summaryrefslogtreecommitdiffstats
path: root/apps/req.c
Commit message (Collapse)AuthorAgeFilesLines
* apps/req.c: Always set permissions for private key outputTomas Mraz2025-12-171-1/+1
| | | | | | | | | | The key output will be always private. Reported with a proposed fix by Stanislav Fort (Aisle Research). Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29397)
* 3.4-POST-CLANG-FORMAT-WEBKIT3.4-POST-CLANG-FORMAT-WEBKITBob Beck2025-12-091-223/+252
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> (Merged from https://github.com/openssl/openssl/pull/29260)
* apps/req.c: No warning reading from stdin if redirectedBhaskar Metiya2024-08-151-1/+2
| | | | | | | | | CLA: trivial Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25179)
* apps/req: avoid needless hint on using -help on duplicate extensions added ↵Dr. David von Oheimb2024-07-101-1/+1
| | | | | | | | via -addext Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24792)
* apps: ca,req,x509: Add explicit start and end dates optionsStephan Wurm2024-04-091-9/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | - Added options `-not_before` (start date) and `-not-after` (end date) for explicit setting of the validity period of a certificate in the apps `ca`, `req` and `x509` - The new options accept time strings or "today" - In app `ca`, use the new options as aliases of the already existing options `-startdate` and `-enddate` - When used in apps `req` and `x509`, the end date must be >= the start date, in app `ca` end date < start date is also accepted - In any case, `-not-after` overrides the `-days` option - Added helper function `check_cert_time_string` to validate given certificate time strings - Use the new helper function in apps `ca`, `req` and `x509` - Moved redundant code for time string checking into `set_cert_times` helper function. - Added tests for explicit start and end dates in apps `req` and `x509` - test: Added auxiliary functions for parsing fields from `-text` formatted output to `tconversion.pl` - CHANGES: Added to new section 3.4 Signed-off-by: Stephan Wurm <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21716)
* Copyright year updatesRichard Levitte2024-04-091-1/+1
| | | | | | | | | | Reviewed-by: Neil Horman <[email protected]> Release: yes (cherry picked from commit 0ce7d1f355c1240653e320a3f6f8109c1f05f8c0) Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24034)
* Fix openssl req with -addext subjectAltName=dirNameBernd Edlinger2024-04-021-1/+1
| | | | | | | | | | | | | | | | The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23669)
* apps/req,crl: exit with 1 on verification failureVladimir Kotal2024-03-261-2/+3
| | | | | | | | Fixes #23771 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23773)
* Fix a possible memory leak in req_mainBernd Edlinger2024-01-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | if the private key is output to stdout using the HARNESS_OSSL_PREFIX, out is a stack of BIOs and must therefore free'd using BIO_free_all. Steps to reproduce: $ HARNESS_OSSL_PREFIX=x OPENSSL_CONF=apps/openssl.cnf util/shlib_wrap.sh apps/openssl req -new -keyout - -passout pass: </dev/null [...] Direct leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f6f692b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f6f686eda00 in CRYPTO_malloc crypto/mem.c:202 #2 0x7f6f686edba0 in CRYPTO_zalloc crypto/mem.c:222 #3 0x7f6f68471bdf in BIO_new_ex crypto/bio/bio_lib.c:83 #4 0x7f6f68491a8f in BIO_new_fp crypto/bio/bss_file.c:95 #5 0x555c5f58b378 in dup_bio_out apps/lib/apps.c:3014 #6 0x555c5f58f9ac in bio_open_default_ apps/lib/apps.c:3175 #7 0x555c5f58f9ac in bio_open_default apps/lib/apps.c:3203 #8 0x555c5f528537 in req_main apps/req.c:683 #9 0x555c5f50e315 in do_cmd apps/openssl.c:426 #10 0x555c5f4c5575 in main apps/openssl.c:307 #11 0x7f6f680461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: 128 byte(s) leaked in 1 allocation(s). Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23365)
* Fix some memory leaks in the openssl appBernd Edlinger2023-09-211-0/+2
| | | | | | | | | | In some error cases the normal cleanup did not happen, but instead an exit(1) which caused some memory leaks, as reported in #22049. Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Nicola Tuveri <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22055)
* Fix output corruption in req commandBernd Edlinger2023-09-091-4/+4
| | | | | | | | | | when used in conjunction with -out and -modulus options. Fixes #21403 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22026)
* Copyright year updatesMatt Caswell2023-09-071-1/+1
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* Per other commands, make progress dots in req only w/ -verbosePhilip Prindeville2023-09-061-3/+10
| | | | | | | | | Signed-off-by: Philip Prindeville <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21937)
* Cast the argument to unsigned char when calling isspace()Michael Baentsch2023-06-091-2/+2
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21151)
* APPS: replace awkward and error-prone pattern by calls to new ↵Dr. David von Oheimb2023-05-251-13/+5
| | | | | | | | | app_conf_try_number() Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20971)
* APPS: replace awkward and error-prone pattern by calls to new ↵Dr. David von Oheimb2023-05-251-70/+29
| | | | | | | | | app_conf_try_string() Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20971)
* feature: openssl req -verify output to stderr instead of stdout #20728Rajarshi Karmakar2023-05-041-1/+1
| | | | | | Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20858)
* apps: silent warning when loading CSR files with vfyopt optionTianjia Zhang2023-05-031-1/+1
| | | | | | | | | | | | | | | | | When verifying or signing a CSR file with the -vfyopt option, a warning message similar to the following will appear: Warning: CSR self-signature does not match the contents This happens especially when the SM2 algorithm is used and the distid parameter is added. Pass the vfyopts parameter to the do_X509_REQ_verify() function to eliminate the warning message. Signed-off-by: Tianjia Zhang <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20799)
* APPS: generated certs bear X.509 V3, unless -x509v1 option of req app is givenDr. David von Oheimb2023-01-241-4/+9
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19271)
* apps/req.c: properly report parse errors by duplicated(); simplify the functionDr. David von Oheimb2023-01-241-11/+14
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/19271)
* APPS: Move load_csr_autofmt() from apps/cmp.c to apps.c and use it also for ↵Dr. David von Oheimb2022-09-201-3/+4
| | | | | | | | | | | apps, too Also add related references to FR #15725. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: David von Oheimb <[email protected]> (Merged from https://github.com/openssl/openssl/pull/18900)
* Update copyright yearMatt Caswell2022-05-031-1/+1
| | | | | Reviewed-by: Tomas Mraz <[email protected]> Release: yes
* req, x509: Allow printing modulus of RSA-PSS keysTomas Mraz2022-04-011-1/+1
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/17990)
* Enable openssl req -x509 to create certificates from CSRsHugo Landau2022-03-031-2/+3
| | | | | | | | | | | | | | | | `openssl req -x509` has code allowing it to generate certificates from CSRs as a replacement for `openssl x509`, but a bug prevents it from working properly. -CA and -CAkey can now be passed to generate a CA-signed certificate as documented in openssl-req(1). Regression testing has been added to `openssl req`. Fixes #17736. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/17782)
* check the return value of CRYPTO_strdup()xkernel2022-02-281-0/+7
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/17741)
* Standardize progress callback for dhparam, dsaparam, etc.Philip Prindeville2022-01-211-20/+1
| | | | | | | | Signed-off-by: Philip Prindeville <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/17359)
* APPS: Add check for multiple 'unknown' optionsDr. David von Oheimb2022-01-111-0/+1
| | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16416)
* APPS: Improve diagnostics on missing/extra args and unknown cipher/digestDr. David von Oheimb2021-12-071-7/+2
| | | | | Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16450)
* X509: Fix handling of AKID and SKID extensions according to configurationDr. David von Oheimb2021-11-111-3/+1
| | | | | | | | | Fixes #16300 Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16342)
* fix some code with obvious wrong coding stylex20182021-10-281-1/+1
| | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16918)
* APPS/req.c: Make -reqexts option an alias of -extensions optionDr. David von Oheimb2021-10-221-53/+30
| | | | | | | | This simplifies code, doc, and use. Fixes issue ignoring one or the other. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16865)
* req: Do not warn about using stdin when generating new requestTomas Mraz2021-10-111-1/+1
| | | | | | | Fixes #16773 Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16774)
* APPS/{x509,req}: Fix description and diagnostics of -key, -in, etc. optionsDr. David von Oheimb2021-09-111-7/+34
| | | | | Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16440)
* APPS/req: Fix AKID generation in case -CA option is usedDr. David von Oheimb2021-08-261-5/+6
| | | | | Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16420)
* APPS/req: Fix misconceptions on -CA, -CAkey, and -key options. -CA now ↵Dr. David von Oheimb2021-08-261-23/+17
| | | | | | | implies -x509 Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16420)
* req: Avoid segfault when -modulus is usedTomas Mraz2021-08-051-2/+2
| | | | | | | | Fixes #16196 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16215)
* If we have passed the private key, don't copy it implicitlyDmitry Belyavskiy2021-08-031-1/+1
| | | | | | | | | Fixes #16197 Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/16199)
* Fix 'openssl req' to correctly use the algorithm from '-newkey algo:nnnn'Richard Levitte2021-06-261-2/+2
| | | | | | | | We used the original string, which meant fetching for, for example, 'rsa:2048'. That was, of course, doomed to fail. Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15912)
* apps: properly initialise arguments to EVP_PKEY_get_bn_param()Pauli2021-06-261-1/+1
| | | | | | | | | | This avoids use of uninitialised memory. Follow on to #15900 Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15908)
* req: detect a bad choice of digest earlyPauli2021-06-041-1/+10
| | | | | | | | | | This is a regression against 1.1.1 when an unknown digest was detected early. Fixes #15285 Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15602)
* req: fix default bits handling for -newkeyTomas Mraz2021-06-041-1/+6
| | | | | | | Fixes #15569 Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15582)
* Rename all getters to use get/get0 in nameTomas Mraz2021-06-011-1/+1
| | | | | | | | | | | | | | For functions that exist in 1.1.1 provide a simple aliases via #define. Fixes #15236 Functions with OSSL_DECODER_, OSSL_ENCODER_, OSSL_STORE_LOADER_, EVP_KEYEXCH_, EVP_KEM_, EVP_ASYM_CIPHER_, EVP_SIGNATURE_, EVP_KEYMGMT_, EVP_RAND_, EVP_MAC_, EVP_KDF_, EVP_PKEY_, EVP_MD_, and EVP_CIPHER_ prefixes are renamed. Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15405)
* req: fix Coverity 1485137 Explicit null dereferencePauli2021-06-011-0/+11
| | | | | | | | Add a check for a non-existent file name when specifying params via file. Add a check for a failure to determine key type. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15534)
* APPS req: Extend the -keyout option to be respected also with -keyDr. David von Oheimb2021-05-271-10/+13
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/13715)
* DOC: Improve description of 'req' app: -new, -newkey, and -keyout optionsDr. David von Oheimb2021-05-271-1/+2
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/13715)
* Add warning to key/param generating apps on potential delay due to missing ↵Dr. David von Oheimb2021-05-251-21/+8
| | | | | | | | | entropy This also introduces app_keygen() and app_paramgen() and cleans up err reporting. Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/12095)
* Fix 'openssl req' to be able to use provided keytypesRichard Levitte2021-05-251-83/+80
| | | | | | | | | | | | 'openssl req' was still using old APIs that could only deal with EVP_PKEY_ASN1_METHOD based EVP_PKEYs. Now modified to use more generic functions that can handle all forms of EVP_PKEY, this app should be ready for the future. Fixes #15388 Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15400)
* Make the -inform option to be respected if possibleTomas Mraz2021-05-061-3/+3
| | | | | | | | | | | | | | | | Add OSSL_STORE_PARAM_INPUT_TYPE and make it possible to be set when OSSL_STORE_open_ex() or OSSL_STORE_attach() is called. The input type format is enforced only in case the file type file store is used. By default we use FORMAT_UNDEF meaning the input type is not enforced. Fixes #14569 Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15100)
* APPS: Replace 'OPT_ERR = -1, OPT_EOF = 0, OPT_HELP' by OPT_COMMON macroDr. David von Oheimb2021-05-051-1/+1
| | | | | Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15111)
* apps/ca,req,x509: Switch to EVP_DigestSignInit_exPetr Gotthard2021-04-301-14/+5
| | | | | | | | | | | | Switch lib/apps.c do_sign_init() to use EVP_DigestSignInit_ex, so it works with external providers. Since EVP_DigestSignInit_ex requires a digest name instead of an EVP_MD pointer, the apps using do_sign_init() had to be modified to pass char* instead of EVP_MD*. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/15014)
generated by cgit (git 2.51.2) at 2026-10-25 12:34:01 +0100