Serve HTTPS with certificate chain

example/client-brski/estclient-brski.c

@@ -17,6 +17,7 @@
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/crypto.h>
+#include <openssl/evp.h>
 #ifndef WIN32
 #include <strings.h>
 #endif
@@ -388,7 +389,7 @@ int main (int argc, char **argv)
                 break;
             case 'f':
                 /* Turn FIPS on if requested and exit if failure */
-                set_fips_return = FIPS_mode_set(1);
+                set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
                 if (!set_fips_return) {
                     printf("\nERROR setting FIPS MODE ON ...\n");
                     ERR_load_crypto_strings();

example/client/estclient.c

@@ -24,6 +24,7 @@
 #include <sys/stat.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/crypto.h>
 #include <openssl/pem.h>
 #ifndef WIN32
@@ -1280,7 +1281,7 @@ int main (int argc, char **argv)
                 break;
             case 'f':
                 /* Turn FIPS on if requested and exit if failure */
-                set_fips_return = FIPS_mode_set(1);
+                set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
                 if (!set_fips_return) {
                     printf("\nERROR setting FIPS MODE ON ...\n");
                     ERR_load_crypto_strings();

example/proxy/estproxy.c

@@ -27,6 +27,7 @@
 #include <getopt.h>
 #include <openssl/ssl.h>
 #include <openssl/bio.h>
+#include <openssl/evp.h>
 #include <est.h>
 #include <sys/types.h>
 #ifndef WIN32
@@ -593,7 +594,7 @@ int main (int argc, char **argv)
             /*
              * Turn FIPS on if user requested it and exit if failure
              */
-            set_fips_return = FIPS_mode_set(1);
+            set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
             if (set_fips_return != 1) {
                 set_fips_error = ERR_get_error();
                 printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");

example/server/README

@@ -32,6 +32,21 @@ To run the example:
 4.  Use an EST client to exercise the server.
 
 
+TLS server certificate chain
+----------------------------
+The -c option supplies the TLS server certificate and -k supplies its private
+key.  To send intermediate CA certificates during the HTTPS handshake, use
+-C <file> or --tls-chain <file>.  The chain file must be PEM encoded and
+contain the issuer of the server certificate first, followed by any higher
+intermediate CAs.  Do not include the server certificate or, normally, the
+self-signed root CA in this file.
+
+For example:
+
+    ./estserver -c server.crt -k server.key -C intermediates.pem \
+        -r estrealm -v
+
+
 
 Certificate Revocation
 ----------------------

example/server/estserver.c

@@ -31,6 +31,7 @@
 #include <openssl/conf.h>
 #include <openssl/ssl.h>
 #include <openssl/bio.h>
+#include <openssl/evp.h>
 #include <openssl/crypto.h>
 #include <openssl/pem.h>
 #include <openssl/md5.h>
@@ -120,6 +121,7 @@ static int perf_timers_on = 0;
 
 char certfile[EST_MAX_FILE_LEN];
 char keyfile[EST_MAX_FILE_LEN];
+char tls_chain_file[EST_MAX_FILE_LEN + 1];
 char cert_auth_ah_pwd[MAX_PWD_LEN + 1];
 char local_nid[MAX_PWD_LEN + 1];
 char mfg_name[MFG_NAME_MAX_LEN + 1];
@@ -227,6 +229,7 @@ static void show_usage_and_exit (void)
             "  -v           Verbose operation\n"
             "  -c <file>    PEM file to use for server cert\n"
             "  -k <file>    PEM file to use for server key\n"
+            "  -C <file>    PEM file of intermediate certs to send in the TLS chain\n"
             "  -r <value>   HTTP realm to present to clients. Max is 32 characters.\n"
             "  -l           Enable CRL checks\n"
             "  -t           Enable check for binding client PoP to the TLS UID\n"
@@ -245,6 +248,7 @@ static void show_usage_and_exit (void)
             "  -?           Print this help message and exit\n"
             "  --keypass_stdin Specify en-/decryption of private key, password read from STDIN\n"
             "  --keypass_arg   Specify en-/decryption of private key, password read from argument\n"
+            "  --tls-chain <file> PEM file of intermediate certs to send in the TLS chain\n"
             "  --srp <file> Enable TLS-SRP authentication of client using the specified SRP parameters file\n"
             "  --enforce-csr  Enable CSR attributes enforcement. The client must provide all the attributes in the CSR.\n"
             "  --token <value> Use HTTP Bearer Token auth.\n"
@@ -2081,6 +2085,7 @@ int main (int argc, char **argv)
 #endif
     static struct option long_options[] = {
         {"srp", 1, NULL, 0},
+        {"tls-chain", 1, NULL, 'C'},
         {"enforce-csr", 0, NULL, 0},
         {"token", 1, 0, 0},
 #if ENABLE_BRSKI
@@ -2122,7 +2127,7 @@ int main (int argc, char **argv)
     memset(masa_root_ca_file, 0, EST_MAX_FILE_LEN+1);
     memset(masa_priv_key_file, 0, EST_MAX_FILE_LEN+1);
 #endif
-    while ((c = getopt_long(argc, argv, "?fhbwnovr:c:k:m:p:d:lt6", long_options,
+    while ((c = getopt_long(argc, argv, "?fhbwnovr:c:k:C:m:p:d:lt6", long_options,
                             &option_index)) != -1) {
         switch (c) {
         case 0:
@@ -2273,6 +2278,9 @@ int main (int argc, char **argv)
         case 'k':
             strncpy(keyfile, optarg, EST_MAX_FILE_LEN);
             break;
+        case 'C':
+            strncpy(tls_chain_file, optarg, EST_MAX_FILE_LEN);
+            break;
         case 'r':
             if (strnlen(optarg, MAX_REALM_LEN+1) > MAX_REALM_LEN) {
                 printf("\nRealm value is too large.  Max is 32 characters\n");
@@ -2285,7 +2293,7 @@ int main (int argc, char **argv)
             /* turn FIPS on if user requested it
              * and exit if failure.
              */
-            set_fips_return = FIPS_mode_set(1);
+            set_fips_return = EVP_default_properties_enable_fips(NULL, 1);
             if (set_fips_return != 1) {
                 set_fips_error = ERR_get_error();
                 printf("\nERROR WHILE SETTING FIPS MODE ON exiting ....\n");
@@ -2392,6 +2400,22 @@ int main (int argc, char **argv)
         printf("\nUnable to initialize EST context.  Aborting!!!\n");
         exit(1);
     }
+    if (tls_chain_file[0]) {
+        unsigned char *tls_chain = NULL;
+        int tls_chain_len = read_binary_file(tls_chain_file, &tls_chain);
+
+        if (tls_chain_len <= 0) {
+            printf("\nTLS identity chain file could not be read: %s\n",
+                   tls_chain_file);
+            exit(1);
+        }
+        rv = est_server_set_tls_identity_chain(ectx, tls_chain, tls_chain_len);
+        free(tls_chain);
+        if (rv != EST_ERR_NONE) {
+            printf("\nUnable to configure TLS identity chain (rv=%d)\n", rv);
+            exit(1);
+        }
+    }
     est_set_ex_data(ectx, &test_app_data);
 
     if (enforce_csr) {
@@ -2760,4 +2784,3 @@ int main (int argc, char **argv)
     X509_free(x);
     return 0;
 }
-

java/jni/client.c

@@ -14,6 +14,7 @@
 #include <est/est.h>
 #include <openssl/x509v3.h>
 #include <openssl/bio.h>
+#include <openssl/evp.h>
 #include "safe_mem_lib.h"
 
 #define EST_CLASS_ENROLL_EXCEPTION 			"com/cisco/c3m/est/EnrollException"
@@ -179,7 +180,7 @@ static int jni_est_client_X509_REQ_sign (X509_REQ *x, EVP_PKEY *pkey, const EVP_
  */
 JNIEXPORT jint JNICALL Java_com_cisco_c3m_est_ESTClient_enable_1fips(
 		JNIEnv *env, jclass obj) {
-	if (!FIPS_mode() && !FIPS_mode_set(1)) {
+	if (!EVP_default_properties_is_fips_enabled(NULL) && !EVP_default_properties_enable_fips(NULL, 1)) {
 		ERR_print_errors_fp(stderr);
 		return -1;
 	} else {

src/est/est.c

@@ -775,6 +775,10 @@ EST_ERROR est_destroy (EST_CTX *ctx)
         free(ctx->ca_chain_raw);
     }
 
+    if (ctx->server_cert_chain) {
+        sk_X509_pop_free(ctx->server_cert_chain, X509_free);
+    }
+
     if (ctx->uri_path_segment) {
         free(ctx->uri_path_segment);
     }

src/est/est.h

@@ -598,6 +598,8 @@ LIBEST_API EST_CTX * est_proxy_init(unsigned char *ca_chain, int ca_chain_len,
                          char *uid, char *pwd);
 LIBEST_API EST_ERROR est_destroy(EST_CTX *ctx);
 LIBEST_API EST_ERROR est_server_set_auth_mode(EST_CTX *ctx, EST_HTTP_AUTH_MODE amode);
+LIBEST_API EST_ERROR est_server_set_tls_identity_chain(
+    EST_CTX *ctx, const unsigned char *chain, int chain_len);
 LIBEST_API EST_ERROR est_server_enable_enhanced_cert_auth(
     EST_CTX *ctx, int local_pki_subj_field_nid, const char *ah_pwd,
     EST_ECA_CSR_CHECK_FLAG csr_check_enabled);
@@ -867,4 +869,3 @@ LIBEST_API EST_ERROR est_disable_performance_timers(EST_CTX *ctx);
 #endif
 
 #endif
-

src/est/est_client.c

@@ -40,6 +40,7 @@
 #include <openssl/ssl.h>
 #include <openssl/cms.h>
 #include <openssl/rand.h>
+#include <openssl/evp.h>
 #include "est.h"
 #include "est_locl.h"
 #include "est_ossl_util.h"
@@ -3182,7 +3183,7 @@ EST_ERROR est_client_enroll_internal (EST_CTX *ctx, char *cn, int *pkcs7_len, in
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -3593,7 +3594,7 @@ EST_ERROR est_client_reenroll (EST_CTX *ctx, X509 *cert, int *pkcs7_len, EVP_PKE
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
 	    EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
 	    rv = EST_ERR_BAD_MODE;
             goto err;
@@ -3679,7 +3680,7 @@ static EST_ERROR est_client_enroll_csr_internal (EST_CTX *ctx, X509_REQ *csr, in
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -5871,7 +5872,7 @@ static EST_ERROR est_client_brski_send_get_voucher (EST_CTX *ctx, int *cacert_le
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -6365,7 +6366,7 @@ EST_ERROR est_client_brski_send_voucher_status (EST_CTX *ctx, EST_BRSKI_STATUS_V
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;
@@ -6534,7 +6535,7 @@ EST_ERROR est_client_brski_send_enroll_status (EST_CTX *ctx, EST_BRSKI_STATUS_VA
          * HTTPS digest mode requires the use of MD5.  Make sure we're not
          * in FIPS mode and can use MD5
          */
-        if (ctx->auth_mode == AUTH_DIGEST && (FIPS_mode())){
+        if (ctx->auth_mode == AUTH_DIGEST && (EVP_default_properties_is_fips_enabled(NULL))){
             EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
             rv = EST_ERR_BAD_MODE;
             goto err;

src/est/est_locl.h

@@ -58,7 +58,7 @@ typedef struct est_timer {
  * Version identifiers.  These should be updated appropriately
  * for each release.
  */
-#define EST_API_LEVEL       4  //Update this whenever there's a change to the public API
+#define EST_API_LEVEL       5  //Update this whenever there's a change to the public API
 #define EST_VER_STRING      PACKAGE_STRING
 
 #define EST_URI_PATH_PREFIX_MAX_LEN (16)
@@ -529,6 +529,7 @@ struct est_ctx {
     EST_MG_CONTEXT *mg_ctx;
     int server_read_timeout;
     X509 *server_cert;
+    STACK_OF(X509) *server_cert_chain;
     EVP_PKEY *server_priv_key;
     int server_enable_pop; /* enable proof-of-possession check */
     int client_force_pop;  /* force proof-of-possession gen at the client */

src/est/est_server.c

@@ -30,6 +30,9 @@
 #include <openssl/x509v3.h>
 #include <openssl/cms.h>
 #include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
 
 
 static ASN1_OBJECT *o_cmcRA = NULL;
@@ -3355,7 +3358,7 @@ EST_ERROR est_server_set_auth_mode (EST_CTX *ctx, EST_HTTP_AUTH_MODE amode)
         /*
          * Since HTTP digest auth uses MD5, make sure we're not in FIPS mode.
          */
-	if (FIPS_mode()) {
+	if (EVP_default_properties_is_fips_enabled(NULL)) {
 	    EST_LOG_ERR("HTTP digest auth not allowed while in FIPS mode");
 	    return (EST_ERR_BAD_MODE);
 	}
@@ -3372,6 +3375,89 @@ EST_ERROR est_server_set_auth_mode (EST_CTX *ctx, EST_HTTP_AUTH_MODE amode)
     }
 }
 
+/*! @brief est_server_set_tls_identity_chain() configures the intermediate
+    certificates sent with the server identity certificate during TLS setup.
+
+    @param ctx       Pointer to the EST context
+    @param chain     PEM encoded intermediate certificates, issuer first
+    @param chain_len Length of the chain buffer
+
+    The server identity certificate supplied to est_server_init() is not
+    included in this buffer.  This function must be invoked before starting
+    the EST server.
+
+    @return EST_ERROR.
+ */
+EST_ERROR est_server_set_tls_identity_chain (EST_CTX *ctx,
+                                              const unsigned char *chain,
+                                              int chain_len)
+{
+    BIO *in = NULL;
+    STACK_OF(X509_INFO) *cert_info = NULL;
+    STACK_OF(X509) *cert_chain = NULL;
+    X509_INFO *info;
+
+    if (!ctx) {
+        EST_LOG_ERR("Null context");
+        return (EST_ERR_NO_CTX);
+    }
+    if (ctx->est_mode != EST_SERVER && ctx->est_mode != EST_PROXY) {
+        EST_LOG_ERR("TLS identity chain is only valid in server or proxy mode");
+        return (EST_ERR_BAD_MODE);
+    }
+    if (ctx->mg_ctx) {
+        EST_LOG_ERR("TLS identity chain must be configured before server start");
+        return (EST_ERR_BAD_MODE);
+    }
+    if (!chain || chain_len <= 0) {
+        EST_LOG_ERR("Invalid TLS identity chain");
+        return (EST_ERR_INVALID_PARAMETERS);
+    }
+
+    in = BIO_new_mem_buf((void *)chain, chain_len);
+    cert_chain = sk_X509_new_null();
+    if (!in || !cert_chain) {
+        BIO_free(in);
+        sk_X509_free(cert_chain);
+        return (EST_ERR_MALLOC);
+    }
+
+    cert_info = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
+    BIO_free(in);
+    if (!cert_info) {
+        sk_X509_free(cert_chain);
+        EST_LOG_ERR("Unable to read PEM encoded TLS identity chain");
+        return (EST_ERR_NO_CERTS_FOUND);
+    }
+
+    while (sk_X509_INFO_num(cert_info)) {
+        info = sk_X509_INFO_shift(cert_info);
+        if (info->x509) {
+            if (!sk_X509_push(cert_chain, info->x509)) {
+                X509_INFO_free(info);
+                sk_X509_INFO_pop_free(cert_info, X509_INFO_free);
+                sk_X509_pop_free(cert_chain, X509_free);
+                return (EST_ERR_MALLOC);
+            }
+            info->x509 = NULL;
+        }
+        X509_INFO_free(info);
+    }
+    sk_X509_INFO_free(cert_info);
+
+    if (!sk_X509_num(cert_chain)) {
+        sk_X509_free(cert_chain);
+        EST_LOG_ERR("No certificates found in TLS identity chain");
+        return (EST_ERR_NO_CERTS_FOUND);
+    }
+
+    if (ctx->server_cert_chain) {
+        sk_X509_pop_free(ctx->server_cert_chain, X509_free);
+    }
+    ctx->server_cert_chain = cert_chain;
+    return (EST_ERR_NONE);
+}
+
 /*! @brief est_set_ca_enroll_cb() is used by an application to install
     a handler for signing incoming PKCS10 requests.