#include <sstream>
#include <unordered_map>
+#include <exception>
#include <openssl/ssl.h>
#include <openssl/err.h>
if( res == "" ) {
bn = BN_new();
- if( !bn ) {
- throw "Initing serial failed";
+ if( !bn || !BN_hex2bn( &bn, "1" )) {
+ throw std::runtime_error("Initing serial failed");
}
} else {
if( !BN_hex2bn( &bn, res.c_str() ) ) {
- throw "Parsing serial failed.";
+ throw std::runtime_error("Parsing serial failed.");
}
}
data.get()[len + 3] = profile & 0xFF; // profile id
if( !RAND_bytes( data.get() + len + 4, 16 ) || !BN_add_word( serial.get(), 1 ) ) {
- throw "Big number math failed while fetching random data for serial number.";
+ throw std::runtime_error("Big number math failed while fetching random data for serial number.");
}
std::shared_ptr<char> serStr = std::shared_ptr<char>(
std::shared_ptr<SignedCertificate> SimpleOpensslSigner::sign( std::shared_ptr<TBSCertificate> cert ) {
std::stringstream signlog;
+ logger::logger_set log_set_sign({logger::log_target(signlog, logger::level::debug)}, logger::auto_register::on);
logger::note( "FINE: Profile name is: ", cert->profile );
if( !ca ) {
logger::error( "ERROR: Signing CA specified in profile could not be loaded." );
- throw "CA-key not found";
+ throw std::runtime_error("CA-key not found");
+ }
+ if(!ca->caKey){
+ throw std::runtime_error("Cannot sign certificate with CA " + ca->name + " because it has no private key.");
}
logger::note( "FINE: Key for Signing CA is correctly loaded." );
req = X509Req::parseCSR( cert->csr_content );
} else {
logger::errorf( "ERROR: Unknown type (\"%s\") of certification in request.", cert->csr_type );
- throw "Error, unknown REQ rype " + ( cert->csr_type ); //! \fixme: Pointer instead of string, please use proper exception classes
+ throw std::runtime_error("Error, unknown REQ rype " + cert->csr_type ); //! \fixme: Pointer instead of string, please use proper exception classe)s
}
int i = req->verify();
if( i < 0 ) {
- throw "Request contains a Signature with problems ... ";
+ throw std::runtime_error("Request contains a Signature with problems ... ");
} else if( i == 0 ) {
- throw "Request contains a Signature that does not match ...";
+ throw std::runtime_error("Request contains a Signature that does not match ...");
} else {
logger::note( "FINE: Request contains valid self-signature." );
}
for( std::shared_ptr<AVA> a : cert->AVAs ) {
logger::notef( "INFO: Trying to add RDN: %s: %s", a->name, a->value );
-
+ if( a->value.empty() ) {
+ logger::notef( "INFO: Removing empty RDN: %s", a->name);
+ continue;
+ }
if( a->name == "CN" ) {
c.addRDN( NID_commonName, a->value );
} else if( a->name == "EMAIL" ) {
c.addRDN( NID_organizationalUnitName, a->value );
} else {
logger::error( "ERROR: Trying to add illegal RDN/AVA type: ", a->name );
- throw "Unhandled/Illegal AVA type";
+ throw std::runtime_error("Unhandled/Illegal AVA type");
}
}
}
logger::note( "INFO: Setting extensions:" );
- c.setExtensions( ca->ca, cert->SANs, prof );
+ c.setExtensions( ca->ca, cert->SANs, prof, ca->crlURL, ca->crtURL );
logger::note( "FINE: Setting extensions successful." );
logger::note( "INFO: Generating next Serial Number ..." );
if( fn.empty() ) {
logger::error( "ERROR: failed to get filename for storage of signed certificate." );
- throw "Storage location could not be determined";
+ throw std::runtime_error("Storage location could not be determined");
}
logger::note( "FINE: Certificate signed successfully." );
}
std::pair<std::shared_ptr<CRL>, std::string> SimpleOpensslSigner::revoke( std::shared_ptr<CAConfig> ca, std::vector<std::string> serials ) {
+ logger::note( "revoking" );
std::string crlpath = ca->path + "/ca.crl";
- std::shared_ptr<CRL> crl( new CRL( crlpath ) );
+ auto crl = std::make_shared<CRL>( crlpath );
std::string date = "";
+ logger::note( "adding serials" );
for( std::string serial : serials ) {
date = crl->revoke( serial, "" );
}
+ logger::note( "signing CRL" );
crl->sign( ca );
writeFile( crlpath, crl->toString() );
+ logger::note( "wrote CRL" );
return std::pair<std::shared_ptr<CRL>, std::string>( crl, date );
}