int MAIN(int argc, char **argv)
	{
	ENGINE *e = NULL;
	int ret=1;
	X509_REQ *req=NULL;
	X509 *x=NULL,*xca=NULL;
	ASN1_OBJECT *objtmp;
	STACK_OF(OPENSSL_STRING) *sigopts = NULL;
	EVP_PKEY *Upkey=NULL,*CApkey=NULL, *fkey = NULL;
	ASN1_INTEGER *sno = NULL;
	int i,num,badops=0;
	BIO *out=NULL;
	BIO *STDout=NULL;
	STACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;
	int informat,outformat,keyformat,CAformat,CAkeyformat;
	char *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;
	char *CAkeyfile=NULL,*CAserial=NULL;
	char *fkeyfile=NULL;
	char *alias=NULL;
	int text=0,serial=0,subject=0,issuer=0,startdate=0,enddate=0;
	int next_serial=0;
	int subject_hash=0,issuer_hash=0,ocspid=0;
#ifndef OPENSSL_NO_MD5
	int subject_hash_old=0,issuer_hash_old=0;
#endif
	int noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0;
	int ocsp_uri=0;
	int trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;
	int C=0;
	int x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;
	int pprint = 0;
	const char **pp;
	X509_STORE *ctx=NULL;
	X509_REQ *rq=NULL;
	int fingerprint=0;
	char buf[256];
	const EVP_MD *md_alg,*digest=NULL;
	CONF *extconf = NULL;
	char *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;
	int need_rand = 0;
	int checkend=0,checkoffset=0;
	unsigned long nmflag = 0, certflag = 0;
	unsigned char *checkhost = NULL, *checkemail = NULL;
	char *checkip = NULL;
#ifndef OPENSSL_NO_ENGINE
	char *engine=NULL;
#endif
	reqfile=0;
	apps_startup();
	if (bio_err == NULL)
		bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
	if (!load_config(bio_err, NULL))
		goto end;
	STDout=BIO_new_fp(stdout,BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
	{
	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
	STDout = BIO_push(tmpbio, STDout);
	}
#endif
	informat=FORMAT_PEM;
	outformat=FORMAT_PEM;
	keyformat=FORMAT_PEM;
	CAformat=FORMAT_PEM;
	CAkeyformat=FORMAT_PEM;
	ctx=X509_STORE_new();
	if (ctx == NULL) goto end;
	X509_STORE_set_verify_cb(ctx,callb);
	argc--;
	argv++;
	num=0;
	while (argc >= 1)
		{
		if 	(strcmp(*argv,"-inform") == 0)
			{
			if (--argc < 1) goto bad;
			informat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-outform") == 0)
			{
			if (--argc < 1) goto bad;
			outformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-keyform") == 0)
			{
			if (--argc < 1) goto bad;
			keyformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-req") == 0)
			{
			reqfile=1;
			need_rand = 1;
			}
		else if (strcmp(*argv,"-CAform") == 0)
			{
			if (--argc < 1) goto bad;
			CAformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-CAkeyform") == 0)
			{
			if (--argc < 1) goto bad;
			CAkeyformat=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-sigopt") == 0)
			{
			if (--argc < 1)
				goto bad;
			if (!sigopts)
				sigopts = sk_OPENSSL_STRING_new_null();
			if (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))
				goto bad;
			}
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days=atoi(*(++argv));
			if (days == 0)
				{
				BIO_printf(bio_err,"bad number of days\n");
				goto bad;
				}
			}
		else if (strcmp(*argv,"-passin") == 0)
			{
			if (--argc < 1) goto bad;
			passargin= *(++argv);
			}
		else if (strcmp(*argv,"-extfile") == 0)
			{
			if (--argc < 1) goto bad;
			extfile= *(++argv);
			}
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extsect= *(++argv);
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-signkey") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			sign_flag= ++num;
			need_rand = 1;
			}
		else if (strcmp(*argv,"-CA") == 0)
			{
			if (--argc < 1) goto bad;
			CAfile= *(++argv);
			CA_flag= ++num;
			need_rand = 1;
			}
		else if (strcmp(*argv,"-CAkey") == 0)
			{
			if (--argc < 1) goto bad;
			CAkeyfile= *(++argv);
			}
		else if (strcmp(*argv,"-CAserial") == 0)
			{
			if (--argc < 1) goto bad;
			CAserial= *(++argv);
			}
		else if (strcmp(*argv,"-set_serial") == 0)
			{
			if (--argc < 1) goto bad;
			if (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv))))
				goto bad;
			}
		else if (strcmp(*argv,"-force_pubkey") == 0)
			{
			if (--argc < 1) goto bad;
			fkeyfile= *(++argv);
			}
		else if (strcmp(*argv,"-addtrust") == 0)
			{
			if (--argc < 1) goto bad;
			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))
				{
				BIO_printf(bio_err,
					"Invalid trust object value %s\n", *argv);
				goto bad;
				}
			if (!trust) trust = sk_ASN1_OBJECT_new_null();
			sk_ASN1_OBJECT_push(trust, objtmp);
			trustout = 1;
			}
		else if (strcmp(*argv,"-addreject") == 0)
			{
			if (--argc < 1) goto bad;
			if (!(objtmp = OBJ_txt2obj(*(++argv), 0)))
				{
				BIO_printf(bio_err,
					"Invalid reject object value %s\n", *argv);
				goto bad;
				}
			if (!reject) reject = sk_ASN1_OBJECT_new_null();
			sk_ASN1_OBJECT_push(reject, objtmp);
			trustout = 1;
			}
		else if (strcmp(*argv,"-setalias") == 0)
			{
			if (--argc < 1) goto bad;
			alias= *(++argv);
			trustout = 1;
			}
		else if (strcmp(*argv,"-certopt") == 0)
			{
			if (--argc < 1) goto bad;
			if (!set_cert_ex(&certflag, *(++argv))) goto bad;
			}
		else if (strcmp(*argv,"-nameopt") == 0)
			{
			if (--argc < 1) goto bad;
			if (!set_name_ex(&nmflag, *(++argv))) goto bad;
			}
#ifndef OPENSSL_NO_ENGINE
		else if (strcmp(*argv,"-engine") == 0)
			{
			if (--argc < 1) goto bad;
			engine= *(++argv);
			}
#endif
		else if (strcmp(*argv,"-C") == 0)
			C= ++num;
		else if (strcmp(*argv,"-email") == 0)
			email= ++num;
		else if (strcmp(*argv,"-ocsp_uri") == 0)
			ocsp_uri= ++num;
		else if (strcmp(*argv,"-serial") == 0)
			serial= ++num;
		else if (strcmp(*argv,"-next_serial") == 0)
			next_serial= ++num;
		else if (strcmp(*argv,"-modulus") == 0)
			modulus= ++num;
		else if (strcmp(*argv,"-pubkey") == 0)
			pubkey= ++num;
		else if (strcmp(*argv,"-x509toreq") == 0)
			x509req= ++num;
		else if (strcmp(*argv,"-text") == 0)
			text= ++num;
		else if (strcmp(*argv,"-hash") == 0
			|| strcmp(*argv,"-subject_hash") == 0)
			subject_hash= ++num;
#ifndef OPENSSL_NO_MD5
		else if (strcmp(*argv,"-subject_hash_old") == 0)
			subject_hash_old= ++num;
#endif
		else if (strcmp(*argv,"-issuer_hash") == 0)
			issuer_hash= ++num;
#ifndef OPENSSL_NO_MD5
		else if (strcmp(*argv,"-issuer_hash_old") == 0)
			issuer_hash_old= ++num;
#endif
		else if (strcmp(*argv,"-subject") == 0)
			subject= ++num;
		else if (strcmp(*argv,"-issuer") == 0)
			issuer= ++num;
		else if (strcmp(*argv,"-fingerprint") == 0)
			fingerprint= ++num;
		else if (strcmp(*argv,"-dates") == 0)
			{
			startdate= ++num;
			enddate= ++num;
			}
		else if (strcmp(*argv,"-purpose") == 0)
			pprint= ++num;
		else if (strcmp(*argv,"-startdate") == 0)
			startdate= ++num;
		else if (strcmp(*argv,"-enddate") == 0)
			enddate= ++num;
		else if (strcmp(*argv,"-checkend") == 0)
			{
			if (--argc < 1) goto bad;
			checkoffset=atoi(*(++argv));
			checkend=1;
			}
		else if (strcmp(*argv,"-checkhost") == 0)
			{
			if (--argc < 1) goto bad;
			checkhost=(unsigned char *)*(++argv);
			}
		else if (strcmp(*argv,"-checkemail") == 0)
			{
			if (--argc < 1) goto bad;
			checkemail=(unsigned char *)*(++argv);
			}
		else if (strcmp(*argv,"-checkip") == 0)
			{
			if (--argc < 1) goto bad;
			checkip=*(++argv);
			}
		else if (strcmp(*argv,"-noout") == 0)
			noout= ++num;
		else if (strcmp(*argv,"-trustout") == 0)
			trustout= 1;
		else if (strcmp(*argv,"-clrtrust") == 0)
			clrtrust= ++num;
		else if (strcmp(*argv,"-clrreject") == 0)
			clrreject= ++num;
		else if (strcmp(*argv,"-alias") == 0)
			aliasout= ++num;
		else if (strcmp(*argv,"-CAcreateserial") == 0)
			CA_createserial= ++num;
		else if (strcmp(*argv,"-clrext") == 0)
			clrext = 1;
#if 1
		else if (strcmp(*argv,"-crlext") == 0)
			{
			BIO_printf(bio_err,"use -clrext instead of -crlext\n");
			clrext = 1;
			}
#endif
		else if (strcmp(*argv,"-ocspid") == 0)
			ocspid= ++num;
		else if ((md_alg=EVP_get_digestbyname(*argv + 1)))
			{
			digest=md_alg;
			}
		else
			{
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}
	if (badops)
		{
bad:
		for (pp=x509_usage; (*pp != NULL); pp++)
			BIO_printf(bio_err,"%s",*pp);
		goto end;
		}
#ifndef OPENSSL_NO_ENGINE
        e = setup_engine(bio_err, engine, 0);
#endif
	if (need_rand)
		app_RAND_load_file(NULL, bio_err, 0);
	ERR_load_crypto_strings();
	if (!app_passwd(bio_err, passargin, NULL, &passin, NULL))
		{
		BIO_printf(bio_err, "Error getting password\n");
		goto end;
		}
	if (!X509_STORE_set_default_paths(ctx))
		{
		ERR_print_errors(bio_err);
		goto end;
		}
	if (fkeyfile)
		{
		fkey = load_pubkey(bio_err, fkeyfile, keyformat, 0,
						NULL, e, "Forced key");
		if (fkey == NULL) goto end;
		}
	if ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM))
		{ CAkeyfile=CAfile; }
	else if ((CA_flag) && (CAkeyfile == NULL))
		{
		BIO_printf(bio_err,"need to specify a CAkey if using the CA command\n");
		goto end;
		}
	if (extfile)
		{
		long errorline = -1;
		X509V3_CTX ctx2;
		extconf = NCONF_new(NULL);
		if (!NCONF_load(extconf, extfile,&errorline))
			{
			if (errorline <= 0)
				BIO_printf(bio_err,
					"error loading the config file '%s'\n",
								extfile);
                	else
                        	BIO_printf(bio_err,
				       "error on line %ld of config file '%s'\n"
							,errorline,extfile);
			goto end;
			}
		if (!extsect)
			{
			extsect = NCONF_get_string(extconf, "default", "extensions");
			if (!extsect)
				{
				ERR_clear_error();
				extsect = "default";
				}
			}
		X509V3_set_ctx_test(&ctx2);
		X509V3_set_nconf(&ctx2, extconf);
		if (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))
			{
			BIO_printf(bio_err,
				"Error Loading extension section %s\n",
								 extsect);
			ERR_print_errors(bio_err);
			goto end;
			}
		}
	if (reqfile)
		{
		EVP_PKEY *pkey;
		BIO *in;
		if (!sign_flag && !CA_flag)
			{
			BIO_printf(bio_err,"We need a private key to sign with\n");
			goto end;
			}
		in=BIO_new(BIO_s_file());
		if (in == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}
		if (infile == NULL)
			BIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);
		else
			{
			if (BIO_read_filename(in,infile) <= 0)
				{
				perror(infile);
				BIO_free(in);
				goto end;
				}
			}
		req=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);
		BIO_free(in);
		if (req == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}
		if (	(req->req_info == NULL) ||
			(req->req_info->pubkey == NULL) ||
			(req->req_info->pubkey->public_key == NULL) ||
			(req->req_info->pubkey->public_key->data == NULL))
			{
			BIO_printf(bio_err,"The certificate request appears to corrupted\n");
			BIO_printf(bio_err,"It does not contain a public key\n");
			goto end;
			}
		if ((pkey=X509_REQ_get_pubkey(req)) == NULL)
	                {
	                BIO_printf(bio_err,"error unpacking public key\n");
	                goto end;
	                }
		i=X509_REQ_verify(req,pkey);
		EVP_PKEY_free(pkey);
		if (i < 0)
			{
			BIO_printf(bio_err,"Signature verification error\n");
			ERR_print_errors(bio_err);
			goto end;
			}
	        if (i == 0)
			{
			BIO_printf(bio_err,"Signature did not match the certificate request\n");
			goto end;
			}
		else
			BIO_printf(bio_err,"Signature ok\n");
		print_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag);
		if ((x=X509_new()) == NULL) goto end;
		if (sno == NULL)
			{
			sno = ASN1_INTEGER_new();
			if (!sno || !rand_serial(NULL, sno))
				goto end;
			if (!X509_set_serialNumber(x, sno))
				goto end;
			ASN1_INTEGER_free(sno);
			sno = NULL;
			}
		else if (!X509_set_serialNumber(x, sno))
			goto end;
		if (!X509_set_issuer_name(x,req->req_info->subject)) goto end;
		if (!X509_set_subject_name(x,req->req_info->subject)) goto end;
		X509_gmtime_adj(X509_get_notBefore(x),0);
	        X509_time_adj_ex(X509_get_notAfter(x),days, 0, NULL);
		if (fkey)
			X509_set_pubkey(x, fkey);
		else
			{
			pkey = X509_REQ_get_pubkey(req);
			X509_set_pubkey(x,pkey);
			EVP_PKEY_free(pkey);
			}
		}
	else
		x=load_cert(bio_err,infile,informat,NULL,e,"Certificate");
	if (x == NULL) goto end;
	if (CA_flag)
		{
		xca=load_cert(bio_err,CAfile,CAformat,NULL,e,"CA Certificate");
		if (xca == NULL) goto end;
		}
	if (!noout || text || next_serial)
		{
		OBJ_create("2.99999.3",
			"SET.ex3","SET x509v3 extension 3");
		out=BIO_new(BIO_s_file());
		if (out == NULL)
			{
			ERR_print_errors(bio_err);
			goto end;
			}
		if (outfile == NULL)
			{
			BIO_set_fp(out,stdout,BIO_NOCLOSE);
#ifdef OPENSSL_SYS_VMS
			{
			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
			out = BIO_push(tmpbio, out);
			}
#endif
			}
		else
			{
			if (BIO_write_filename(out,outfile) <= 0)
				{
				perror(outfile);
				goto end;
				}
			}
		}
	if (alias) X509_alias_set1(x, (unsigned char *)alias, -1);
	if (clrtrust) X509_trust_clear(x);
	if (clrreject) X509_reject_clear(x);
	if (trust)
		{
		for (i = 0; i < sk_ASN1_OBJECT_num(trust); i++)
			{
			objtmp = sk_ASN1_OBJECT_value(trust, i);
			X509_add1_trust_object(x, objtmp);
			}
		}
	if (reject)
		{
		for (i = 0; i < sk_ASN1_OBJECT_num(reject); i++)
			{
			objtmp = sk_ASN1_OBJECT_value(reject, i);
			X509_add1_reject_object(x, objtmp);
			}
		}
	if (num)
		{
		for (i=1; i<=num; i++)
			{
			if (issuer == i)
				{
				print_name(STDout, "issuer= ",
					X509_get_issuer_name(x), nmflag);
				}
			else if (subject == i)
				{
				print_name(STDout, "subject= ",
					X509_get_subject_name(x), nmflag);
				}
			else if (serial == i)
				{
				BIO_printf(STDout,"serial=");
				i2a_ASN1_INTEGER(STDout,
					X509_get_serialNumber(x));
				BIO_printf(STDout,"\n");
				}
			else if (next_serial == i)
				{
				BIGNUM *bnser;
				ASN1_INTEGER *ser;
				ser = X509_get_serialNumber(x);
				bnser = ASN1_INTEGER_to_BN(ser, NULL);
				if (!bnser)
					goto end;
				if (!BN_add_word(bnser, 1))
					goto end;
				ser = BN_to_ASN1_INTEGER(bnser, NULL);
				if (!ser)
					goto end;
				BN_free(bnser);
				i2a_ASN1_INTEGER(out, ser);
				ASN1_INTEGER_free(ser);
				BIO_puts(out, "\n");
				}
			else if ((email == i) || (ocsp_uri == i))
				{
				int j;
				STACK_OF(OPENSSL_STRING) *emlst;
				if (email == i)
					emlst = X509_get1_email(x);
				else
					emlst = X509_get1_ocsp(x);
				for (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)
					BIO_printf(STDout, "%s\n",
						   sk_OPENSSL_STRING_value(emlst, j));
				X509_email_free(emlst);
				}
			else if (aliasout == i)
				{
				unsigned char *alstr;
				alstr = X509_alias_get0(x, NULL);
				if (alstr) BIO_printf(STDout,"%s\n", alstr);
				else BIO_puts(STDout,"<No Alias>\n");
				}
			else if (subject_hash == i)
				{
				BIO_printf(STDout,"%08lx\n",X509_subject_name_hash(x));
				}
#ifndef OPENSSL_NO_MD5
			else if (subject_hash_old == i)
				{
				BIO_printf(STDout,"%08lx\n",X509_subject_name_hash_old(x));
				}
#endif
			else if (issuer_hash == i)
				{
				BIO_printf(STDout,"%08lx\n",X509_issuer_name_hash(x));
				}
#ifndef OPENSSL_NO_MD5
			else if (issuer_hash_old == i)
				{
				BIO_printf(STDout,"%08lx\n",X509_issuer_name_hash_old(x));
				}
#endif
			else if (pprint == i)
				{
				X509_PURPOSE *ptmp;
				int j;
				BIO_printf(STDout, "Certificate purposes:\n");
				for (j = 0; j < X509_PURPOSE_get_count(); j++)
					{
					ptmp = X509_PURPOSE_get0(j);
					purpose_print(STDout, x, ptmp);
					}
				}
			else
				if (modulus == i)
				{
				EVP_PKEY *pkey;
				pkey=X509_get_pubkey(x);
				if (pkey == NULL)
					{
					BIO_printf(bio_err,"Modulus=unavailable\n");
					ERR_print_errors(bio_err);
					goto end;
					}
				BIO_printf(STDout,"Modulus=");
#ifndef OPENSSL_NO_RSA
				if (pkey->type == EVP_PKEY_RSA)
					BN_print(STDout,pkey->pkey.rsa->n);
				else
#endif
#ifndef OPENSSL_NO_DSA
				if (pkey->type == EVP_PKEY_DSA)
					BN_print(STDout,pkey->pkey.dsa->pub_key);
				else
#endif
					BIO_printf(STDout,"Wrong Algorithm type");
				BIO_printf(STDout,"\n");
				EVP_PKEY_free(pkey);
				}
			else
				if (pubkey == i)
				{
				EVP_PKEY *pkey;
				pkey=X509_get_pubkey(x);
				if (pkey == NULL)
					{
					BIO_printf(bio_err,"Error getting public key\n");
					ERR_print_errors(bio_err);
					goto end;
					}
				PEM_write_bio_PUBKEY(STDout, pkey);
				EVP_PKEY_free(pkey);
				}
			else
				if (C == i)
				{
				unsigned char *d;
				char *m;
				int y,z;
				X509_NAME_oneline(X509_get_subject_name(x),
					buf,sizeof buf);
				BIO_printf(STDout,"/* subject:%s */\n",buf);
				m=X509_NAME_oneline(
					X509_get_issuer_name(x),buf,
					sizeof buf);
				BIO_printf(STDout,"/* issuer :%s */\n",buf);
				z=i2d_X509(x,NULL);
				m=OPENSSL_malloc(z);
				d=(unsigned char *)m;
				z=i2d_X509_NAME(X509_get_subject_name(x),&d);
				BIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
				z=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d);
				BIO_printf(STDout,"unsigned char XXX_public_key[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
				z=i2d_X509(x,&d);
				BIO_printf(STDout,"unsigned char XXX_certificate[%d]={\n",z);
				d=(unsigned char *)m;
				for (y=0; y<z; y++)
					{
					BIO_printf(STDout,"0x%02X,",d[y]);
					if ((y & 0x0f) == 0x0f)
						BIO_printf(STDout,"\n");
					}
				if (y%16 != 0) BIO_printf(STDout,"\n");
				BIO_printf(STDout,"};\n");
				OPENSSL_free(m);
				}
			else if (text == i)
				{
				X509_print_ex(STDout,x,nmflag, certflag);
				}
			else if (startdate == i)
				{
				BIO_puts(STDout,"notBefore=");
				ASN1_TIME_print(STDout,X509_get_notBefore(x));
				BIO_puts(STDout,"\n");
				}
			else if (enddate == i)
				{
				BIO_puts(STDout,"notAfter=");
				ASN1_TIME_print(STDout,X509_get_notAfter(x));
				BIO_puts(STDout,"\n");
				}
			else if (fingerprint == i)
				{
				int j;
				unsigned int n;
				unsigned char md[EVP_MAX_MD_SIZE];
				const EVP_MD *fdig = digest;
				if (!fdig)
					fdig = EVP_sha1();
				if (!X509_digest(x,fdig,md,&n))
					{
					BIO_printf(bio_err,"out of memory\n");
					goto end;
					}
				BIO_printf(STDout,"%s Fingerprint=",
						OBJ_nid2sn(EVP_MD_type(fdig)));
				for (j=0; j<(int)n; j++)
					{
					BIO_printf(STDout,"%02X%c",md[j],
						(j+1 == (int)n)
						?'\n':':');
					}
				}
			else if ((sign_flag == i) && (x509req == 0))
				{
				BIO_printf(bio_err,"Getting Private key\n");
				if (Upkey == NULL)
					{
					Upkey=load_key(bio_err,
						keyfile, keyformat, 0,
						passin, e, "Private key");
					if (Upkey == NULL) goto end;
					}
				assert(need_rand);
				if (!sign(x,Upkey,days,clrext,digest,
						 extconf, extsect)) goto end;
				}
			else if (CA_flag == i)
				{
				BIO_printf(bio_err,"Getting CA Private Key\n");
				if (CAkeyfile != NULL)
					{
					CApkey=load_key(bio_err,
						CAkeyfile, CAkeyformat,
						0, passin, e,
						"CA Private Key");
					if (CApkey == NULL) goto end;
					}
				assert(need_rand);
				if (!x509_certify(ctx,CAfile,digest,x,xca,
					CApkey, sigopts,
					CAserial,CA_createserial,days, clrext,
					extconf, extsect, sno))
					goto end;
				}
			else if (x509req == i)
				{
				EVP_PKEY *pk;
				BIO_printf(bio_err,"Getting request Private Key\n");
				if (keyfile == NULL)
					{
					BIO_printf(bio_err,"no request key file specified\n");
					goto end;
					}
				else
					{
					pk=load_key(bio_err,
						keyfile, keyformat, 0,
						passin, e, "request key");
					if (pk == NULL) goto end;
					}
				BIO_printf(bio_err,"Generating certificate request\n");
				rq=X509_to_X509_REQ(x,pk,digest);
				EVP_PKEY_free(pk);
				if (rq == NULL)
					{
					ERR_print_errors(bio_err);
					goto end;
					}
				if (!noout)
					{
					X509_REQ_print(out,rq);
					PEM_write_bio_X509_REQ(out,rq);
					}
				noout=1;
				}
			else if (ocspid == i)
				{
				X509_ocspid_print(out, x);
				}
			}
		}
	if (checkend)
		{
		time_t tcheck=time(NULL) + checkoffset;
		if (X509_cmp_time(X509_get_notAfter(x), &tcheck) < 0)
			{
			BIO_printf(out,"Certificate will expire\n");
			ret=1;
			}
		else
			{
			BIO_printf(out,"Certificate will not expire\n");
			ret=0;
			}
		goto end;
		}
	print_cert_checks(STDout, x, checkhost, checkemail, checkip);
	if (noout)
		{
		ret=0;
		goto end;
		}
	if 	(outformat == FORMAT_ASN1)
		i=i2d_X509_bio(out,x);
	else if (outformat == FORMAT_PEM)
		{
		if (trustout) i=PEM_write_bio_X509_AUX(out,x);
		else i=PEM_write_bio_X509(out,x);
		}
	else if (outformat == FORMAT_NETSCAPE)
		{
		NETSCAPE_X509 nx;
		ASN1_OCTET_STRING hdr;
		hdr.data=(unsigned char *)NETSCAPE_CERT_HDR;
		hdr.length=strlen(NETSCAPE_CERT_HDR);
		nx.header= &hdr;
		nx.cert=x;
		i=ASN1_item_i2d_bio(ASN1_ITEM_rptr(NETSCAPE_X509),out,&nx);
		}
	else	{
		BIO_printf(bio_err,"bad output format specified for outfile\n");
		goto end;
		}
	if (!i)
		{
		BIO_printf(bio_err,"unable to write certificate\n");
		ERR_print_errors(bio_err);
		goto end;
		}
	ret=0;
end:
	if (need_rand)
		app_RAND_write_file(NULL, bio_err);
	OBJ_cleanup();
	NCONF_free(extconf);
	BIO_free_all(out);
	BIO_free_all(STDout);
	X509_STORE_free(ctx);
	X509_REQ_free(req);
	X509_free(x);
	X509_free(xca);
	EVP_PKEY_free(Upkey);
	EVP_PKEY_free(CApkey);
	EVP_PKEY_free(fkey);
	if (sigopts)
		sk_OPENSSL_STRING_free(sigopts);
	X509_REQ_free(rq);
	ASN1_INTEGER_free(sno);
	sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
	sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
	if (passin) OPENSSL_free(passin);
	apps_shutdown();
	OPENSSL_EXIT(ret);
	}
['int MAIN(int argc, char **argv)\n\t{\n\tENGINE *e = NULL;\n\tint ret=1;\n\tX509_REQ *req=NULL;\n\tX509 *x=NULL,*xca=NULL;\n\tASN1_OBJECT *objtmp;\n\tSTACK_OF(OPENSSL_STRING) *sigopts = NULL;\n\tEVP_PKEY *Upkey=NULL,*CApkey=NULL, *fkey = NULL;\n\tASN1_INTEGER *sno = NULL;\n\tint i,num,badops=0;\n\tBIO *out=NULL;\n\tBIO *STDout=NULL;\n\tSTACK_OF(ASN1_OBJECT) *trust = NULL, *reject = NULL;\n\tint informat,outformat,keyformat,CAformat,CAkeyformat;\n\tchar *infile=NULL,*outfile=NULL,*keyfile=NULL,*CAfile=NULL;\n\tchar *CAkeyfile=NULL,*CAserial=NULL;\n\tchar *fkeyfile=NULL;\n\tchar *alias=NULL;\n\tint text=0,serial=0,subject=0,issuer=0,startdate=0,enddate=0;\n\tint next_serial=0;\n\tint subject_hash=0,issuer_hash=0,ocspid=0;\n#ifndef OPENSSL_NO_MD5\n\tint subject_hash_old=0,issuer_hash_old=0;\n#endif\n\tint noout=0,sign_flag=0,CA_flag=0,CA_createserial=0,email=0;\n\tint ocsp_uri=0;\n\tint trustout=0,clrtrust=0,clrreject=0,aliasout=0,clrext=0;\n\tint C=0;\n\tint x509req=0,days=DEF_DAYS,modulus=0,pubkey=0;\n\tint pprint = 0;\n\tconst char **pp;\n\tX509_STORE *ctx=NULL;\n\tX509_REQ *rq=NULL;\n\tint fingerprint=0;\n\tchar buf[256];\n\tconst EVP_MD *md_alg,*digest=NULL;\n\tCONF *extconf = NULL;\n\tchar *extsect = NULL, *extfile = NULL, *passin = NULL, *passargin = NULL;\n\tint need_rand = 0;\n\tint checkend=0,checkoffset=0;\n\tunsigned long nmflag = 0, certflag = 0;\n\tunsigned char *checkhost = NULL, *checkemail = NULL;\n\tchar *checkip = NULL;\n#ifndef OPENSSL_NO_ENGINE\n\tchar *engine=NULL;\n#endif\n\treqfile=0;\n\tapps_startup();\n\tif (bio_err == NULL)\n\t\tbio_err=BIO_new_fp(stderr,BIO_NOCLOSE);\n\tif (!load_config(bio_err, NULL))\n\t\tgoto end;\n\tSTDout=BIO_new_fp(stdout,BIO_NOCLOSE);\n#ifdef OPENSSL_SYS_VMS\n\t{\n\tBIO *tmpbio = BIO_new(BIO_f_linebuffer());\n\tSTDout = BIO_push(tmpbio, STDout);\n\t}\n#endif\n\tinformat=FORMAT_PEM;\n\toutformat=FORMAT_PEM;\n\tkeyformat=FORMAT_PEM;\n\tCAformat=FORMAT_PEM;\n\tCAkeyformat=FORMAT_PEM;\n\tctx=X509_STORE_new();\n\tif (ctx == NULL) goto end;\n\tX509_STORE_set_verify_cb(ctx,callb);\n\targc--;\n\targv++;\n\tnum=0;\n\twhile (argc >= 1)\n\t\t{\n\t\tif \t(strcmp(*argv,"-inform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-outform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-keyform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-req") == 0)\n\t\t\t{\n\t\t\treqfile=1;\n\t\t\tneed_rand = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-CAform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tCAformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-CAkeyform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tCAkeyformat=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-sigopt") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1)\n\t\t\t\tgoto bad;\n\t\t\tif (!sigopts)\n\t\t\t\tsigopts = sk_OPENSSL_STRING_new_null();\n\t\t\tif (!sigopts || !sk_OPENSSL_STRING_push(sigopts, *(++argv)))\n\t\t\t\tgoto bad;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-days") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tdays=atoi(*(++argv));\n\t\t\tif (days == 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"bad number of days\\n");\n\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\t}\n\t\telse if (strcmp(*argv,"-passin") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tpassargin= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-extfile") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\textfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-extensions") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\textsect= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-in") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-out") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-signkey") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyfile= *(++argv);\n\t\t\tsign_flag= ++num;\n\t\t\tneed_rand = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-CA") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tCAfile= *(++argv);\n\t\t\tCA_flag= ++num;\n\t\t\tneed_rand = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-CAkey") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tCAkeyfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-CAserial") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tCAserial= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-set_serial") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tif (!(sno = s2i_ASN1_INTEGER(NULL, *(++argv))))\n\t\t\t\tgoto bad;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-force_pubkey") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tfkeyfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-addtrust") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tif (!(objtmp = OBJ_txt2obj(*(++argv), 0)))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t\t"Invalid trust object value %s\\n", *argv);\n\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\tif (!trust) trust = sk_ASN1_OBJECT_new_null();\n\t\t\tsk_ASN1_OBJECT_push(trust, objtmp);\n\t\t\ttrustout = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-addreject") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tif (!(objtmp = OBJ_txt2obj(*(++argv), 0)))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t\t"Invalid reject object value %s\\n", *argv);\n\t\t\t\tgoto bad;\n\t\t\t\t}\n\t\t\tif (!reject) reject = sk_ASN1_OBJECT_new_null();\n\t\t\tsk_ASN1_OBJECT_push(reject, objtmp);\n\t\t\ttrustout = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-setalias") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\talias= *(++argv);\n\t\t\ttrustout = 1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-certopt") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tif (!set_cert_ex(&certflag, *(++argv))) goto bad;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-nameopt") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tif (!set_name_ex(&nmflag, *(++argv))) goto bad;\n\t\t\t}\n#ifndef OPENSSL_NO_ENGINE\n\t\telse if (strcmp(*argv,"-engine") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tengine= *(++argv);\n\t\t\t}\n#endif\n\t\telse if (strcmp(*argv,"-C") == 0)\n\t\t\tC= ++num;\n\t\telse if (strcmp(*argv,"-email") == 0)\n\t\t\temail= ++num;\n\t\telse if (strcmp(*argv,"-ocsp_uri") == 0)\n\t\t\tocsp_uri= ++num;\n\t\telse if (strcmp(*argv,"-serial") == 0)\n\t\t\tserial= ++num;\n\t\telse if (strcmp(*argv,"-next_serial") == 0)\n\t\t\tnext_serial= ++num;\n\t\telse if (strcmp(*argv,"-modulus") == 0)\n\t\t\tmodulus= ++num;\n\t\telse if (strcmp(*argv,"-pubkey") == 0)\n\t\t\tpubkey= ++num;\n\t\telse if (strcmp(*argv,"-x509toreq") == 0)\n\t\t\tx509req= ++num;\n\t\telse if (strcmp(*argv,"-text") == 0)\n\t\t\ttext= ++num;\n\t\telse if (strcmp(*argv,"-hash") == 0\n\t\t\t|| strcmp(*argv,"-subject_hash") == 0)\n\t\t\tsubject_hash= ++num;\n#ifndef OPENSSL_NO_MD5\n\t\telse if (strcmp(*argv,"-subject_hash_old") == 0)\n\t\t\tsubject_hash_old= ++num;\n#endif\n\t\telse if (strcmp(*argv,"-issuer_hash") == 0)\n\t\t\tissuer_hash= ++num;\n#ifndef OPENSSL_NO_MD5\n\t\telse if (strcmp(*argv,"-issuer_hash_old") == 0)\n\t\t\tissuer_hash_old= ++num;\n#endif\n\t\telse if (strcmp(*argv,"-subject") == 0)\n\t\t\tsubject= ++num;\n\t\telse if (strcmp(*argv,"-issuer") == 0)\n\t\t\tissuer= ++num;\n\t\telse if (strcmp(*argv,"-fingerprint") == 0)\n\t\t\tfingerprint= ++num;\n\t\telse if (strcmp(*argv,"-dates") == 0)\n\t\t\t{\n\t\t\tstartdate= ++num;\n\t\t\tenddate= ++num;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-purpose") == 0)\n\t\t\tpprint= ++num;\n\t\telse if (strcmp(*argv,"-startdate") == 0)\n\t\t\tstartdate= ++num;\n\t\telse if (strcmp(*argv,"-enddate") == 0)\n\t\t\tenddate= ++num;\n\t\telse if (strcmp(*argv,"-checkend") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcheckoffset=atoi(*(++argv));\n\t\t\tcheckend=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-checkhost") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcheckhost=(unsigned char *)*(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-checkemail") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcheckemail=(unsigned char *)*(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-checkip") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcheckip=*(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-noout") == 0)\n\t\t\tnoout= ++num;\n\t\telse if (strcmp(*argv,"-trustout") == 0)\n\t\t\ttrustout= 1;\n\t\telse if (strcmp(*argv,"-clrtrust") == 0)\n\t\t\tclrtrust= ++num;\n\t\telse if (strcmp(*argv,"-clrreject") == 0)\n\t\t\tclrreject= ++num;\n\t\telse if (strcmp(*argv,"-alias") == 0)\n\t\t\taliasout= ++num;\n\t\telse if (strcmp(*argv,"-CAcreateserial") == 0)\n\t\t\tCA_createserial= ++num;\n\t\telse if (strcmp(*argv,"-clrext") == 0)\n\t\t\tclrext = 1;\n#if 1\n\t\telse if (strcmp(*argv,"-crlext") == 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"use -clrext instead of -crlext\\n");\n\t\t\tclrext = 1;\n\t\t\t}\n#endif\n\t\telse if (strcmp(*argv,"-ocspid") == 0)\n\t\t\tocspid= ++num;\n\t\telse if ((md_alg=EVP_get_digestbyname(*argv + 1)))\n\t\t\t{\n\t\t\tdigest=md_alg;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unknown option %s\\n",*argv);\n\t\t\tbadops=1;\n\t\t\tbreak;\n\t\t\t}\n\t\targc--;\n\t\targv++;\n\t\t}\n\tif (badops)\n\t\t{\nbad:\n\t\tfor (pp=x509_usage; (*pp != NULL); pp++)\n\t\t\tBIO_printf(bio_err,"%s",*pp);\n\t\tgoto end;\n\t\t}\n#ifndef OPENSSL_NO_ENGINE\n        e = setup_engine(bio_err, engine, 0);\n#endif\n\tif (need_rand)\n\t\tapp_RAND_load_file(NULL, bio_err, 0);\n\tERR_load_crypto_strings();\n\tif (!app_passwd(bio_err, passargin, NULL, &passin, NULL))\n\t\t{\n\t\tBIO_printf(bio_err, "Error getting password\\n");\n\t\tgoto end;\n\t\t}\n\tif (!X509_STORE_set_default_paths(ctx))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tif (fkeyfile)\n\t\t{\n\t\tfkey = load_pubkey(bio_err, fkeyfile, keyformat, 0,\n\t\t\t\t\t\tNULL, e, "Forced key");\n\t\tif (fkey == NULL) goto end;\n\t\t}\n\tif ((CAkeyfile == NULL) && (CA_flag) && (CAformat == FORMAT_PEM))\n\t\t{ CAkeyfile=CAfile; }\n\telse if ((CA_flag) && (CAkeyfile == NULL))\n\t\t{\n\t\tBIO_printf(bio_err,"need to specify a CAkey if using the CA command\\n");\n\t\tgoto end;\n\t\t}\n\tif (extfile)\n\t\t{\n\t\tlong errorline = -1;\n\t\tX509V3_CTX ctx2;\n\t\textconf = NCONF_new(NULL);\n\t\tif (!NCONF_load(extconf, extfile,&errorline))\n\t\t\t{\n\t\t\tif (errorline <= 0)\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t\t"error loading the config file \'%s\'\\n",\n\t\t\t\t\t\t\t\textfile);\n                \telse\n                        \tBIO_printf(bio_err,\n\t\t\t\t       "error on line %ld of config file \'%s\'\\n"\n\t\t\t\t\t\t\t,errorline,extfile);\n\t\t\tgoto end;\n\t\t\t}\n\t\tif (!extsect)\n\t\t\t{\n\t\t\textsect = NCONF_get_string(extconf, "default", "extensions");\n\t\t\tif (!extsect)\n\t\t\t\t{\n\t\t\t\tERR_clear_error();\n\t\t\t\textsect = "default";\n\t\t\t\t}\n\t\t\t}\n\t\tX509V3_set_ctx_test(&ctx2);\n\t\tX509V3_set_nconf(&ctx2, extconf);\n\t\tif (!X509V3_EXT_add_nconf(extconf, &ctx2, extsect, NULL))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,\n\t\t\t\t"Error Loading extension section %s\\n",\n\t\t\t\t\t\t\t\t extsect);\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t\t}\n\tif (reqfile)\n\t\t{\n\t\tEVP_PKEY *pkey;\n\t\tBIO *in;\n\t\tif (!sign_flag && !CA_flag)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"We need a private key to sign with\\n");\n\t\t\tgoto end;\n\t\t\t}\n\t\tin=BIO_new(BIO_s_file());\n\t\tif (in == NULL)\n\t\t\t{\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t\tif (infile == NULL)\n\t\t\tBIO_set_fp(in,stdin,BIO_NOCLOSE|BIO_FP_TEXT);\n\t\telse\n\t\t\t{\n\t\t\tif (BIO_read_filename(in,infile) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(infile);\n\t\t\t\tBIO_free(in);\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\t}\n\t\treq=PEM_read_bio_X509_REQ(in,NULL,NULL,NULL);\n\t\tBIO_free(in);\n\t\tif (req == NULL)\n\t\t\t{\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t\tif (\t(req->req_info == NULL) ||\n\t\t\t(req->req_info->pubkey == NULL) ||\n\t\t\t(req->req_info->pubkey->public_key == NULL) ||\n\t\t\t(req->req_info->pubkey->public_key->data == NULL))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"The certificate request appears to corrupted\\n");\n\t\t\tBIO_printf(bio_err,"It does not contain a public key\\n");\n\t\t\tgoto end;\n\t\t\t}\n\t\tif ((pkey=X509_REQ_get_pubkey(req)) == NULL)\n\t                {\n\t                BIO_printf(bio_err,"error unpacking public key\\n");\n\t                goto end;\n\t                }\n\t\ti=X509_REQ_verify(req,pkey);\n\t\tEVP_PKEY_free(pkey);\n\t\tif (i < 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Signature verification error\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t        if (i == 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Signature did not match the certificate request\\n");\n\t\t\tgoto end;\n\t\t\t}\n\t\telse\n\t\t\tBIO_printf(bio_err,"Signature ok\\n");\n\t\tprint_name(bio_err, "subject=", X509_REQ_get_subject_name(req), nmflag);\n\t\tif ((x=X509_new()) == NULL) goto end;\n\t\tif (sno == NULL)\n\t\t\t{\n\t\t\tsno = ASN1_INTEGER_new();\n\t\t\tif (!sno || !rand_serial(NULL, sno))\n\t\t\t\tgoto end;\n\t\t\tif (!X509_set_serialNumber(x, sno))\n\t\t\t\tgoto end;\n\t\t\tASN1_INTEGER_free(sno);\n\t\t\tsno = NULL;\n\t\t\t}\n\t\telse if (!X509_set_serialNumber(x, sno))\n\t\t\tgoto end;\n\t\tif (!X509_set_issuer_name(x,req->req_info->subject)) goto end;\n\t\tif (!X509_set_subject_name(x,req->req_info->subject)) goto end;\n\t\tX509_gmtime_adj(X509_get_notBefore(x),0);\n\t        X509_time_adj_ex(X509_get_notAfter(x),days, 0, NULL);\n\t\tif (fkey)\n\t\t\tX509_set_pubkey(x, fkey);\n\t\telse\n\t\t\t{\n\t\t\tpkey = X509_REQ_get_pubkey(req);\n\t\t\tX509_set_pubkey(x,pkey);\n\t\t\tEVP_PKEY_free(pkey);\n\t\t\t}\n\t\t}\n\telse\n\t\tx=load_cert(bio_err,infile,informat,NULL,e,"Certificate");\n\tif (x == NULL) goto end;\n\tif (CA_flag)\n\t\t{\n\t\txca=load_cert(bio_err,CAfile,CAformat,NULL,e,"CA Certificate");\n\t\tif (xca == NULL) goto end;\n\t\t}\n\tif (!noout || text || next_serial)\n\t\t{\n\t\tOBJ_create("2.99999.3",\n\t\t\t"SET.ex3","SET x509v3 extension 3");\n\t\tout=BIO_new(BIO_s_file());\n\t\tif (out == NULL)\n\t\t\t{\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto end;\n\t\t\t}\n\t\tif (outfile == NULL)\n\t\t\t{\n\t\t\tBIO_set_fp(out,stdout,BIO_NOCLOSE);\n#ifdef OPENSSL_SYS_VMS\n\t\t\t{\n\t\t\tBIO *tmpbio = BIO_new(BIO_f_linebuffer());\n\t\t\tout = BIO_push(tmpbio, out);\n\t\t\t}\n#endif\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tif (BIO_write_filename(out,outfile) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(outfile);\n\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tif (alias) X509_alias_set1(x, (unsigned char *)alias, -1);\n\tif (clrtrust) X509_trust_clear(x);\n\tif (clrreject) X509_reject_clear(x);\n\tif (trust)\n\t\t{\n\t\tfor (i = 0; i < sk_ASN1_OBJECT_num(trust); i++)\n\t\t\t{\n\t\t\tobjtmp = sk_ASN1_OBJECT_value(trust, i);\n\t\t\tX509_add1_trust_object(x, objtmp);\n\t\t\t}\n\t\t}\n\tif (reject)\n\t\t{\n\t\tfor (i = 0; i < sk_ASN1_OBJECT_num(reject); i++)\n\t\t\t{\n\t\t\tobjtmp = sk_ASN1_OBJECT_value(reject, i);\n\t\t\tX509_add1_reject_object(x, objtmp);\n\t\t\t}\n\t\t}\n\tif (num)\n\t\t{\n\t\tfor (i=1; i<=num; i++)\n\t\t\t{\n\t\t\tif (issuer == i)\n\t\t\t\t{\n\t\t\t\tprint_name(STDout, "issuer= ",\n\t\t\t\t\tX509_get_issuer_name(x), nmflag);\n\t\t\t\t}\n\t\t\telse if (subject == i)\n\t\t\t\t{\n\t\t\t\tprint_name(STDout, "subject= ",\n\t\t\t\t\tX509_get_subject_name(x), nmflag);\n\t\t\t\t}\n\t\t\telse if (serial == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(STDout,"serial=");\n\t\t\t\ti2a_ASN1_INTEGER(STDout,\n\t\t\t\t\tX509_get_serialNumber(x));\n\t\t\t\tBIO_printf(STDout,"\\n");\n\t\t\t\t}\n\t\t\telse if (next_serial == i)\n\t\t\t\t{\n\t\t\t\tBIGNUM *bnser;\n\t\t\t\tASN1_INTEGER *ser;\n\t\t\t\tser = X509_get_serialNumber(x);\n\t\t\t\tbnser = ASN1_INTEGER_to_BN(ser, NULL);\n\t\t\t\tif (!bnser)\n\t\t\t\t\tgoto end;\n\t\t\t\tif (!BN_add_word(bnser, 1))\n\t\t\t\t\tgoto end;\n\t\t\t\tser = BN_to_ASN1_INTEGER(bnser, NULL);\n\t\t\t\tif (!ser)\n\t\t\t\t\tgoto end;\n\t\t\t\tBN_free(bnser);\n\t\t\t\ti2a_ASN1_INTEGER(out, ser);\n\t\t\t\tASN1_INTEGER_free(ser);\n\t\t\t\tBIO_puts(out, "\\n");\n\t\t\t\t}\n\t\t\telse if ((email == i) || (ocsp_uri == i))\n\t\t\t\t{\n\t\t\t\tint j;\n\t\t\t\tSTACK_OF(OPENSSL_STRING) *emlst;\n\t\t\t\tif (email == i)\n\t\t\t\t\temlst = X509_get1_email(x);\n\t\t\t\telse\n\t\t\t\t\temlst = X509_get1_ocsp(x);\n\t\t\t\tfor (j = 0; j < sk_OPENSSL_STRING_num(emlst); j++)\n\t\t\t\t\tBIO_printf(STDout, "%s\\n",\n\t\t\t\t\t\t   sk_OPENSSL_STRING_value(emlst, j));\n\t\t\t\tX509_email_free(emlst);\n\t\t\t\t}\n\t\t\telse if (aliasout == i)\n\t\t\t\t{\n\t\t\t\tunsigned char *alstr;\n\t\t\t\talstr = X509_alias_get0(x, NULL);\n\t\t\t\tif (alstr) BIO_printf(STDout,"%s\\n", alstr);\n\t\t\t\telse BIO_puts(STDout,"<No Alias>\\n");\n\t\t\t\t}\n\t\t\telse if (subject_hash == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(STDout,"%08lx\\n",X509_subject_name_hash(x));\n\t\t\t\t}\n#ifndef OPENSSL_NO_MD5\n\t\t\telse if (subject_hash_old == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(STDout,"%08lx\\n",X509_subject_name_hash_old(x));\n\t\t\t\t}\n#endif\n\t\t\telse if (issuer_hash == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(STDout,"%08lx\\n",X509_issuer_name_hash(x));\n\t\t\t\t}\n#ifndef OPENSSL_NO_MD5\n\t\t\telse if (issuer_hash_old == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(STDout,"%08lx\\n",X509_issuer_name_hash_old(x));\n\t\t\t\t}\n#endif\n\t\t\telse if (pprint == i)\n\t\t\t\t{\n\t\t\t\tX509_PURPOSE *ptmp;\n\t\t\t\tint j;\n\t\t\t\tBIO_printf(STDout, "Certificate purposes:\\n");\n\t\t\t\tfor (j = 0; j < X509_PURPOSE_get_count(); j++)\n\t\t\t\t\t{\n\t\t\t\t\tptmp = X509_PURPOSE_get0(j);\n\t\t\t\t\tpurpose_print(STDout, x, ptmp);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tif (modulus == i)\n\t\t\t\t{\n\t\t\t\tEVP_PKEY *pkey;\n\t\t\t\tpkey=X509_get_pubkey(x);\n\t\t\t\tif (pkey == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Modulus=unavailable\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\tBIO_printf(STDout,"Modulus=");\n#ifndef OPENSSL_NO_RSA\n\t\t\t\tif (pkey->type == EVP_PKEY_RSA)\n\t\t\t\t\tBN_print(STDout,pkey->pkey.rsa->n);\n\t\t\t\telse\n#endif\n#ifndef OPENSSL_NO_DSA\n\t\t\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t\t\t\tBN_print(STDout,pkey->pkey.dsa->pub_key);\n\t\t\t\telse\n#endif\n\t\t\t\t\tBIO_printf(STDout,"Wrong Algorithm type");\n\t\t\t\tBIO_printf(STDout,"\\n");\n\t\t\t\tEVP_PKEY_free(pkey);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tif (pubkey == i)\n\t\t\t\t{\n\t\t\t\tEVP_PKEY *pkey;\n\t\t\t\tpkey=X509_get_pubkey(x);\n\t\t\t\tif (pkey == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Error getting public key\\n");\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\tPEM_write_bio_PUBKEY(STDout, pkey);\n\t\t\t\tEVP_PKEY_free(pkey);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tif (C == i)\n\t\t\t\t{\n\t\t\t\tunsigned char *d;\n\t\t\t\tchar *m;\n\t\t\t\tint y,z;\n\t\t\t\tX509_NAME_oneline(X509_get_subject_name(x),\n\t\t\t\t\tbuf,sizeof buf);\n\t\t\t\tBIO_printf(STDout,"/* subject:%s */\\n",buf);\n\t\t\t\tm=X509_NAME_oneline(\n\t\t\t\t\tX509_get_issuer_name(x),buf,\n\t\t\t\t\tsizeof buf);\n\t\t\t\tBIO_printf(STDout,"/* issuer :%s */\\n",buf);\n\t\t\t\tz=i2d_X509(x,NULL);\n\t\t\t\tm=OPENSSL_malloc(z);\n\t\t\t\td=(unsigned char *)m;\n\t\t\t\tz=i2d_X509_NAME(X509_get_subject_name(x),&d);\n\t\t\t\tBIO_printf(STDout,"unsigned char XXX_subject_name[%d]={\\n",z);\n\t\t\t\td=(unsigned char *)m;\n\t\t\t\tfor (y=0; y<z; y++)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(STDout,"0x%02X,",d[y]);\n\t\t\t\t\tif ((y & 0x0f) == 0x0f) BIO_printf(STDout,"\\n");\n\t\t\t\t\t}\n\t\t\t\tif (y%16 != 0) BIO_printf(STDout,"\\n");\n\t\t\t\tBIO_printf(STDout,"};\\n");\n\t\t\t\tz=i2d_X509_PUBKEY(X509_get_X509_PUBKEY(x),&d);\n\t\t\t\tBIO_printf(STDout,"unsigned char XXX_public_key[%d]={\\n",z);\n\t\t\t\td=(unsigned char *)m;\n\t\t\t\tfor (y=0; y<z; y++)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(STDout,"0x%02X,",d[y]);\n\t\t\t\t\tif ((y & 0x0f) == 0x0f)\n\t\t\t\t\t\tBIO_printf(STDout,"\\n");\n\t\t\t\t\t}\n\t\t\t\tif (y%16 != 0) BIO_printf(STDout,"\\n");\n\t\t\t\tBIO_printf(STDout,"};\\n");\n\t\t\t\tz=i2d_X509(x,&d);\n\t\t\t\tBIO_printf(STDout,"unsigned char XXX_certificate[%d]={\\n",z);\n\t\t\t\td=(unsigned char *)m;\n\t\t\t\tfor (y=0; y<z; y++)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(STDout,"0x%02X,",d[y]);\n\t\t\t\t\tif ((y & 0x0f) == 0x0f)\n\t\t\t\t\t\tBIO_printf(STDout,"\\n");\n\t\t\t\t\t}\n\t\t\t\tif (y%16 != 0) BIO_printf(STDout,"\\n");\n\t\t\t\tBIO_printf(STDout,"};\\n");\n\t\t\t\tOPENSSL_free(m);\n\t\t\t\t}\n\t\t\telse if (text == i)\n\t\t\t\t{\n\t\t\t\tX509_print_ex(STDout,x,nmflag, certflag);\n\t\t\t\t}\n\t\t\telse if (startdate == i)\n\t\t\t\t{\n\t\t\t\tBIO_puts(STDout,"notBefore=");\n\t\t\t\tASN1_TIME_print(STDout,X509_get_notBefore(x));\n\t\t\t\tBIO_puts(STDout,"\\n");\n\t\t\t\t}\n\t\t\telse if (enddate == i)\n\t\t\t\t{\n\t\t\t\tBIO_puts(STDout,"notAfter=");\n\t\t\t\tASN1_TIME_print(STDout,X509_get_notAfter(x));\n\t\t\t\tBIO_puts(STDout,"\\n");\n\t\t\t\t}\n\t\t\telse if (fingerprint == i)\n\t\t\t\t{\n\t\t\t\tint j;\n\t\t\t\tunsigned int n;\n\t\t\t\tunsigned char md[EVP_MAX_MD_SIZE];\n\t\t\t\tconst EVP_MD *fdig = digest;\n\t\t\t\tif (!fdig)\n\t\t\t\t\tfdig = EVP_sha1();\n\t\t\t\tif (!X509_digest(x,fdig,md,&n))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"out of memory\\n");\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\tBIO_printf(STDout,"%s Fingerprint=",\n\t\t\t\t\t\tOBJ_nid2sn(EVP_MD_type(fdig)));\n\t\t\t\tfor (j=0; j<(int)n; j++)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(STDout,"%02X%c",md[j],\n\t\t\t\t\t\t(j+1 == (int)n)\n\t\t\t\t\t\t?\'\\n\':\':\');\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse if ((sign_flag == i) && (x509req == 0))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"Getting Private key\\n");\n\t\t\t\tif (Upkey == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tUpkey=load_key(bio_err,\n\t\t\t\t\t\tkeyfile, keyformat, 0,\n\t\t\t\t\t\tpassin, e, "Private key");\n\t\t\t\t\tif (Upkey == NULL) goto end;\n\t\t\t\t\t}\n\t\t\t\tassert(need_rand);\n\t\t\t\tif (!sign(x,Upkey,days,clrext,digest,\n\t\t\t\t\t\t extconf, extsect)) goto end;\n\t\t\t\t}\n\t\t\telse if (CA_flag == i)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"Getting CA Private Key\\n");\n\t\t\t\tif (CAkeyfile != NULL)\n\t\t\t\t\t{\n\t\t\t\t\tCApkey=load_key(bio_err,\n\t\t\t\t\t\tCAkeyfile, CAkeyformat,\n\t\t\t\t\t\t0, passin, e,\n\t\t\t\t\t\t"CA Private Key");\n\t\t\t\t\tif (CApkey == NULL) goto end;\n\t\t\t\t\t}\n\t\t\t\tassert(need_rand);\n\t\t\t\tif (!x509_certify(ctx,CAfile,digest,x,xca,\n\t\t\t\t\tCApkey, sigopts,\n\t\t\t\t\tCAserial,CA_createserial,days, clrext,\n\t\t\t\t\textconf, extsect, sno))\n\t\t\t\t\tgoto end;\n\t\t\t\t}\n\t\t\telse if (x509req == i)\n\t\t\t\t{\n\t\t\t\tEVP_PKEY *pk;\n\t\t\t\tBIO_printf(bio_err,"Getting request Private Key\\n");\n\t\t\t\tif (keyfile == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"no request key file specified\\n");\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\tpk=load_key(bio_err,\n\t\t\t\t\t\tkeyfile, keyformat, 0,\n\t\t\t\t\t\tpassin, e, "request key");\n\t\t\t\t\tif (pk == NULL) goto end;\n\t\t\t\t\t}\n\t\t\t\tBIO_printf(bio_err,"Generating certificate request\\n");\n\t\t\t\trq=X509_to_X509_REQ(x,pk,digest);\n\t\t\t\tEVP_PKEY_free(pk);\n\t\t\t\tif (rq == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\t\tgoto end;\n\t\t\t\t\t}\n\t\t\t\tif (!noout)\n\t\t\t\t\t{\n\t\t\t\t\tX509_REQ_print(out,rq);\n\t\t\t\t\tPEM_write_bio_X509_REQ(out,rq);\n\t\t\t\t\t}\n\t\t\t\tnoout=1;\n\t\t\t\t}\n\t\t\telse if (ocspid == i)\n\t\t\t\t{\n\t\t\t\tX509_ocspid_print(out, x);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tif (checkend)\n\t\t{\n\t\ttime_t tcheck=time(NULL) + checkoffset;\n\t\tif (X509_cmp_time(X509_get_notAfter(x), &tcheck) < 0)\n\t\t\t{\n\t\t\tBIO_printf(out,"Certificate will expire\\n");\n\t\t\tret=1;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tBIO_printf(out,"Certificate will not expire\\n");\n\t\t\tret=0;\n\t\t\t}\n\t\tgoto end;\n\t\t}\n\tprint_cert_checks(STDout, x, checkhost, checkemail, checkip);\n\tif (noout)\n\t\t{\n\t\tret=0;\n\t\tgoto end;\n\t\t}\n\tif \t(outformat == FORMAT_ASN1)\n\t\ti=i2d_X509_bio(out,x);\n\telse if (outformat == FORMAT_PEM)\n\t\t{\n\t\tif (trustout) i=PEM_write_bio_X509_AUX(out,x);\n\t\telse i=PEM_write_bio_X509(out,x);\n\t\t}\n\telse if (outformat == FORMAT_NETSCAPE)\n\t\t{\n\t\tNETSCAPE_X509 nx;\n\t\tASN1_OCTET_STRING hdr;\n\t\thdr.data=(unsigned char *)NETSCAPE_CERT_HDR;\n\t\thdr.length=strlen(NETSCAPE_CERT_HDR);\n\t\tnx.header= &hdr;\n\t\tnx.cert=x;\n\t\ti=ASN1_item_i2d_bio(ASN1_ITEM_rptr(NETSCAPE_X509),out,&nx);\n\t\t}\n\telse\t{\n\t\tBIO_printf(bio_err,"bad output format specified for outfile\\n");\n\t\tgoto end;\n\t\t}\n\tif (!i)\n\t\t{\n\t\tBIO_printf(bio_err,"unable to write certificate\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto end;\n\t\t}\n\tret=0;\nend:\n\tif (need_rand)\n\t\tapp_RAND_write_file(NULL, bio_err);\n\tOBJ_cleanup();\n\tNCONF_free(extconf);\n\tBIO_free_all(out);\n\tBIO_free_all(STDout);\n\tX509_STORE_free(ctx);\n\tX509_REQ_free(req);\n\tX509_free(x);\n\tX509_free(xca);\n\tEVP_PKEY_free(Upkey);\n\tEVP_PKEY_free(CApkey);\n\tEVP_PKEY_free(fkey);\n\tif (sigopts)\n\t\tsk_OPENSSL_STRING_free(sigopts);\n\tX509_REQ_free(rq);\n\tASN1_INTEGER_free(sno);\n\tsk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);\n\tsk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);\n\tif (passin) OPENSSL_free(passin);\n\tapps_shutdown();\n\tOPENSSL_EXIT(ret);\n\t}', 'void OBJ_cleanup(void)\n\t{\n\tif (obj_cleanup_defer)\n\t\t{\n\t\tobj_cleanup_defer = 2;\n\t\treturn ;\n\t\t}\n\tif (added == NULL) return;\n\tlh_ADDED_OBJ_down_load(added) = 0;\n\tlh_ADDED_OBJ_doall(added,LHASH_DOALL_FN(cleanup1));\n\tlh_ADDED_OBJ_doall(added,LHASH_DOALL_FN(cleanup2));\n\tlh_ADDED_OBJ_doall(added,LHASH_DOALL_FN(cleanup3));\n\tlh_ADDED_OBJ_free(added);\n\tadded=NULL;\n\t}', 'void NCONF_free(CONF *conf)\n\t{\n\tif (conf == NULL)\n\t\treturn;\n\tconf->meth->destroy(conf);\n\t}', 'void BIO_free_all(BIO *bio)\n\t{\n\tBIO *b;\n\tint ref;\n\twhile (bio != NULL)\n\t\t{\n\t\tb=bio;\n\t\tref=b->references;\n\t\tbio=bio->next_bio;\n\t\tBIO_free(b);\n\t\tif (ref > 1) break;\n\t\t}\n\t}']