2 # ***************************************************************************
4 # * Project ___| | | | _ \| |
5 # * / __| | | | |_) | |
6 # * | (__| |_| | _ <| |___
7 # * \___|\___/|_| \_\_____|
9 # * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
11 # * This software is licensed as described in the file COPYING, which
12 # * you should have received as part of this distribution. The terms
13 # * are also available at http://curl.haxx.se/docs/copyright.html.
15 # * You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 # * copies of the Software, and permit persons to whom the Software is
17 # * furnished to do so, under the terms of the COPYING file.
19 # * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 # * KIND, either express or implied.
22 # ***************************************************************************
23 # This Perl script creates a fresh ca-bundle.crt file for use with libcurl.
24 # It downloads certdata.txt from Mozilla's source tree (see URL below),
25 # then parses certdata.txt and extracts CA Root Certificates into PEM format.
26 # These are then processed with the OpenSSL commandline tool to produce the
27 # final ca-bundle.crt file.
28 # The script is based on the parse-certs script written by Roland Krikava.
29 # This Perl script works on almost any platform since its only external
30 # dependency is the OpenSSL commandline tool for optional text listing.
31 # Hacked by Guenter Knauf.
37 use vars qw($opt_b $opt_f $opt_h $opt_i $opt_l $opt_n $opt_q $opt_t $opt_u $opt_v $opt_w);
39 my $url = 'http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1';
40 # If the OpenSSL commandline is not in search path you can configure it here!
41 my $openssl = 'openssl';
45 $opt_w = 76; # default base64 encoded lines length
48 $Getopt::Std::STANDARD_HELP_VERSION = 1;
49 getopts('bfhilnqtuvw:');
52 print ("=" x 78 . "\n");
53 print "Script Version : $version\n";
54 print "Perl Version : $]\n";
55 print "Operating System Name : $^O\n";
56 print "Getopt::Std.pm Version : ${Getopt::Std::VERSION}\n";
57 print "MIME::Base64.pm Version : ${MIME::Base64::VERSION}\n";
58 print "LWP::UserAgent.pm Version : ${LWP::UserAgent::VERSION}\n";
59 print "LWP.pm Version : ${LWP::VERSION}\n";
60 print ("=" x 78 . "\n");
64 print "Usage:\t${0} [-b] [-f] [-i] [-l] [-n] [-q] [-t] [-u] [-v] [-w<l>] [<outputfile>]\n";
65 print "\t-b\tbackup an existing version of ca-bundle.crt\n";
66 print "\t-f\tforce rebuild even if certdata.txt is current\n";
67 print "\t-i\tprint version info about used modules\n";
68 print "\t-l\tprint license info about certdata.txt\n";
69 print "\t-n\tno download of certdata.txt (to use existing)\n";
70 print "\t-q\tbe really quiet (no progress output at all)\n";
71 print "\t-t\tinclude plain text listing of certificates\n";
72 print "\t-u\tunlink (remove) certdata.txt after processing\n";
73 print "\t-v\tbe verbose and print out processed CAs\n";
74 print "\t-w <l>\twrap base64 output lines after <l> chars (default: ${opt_w})\n";
78 sub VERSION_MESSAGE() {
79 print "${0} version ${version} running Perl ${]} on ${^O}\n";
82 HELP_MESSAGE() if ($opt_h);
84 my $crt = $ARGV[0] || 'ca-bundle.crt';
85 (my $txt = $url) =~ s@(.*/|\?.*)@@g;
87 my $stdout = $crt eq '-';
91 unless ($opt_n and -e $txt) {
92 print STDERR "Downloading '$txt' ...\n" if (!$opt_q);
93 my $ua = new LWP::UserAgent(agent => "$0/$version");
95 $resp = $ua->mirror($url, $txt);
96 if ($resp && $resp->code eq '304') {
97 print STDERR "Not modified\n" unless $opt_q;
98 exit 0 if -e $crt && !$opt_f;
102 if( !$resp || $resp->code !~ /^(?:200|304)$/ ) {
103 print STDERR "Unable to download latest data: "
104 . ($resp? $resp->code . ' - ' . $resp->message : "LWP failed") . "\n"
106 exit 1 if -e $crt || ! -r $txt;
110 my $currentdate = scalar gmtime($fetched ? $resp->last_modified : (stat($txt))[9]);
112 my $format = $opt_t ? "plain text and " : "";
114 open(CRT, '> -') or die "Couldn't open STDOUT: $!\n";
116 open(CRT,">$crt.~") or die "Couldn't open $crt.~: $!\n";
120 ## $crt -- Bundle of CA Root Certificates
122 ## Certificate data from Mozilla as of: ${currentdate}
124 ## This is a bundle of X.509 certificates of public Certificate Authorities
125 ## (CA). These were automatically extracted from Mozilla's root certificates
126 ## file (certdata.txt). This file can be found in the mozilla source tree:
129 ## It contains the certificates in ${format}PEM format and therefore
130 ## can be directly used with curl / libcurl / php_curl, or with
131 ## an Apache+mod_ssl webserver for SSL client authentication.
132 ## Just configure this file as the SSLCACertificateFile.
137 print STDERR "Processing '$txt' ...\n" if (!$opt_q);
141 my $start_of_cert = 0;
143 open(TXT,"$txt") or die "Couldn't open $txt: $!\n";
145 if (/\*\*\*\*\* BEGIN LICENSE BLOCK \*\*\*\*\*/) {
151 last if (/\*\*\*\*\* END LICENSE BLOCK \*\*\*\*\*/);
156 if (/^CVS_ID\s+\"(.*)\"/) {
160 # this is a match for the start of a certificate
161 if (/^CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE/) {
164 if ($start_of_cert && /^CKA_LABEL UTF8 \"(.*)\"/) {
168 if ($start_of_cert && /^CKA_VALUE MULTILINE_OCTAL/) {
173 my @octets = split(/\\/);
179 # scan forwards until the trust part
181 last if (/^CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST/);
184 # now scan the trust part for untrusted certs
187 if (/^CKA_TRUST_SERVER_AUTH\s+CK_TRUST\s+CKT_NSS_NOT_TRUSTED$/
188 or /^CKA_TRUST_SERVER_AUTH\s+CK_TRUST\s+CKT_NSS_TRUST_UNKNOWN$/) {
195 my $encoded = MIME::Base64::encode_base64($data, '');
196 $encoded =~ s/(.{1,${opt_w}})/$1\n/g;
197 my $pem = "-----BEGIN CERTIFICATE-----\n"
199 . "-----END CERTIFICATE-----\n";
200 print CRT "\n$caname\n";
201 print CRT ("=" x length($caname) . "\n");
205 my $pipe = "|$openssl x509 -md5 -fingerprint -text -inform PEM";
207 $pipe .= " >> $crt.~";
208 close(CRT) or die "Couldn't close $crt.~: $!";
210 open(TMP, $pipe) or die "Couldn't open openssl pipe: $!";
212 close(TMP) or die "Couldn't close openssl pipe: $!";
214 open(CRT, ">>$crt.~") or die "Couldn't open $crt.~: $!";
217 print STDERR "Parsing: $caname\n" if ($opt_v);
223 close(TXT) or die "Couldn't close $txt: $!\n";
224 close(CRT) or die "Couldn't close $crt.~: $!\n";
226 if ($opt_b && -e $crt) {
228 while (-e "$crt.~${bk}~") {
231 rename $crt, "$crt.~${bk}~" or die "Failed to create backup $crt.~$bk}~: $!\n";
233 unlink( $crt ) or die "Failed to remove $crt: $!\n";
235 rename "$crt.~", $crt or die "Failed to rename $crt.~ to $crt: $!\n";
237 unlink $txt if ($opt_u);
238 print STDERR "Done ($certnum CA certs processed, $skipnum untrusted skipped).\n" if (!$opt_q);