path: root/certs/makecerts.py

#!/usr/bin/env python
# **********************************************************************
#
# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
#
# This copy of Ice is licensed to you under the terms described in the
# ICE_LICENSE file included in this distribution.
#
# **********************************************************************

import os, sys, shutil, glob, socket, subprocess

def usage():
    print("Usage: " + sys.argv[0] + " [options] [ip-address]")
    print("")
    print("Options:")
    print("-h    Show this message.")
    print("-d    Debugging output.")
    sys.exit(1)

try:
    from subprocess import DEVNULL
except ImportError:
    DEVNULL = open(os.devnull, 'wb')

debug = False
ipAddress = None

#
# Check arguments
#
debug = False
ipAddress = None
for x in sys.argv[1:]:
    if x == "-h":
        usage()
        sys.exit(0)
    elif x == "-d":
        debug = True
    elif x.startswith("-"):
        print(sys.argv[0] + ": unknown option `" + x + "'")
        print("")
        usage()
        sys.exit(1)
    else:
        ipAddress = x

if not ipAddress:
    try:
        ipAddress = socket.gethostbyname(socket.gethostname())
    except:
        ipAddress = "127.0.0.1"

cwd = os.getcwd()
if not os.path.exists("ImportKey.class") or os.path.basename(cwd) != "certs":
    print("You must run this script from the certs directory")
    sys.exit(1)

#
# Make sure keytool is available
#
if subprocess.call("keytool", shell=True, stdout=DEVNULL, stderr=DEVNULL) != 0:
    print("error: couldn't run keytool, make sure the Java bin directory is in your PATH,\nkeytool is required to generate Java certificates")
    sys.exit(1)

bksSupport = True
if subprocess.call("javap org.bouncycastle.jce.provider.BouncyCastleProvider", shell=True, stdout=DEVNULL, stderr=DEVNULL) != 0:
    print("warning: couldn't find Bouncy Castle provider, Android certificates won't be created")
    bksSupport = False
    
while True:
    print("The IP address used for the server certificate will be: " + ipAddress)
    sys.stdout.write("Do you want to keep this IP address? (y/n) [y]")
    sys.stdout.flush()
    input = sys.stdin.readline().strip()
    if input == 'n':
        sys.stdout.write("IP : ")
        sys.stdout.flush()
        ipAddress = sys.stdin.readline().strip()
    else:
        break

certs = "."
caHome = os.path.abspath(os.path.join(certs, "ca")).replace('\\', '/')

#
# Static configuration file data.
#
configFiles = {\
"ca.cnf":"\
# **********************************************************************\n\
#\n\
# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
#\n\
# This copy of Ice is licensed to you under the terms described in the\n\
# ICE_LICENSE file included in this distribution.\n\
#\n\
# **********************************************************************\n\
\n\
# Configuration file for the CA. This file is generated by iceca init.\n\
# DO NOT EDIT!\n\
\n\
###############################################################################\n\
###  Self Signed Root Certificate\n\
###############################################################################\n\
\n\
[ ca ]\n\
default_ca = ice\n\
\n\
[ ice ]\n\
default_days     = 1825    # How long certs are valid.\n\
default_md       = sha256  # The Message Digest type.\n\
preserve         = no      # Keep passed DN ordering?\n\
\n\
[ req ]\n\
default_bits        = 2048\n\
default_keyfile     = {0}/cakey.pem\n\
default_md          = sha256\n\
prompt              = no\n\
distinguished_name  = dn\n\
x509_extensions     = extensions\n\
\n\
[ extensions ]\n\
basicConstraints = CA:true\n\
\n\
# PKIX recommendation.\n\
subjectKeyIdentifier = hash\n\
authorityKeyIdentifier = keyid:always,issuer:always\n\
\n\
[dn]\n\
countryName            = US\n\
stateOrProvinceName    = Florida\n\
localityName           = Jupiter\n\
organizationName       = ZeroC, Inc.\n\
organizationalUnitName = Ice\n\
commonName             = ZeroC Tests and Demos CA\n\
emailAddress           = info@zeroc.com\n\
",\
"ice.cnf":"\
# **********************************************************************\n\
#\n\
# Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.\n\
#\n\
# This copy of Ice is licensed to you under the terms described in the\n\
# ICE_LICENSE file included in this distribution.\n\
#\n\
# **********************************************************************\n\
\n\
# Configuration file to sign a certificate. This file is generated by iceca init.\n\
# DO NOT EDIT!!\n\
\n\
[ ca ]\n\
default_ca = ice\n\
\n\
[ ice ]\n\
dir              = {0}              # Where everything is kept.\n\
private_key      = $dir/cakey.pem   # The CA Private Key.\n\
certificate      = $dir/cacert.pem  # The CA Certificate.\n\
database         = $dir/index.txt           # Database index file.\n\
new_certs_dir    = $dir                     # Default loc for new certs.\n\
serial           = $dir/serial              # The current serial number.\n\
certs            = $dir                     # Where issued certs are kept.\n\
RANDFILE         = $dir/.rand               # Private random number file.\n\
default_days     = 1825                     # How long certs are valid.\n\
default_md       = sha256                      # The Message Digest type.\n\
preserve         = yes                      # Keep passed DN ordering?\n\
\n\
policy           = ca_policy\n\
x509_extensions  = certificate_extensions\n\
\n\
[ certificate_extensions ]\n\
basicConstraints = CA:false\n\
\n\
# PKIX recommendation.\n\
subjectKeyIdentifier = hash\n\
authorityKeyIdentifier = keyid:always,issuer:always\n\
subjectAltName         = DNS:{1}, IP:{2}\n\
\n\
[ ca_policy ]\n\
countryName            = match\n\
stateOrProvinceName    = match\n\
organizationName       = match\n\
organizationalUnitName = optional\n\
emailAddress           = optional\n\
commonName             = supplied\n\
\n\
[ req ]\n\
default_bits        = 1024\n\
default_md          = sha256\n\
prompt              = no\n\
distinguished_name  = dn\n\
x509_extensions     = extensions\n\
\n\
[ extensions ]\n\
basicConstraints = CA:false\n\
\n\
# PKIX recommendation.\n\
subjectKeyIdentifier = hash\n\
authorityKeyIdentifier = keyid:always,issuer:always\n\
keyUsage = nonRepudiation, digitalSignature, keyEncipherment\n\
\n\
[dn]\n\
countryName            = US\n\
stateOrProvinceName    = Florida\n\
localityName           = Jupiter\n\
organizationName       = ZeroC, Inc.\n\
organizationalUnitName = Ice\n\
commonName             = {3}\n\
emailAddress           = info@zeroc.com\n\
" }

def generateConf(file, dns = None, ip = None, commonName = None):
    cnf = open(os.path.join(caHome, file), "w")
    if dns and ip and commonName:
        cnf.write(configFiles[file].format(caHome, dns, ip, commonName))
    else:
        cnf.write(configFiles[file].format(caHome))
    cnf.close()

def run(cmd):
    if debug:
        print("[debug]", cmd)

    p = subprocess.Popen(cmd,
                         shell = True,
                         stdin = subprocess.PIPE,
                         stdout = subprocess.STDOUT if debug else subprocess.PIPE,
                         stderr = subprocess.STDERR if debug else subprocess.PIPE,
                         bufsize = 0)
    if p.wait() != 0:
        print("command failed:" + cmd + "\n")
        for line in p.stdout.readlines():
            print(line.decode("utf-8").strip())
        sys.exit(1)
    
def runOpenSSL(command):
    run("openssl " + command)

def jksToBks(source, target):
    cmd = "keytool -importkeystore -srckeystore " + source + " -destkeystore " + target + \
          " -srcstoretype JKS -deststoretype BKS -srcstorepass password -deststorepass password " + \
          "-provider org.bouncycastle.jce.provider.BouncyCastleProvider -noprompt"
    if debug:
        print("[debug]", cmd)

    p = subprocess.Popen(cmd, shell = True, stdin = subprocess.PIPE, stdout = subprocess.PIPE,
                        stderr = subprocess.STDOUT, bufsize = 0)

    while(True):
        line = p.stdout.readline()            
        if p.poll() is not None and not line:
            # The process terminated
            break
            
        if line.find("java.lang.ClassNotFoundException: org.bouncycastle.jce.provider.BouncyCastleProvider") != -1:
            print("")
            print("WARNING: BouncyCastleProvider not found cannot export certificates for android")
            print("         demos in BKS format. You can download BKS provider from:")
            print("")
            print("            http://www.bouncycastle.org/")
            print("")
            print("         After download copy the JAR to $JAVA_HOME/lib/ext where JAVA_HOME")
            print("         points to your JRE and run this script again.")
            print("")
            return False
        elif line.find("java.security.InvalidKeyException: Illegal key size") != -1:
            print("")
            print("WARNING: You need to install Java Cryptography Extension (JCE) Unlimited")
            print("         Strength. You can download it from Additional Resources section")
            print("         in Orcale Java Download page at:")
            print("")
            print("             http://www.oracle.com/technetwork/java/javase/downloads/index.html")
            print("")
            return False
        return True
    if p.poll() != 0:
        sys.exit(1)

def generateCert(desc, name, commonName = None):

    if not commonName:
        commonName = desc
    
    generateConf("ice.cnf", ipAddress, ipAddress, commonName)

    cert = os.path.join(certs, name + "_rsa1024_pub.pem")
    key = os.path.join(certs, name + "_rsa1024_priv.pem")
    sys.stdout.write("Generating new " + desc + " certificates... ")
    sys.stdout.flush()

    if os.path.exists(cert):
        os.remove(cert)
    if os.path.exists(key):
        os.remove(key)

    serial = os.path.join(caHome, "serial")
    f = open(serial, "r")
    serialNum = f.read().strip()
    f.close()
    
    tmpKey = os.path.join(caHome, serialNum + "_key.pem")
    tmpCert = os.path.join(caHome, serialNum + "_cert.pem")
    req = os.path.join(caHome, "req.pem")
    config = os.path.join(caHome, "ice.cnf")

    #
    # Generate PEM certificates
    #
    runOpenSSL("req -config " + config + " -newkey rsa:1024 -nodes -keyout " + tmpKey + " -keyform PEM -out " + req)
    runOpenSSL("ca -config " + config + " -batch -in " + req)

    shutil.move(os.path.join(caHome, serialNum + ".pem"), tmpCert)
    shutil.copyfile(tmpKey, key)
    shutil.copyfile(tmpCert, cert)
    os.remove(req)

    #
    # Generate PKCS12 certificates
    #
    runOpenSSL("pkcs12 -in " + cert + " -inkey " + key + " -export -out " + name + "_rsa1024.pfx" + \
               " -certpbe PBE-SHA1-RC4-40 -keypbe PBE-SHA1-RC4-40" + \
               " -passout pass:password -name " + desc)

    #
    # Generate Java keystore
    #
    tmpFile = desc + ".p12"
    runOpenSSL("pkcs12 -in " + cert + " -inkey " + key + " -export -out " + tmpFile + \
               " -name rsakey -passout pass:password -certfile cacert.pem")
    run("java -classpath . ImportKey " + tmpFile + " rsakey cacert.pem " + desc + ".jks password")
    os.remove(tmpFile)

    #
    # Generate BKS for Android if supported
    #
    if bksSupport:
        jksToBks(desc + ".jks", desc + ".bks")
    
    if not debug:
        print("ok")


#
# Generate the CA certificate and database
#
if os.path.exists(caHome):
    shutil.rmtree(caHome)

sys.stdout.write("Generating new CA certificate and key... ")
sys.stdout.flush()
os.mkdir(caHome)

f = open(os.path.join(caHome, "serial"), "w")
f.write("01")
f.close()

f = open(os.path.join(caHome, "index.txt"), "w")
f.truncate(0)
f.close()

generateConf("ca.cnf")

config = os.path.join(caHome, "ca.cnf")
caCert = os.path.join(caHome, "cacert.pem")
runOpenSSL("req -config " + config + " -x509 -days 1825 -newkey rsa:1024 -out " + caCert + " -outform PEM -nodes")
runOpenSSL("x509 -in " + caCert + " -outform DER -out " + os.path.join(certs, "cacert.der")) # Convert to DER
shutil.copyfile(caCert, os.path.join(certs, "cacert.pem"))
shutil.copyfile(os.path.join(caHome, "cakey.pem"), os.path.join(certs, "cakey.pem"))
if os.path.exists("certs.jks"):
    os.remove("certs.jks")
run("keytool -import -alias cacert -file cacert.der -keystore certs.jks -storepass password -noprompt")
if not debug:
    print("ok")

#
# Generate the client and the server certificates
#
generateCert("server", "s", ipAddress) # commonName = ipAddress
generateCert("client", "c")

os.chdir("..")