// SignWithOpenSSL.cpp : 定义控制台应用程序的入口点。

//

#include "stdafx.h"

#include <windows.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <openssl/engine.h>

#include <openssl/conf.h>

#include <openssl/pem.h>

#include <openssl/x509.h>

#include <openssl/rsa.h>

#include <openssl/x509v3.h>

#define OPENSSL_LOAD_CONF

#define UC_ENGINE_SOPATH "C:\\Program Files\\Smart card bundle\\engine_pkcs11.dll"

#define UC_EXPECTED_ENGINE_ID "pkcs11"

#define UC_ENGINE_MODULEPATH "C:\\Windows\\System32\\DMPKCS11.dll"

// 列出当前所有的engine

/*

ENGINE *ENGINE_get_first(void);

ENGINE *ENGINE_get_last(void);

ENGINE *ENGINE_get_next(ENGINE *e);

ENGINE *ENGINE_get_prev(ENGINE *e);

*/

void ListEngine()

{

ENGINE *current;

current = ENGINE_get_first();

if( NULL != current )

{

printf("id: %s, name: %s\n",

ENGINE_get_id(current),

ENGINE_get_name(current));

while( NULL != (current = ENGINE_get_next(current)))

{

printf("id: %s, name: %s\n",

ENGINE_get_id(current),

ENGINE_get_name(current));

}

}

}

/*存储证书*/

int save_cert(X509 *pCert, char *pCertFile)

{

BIO *pbio;

if(NULL == pCert || NULL == pCertFile)

{

return -1;

}

pbio = BIO_new_file(pCertFile, "w");

if(NULL == pbio)

{

return -1;

}

if(!i2d_X509_bio(pbio, pCert))

{

printf("save_cert:call PEM_write_bio_X509 error ");

return -1;

}

printf("Bingo, New Cert is borned\n");

BIO_free(pbio);

return 0;

}

void add_subject_entity(X509_NAME *pSubjectName, char *key, char *value)

{

int nid;

X509_NAME_ENTRY *ent;

if( (nid =OBJ_txt2nid(key)) == NID_undef )

{

printf(" add_subject_entity:concert nid error");

return ;

}

ent = X509_NAME_ENTRY_create_by_NID( NULL, nid, MBSTRING_UTF8,

(unsigned char*)value, -1);

if(ent == NULL)

{

printf("add_subject_entity:create ent error");

return;

}

if(X509_NAME_add_entry(pSubjectName, ent, -1, 0) != 1)

{

printf("add_subject_entity:add to subjectname error");

return;

}

return;

}

int CreateX509Cert(X509 *m_pCACert, EVP_PKEY *m_pCAKey)

{

// 读取证书请求

BIO           *in;

X509_REQ      *req=NULL,**req2=NULL;

in = BIO_new_file("certreq.txt","r");

req = PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);

if( req == NULL )

{

printf("DER Decode Error!\n");

}

else

{

printf("DER Decode Success!\n");

}

// 使用usbkey中的私钥进行签名

X509 *m_pClientCert;

m_pClientCert = X509_new();

//设置版本号

X509_set_version(m_pClientCert, 2);

//设置证书序列号，这个sn就是CA中心颁发的第N份证书

ASN1_INTEGER_set(X509_get_serialNumber(m_pClientCert),100);

//设置证书开始时间

X509_gmtime_adj(X509_get_notBefore(m_pClientCert),0);

//设置证书结束时间

X509_gmtime_adj(X509_get_notAfter(m_pClientCert), (long)60*60*24);

//设置证书的主体名称，req就是刚刚生成的请求证书

X509_set_subject_name(m_pClientCert, X509_REQ_get_subject_name(req));

//设置证书的公钥信息

X509_set_pubkey(m_pClientCert, X509_PUBKEY_get(req->req_info->pubkey));

//设置证书的签发者信息，m_pCACert是CA证书

X509_set_issuer_name(m_pClientCert, X509_get_subject_name(m_pCACert));

//设置扩展项目

X509V3_CTX ctx;

X509V3_set_ctx(&ctx, m_pCACert, m_pClientCert, NULL, NULL, 0);

X509_EXTENSION *x509_ext = X509_EXTENSION_new();

x509_ext = X509V3_EXT_conf(NULL, &ctx, "HELLO", "HELLO");

X509_add_ext(m_pClientCert,x509_ext,-1);

//设置签名值

// EVP_sha1 是否可以设置成别的，如EVP_md5

// 这样一份X509证书就生成了，下面的任务就是对它进行编码保存。

X509_sign(m_pClientCert, m_pCAKey, EVP_sha1());

// 输出证书

save_cert(m_pClientCert, "d:\\test.cer");

return 0;

}

int main(int argc, CHAR* argv[])

{

ENGINE *e;

const char *engine_id = "pkcs11";

const char *key_id = "37af001ddbd525e640ca3c3f6d78b009741d1f48";

UI_METHOD *ui_method = NULL;

EVP_PKEY *priv_key;

void *cb_data;

const char *config_name = NULL;

BIO *bio_err=NULL;

/* Load the config file */

//OPENSSL_config(config_name); // 不使用Openssl0.9.8e的配置文件来导入PKCS11

ENGINE_load_dynamic();

ListEngine();

printf("\nLoading Dynamic...\n");

/* Register engine */

printf("Registering enginen");

e = ENGINE_by_id("dynamic");

if(!e) {

/* the engine isn't available */

printf("The engine isn't available\n");

return 0;

}

//int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void));

ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);

// 设置engine_pkcs11的路径

ENGINE_ctrl_cmd_string(e, "SO_PATH", UC_ENGINE_SOPATH, 0);

ENGINE_ctrl_cmd_string(e, "ID", UC_EXPECTED_ENGINE_ID, 0);

ENGINE_ctrl_cmd_string(e, "LIST_ADD", "1", 0);

ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0);

// 设置USBKEY厂商PKCS#11实现的路径

ENGINE_ctrl_cmd_string(e, "MODULE_PATH", UC_ENGINE_MODULEPATH, 0);

// 设置PIN码

if(!ENGINE_ctrl_cmd_string(e, "PIN", "111111", 0)){

printf("Error sending PIN to = engine");

ENGINE_free(e);

return 0;

}

ListEngine();

if(!ENGINE_init(e)) {

/* the engine couldn't initialise, release 'e' */

printf("The engine couldn't initialise\n");

ENGINE_free(e);

return 0;

}

if(!ENGINE_register_RSA(e)){

/* This should only happen when 'e' can't initialise, but the previous

* statement suggests it did. */

printf("This should not happen\n");

abort();

}

// 直接从usb-key中导入证书,但必须初始化后。

struct {

const char * cert_id;

X509 * cert;

} parms;

parms.cert_id = "slot_0-id_37af001ddbd525e640ca3c3f6d78b009741d1f48";

parms.cert = NULL;

ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);

// Load private key

printf("Loading private key\n");

priv_key = ENGINE_load_private_key(e, key_id, ui_method, &cb_data);

// 产生证书

CreateX509Cert(parms.cert, priv_key);

// Release the functional reference from ENGINE_init()

ENGINE_finish(e);

// Release the structural reference from ENGINE_by_id()

ENGINE_free(e);

return 0;

}