]> git.saurik.com Git - apple/security.git/blame - SecurityTests/clxutils/signerAndSubj/signerAndSubj.cpp
projects / apple / security.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Security-57740.31.2.tar.gz
[apple/security.git] / SecurityTests / clxutils / signerAndSubj / signerAndSubj.cpp
CommitLineData
d8f41ccd
A		 1/* Copyright (c) 1998,2003,2005-2006,2008 Apple Inc.
2 *
3 * signerAndSubj.c
4 *
5 * Create two certs - a root, and a subject cert signed by the root. Includes
6 * extension construction. Verify certs every which way, including various expected
7 * failures.
8 *
9 * Revision History
10 * ----------------
11 * 31 Aug 2000 Doug Mitchell at Apple
12 * Ported to X/CDSA2.
13 * 20 Jul 1998 Doug Mitchell at NeXT
14 * Created.
15 */
16
17#include <utilLib/common.h>
18#include <utilLib/cspwrap.h>
19#include <security_cdsa_utils/cuFileIo.h>
20#include <clAppUtils/CertBuilderApp.h>
21#include <clAppUtils/clutils.h>
22#include <stdlib.h>
23#include <stdio.h>
24#include <string.h>
25#include <Security/cssm.h>
26#include <Security/x509defs.h>
27#include <Security/oidsattr.h>
28#include <Security/oidscert.h>
29#include <Security/oidsalg.h>
30#include <Security/certextensions.h>
31#include <Security/cssmapple.h>
32#include <string.h>
33
34#define SUBJ_KEY_LABEL "subjectKey"
35#define ROOT_KEY_LABEL "rootKey"
36/* default key and signature algorithm */
37#define SIG_ALG_DEFAULT CSSM_ALGID_SHA1WithRSA
38#define KEY_ALG_DEFAULT CSSM_ALGID_RSA
39
40/* for write certs/components option */
41#define ROOT_CERT_FILE_NAME "ssRootCert.der"
42#define ROOT_TBS_FILE_NAME "ssRootTBS.der"
43#define SUBJ_CERT_FILE_NAME "ssSubjCert.der"
44#define SUBJ_TBS_FILE_NAME "ssSubjTBS.der"
45#define ROOT_PRIV_KEY_FILE "ssRootPriv.der"
46#define SUBJ_PRIV_KEY_FILE "ssSubjPriv.der"
47
48static void usage(char **argv)
49{
50 printf("Usage: %s [options]\n", argv[0]);
51 printf("Options:\n");
52 printf(" w[rite certs and components]\n");
53 printf(" a=alg where alg is s(RSA/SHA1), m(RSA/MD5), f(FEE/MD5), F(FEE/SHA1),\n");
54 printf(" 2(RSA/SHA224), 6(RSA/SHA256), 3(RSA/SHA384) 5=RSA/SHA512,\n");
55 printf(" e(ECDSA), E(ANSI/ECDSA), 7(ECDSA/SHA256), 8(ECDSA/SHA384), 9(ECDSA/SHA512)\n");
56 printf(" k=keySizeInBits\n");
57 exit(1);
58}
59
60/*
61 * RDN components for root, subject
62 */
63CB_NameOid rootRdn[] =
64{
65 { "Apple Computer", &CSSMOID_OrganizationName },
66 { "The Big Cheese", &CSSMOID_Title }
67};
68#define NUM_ROOT_NAMES (sizeof(rootRdn) / sizeof(CB_NameOid))
69
70CB_NameOid subjRdn[] =
71{
72 /* note extra space for normalize test */
73 { "Apple Computer", &CSSMOID_OrganizationName },
74 { "Doug Mitchell", &CSSMOID_CommonName }
75};
76#define NUM_SUBJ_NAMES (sizeof(subjRdn) / sizeof(CB_NameOid))
77
78static CSSM_BOOL compareKeyData(const CSSM_KEY *key1, const CSSM_KEY *key2);
79static CSSM_RETURN verifyCert(CSSM_CL_HANDLE clHand,
80 CSSM_CSP_HANDLE cspHand,
81 CSSM_DATA_PTR cert,
82 CSSM_DATA_PTR signerCert,
83 CSSM_KEY_PTR key,
84 CSSM_ALGORITHMS sigAlg,
85 CSSM_RETURN expectResult,
86 const char *opString);
87
88
89int main(int argc, char **argv)
90{
91 CSSM_CL_HANDLE clHand; // CL handle
92 CSSM_X509_NAME *subjName;
93 CSSM_X509_NAME *rootName;
94 CSSM_X509_TIME *notBefore; // UTC-style "not before" time
95 CSSM_X509_TIME *notAfter; // UTC-style "not after" time
96 CSSM_DATA_PTR rawCert; // from CSSM_CL_CertCreateTemplate
97 CSSM_DATA signedRootCert; // from CSSM_CL_CertSign
98 CSSM_DATA signedSubjCert; // from CSSM_CL_CertSign
99 CSSM_CSP_HANDLE cspHand; // CSP handle
100 CSSM_KEY subjPubKey; // subject's RSA public key blob
101 CSSM_KEY subjPrivKey; // subject's RSA private key - ref format
102 CSSM_KEY rootPubKey; // root's RSA public key blob
103 CSSM_KEY rootPrivKey; // root's RSA private key - ref format
104 CSSM_RETURN crtn;
105 CSSM_KEY_PTR extractRootKey; // from CSSM_CL_CertGetKeyInfo()
106 CSSM_KEY_PTR extractSubjKey; // ditto
107 CSSM_CC_HANDLE signContext; // for signing/verifying the cert
108 unsigned badByte;
109 int arg;
110 unsigned errorCount = 0;
111
112 /* user-spec'd variables */
113 CSSM_BOOL writeBlobs = CSSM_FALSE;
114 CSSM_ALGORITHMS keyAlg = KEY_ALG_DEFAULT;
115 CSSM_ALGORITHMS sigAlg = SIG_ALG_DEFAULT;
116 uint32 keySizeInBits = CSP_KEY_SIZE_DEFAULT;
117
118 /*
119 * Two extensions. Subject has one (KeyUsage); root has KeyUsage and
120 * BasicConstraints.
121 */
122 CSSM_X509_EXTENSION exts[2];
123 CE_KeyUsage keyUsage;
124 CE_BasicConstraints bc;
125
126 for(arg=1; arg<argc; arg++) {
127 switch(argv[arg][0]) {
128 case 'w':
129 writeBlobs = CSSM_TRUE;
130 break;
131 case 'a':
132 if((argv[arg][1] == '\0') || (argv[arg][2] == '\0')) {
133 usage(argv);
134 }
135 switch(argv[arg][2]) {
136 case 's':
137 keyAlg = CSSM_ALGID_RSA;
138 sigAlg = CSSM_ALGID_SHA1WithRSA;
139 break;
140 case 'm':
141 keyAlg = CSSM_ALGID_RSA;
142 sigAlg = CSSM_ALGID_MD5WithRSA;
143 break;
144 case 'f':
145 keyAlg = CSSM_ALGID_FEE;
146 sigAlg = CSSM_ALGID_FEE_MD5;
147 break;
148 case 'F':
149 keyAlg = CSSM_ALGID_FEE;
150 sigAlg = CSSM_ALGID_FEE_SHA1;
151 break;
152 case 'e':
153 keyAlg = CSSM_ALGID_FEE;
154 sigAlg = CSSM_ALGID_SHA1WithECDSA;
155 break;
156 case 'E':
157 keyAlg = CSSM_ALGID_ECDSA;
158 sigAlg = CSSM_ALGID_SHA1WithECDSA;
159 break;
160 case '7':
161 keyAlg = CSSM_ALGID_ECDSA;
162 sigAlg = CSSM_ALGID_SHA256WithECDSA;
163 break;
164 case '8':
165 keyAlg = CSSM_ALGID_ECDSA;
166 sigAlg = CSSM_ALGID_SHA384WithECDSA;
167 break;
168 case '9':
169 keyAlg = CSSM_ALGID_ECDSA;
170 sigAlg = CSSM_ALGID_SHA512WithECDSA;
171 break;
172 case '2':
173 keyAlg = CSSM_ALGID_RSA;
174 sigAlg = CSSM_ALGID_SHA224WithRSA;
175 break;
176 case '6':
177 keyAlg = CSSM_ALGID_RSA;
178 sigAlg = CSSM_ALGID_SHA256WithRSA;
179 break;
180 case '3':
181 keyAlg = CSSM_ALGID_RSA;
182 sigAlg = CSSM_ALGID_SHA384WithRSA;
183 break;
184 case '5':
185 keyAlg = CSSM_ALGID_RSA;
186 sigAlg = CSSM_ALGID_SHA512WithRSA;
187 break;
188 default:
189 usage(argv);
190 }
191 break;
192 case 'k':
193 keySizeInBits = atoi(&argv[arg][2]);
194 break;
195 default:
196 usage(argv);
197 }
198 }
199
200 /* connect to CL and CSP */
201 clHand = clStartup();
202 if(clHand == 0) {
203 return 0;
204 }
205 cspHand = cspStartup();
206 if(cspHand == 0) {
207 return 0;
208 }
209
210 /* subsequent errors to abort: to detach */
211
212 /* cook up an RSA key pair for the subject */
213 crtn = cspGenKeyPair(cspHand,
214 keyAlg,
215 SUBJ_KEY_LABEL,
216 strlen(SUBJ_KEY_LABEL),
217 keySizeInBits,
218 &subjPubKey,
219 CSSM_FALSE, // pubIsRef - should work both ways, but not yet
220 CSSM_KEYUSE_VERIFY,
221 CSSM_KEYBLOB_RAW_FORMAT_NONE,
222 &subjPrivKey,
223 CSSM_FALSE, // privIsRef
224 CSSM_KEYUSE_SIGN,
225 CSSM_KEYBLOB_RAW_FORMAT_NONE,
226 CSSM_FALSE);
227 if(crtn) {
228 errorCount++;
229 goto abort;
230 }
231 if(writeBlobs) {
232 writeFile(SUBJ_PRIV_KEY_FILE, subjPrivKey.KeyData.Data,
233 subjPrivKey.KeyData.Length);
234 printf("...wrote %lu bytes to %s\n", subjPrivKey.KeyData.Length,
235 SUBJ_PRIV_KEY_FILE);
236 }
237
238 /* and the root */
239 crtn = cspGenKeyPair(cspHand,
240 keyAlg,
241 ROOT_KEY_LABEL,
242 strlen(ROOT_KEY_LABEL),
243 keySizeInBits,
244 &rootPubKey,
245 CSSM_FALSE, // pubIsRef - should work both ways, but not yet
246 CSSM_KEYUSE_VERIFY,
247 CSSM_KEYBLOB_RAW_FORMAT_NONE,
248 &rootPrivKey,
249 CSSM_FALSE, // privIsRef
250 CSSM_KEYUSE_SIGN,
251 CSSM_KEYBLOB_RAW_FORMAT_NONE,
252 CSSM_FALSE);
253 if(crtn) {
254 errorCount++;
255 goto abort;
256 }
257 if(writeBlobs) {
258 writeFile(ROOT_PRIV_KEY_FILE, rootPrivKey.KeyData.Data,
259 rootPrivKey.KeyData.Length);
260 printf("...wrote %lu bytes to %s\n", rootPrivKey.KeyData.Length,
261 ROOT_PRIV_KEY_FILE);
262 }
263
264 if(compareKeyData(&rootPubKey, &subjPubKey)) {
265 printf("**WARNING: Identical root and subj keys!\n");
266 }
267
268 /*
269 * Cook up various cert fields.
270 * First, the RDNs for subject and issuer.
271 */
272 rootName = CB_BuildX509Name(rootRdn, NUM_ROOT_NAMES);
273 subjName = CB_BuildX509Name(subjRdn, NUM_SUBJ_NAMES);
274 if((rootName == NULL) || (subjName == NULL)) {
275 printf("CB_BuildX509Name failure");
276 errorCount++;
277 goto abort;
278 }
279
280 /* not before/after in generalized time format */
281 notBefore = CB_BuildX509Time(0);
282 notAfter = CB_BuildX509Time(10000);
283
284 /* A KeyUsage extension for both certs */
285 exts[0].extnId = CSSMOID_KeyUsage;
286 exts[0].critical = CSSM_FALSE;
287 exts[0].format = CSSM_X509_DATAFORMAT_PARSED;
288 keyUsage = CE_KU_DigitalSignature | CE_KU_KeyCertSign |
289 CE_KU_KeyEncipherment | CE_KU_DataEncipherment;
290 exts[0].value.parsedValue = &keyUsage;
291 exts[0].BERvalue.Data = NULL;
292 exts[0].BERvalue.Length = 0;
293
294 /* BasicConstraints for root only */
295 exts[1].extnId = CSSMOID_BasicConstraints;
296 exts[1].critical = CSSM_TRUE;
297 exts[1].format = CSSM_X509_DATAFORMAT_PARSED;
298 bc.cA = CSSM_TRUE;
299 bc.pathLenConstraintPresent = CSSM_TRUE;
300 bc.pathLenConstraint = 2;
301 exts[1].value.parsedValue = &bc;
302 exts[1].BERvalue.Data = NULL;
303 exts[1].BERvalue.Length = 0;
304
305 /* cook up root cert */
306 printf("Creating root cert...\n");
307 rawCert = CB_MakeCertTemplate(clHand,
308 0x12345678, // serial number
309 rootName,
310 rootName,
311 notBefore,
312 notAfter,
313 &rootPubKey,
314 sigAlg,
315 NULL, // subjUniqueId
316 NULL, // issuerUniqueId
317 exts, // extensions
318 2); // numExtensions
319
320 if(rawCert == NULL) {
321 errorCount++;
322 goto abort;
323 }
324 if(writeBlobs) {
325 writeFile(ROOT_TBS_FILE_NAME, rawCert->Data, rawCert->Length);
326 printf("...wrote %lu bytes to %s\n", rawCert->Length, ROOT_TBS_FILE_NAME);
327 }
328
329 /* Self-sign; this is a root cert */
330 crtn = CSSM_CSP_CreateSignatureContext(cspHand,
331 sigAlg,
332 NULL, // AccessCred
333 &rootPrivKey,
334 &signContext);
335 if(crtn) {
336 printError("CSSM_CSP_CreateSignatureContext", crtn);
337 errorCount++;
338 goto abort;
339 }
340 signedRootCert.Data = NULL;
341 signedRootCert.Length = 0;
342 crtn = CSSM_CL_CertSign(clHand,
343 signContext,
344 rawCert, // CertToBeSigned
345 NULL, // SignScope
346 0, // ScopeSize,
347 &signedRootCert);
348 if(crtn) {
349 printError("CSSM_CL_CertSign", crtn);
350 errorCount++;
351 goto abort;
352 }
353 crtn = CSSM_DeleteContext(signContext);
354 if(crtn) {
355 printError("CSSM_DeleteContext", crtn);
356 errorCount++;
357 goto abort;
358 }
359 appFreeCssmData(rawCert, CSSM_TRUE);
360 if(writeBlobs) {
361 writeFile(ROOT_CERT_FILE_NAME, signedRootCert.Data, signedRootCert.Length);
362 printf("...wrote %lu bytes to %s\n", signedRootCert.Length,
363 ROOT_CERT_FILE_NAME);
364 }
365
366 /* now a subject cert signed by the root cert */
367 printf("Creating subject cert...\n");
368 rawCert = CB_MakeCertTemplate(clHand,
369 0x8765, // serial number
370 rootName,
371 subjName,
372 notBefore,
373 notAfter,
374 &subjPubKey,
375 sigAlg,
376 NULL, // subjUniqueId
377 NULL, // issuerUniqueId
378 exts, // extensions
379 1); // numExtensions
380 if(rawCert == NULL) {
381 errorCount++;
382 goto abort;
383 }
384 if(writeBlobs) {
385 writeFile(SUBJ_TBS_FILE_NAME, rawCert->Data, rawCert->Length);
386 printf("...wrote %lu bytes to %s\n", rawCert->Length, SUBJ_TBS_FILE_NAME);
387 }
388
389 /* sign by root */
390 crtn = CSSM_CSP_CreateSignatureContext(cspHand,
391 sigAlg,
392 NULL, // AccessCred
393 &rootPrivKey,
394 &signContext);
395 if(crtn) {
396 printError("CSSM_CSP_CreateSignatureContext", crtn);
397 errorCount++;
398 goto abort;
399 }
400 signedSubjCert.Data = NULL;
401 signedSubjCert.Length = 0;
402 crtn = CSSM_CL_CertSign(clHand,
403 signContext,
404 rawCert, // CertToBeSigned
405 NULL, // SignScope
406 0, // ScopeSize,
407 &signedSubjCert);
408 if(crtn) {
409 printError("CSSM_CL_CertSign", crtn);
410 errorCount++;
411 goto abort;
412 }
413 crtn = CSSM_DeleteContext(signContext);
414 if(crtn) {
415 printError("CSSM_DeleteContext", crtn);
416 errorCount++;
417 goto abort;
418 }
419 appFreeCssmData(rawCert, CSSM_TRUE);
420 if(writeBlobs) {
421 writeFile(SUBJ_CERT_FILE_NAME, signedSubjCert.Data, signedSubjCert.Length);
422 printf("...wrote %lu bytes to %s\n", signedSubjCert.Length,
423 SUBJ_CERT_FILE_NAME);
424 }
425
426 /* Free the stuff we allocd to get here */
427 CB_FreeX509Name(rootName);
428 CB_FreeX509Name(subjName);
429 CB_FreeX509Time(notBefore);
430 CB_FreeX509Time(notAfter);
431
432 /*
433 * Extract public keys from the two certs, verify.
434 */
435 crtn = CSSM_CL_CertGetKeyInfo(clHand, &signedSubjCert, &extractSubjKey);
436 if(crtn) {
437 printError("CSSM_CL_CertGetKeyInfo", crtn);
438 }
439 else {
440 /* compare key data - header is different.
441 * Known header differences:
442 * -- CspID - CSSM_CL_CertGetKeyInfo returns a key with NULL for
443 * this field
444 * -- Format. rootPubKey : 6 (CSSM_KEYBLOB_RAW_FORMAT_BSAFE)
445 * extractRootKey : 1 (CSSM_KEYBLOB_RAW_FORMAT_PKCS1)
446 * -- KeyAttr. rootPubKey : 0x20 (CSSM_KEYATTR_EXTRACTABLE)
447 * extractRootKey : 0x0
448 */
449 if(!compareKeyData(extractSubjKey, &subjPubKey)) {
450 printf("***CSSM_CL_CertGetKeyInfo(signedSubjCert) returned bad key data\n");
451 }
452 if(extractSubjKey->KeyHeader.LogicalKeySizeInBits !=
453 subjPubKey.KeyHeader.LogicalKeySizeInBits) {
454 printf("***EffectiveKeySizeInBits mismatch: extract %u subj %u\n",
455 (unsigned)extractSubjKey->KeyHeader.LogicalKeySizeInBits,
456 (unsigned)subjPubKey.KeyHeader.LogicalKeySizeInBits);
457 }
458 }
459 crtn = CSSM_CL_CertGetKeyInfo(clHand, &signedRootCert, &extractRootKey);
460 if(crtn) {
461 printError("CSSM_CL_CertGetKeyInfo", crtn);
462 }
463 else {
464 if(!compareKeyData(extractRootKey, &rootPubKey)) {
465 printf("***CSSM_CL_CertGetKeyInfo(signedRootCert) returned bad key data\n");
466 }
467 }
468
469 /*
470 * Verify:
471 */
472 printf("Verifying certificates...\n");
473
474 /*
475 * Verify root cert by root pub key, should succeed.
476 */
477 if(verifyCert(clHand,
478 cspHand,
479 &signedRootCert,
480 NULL,
481 &rootPubKey,
482 sigAlg,
483 CSSM_OK,
484 "Verify(root by root key)")) {
485 errorCount++;
486 /* continue */
487 }
488
489 /*
490 * Verify root cert by root cert, should succeed.
491 */
492 if(verifyCert(clHand,
493 cspHand,
494 &signedRootCert,
495 &signedRootCert,
496 NULL,
497 CSSM_ALGID_NONE, // sigAlg not used here
498 CSSM_OK,
499 "Verify(root by root cert)")) {
500 errorCount++;
501 /* continue */
502 }
503
504
505 /*
506 * Verify subject cert by root pub key, should succeed.
507 */
508 if(verifyCert(clHand,
509 cspHand,
510 &signedSubjCert,
511 NULL,
512 &rootPubKey,
513 sigAlg,
514 CSSM_OK,
515 "Verify(subj by root key)")) {
516 errorCount++;
517 /* continue */
518 }
519
520 /*
521 * Verify subject cert by root cert, should succeed.
522 */
523 if(verifyCert(clHand,
524 cspHand,
525 &signedSubjCert,
526 &signedRootCert,
527 NULL,
528 CSSM_ALGID_NONE, // sigAlg not used here
529 CSSM_OK,
530 "Verify(subj by root cert)")) {
531 errorCount++;
532 /* continue */
533 }
534
535 /*
536 * Verify subject cert by root cert AND key, should succeed.
537 */
538 if(verifyCert(clHand,
539 cspHand,
540 &signedSubjCert,
541 &signedRootCert,
542 &rootPubKey,
543 sigAlg,
544 CSSM_OK,
545 "Verify(subj by root cert and key)")) {
546 errorCount++;
547 /* continue */
548 }
549
550 /*
551 * Verify subject cert by extracted root pub key, should succeed.
552 */
553 if(verifyCert(clHand,
554 cspHand,
555 &signedSubjCert,
556 NULL,
557 extractRootKey,
558 sigAlg,
559 CSSM_OK,
560 "Verify(subj by extracted root key)")) {
561 errorCount++;
562 /* continue */
563 }
564
565 /*
566 * Verify subject cert by subject pub key, should fail.
567 */
568 if(verifyCert(clHand,
569 cspHand,
570 &signedSubjCert,
571 NULL,
572 &subjPubKey,
573 sigAlg,
574 CSSMERR_CL_VERIFICATION_FAILURE,
575 "Verify(subj by subj key)")) {
576 errorCount++;
577 /* continue */
578 }
579
580 /*
581 * Verify subject cert by subject cert, should fail.
582 */
583 if(verifyCert(clHand,
584 cspHand,
585 &signedSubjCert,
586 &signedSubjCert,
587 NULL,
588 CSSM_ALGID_NONE, // sigAlg not used here
589 CSSMERR_CL_VERIFICATION_FAILURE,
590 "Verify(subj by subj cert)")) {
591 errorCount++;
592 /* continue */
593 }
594
595 /*
596 * Verify erroneous subject cert by root pub key, should fail.
597 */
598 badByte = genRand(1, signedSubjCert.Length - 1);
599 signedSubjCert.Data[badByte] ^= 0x55;
600 if(verifyCert(clHand,
601 cspHand,
602 &signedSubjCert,
603 NULL,
604 &rootPubKey,
605 sigAlg,
606 CSSMERR_CL_VERIFICATION_FAILURE,
607 "Verify(bad subj by root key)")) {
608 errorCount++;
609 /* continue */
610 }
611
612
613 /* free/delete certs and keys */
614 appFreeCssmData(&signedSubjCert, CSSM_FALSE);
615 appFreeCssmData(&signedRootCert, CSSM_FALSE);
616
617 cspFreeKey(cspHand, &rootPubKey);
618 cspFreeKey(cspHand, &subjPubKey);
619
620 /* These don't work because CSSM_CL_CertGetKeyInfo() gives keys with
621 * a bogus GUID. This may be a problem with the Apple CSP...
622 *
623 cspFreeKey(cspHand, extractRootKey);
624 cspFreeKey(cspHand, extractSubjKey);
625 *
626 * do it this way instead...*/
627 CSSM_FREE(extractRootKey->KeyData.Data);
628 CSSM_FREE(extractSubjKey->KeyData.Data);
629
630 /* need to do this regardless...*/
631 CSSM_FREE(extractRootKey);
632 CSSM_FREE(extractSubjKey);
633
634abort:
635 if(cspHand != 0) {
636 CSSM_ModuleDetach(cspHand);
637 }
638
639 if(errorCount) {
640 printf("Signer/Subject test failed with %d errors\n", errorCount);
641 }
642 else {
643 printf("Signer/Subject test succeeded\n");
644 }
645 return 0;
646}
647
648
649/* compare KeyData for two keys. */
650static CSSM_BOOL compareKeyData(const CSSM_KEY *key1, const CSSM_KEY *key2)
651{
652 if(key1->KeyData.Length != key2->KeyData.Length) {
653 return CSSM_FALSE;
654 }
655 if(memcmp(key1->KeyData.Data,
656 key2->KeyData.Data,
657 key1->KeyData.Length)) {
658 return CSSM_FALSE;
659 }
660 return CSSM_TRUE;
661}
662
663/* verify a cert using specified key and/or signerCert */
664static CSSM_RETURN verifyCert(CSSM_CL_HANDLE clHand,
665 CSSM_CSP_HANDLE cspHand,
666 CSSM_DATA_PTR cert,
667 CSSM_DATA_PTR signerCert, // optional
668 CSSM_KEY_PTR key, // ditto, to work spec one, other, or both
669 CSSM_ALGORITHMS sigAlg, // CSSM_ALGID_SHA1WithRSA, etc.
670 CSSM_RETURN expectResult,
671 const char *opString)
672{
673 CSSM_RETURN crtn;
674 CSSM_CC_HANDLE signContext = CSSM_INVALID_HANDLE;
675
676 if(key) {
677 crtn = CSSM_CSP_CreateSignatureContext(cspHand,
678 sigAlg,
679 NULL, // AccessCred
680 key,
681 &signContext);
682 if(crtn) {
683 printf("Failure during %s\n", opString);
684 printError("CSSM_CSP_CreateSignatureContext", crtn);
685 return crtn;
686 }
687 }
688 crtn = CSSM_CL_CertVerify(clHand,
689 signContext,
690 cert, // CertToBeVerified
691 signerCert, // SignerCert
692 NULL, // VerifyScope
693 0); // ScopeSize
694 if(crtn != expectResult) {
695 printf("Failure during %s\n", opString);
696 if(crtn == CSSM_OK) {
697 printf("Unexpected CSSM_CL_CertVerify success\n");
698 }
699 else if(expectResult == CSSM_OK) {
700 printError("CSSM_CL_CertVerify", crtn);
701 }
702 else {
703 printError("CSSM_CL_CertVerify: expected", expectResult);
704 printError("CSSM_CL_CertVerify: got ", crtn);
705 }
706 return CSSMERR_CL_VERIFICATION_FAILURE;
707 }
708 if(signContext != CSSM_INVALID_HANDLE) {
709 crtn = CSSM_DeleteContext(signContext);
710 if(crtn) {
711 printf("Failure during %s\n", opString);
712 printError("CSSM_DeleteContext", crtn);
713 return crtn;
714 }
715 }
716 return CSSM_OK;
717}
mirror of Security