OCTET_STRING *header;
1084 #ifdef KSSL_HAVE_SSL
1085 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
1087 ASN1_OCTET_STRING hdr;
1090 ASN1_OCTET_STRING os;
1094 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
1095 hdr.data = (
unsigned char *)NETSCAPE_CERT_HDR;
1096 hdr.length = strlen(NETSCAPE_CERT_HDR);
1098 nx.cert = getCert();
1100 d->kossl->ASN1_i2d_fp(ktf.fstream(),(
unsigned char *)&nx);
1102 os.data = (
unsigned char *)NETSCAPE_CERT_HDR;
1103 os.length = strlen(NETSCAPE_CERT_HDR);
1105 ah.data = (
char *)getCert();
1106 ah.meth = d->kossl->X509_asn1_meth();
1108 d->kossl->ASN1_i2d_fp(ktf.fstream(),(
unsigned char *)&ah);
1113 TQFile qf(ktf.name());
1114 qf.open(IO_ReadOnly);
1115 char *buf =
new char[qf.size()];
1116 qf.readBlock(buf, qf.size());
1117 qba.duplicate(buf, qf.size());
1131 #ifdef KSSL_HAVE_SSL
1134 d->kossl->X509_print(ktf.fstream(), getCert());
1137 TQFile qf(ktf.name());
1138 qf.open(IO_ReadOnly);
1139 char *buf =
new char[qf.size()+1];
1140 qf.readBlock(buf, qf.size());
1152 #ifdef KSSL_HAVE_SSL
1153 TQByteArray qba, qbb = cert.local8Bit().copy();
1154 KCodecs::base64Decode(qbb, qba);
1155 unsigned char *qbap =
reinterpret_cast<unsigned char *
>(qba.data());
1156 X509 *x5c = KOSSL::self()->d2i_X509(NULL, &qbap, qba.size());
1167 return d->_extensions;
1172 return d->_extensions.certTypeCA();
1178 #ifdef KSSL_HAVE_SSL
1179 STACK_OF(GENERAL_NAME) *names;
1180 names = (STACK_OF(GENERAL_NAME)*)d->kossl->X509_get_ext_d2i(d->m_cert, NID_subject_alt_name, 0, 0);
1186 int cnt = d->kossl->OPENSSL_sk_num(names);
1188 for (
int i = 0; i < cnt; i++) {
1189 const GENERAL_NAME *val = (
const GENERAL_NAME *)d->kossl->OPENSSL_sk_value(names, i);
1190 if (val->type != GEN_DNS) {
1194 TQString s = (
const char *)d->kossl->ASN1_STRING_data(val->d.ia5);
1197 s.length() == (
unsigned int)d->kossl->ASN1_STRING_length(val->d.ia5)) {
1201 d->kossl->OPENSSL_sk_free(names);
1209 TQPtrList<KSSLCertificate> cl =
const_cast<KSSLCertificate&
>(r).chain().getChain();
1215 cl.setAutoDelete(
true);
1217 s << const_cast<KSSLCertificate&>(r).toString() << qsl;
1229 if (r.
setCert(cert) && !qsl.isEmpty())