Update X509 and certgen tool

tools/certgen.c

@@ -1,5 +1,5 @@
 /*
- *  Copyright 2014-2022 The GmSSL Project. All Rights Reserved.
+ *  Copyright 2014-2023 The GmSSL Project. All Rights Reserved.
  *
  *  Licensed under the Apache License, Version 2.0 (the License); you may
  *  not use this file except in compliance with the License.
@@ -17,15 +17,92 @@
 #include <gmssl/pkcs8.h>
 #include <gmssl/error.h>
 #include <gmssl/x509.h>
+#include <gmssl/x509_oid.h>
 #include <gmssl/x509_ext.h>
 
 
 static const char *options =
-	"[-C str] [-ST str] [-L str] [-O str] [-OU str] -CN str -days num "
-	"-key file [-pass pass] "
-	"-crl_uri uri"
-	"-ca_issuers_uri uri -ocsp_uri uri"
-	"[-key_usage str]* [-ocsp uri] [-out file]";
+	"[-C str] [-ST str] [-L str] [-O str] [-OU str] -CN str"
+	" -days num"
+	" -key file -pass pass"
+	" [-gen_authority_key_id]"
+	" [-gen_subject_key_id]"
+	" [-key_usage str]*"
+	" [-subject_dns_name str]*"
+	" [-issuer_dns_name str]*"
+	" [-ca -path_len_constraints num]"
+	" [-ext_key_usage str]*"
+	" [-crl_http_uri uri] [-crl_ldap_uri uri]"
+	" [-inhibit_any_policy num]"
+	" [-ca_issuers_uri uri] [-ocsp_uri uri uri]"
+	" [-out file]";
+
+static char *usage =
+"Options\n"
+"\n"
+"    -serial_len num              Serial number length in bytes\n"
+"    -days num                    Validity peroid in days\n"
+"    -key file                    Private key file in PEM format\n"
+"    -pass pass                   Password for decrypting private key file\n"
+"    -out file                    Output certificate file in PEM format\n"
+"\n"
+"  Subject and Issuer options\n"
+"\n"
+"    -C  str                      Country\n"
+"    -ST str                      State or province name\n"
+"    -L  str                      Locality\n"
+"    -O  str                      Organization\n"
+"    -OU str                      Organizational unit\n"
+"    -CN str                      Common name\n"
+"\n"
+"  Extension options\n"
+"\n"
+"    -gen_authority_key_id        Generate AuthorityKeyIdentifier extension use SM3\n"
+"    -gen_subject_key_id          Generate SubjectKeyIdentifier extension use SM3\n"
+"    -key_usage str               Add KeyUsage extension\n"
+"                                 this option can be called multi-times\n"
+"                                 avaiable values:\n"
+"                                     digitalSignature\n"
+"                                     nonRepudiation\n"
+"                                     keyEncipherment\n"
+"                                     dataEncipherment\n"
+"                                     keyAgreement\n"
+"                                     keyCertSign\n"
+"                                     cRLSign\n"
+"                                     encipherOnly\n"
+"                                     decipherOnly\n"
+"    -subject_dns_name str        Add DNS name to SubjectAltName extension\n"
+"                                 this option can be called multi-times\n"
+"    -issuer_dns_name str         Add DNS name to IssuerAltName extension\n"
+"                                 this option can be called multi-times\n"
+"    -ca                          Set cA of BasicConstaints extension\n"
+"    -path_len_constraints num    Set pathLenConstaints of BasicConstaints extension\n"
+"    -ext_key_usage str           Set ExtKeyUsage extension\n"
+"                                 this option can be called multi-times\n"
+"                                 avaiable values:\n"
+"                                     anyExtendedKeyUsage\n"
+"                                     serverAuth\n"
+"                                     clientAuth\n"
+"                                     codeSigning\n"
+"                                     emailProtection\n"
+"                                     timeStamping\n"
+"                                     OCSPSigning\n"
+"    -crl_http_uri uri            Set HTTP URI of CRL of CRLDistributionPoints extension\n"
+"    -crl_ldap_uri uri            Set LDAP URI of CRL of CRLDistributionPoints extension\n"
+"    -inhibit_any_policy num      Set skipCerts number of InhibitAnyPolicy extension\n"
+"    -ca_issuers_uri uri          Set URI of the CA certificate in DER-encoding o FreshestCRL extension\n"
+"    -ocsp_uri uri                Set OCSP URI of FreshestCRL extension\n"
+"\n"
+"Examples\n"
+"\n"
+"    gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
+"          -key rootcakey.pem -pass P@ssw0rd \\\n"
+"          -ca -path_len_constraints 6 \\\n"
+"          -key_usage keyCertSign -key_usage cRLSign \\\n"
+"          -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
+"          -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
+"          -out rootcacert.pem\n"
+"\n";
 
 
 static int ext_key_usage_set(int *usages, const char *usage_name)
@@ -43,48 +120,100 @@ int certgen_main(int argc, char **argv)
 {
 	int ret = 1;
 	char *prog = argv[0];
+	char *str;
+
+	// SerialNumber
+	uint8_t serial[20];
+	int serial_len = 12;
+
+	// Issuer, Subject
+	uint8_t name[256];
+	size_t namelen;
 	char *country = NULL;
 	char *state = NULL;
 	char *locality = NULL;
 	char *org = NULL;
 	char *org_unit = NULL;
 	char *common_name = NULL;
-	int days = 0;
-	int key_usage = 0;
-	char *ocsp = NULL;
-	char *crl_uri = NULL;
-	char *ca_issuers_uri = NULL;
-	char *ocsp_uri = NULL;
-	char *keyfile = NULL;
-	char *pass = NULL;
-	char *outfile = NULL;
 
-	uint8_t serial[12];
-	uint8_t name[256];
-	size_t namelen;
+	// Validity
+	int days = 0;
 	time_t not_before;
 	time_t not_after;
-	uint8_t exts[512];
-	size_t extslen = 0;
+
+	// Private Key
+	char *keyfile = NULL;
+	char *pass = NULL;
 	FILE *keyfp = NULL;
 	SM2_KEY sm2_key;
-	uint8_t cert[1024];
+
+	uint8_t cert[4096];
 	size_t certlen;
 	FILE *outfp = stdout;
+	char *outfile = NULL;
+
+	// Extensions
+	uint8_t exts[4096];
+	size_t extslen = 0;
+
+	// AuthorityKeyIdentifier
+	int gen_authority_key_id = 0;
+
+	// SubjectKeyIdentifier
+	int gen_subject_key_id = 0;
+
+	// KeyUsage
+	int key_usage = 0;
+
+	// SubjectAltName
+	uint8_t subject_alt_name[2048];
+	size_t subject_alt_name_len = 0;
+
+	// IssuerAltName
+	uint8_t issuer_alt_name[512];
+	size_t issuer_alt_name_len = 0;
+
+	// BasicConstraints
+	int ca = -1;
+	int path_len_constraints = -1;
+
+	// ExtKeyUsageSyntax
+	int ext_key_usages[12];
+	size_t ext_key_usages_cnt = 0;
+
+	// CRLDistributionPoints
+	char *crl_http_uri = NULL;
+	char *crl_ldap_uri = NULL;
+
+	// InhibitAnyPolicy
+	int inhibit_any_policy = -1;
+
+	// FreshestCRL
+	char *ca_issuers_uri = NULL;
+	char *ocsp_uri = NULL;
+
 
 	argc--;
 	argv++;
 
 	if (argc < 1) {
-		fprintf(stderr, "usage: %s %s\n", prog, options);
+		fprintf(stderr, "usage: gmssl %s %s\n", prog, options);
 		return 1;
 	}
 
 	while (argc > 0) {
 		if (!strcmp(*argv, "-help")) {
-			printf("usage: %s %s\n", prog, options);
+			printf("usage: gmssl %s %s\n\n", prog, options);
+			printf(usage, prog);
 			ret = 0;
 			goto end;
+		} else if (!strcmp(*argv, "-serial_len")) {
+			if (--argc < 1) goto bad;
+			serial_len = atoi(*(++argv));
+			if (serial_len <= 0 || serial_len > sizeof(serial)) {
+				fprintf(stderr, "%s: invalid '-serial_len' value, need a number less than %zu\n", prog, sizeof(serial));
+				goto end;
+			}
 		} else if (!strcmp(*argv, "-CN")) {
 			if (--argc < 1) goto bad;
 			common_name = *(++argv);
@@ -97,6 +226,10 @@ int certgen_main(int argc, char **argv)
 		} else if (!strcmp(*argv, "-C")) {
 			if (--argc < 1) goto bad;
 			country = *(++argv);
+			if (strlen(country) != 2) {
+				fprintf(stderr, "%s: invalid '-C' value, need 2-char country name such as 'CN', 'US'\n", prog);
+				goto end;
+			}
 		} else if (!strcmp(*argv, "-ST")) {
 			if (--argc < 1) goto bad;
 			state = *(++argv);
@@ -107,26 +240,10 @@ int certgen_main(int argc, char **argv)
 			if (--argc < 1) goto bad;
 			days = atoi(*(++argv));
 			if (days <= 0) {
-				fprintf(stderr, "%s: invalid '-days' value\n", prog);
+				fprintf(stderr, "%s: invalid `-days` value, need a positive number\n", prog);
 				goto end;
 			}
-		} else if (!strcmp(*argv, "-key_usage")) {
-			char *usage;
-			if (--argc < 1) goto bad;
-			usage = *(++argv);
-			if (ext_key_usage_set(&key_usage, usage) != 1) {
-				fprintf(stderr, "%s: invalid -key_usage value '%s'\n", prog, usage);
-				goto end;
-			}
-		} else if (!strcmp(*argv, "-crl_uri")) {
-			if (--argc < 1) goto bad;
-			crl_uri = *(++argv);
-		} else if (!strcmp(*argv, "-ca_issuers_uri")) {
-			if (--argc < 1) goto bad;
-			ca_issuers_uri = *(++argv);
-		} else if (!strcmp(*argv, "-ocsp_uri")) {
-			if (--argc < 1) goto bad;
-			ocsp_uri = *(++argv);
+
 		} else if (!strcmp(*argv, "-key")) {
 			if (--argc < 1) goto bad;
 			keyfile = *(++argv);
@@ -134,9 +251,78 @@ int certgen_main(int argc, char **argv)
 				fprintf(stderr, "%s: open '%s' failure : %s\n", prog, keyfile, strerror(errno));
 				goto end;
 			}
+
 		} else if (!strcmp(*argv, "-pass")) {
 			if (--argc < 1) goto bad;
 			pass = *(++argv);
+		} else if (!strcmp(*argv, "-gen_authority_key_id")) {
+			gen_authority_key_id = 1;
+		} else if (!strcmp(*argv, "-gen_subject_key_id")) {
+			gen_subject_key_id = 1;
+		} else if (!strcmp(*argv, "-key_usage")) {
+			if (--argc < 1) goto bad;
+			str = *(++argv);
+			if (ext_key_usage_set(&key_usage, str) != 1) {
+				fprintf(stderr, "%s: invalid `-key_usage` value '%s'\n", prog, str);
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-subject_dns_name")) {
+			if (--argc < 1) goto bad;
+			str = *(++argv);
+			if (x509_general_names_add_dns_name(
+				subject_alt_name, &subject_alt_name_len, sizeof(subject_alt_name), str) != 1) {
+				fprintf(stderr, "%s: inner error on processing `-subject_dns_name`\n", prog);
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-issuer_dns_name")) {
+			if (--argc < 1) goto bad;
+			str = *(++argv);
+			if (x509_general_names_add_dns_name(
+				issuer_alt_name, &issuer_alt_name_len, sizeof(issuer_alt_name), str) != 1) {
+				fprintf(stderr, "%s: inner error on processing `-issuer_dns_name`\n", prog);
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-ca")) {
+			ca = 1;
+		} else if (!strcmp(*argv, "-path_len_constraints")) {
+			if (--argc < 1) goto bad;
+			path_len_constraints = atoi(*(++argv));
+			if (path_len_constraints <= 0) {
+				fprintf(stderr, "%s: invalid `-path_len_constraints` value\n", prog);
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-ext_key_usage")) {
+			if (--argc < 1) goto bad;
+			str = *(++argv);
+			if (x509_key_purpose_from_name(str) <= 0) {
+				fprintf(stderr, "%s: invalid `-ext_key_usage` value '%s'\n", prog, str);
+				goto end;
+			}
+			if (ext_key_usages_cnt >= sizeof(ext_key_usages)/sizeof(ext_key_usages[0])) {
+				fprintf(stderr, "%s: too much `-ext_key_usage` options\n", prog);
+				goto end;
+			}
+			ext_key_usages[ext_key_usages_cnt++] = x509_key_purpose_from_name(str);
+		} else if (!strcmp(*argv, "-crl_http_uri")) {
+			if (--argc < 1) goto bad;
+			crl_http_uri = *(++argv);
+		} else if (!strcmp(*argv, "-crl_ldap_uri")) {
+			if (--argc < 1) goto bad;
+			crl_ldap_uri = *(++argv);
+		} else if (!strcmp(*argv, "-inhibit_any_policy")) {
+			if (--argc < 1) goto bad;
+			inhibit_any_policy = atoi(*(++argv));
+			if (inhibit_any_policy < 0) {
+				fprintf(stderr, "%s: invalid `-inhibit_any_policy` value\n", prog);
+				goto end;
+			}
+		} else if (!strcmp(*argv, "-ca_issuers_uri")) {
+			if (--argc < 1) goto bad;
+			ca_issuers_uri = *(++argv);
+		} else if (!strcmp(*argv, "-ocsp_uri")) {
+			if (--argc < 1) goto bad;
+			ocsp_uri = *(++argv);
+
 		} else if (!strcmp(*argv, "-out")) {
 			if (--argc < 1) goto bad;
 			outfile = *(++argv);
@@ -148,7 +334,7 @@ int certgen_main(int argc, char **argv)
 			fprintf(stderr, "%s: illegal option '%s'\n", prog, *argv);
 			goto end;
 bad:
-			fprintf(stderr, "%s: '%s' option value missing\n", prog, *argv);
+			fprintf(stderr, "%s: `%s` value missing\n", prog, *argv);
 			goto end;
 		}
 
@@ -157,71 +343,137 @@ bad:
 	}
 
 	if (!common_name) {
-		fprintf(stderr, "%s: '-CN' option required\n", prog);
+		fprintf(stderr, "%s: option `-CN` required\n", prog);
 		goto end;
 	}
 	if (!days) {
-		fprintf(stderr, "%s: '-days' option required\n", prog);
+		fprintf(stderr, "%s: option `-days` required\n", prog);
 		goto end;
 	}
 	if (!keyfile) {
-		fprintf(stderr, "%s: '-key' option required\n", prog);
+		fprintf(stderr, "%s: option `-key` required\n", prog);
 		goto end;
 	}
 	if (!pass) {
-		fprintf(stderr, "%s: '-pass' option required\n", prog);
+		fprintf(stderr, "%s: option `-pass` required\n", prog);
 		goto end;
 	}
-	if (!key_usage) {
-		fprintf(stderr, "%s: '-key_usage' option required\n", prog);
-		goto end;
-	}
-
 	if (sm2_private_key_info_decrypt_from_pem(&sm2_key, pass, keyfp) != 1) {
 		fprintf(stderr, "%s: load private key failed\n", prog);
 		goto end;
 	}
 
-	if (x509_exts_add_key_usage(exts, &extslen, sizeof(exts), 1, key_usage) != 1
-		|| x509_exts_add_basic_constraints(exts, &extslen, sizeof(exts), 1, 1, -1) != 1
-		|| x509_exts_add_default_authority_key_identifier(exts, &extslen, sizeof(exts), &sm2_key) != 1) {
-		fprintf(stderr, "%s: inner error\n", prog);
+	// Serial
+	if (rand_bytes(serial, sizeof(serial)) != 1) {
+		fprintf(stderr, "%s: RNG error\n", prog);
 		goto end;
 	}
-	if (crl_uri) {
-		if (x509_exts_add_crl_distribution_points(exts, &extslen, sizeof(exts), 0,
-			crl_uri, strlen(crl_uri), NULL, 0) != 1) {
+
+	// Issuer, Subject
+	if (x509_name_set(name, &namelen, sizeof(name), country, state, locality, org, org_unit, common_name) != 1) {
+		fprintf(stderr, "%s: set Issuer/Subject Name error\n", prog);
+		goto end;
+	}
+
+	// Validity
+	time(&not_before);
+	if (x509_validity_add_days(&not_after, not_before, days) != 1) {
+		fprintf(stderr, "%s: set Validity failure\n", prog);
+		goto end;
+	}
+
+	// Extensions
+	if (gen_authority_key_id) {
+		if (x509_exts_add_default_authority_key_identifier(exts, &extslen, sizeof(exts), &sm2_key) != 1) {
+			fprintf(stderr, "%s: set AuthorityKeyIdentifier extension failure\n", prog);
+			goto end;
+		}
+	}
+	if (gen_subject_key_id) {
+		if (x509_exts_add_subject_key_identifier_ex(exts, &extslen, sizeof(exts), -1, &sm2_key) != 1) {
+			fprintf(stderr, "%s: set SubjectKeyIdentifier extension failure\n", prog);
+			goto end;
+		}
+	}
+	if (key_usage) {
+		if (x509_exts_add_key_usage(exts, &extslen, sizeof(exts), X509_critical, key_usage) != 1) {
+			fprintf(stderr, "%s: set KeyUsage extension failure\n", prog);
+			goto end;
+		}
+	}
+	// no CertificatePolicies
+	// no PolicyMappings
+	if (subject_alt_name_len) {
+		if (x509_exts_add_subject_alt_name(exts, &extslen, sizeof(exts),
+			-1, subject_alt_name, subject_alt_name_len) != 1) {
+			fprintf(stderr, "%s: set SubjectAltName extension failure\n", prog);
+			goto end;
+		}
+	}
+	if (issuer_alt_name_len) {
+		if (x509_exts_add_issuer_alt_name(exts, &extslen, sizeof(exts),
+			-1, issuer_alt_name, issuer_alt_name_len) != 1) {
+			fprintf(stderr, "%s: set IssuerAltName extension failure\n", prog);
+			goto end;
+		}
+	}
+	// no SubjectDirectoryAttributes
+	if (path_len_constraints) {
+		if (x509_exts_add_basic_constraints(exts, &extslen, sizeof(exts),
+			X509_critical, ca, path_len_constraints) != 1) {
+			fprintf(stderr, "%s: set BasicConstraints extension failure\n", prog);
+			goto end;
+		}
+	}
+	// no NameConstraints
+	// no PolicyConstraints
+	if (ext_key_usages_cnt) {
+		if (x509_exts_add_ext_key_usage(exts, &extslen, sizeof(exts),
+			-1, ext_key_usages, ext_key_usages_cnt) != 1) {
+			fprintf(stderr, "%s: set ExtKeyUsage extension failure\n", prog);
+			goto end;
+		}
+	}
+	if (crl_http_uri || crl_ldap_uri) {
+		if (x509_exts_add_crl_distribution_points(exts, &extslen, sizeof(exts),
+			-1,
+			crl_http_uri, crl_http_uri ? strlen(crl_http_uri) : 0,
+			crl_ldap_uri, crl_ldap_uri ? strlen(crl_ldap_uri) : 0) != 1) {
+			fprintf(stderr, "%s: set CRLDistributionPoints extension failure\n", prog);
 			error_print();
 			return -1;
 		}
 	}
+	if (inhibit_any_policy >= 0) {
+		if (x509_exts_add_inhibit_any_policy(exts, &extslen, sizeof(exts),
+			X509_critical, inhibit_any_policy) != 1) {
+			fprintf(stderr, "%s: set InhibitAnyPolicy extension failure\n", prog);
+			goto end;
+		}
+	}
 	if (ca_issuers_uri || ocsp_uri) {
 		if (x509_exts_add_authority_info_access(exts, &extslen, sizeof(exts), 0,
-			ca_issuers_uri, strlen(ca_issuers_uri), ocsp_uri, strlen(ocsp_uri)) != 1) {
-			fprintf(stderr, "%s: error\n",  prog);
+			ca_issuers_uri, ca_issuers_uri ? strlen(ca_issuers_uri) : 0,
+			ocsp_uri, ocsp_uri ? strlen(ocsp_uri) : 0) != 1) {
+			fprintf(stderr, "%s: set AuthorityInfoAccess extension failure\n",  prog);
 			goto end;
 		}
 	}
 
-	time(&not_before);
-	if (rand_bytes(serial, sizeof(serial)) != 1
-		|| x509_name_set(name, &namelen, sizeof(name),
-			country, state, locality, org, org_unit, common_name) != 1
-		|| x509_validity_add_days(&not_after, not_before, days) != 1
-		|| x509_cert_sign(
-			cert, &certlen, sizeof(cert),
-			X509_version_v3,
-			serial, sizeof(serial),
-			OID_sm2sign_with_sm3,
-			name, namelen,
-			not_before, not_after,
-			name, namelen,
-			&sm2_key,
-			NULL, 0,
-			NULL, 0,
-			exts, extslen,
-			&sm2_key, SM2_DEFAULT_ID, strlen(SM2_DEFAULT_ID)) != 1) {
-		fprintf(stderr, "%s: inner error\n", prog);
+	if (x509_cert_sign(
+		cert, &certlen, sizeof(cert),
+		X509_version_v3,
+		serial, sizeof(serial),
+		OID_sm2sign_with_sm3,
+		name, namelen,
+		not_before, not_after,
+		name, namelen,
+		&sm2_key,
+		NULL, 0,
+		NULL, 0,
+		exts, extslen,
+		&sm2_key, SM2_DEFAULT_ID, strlen(SM2_DEFAULT_ID)) != 1) {
+		fprintf(stderr, "%s: certificate generation failure\n", prog);
 		goto end;
 	}
 	if (x509_cert_to_pem(cert, certlen, outfp) != 1) {

tools/crlgen.c

@@ -14,15 +14,31 @@
 #include <stdlib.h>
 #include <gmssl/pem.h>
 #include <gmssl/x509.h>
+#include <gmssl/x509_ext.h>
 #include <gmssl/x509_crl.h>
 #include <gmssl/file.h>
 
 
-static const char *options =
-	"-in RevokedCertificate.der"
-	" -key pem -pass str -cert pem"
-	" [-next_update timestamp] "
-	" [-out crl.der]";
+static const char *usage = "-in revoked_certs.der -key pem -pass str -cacert pem [-next_update time] "
+	"[-gen_authority_key_id] [-crl_num num] [-delta_crl_indicator num] [-ca_issuers_uri uri] [-ocsp_uri uri] [-out crl.der]";
+
+static void print_options(const char *prog)
+{
+	printf("Options\n");
+	printf("\n");
+	printf("    -in revoked_certs.der             To be revoked certificate list\n");
+	printf("                                      This input file format is DER-encoding of SEQUENCE OF RevokedCertificate\n");
+	printf("                                      revoked_certs.der can be generated by `gmssl certrevoke`\n");
+	printf("\n");
+	printf("    -key pkcs8.pem                    The issuer private key.\n");
+	printf("\n");
+	printf("    -cacert cert.pem                  The issuer certificate.\n");
+	printf("\n");
+	printf("    -next_update time                 Optional CRL attribute.\n");
+	printf("\n");
+	printf("    -out crl.der                      Output CRL in DER-encoding\n");
+}
+
 
 int crlgen_main(int argc, char **argv)
 {
@@ -44,6 +60,16 @@ int crlgen_main(int argc, char **argv)
 	size_t issuer_len;
 	time_t next_update = -1;
 
+	uint8_t exts[512];
+	size_t extslen = 0;
+	int gen_authority_key_id = 0;
+	int crl_num = -1;
+	int delta_crl_indicator = -1;
+	char *http_uri = NULL;
+	char *ldap_uri = NULL;
+	char *ca_issuers_uri = NULL;
+	char *ocsp_uri = NULL;
+
 	uint8_t outbuf[64 * 1024];
 	uint8_t *out = outbuf;
 	size_t outlen = 0;
@@ -53,7 +79,9 @@ int crlgen_main(int argc, char **argv)
 
 	while (argc > 0) {
 		if (!strcmp(*argv, "-help")) {
-			printf("usage: %s %s\n", prog, options);
+			printf("usage: %s %s\n", prog, usage);
+			printf("\n");
+			print_options(prog);
 			goto end;
 
 		} else if (!strcmp(*argv, "-in")) {
@@ -87,7 +115,29 @@ int crlgen_main(int argc, char **argv)
 			}
 		} else if (!strcmp(*argv, "-next_update")) {
 			if (--argc < 1) goto bad;
-			next_update = atoi(*(++argv));
+			if (asn1_time_from_str(0, &next_update, *(++argv)) != 1) {
+				fprintf(stderr, "%s: invalid time format for '-next_update', should be 'YYYYMMDDHHMMSSZ'\n", prog);
+				goto bad;
+			}
+		} else if (!strcmp(*argv, "-gen_authority_key_id")) {
+			gen_authority_key_id = 1;
+		} else if (!strcmp(*argv, "-crl_num")) {
+			if (--argc < 1) goto bad;
+			crl_num = atoi(*(++argv));
+		} else if (!strcmp(*argv, "-delta_crl_indicator")) {
+			if (--argc < 1) goto bad;
+			delta_crl_indicator = atoi(*(++argv));
+		} else if (!strcmp(*argv, "-http_uri")) {
+			if (--argc < 1) goto bad;
+			http_uri = *(++argv);
+		} else if (!strcmp(*argv, "-ldap_uri")) {
+			if (--argc < 1) goto bad;
+			ldap_uri = *(++argv);
+		} else if (!strcmp(*argv, "-ca_issuers_uri")) {
+			ca_issuers_uri = *(++argv);
+		} else if (!strcmp(*argv, "-ocsp_uri")) {
+			if (--argc < 1) goto bad;
+			ocsp_uri = *(++argv);
 		} else {
 			fprintf(stderr, "%s: illegal option '%s'\n", prog, *argv);
 			goto end;
@@ -121,7 +171,7 @@ bad:
 
 
 	if (!revoked_certs || !revoked_certs_len) {
-		fprintf(stderr, "usage: %s %s\n", prog, options);
+		fprintf(stderr, "usage: %s %s\n", prog, usage);
 		goto end;
 	}
 
@@ -134,13 +184,41 @@ bad:
 		goto end;
 	}
 
+	if (gen_authority_key_id) {
+		if (x509_crl_exts_add_default_authority_key_identifier(exts, &extslen, sizeof(exts), &sign_key) != 1) {
+			fprintf(stderr, "%s: inner error\n", prog);
+			goto end;
+		}
+	}
+	if (x509_crl_exts_add_crl_number(exts, &extslen, sizeof(exts), -1, crl_num) < 0
+		|| x509_crl_exts_add_delta_crl_indicator(exts, &extslen, sizeof(exts), X509_critical, delta_crl_indicator) < 0) {
+		fprintf(stderr, "%s: inner error\n", prog);
+		goto end;
+	}
+	if (ca_issuers_uri || ocsp_uri) {
+		if (x509_crl_exts_add_authority_info_acess(exts, &extslen, sizeof(exts), -1,
+			ca_issuers_uri, ca_issuers_uri ? strlen(ca_issuers_uri) : 0,
+			ocsp_uri, ocsp_uri ? strlen(ocsp_uri) : 0) != 1) {
+			fprintf(stderr, "%s: inner error\n", prog);
+			goto end;
+		}
+	}
+	if (http_uri || ldap_uri) {
+		if (x509_crl_exts_add_freshest_crl(exts, &extslen, sizeof(exts), -1,
+			http_uri, http_uri ? strlen(http_uri) : 0,
+			ldap_uri, ldap_uri ? strlen(ldap_uri) : 0) != 1) {
+			fprintf(stderr, "%s: inner error\n", prog);
+			goto end;
+		}
+	}
+
 	if (x509_crl_sign_to_der(
 		X509_version_v2,
 		OID_sm2sign_with_sm3,
 		issuer, issuer_len,
 		time(NULL), next_update,
 		revoked_certs, revoked_certs_len,
-		NULL, 0,
+		extslen ? exts : NULL, extslen,
 		&sign_key, SM2_DEFAULT_ID, SM2_DEFAULT_ID_LENGTH,
 		&out, &outlen) != 1) {
 

tools/crlverify.c

@@ -104,7 +104,6 @@ bad:
 		fprintf(stderr, "%s: read CRL failure\n", prog);
 		goto end;
 	}
-
 	if (x509_crl_get_issuer(crl, crllen, &subject, &subject_len) != 1) {
 		fprintf(stderr, "%s: inner error\n", prog);
 		goto end;
@@ -113,6 +112,10 @@ bad:
 		fprintf(stderr, "%s: read certificate failure\n", prog);
 		goto end;
 	}
+	if (x509_crl_validate(crl, crllen, time(NULL)) != 1) {
+		fprintf(stderr, "%s: invalid CRL data or format\n", prog);
+		goto end;
+	}
 	if ((rv = x509_crl_verify_by_ca_cert(crl, crllen, cacert, cacertlen, SM2_DEFAULT_ID, strlen(SM2_DEFAULT_ID))) < 0) {
 		fprintf(stderr, "%s: verification inner error\n", prog);
 		goto end;
@@ -127,24 +130,3 @@ end:
 	if (in) free(in);
 	return ret;
 }
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-