path: root/certutil

#!/bin/sh
#ident $Id$
#
# certutil -- manage trusted X.509 certificates
# inspired by Netscape PKCS #11 toolkit
# contributed by Jarkko Turkulainen <jt@wapit.com>
#
#
# INTRODUCTION
#
#    certutil can be used with various OpenSSL routines and tools
#    that utilize OpenSSL. Example:
#
#    $ openssl s_client -CApath certdir
#
#    where certdir is a directory created by certutil. Other well known
#    programs that use the same format are stunnel, sendmail and pam_ldap
#
#
#
# HOWTO
#
# 1. Initialize certificate database
#
#    Simply by adding a new certificate. If the certificate directory
#    doesn't exist, the script asks for creating a one. Example:
#
#    $ certutil -a -n "First Cert" -i cert.pem -d /home/jt/mycerts
#    ./certutil: cannot access /home/jt/mycerts, create? [y/N] y
#
#
# 2. Add new certificate
#
#    $ certutil -a -n "My Cert" -i cert.pem [-d certdir]
#
#    Note that nickname (-n) must exist. certdir is optional - if it's
#    not given, $PWD is used. The directory must have a file named certs.dat.
#    If that file doesn't exist, the script refuses to do anything. If your
#    certs.dat file is corrupted, "rm -rf" the whole dir and start from
#    the scratch. cert.pem is the actual sertificate.
#
# 3. Delete certificate
#
#    $ certutil -r -n "My Cert" [-d certdir]
#
#    This command removes the certificate named "My Cert". certdir is
#    optional, see 2.
#
# 4. List sertificates
#
#    $ certutil -l [-d certdir]
#
#    And again, certdir is optional.
#
# 5. View certificate properties
#
#    $ certutil -v -n "My Cert" [-d certdir]
#
#


# Print usage
usage() {
        cat << EOF

Usage: $0 -l [-d dir]
          -a -n name -i file [-d dir]
          -r -n name [-d dir]
          -v -n name [-d dir]

       Commands:
          -l   -- List sertificates (requires a valid dir)
          -a   -- Add sertificate and create dir if necessary
          -r   -- Remove sertificate (requires a valid dir)
          -v   -- View sertificate (requires a valid dir)

       Parameters:
          dir  -- Certificate directory, or \$PWD if not given
          name -- Nickname of the certificate
          file -- Certificate file in PEM format

EOF
        exit 1
}

# Check path
check_path() {

        # check the directory
        if [ ! -d $CDIR -a $ADD -eq 1 ]; then
                echo -n "$0: cannot access $CDIR, create? [y/N] "
                read LINE
                case $LINE in
                        y|Y)
                                mkdir $CDIR
                                chmod 700 $CDIR
                                touch $CDIR/certs.dat
                                chmod 600 $CDIR/certs.dat
                                ;;
                        *)
                                exit 1
                                ;;
                esac
        fi

        # check certs.dat
        if [ ! -e $CDIR/certs.dat ]; then
                echo "$0: please specify a valid cert directory"
                exit 1
        fi
}

# Add certificates
add_cert() {
        check_path
        if [ ! -e $FILE ]; then
                echo "$0: cannot find $FILE"
                exit 1
        fi
        HASH=`openssl x509 -in $FILE -hash -noout 2>/dev/null`.0
        if [ $? -ne 0 ]; then
                echo "$0: unable to load certificate $FILE"
                exit 1
        fi

        if grep "^$CNAME|" $CDIR/certs.dat 1>/dev/null 2>&1; then
                echo "$0: nickname already in use"
                exit 1
        fi

        if [ -e $CDIR/$HASH ]; then
                echo "$0: certificate already in directory"
                echo `openssl x509 -in $CDIR/$HASH -subject -noout`
                exit 1
        else
                cp $FILE $CDIR/$HASH
                chmod 600 $CDIR/$HASH
                echo "$CNAME|$HASH" >> $CDIR/certs.dat
                chmod 600 $CDIR/certs.dat
        fi

}

# List certificates
#
# (this is too slow...)
#
list_cert() {
        check_path
        echo
        echo "Certificates in directory $CDIR"
        echo
        printf "%-30s%s\n" nickname subject/issuer
        echo "----------------------------------------------------------------------------"
        cat $CDIR/certs.dat | while read LINE; do
                NICK=`echo $LINE | cut -d "|" -f 1`
                HASH=`echo $LINE | cut -d "|" -f 2`
                SUBJECT=`openssl x509 -in $CDIR/$HASH -subject -noout`
                ISSUER=`openssl x509 -in $CDIR/$HASH -issuer -noout`
                printf "%-30s%s\n" "$NICK" "$SUBJECT"
                printf "%-30s%s\n\n" "" "$ISSUER"

        done
}

# Remove certificates
remove_cert() {
        check_path
        (
        cat $CDIR/certs.dat | while read LINE; do
                NICK=`echo $LINE | cut -d "|" -f 1`
                HASH=`echo $LINE | cut -d "|" -f 2`
                if [ "$CNAME" = "$NICK" ]; then
                        rm $CDIR/$HASH
                else
                        echo $LINE
                fi
        done
        ) > /tmp/$$
        mv /tmp/$$ $CDIR/certs.dat
        chmod 600 $CDIR/certs.dat
}

# View certificate
view_cert() {
        check_path
        cat $CDIR/certs.dat | while read LINE; do
                NICK=`echo $LINE | cut -d "|" -f 1`
                HASH=`echo $LINE | cut -d "|" -f 2`
                if [ "$CNAME" = "$NICK" ]; then
                        openssl x509 -in $CDIR/$HASH -text
                        return 1
                fi
        done
}

# Parse option string
ADD=0
REMOVE=0
LIST=0
VIEW=0
while getopts "arlvd:n:i:" OPT; do
        case $OPT in
                a)
                        ADD=1
                        ;;
                r)
                        REMOVE=1
                        ;;
                l)
                        LIST=1
                        ;;
                v)
                        VIEW=1
                        ;;
                d)
                        CDIR=$OPTARG
                        ;;
                n)
                        CNAME=$OPTARG
                        ;;
                i)
                        FILE=$OPTARG
                        ;;
                *)
                        usage
                        ;;
        esac
done

# Default options
CDIR=${CDIR:=.}

# Check command line options
if [ $ADD -eq 1 -a $REMOVE -eq 0 -a $LIST -eq 0 -a $VIEW -eq 0 ]; then
        if [ -n "$CNAME" -a -n "$FILE" ]; then
                add_cert
        else
                echo "$0: missing certificate name or file"
                usage
        fi
elif [ $REMOVE -eq 1 -a $ADD -eq 0 -a $LIST -eq 0 -a $VIEW -eq 0 ]; then
        if [ -n "$CNAME" ]; then
                remove_cert
        else
                echo "$0: missing certificate name"
                usage
        fi
elif [ $LIST -eq 1 -a $ADD -eq 0 -a $REMOVE -eq 0 -a $VIEW -eq 0 ]; then
        list_cert
elif [ $VIEW -eq 1 -a $ADD -eq 0 -a $REMOVE -eq 0 -a $LIST -eq 0 ]; then
        if [ -n "$CNAME" ]; then
                if view_cert; then
                        echo "$0: cert named \"$CNAME\" not found"
                        exit 1
                fi
        else
                echo "$0: missing certificate name"
                usage
        fi
else
        usage
fi