int MAIN(int argc, char **argv)
	{
	ENGINE *e = NULL;
	char *key=NULL,*passargin=NULL;
	int free_key = 0;
	int total=0;
	int total_done=0;
	int badops=0;
	int ret=1;
	int email_dn=1;
	int req=0;
	int verbose=0;
	int gencrl=0;
	int dorevoke=0;
	int doupdatedb=0;
	long crldays=0;
	long crlhours=0;
	long errorline= -1;
	char *configfile=NULL;
	char *md=NULL;
	char *policy=NULL;
	char *keyfile=NULL;
	char *certfile=NULL;
	int keyform=FORMAT_PEM;
	char *infile=NULL;
	char *spkac_file=NULL;
	char *ss_cert_file=NULL;
	char *ser_status=NULL;
	EVP_PKEY *pkey=NULL;
	int output_der = 0;
	char *outfile=NULL;
	char *outdir=NULL;
	char *serialfile=NULL;
	char *extensions=NULL;
	char *extfile=NULL;
	char *subj=NULL;
	char *tmp_email_dn=NULL;
	char *crl_ext=NULL;
	int rev_type = REV_NONE;
	char *rev_arg = NULL;
	BIGNUM *serial=NULL;
	char *startdate=NULL;
	char *enddate=NULL;
	long days=0;
	int batch=0;
	int notext=0;
	unsigned long nameopt = 0, certopt = 0;
	int default_op = 1;
	int ext_copy = EXT_COPY_NONE;
	X509 *x509=NULL;
	X509 *x=NULL;
	BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;
	char *dbfile=NULL;
	TXT_DB *db=NULL;
	X509_CRL *crl=NULL;
	X509_REVOKED *r=NULL;
	ASN1_TIME *tmptm;
	ASN1_INTEGER *tmpser;
	char **pp,*p,*f;
	int i,j;
	long l;
	const EVP_MD *dgst=NULL;
	STACK_OF(CONF_VALUE) *attribs=NULL;
	STACK_OF(X509) *cert_sk=NULL;
#undef BSIZE
#define BSIZE 256
	MS_STATIC char buf[3][BSIZE];
	char *randfile=NULL;
	char *engine = NULL;
#ifdef EFENCE
EF_PROTECT_FREE=1;
EF_PROTECT_BELOW=1;
EF_ALIGNMENT=0;
#endif
	apps_startup();
	conf = NULL;
	key = NULL;
	section = NULL;
	preserve=0;
	msie_hack=0;
	if (bio_err == NULL)
		if ((bio_err=BIO_new(BIO_s_file())) != NULL)
			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);
	argc--;
	argv++;
	while (argc >= 1)
		{
		if	(strcmp(*argv,"-verbose") == 0)
			verbose=1;
		else if	(strcmp(*argv,"-config") == 0)
			{
			if (--argc < 1) goto bad;
			configfile= *(++argv);
			}
		else if (strcmp(*argv,"-name") == 0)
			{
			if (--argc < 1) goto bad;
			section= *(++argv);
			}
		else if (strcmp(*argv,"-subj") == 0)
			{
			if (--argc < 1) goto bad;
			subj= *(++argv);
			}
		else if (strcmp(*argv,"-startdate") == 0)
			{
			if (--argc < 1) goto bad;
			startdate= *(++argv);
			}
		else if (strcmp(*argv,"-enddate") == 0)
			{
			if (--argc < 1) goto bad;
			enddate= *(++argv);
			}
		else if (strcmp(*argv,"-days") == 0)
			{
			if (--argc < 1) goto bad;
			days=atoi(*(++argv));
			}
		else if (strcmp(*argv,"-md") == 0)
			{
			if (--argc < 1) goto bad;
			md= *(++argv);
			}
		else if (strcmp(*argv,"-policy") == 0)
			{
			if (--argc < 1) goto bad;
			policy= *(++argv);
			}
		else if (strcmp(*argv,"-keyfile") == 0)
			{
			if (--argc < 1) goto bad;
			keyfile= *(++argv);
			}
		else if (strcmp(*argv,"-keyform") == 0)
			{
			if (--argc < 1) goto bad;
			keyform=str2fmt(*(++argv));
			}
		else if (strcmp(*argv,"-passin") == 0)
			{
			if (--argc < 1) goto bad;
			passargin= *(++argv);
			}
		else if (strcmp(*argv,"-key") == 0)
			{
			if (--argc < 1) goto bad;
			key= *(++argv);
			}
		else if (strcmp(*argv,"-cert") == 0)
			{
			if (--argc < 1) goto bad;
			certfile= *(++argv);
			}
		else if (strcmp(*argv,"-in") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			req=1;
			}
		else if (strcmp(*argv,"-out") == 0)
			{
			if (--argc < 1) goto bad;
			outfile= *(++argv);
			}
		else if (strcmp(*argv,"-outdir") == 0)
			{
			if (--argc < 1) goto bad;
			outdir= *(++argv);
			}
		else if (strcmp(*argv,"-notext") == 0)
			notext=1;
		else if (strcmp(*argv,"-batch") == 0)
			batch=1;
		else if (strcmp(*argv,"-preserveDN") == 0)
			preserve=1;
		else if (strcmp(*argv,"-noemailDN") == 0)
			email_dn=0;
		else if (strcmp(*argv,"-gencrl") == 0)
			gencrl=1;
		else if (strcmp(*argv,"-msie_hack") == 0)
			msie_hack=1;
		else if (strcmp(*argv,"-crldays") == 0)
			{
			if (--argc < 1) goto bad;
			crldays= atol(*(++argv));
			}
		else if (strcmp(*argv,"-crlhours") == 0)
			{
			if (--argc < 1) goto bad;
			crlhours= atol(*(++argv));
			}
		else if (strcmp(*argv,"-infiles") == 0)
			{
			argc--;
			argv++;
			req=1;
			break;
			}
		else if (strcmp(*argv, "-ss_cert") == 0)
			{
			if (--argc < 1) goto bad;
			ss_cert_file = *(++argv);
			req=1;
			}
		else if (strcmp(*argv, "-spkac") == 0)
			{
			if (--argc < 1) goto bad;
			spkac_file = *(++argv);
			req=1;
			}
		else if (strcmp(*argv,"-revoke") == 0)
			{
			if (--argc < 1) goto bad;
			infile= *(++argv);
			dorevoke=1;
			}
		else if (strcmp(*argv,"-extensions") == 0)
			{
			if (--argc < 1) goto bad;
			extensions= *(++argv);
			}
		else if (strcmp(*argv,"-extfile") == 0)
			{
			if (--argc < 1) goto bad;
			extfile= *(++argv);
			}
		else if (strcmp(*argv,"-status") == 0)
			{
			if (--argc < 1) goto bad;
			ser_status= *(++argv);
			}
		else if (strcmp(*argv,"-updatedb") == 0)
			{
			doupdatedb=1;
			}
		else if (strcmp(*argv,"-crlexts") == 0)
			{
			if (--argc < 1) goto bad;
			crl_ext= *(++argv);
			}
		else if (strcmp(*argv,"-crl_reason") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_CRL_REASON;
			}
		else if (strcmp(*argv,"-crl_hold") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_HOLD;
			}
		else if (strcmp(*argv,"-crl_compromise") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_KEY_COMPROMISE;
			}
		else if (strcmp(*argv,"-crl_CA_compromise") == 0)
			{
			if (--argc < 1) goto bad;
			rev_arg = *(++argv);
			rev_type = REV_CA_COMPROMISE;
			}
		else if (strcmp(*argv,"-engine") == 0)
			{
			if (--argc < 1) goto bad;
			engine= *(++argv);
			}
		else
			{
bad:
			BIO_printf(bio_err,"unknown option %s\n",*argv);
			badops=1;
			break;
			}
		argc--;
		argv++;
		}
	if (badops)
		{
		for (pp=ca_usage; (*pp != NULL); pp++)
			BIO_printf(bio_err,"%s",*pp);
		goto err;
		}
	ERR_load_crypto_strings();
        e = setup_engine(bio_err, engine, 0);
	if (configfile == NULL) configfile = getenv("OPENSSL_CONF");
	if (configfile == NULL) configfile = getenv("SSLEAY_CONF");
	if (configfile == NULL)
		{
#ifdef OPENSSL_SYS_VMS
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-1-sizeof(CONFIG_FILE));
#else
		strncpy(buf[0],X509_get_default_cert_area(),
			sizeof(buf[0])-2-sizeof(CONFIG_FILE));
		buf[0][sizeof(buf[0])-2-sizeof(CONFIG_FILE)]='\0';
		strcat(buf[0],"/");
#endif
		strcat(buf[0],CONFIG_FILE);
		configfile=buf[0];
		}
	BIO_printf(bio_err,"Using configuration from %s\n",configfile);
	conf = NCONF_new(NULL);
	if (NCONF_load(conf,configfile,&errorline) <= 0)
		{
		if (errorline <= 0)
			BIO_printf(bio_err,"error loading the config file '%s'\n",
				configfile);
		else
			BIO_printf(bio_err,"error on line %ld of config file '%s'\n"
				,errorline,configfile);
		goto err;
		}
	if (!load_config(bio_err, conf))
		goto err;
	if (section == NULL)
		{
		section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);
		if (section == NULL)
			{
			lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);
			goto err;
			}
		}
	if (conf != NULL)
		{
		p=NCONF_get_string(conf,NULL,"oid_file");
		if (p == NULL)
			ERR_clear_error();
		if (p != NULL)
			{
			BIO *oid_bio;
			oid_bio=BIO_new_file(p,"r");
			if (oid_bio == NULL)
				{
				ERR_clear_error();
				}
			else
				{
				OBJ_create_objects(oid_bio);
				BIO_free(oid_bio);
				}
			}
		if (!add_oid_section(bio_err,conf))
			{
			ERR_print_errors(bio_err);
			goto err;
			}
		}
	randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");
	if (randfile == NULL)
		ERR_clear_error();
	app_RAND_load_file(randfile, bio_err, 0);
	in=BIO_new(BIO_s_file());
	out=BIO_new(BIO_s_file());
	Sout=BIO_new(BIO_s_file());
	Cout=BIO_new(BIO_s_file());
	if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))
		{
		ERR_print_errors(bio_err);
		goto err;
		}
	if (ser_status)
	{
		if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
			{
			lookup_fail(section,ENV_DATABASE);
			goto err;
			}
		if (BIO_read_filename(in,dbfile) <= 0)
			{
			perror(dbfile);
			BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
			goto err;
			}
		db=TXT_DB_read(in,DB_NUMBER);
		if (db == NULL) goto err;
		if (!make_serial_index(db))
			goto err;
		if (get_certificate_status(ser_status,db) != 1)
			BIO_printf(bio_err,"Error verifying serial %s!\n",
				 ser_status);
		goto err;
	}
	if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,
		section,ENV_PRIVATE_KEY)) == NULL))
		{
		lookup_fail(section,ENV_PRIVATE_KEY);
		goto err;
		}
	if (!key)
		{
		free_key = 1;
		if (!app_passwd(bio_err, passargin, NULL, &key, NULL))
			{
			BIO_printf(bio_err,"Error getting password\n");
			goto err;
			}
		}
	pkey = load_key(bio_err, keyfile, keyform, key, e,
		"CA private key");
	if (key) memset(key,0,strlen(key));
	if (pkey == NULL)
		{
		goto err;
		}
	if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,
		section,ENV_CERTIFICATE)) == NULL))
		{
		lookup_fail(section,ENV_CERTIFICATE);
		goto err;
		}
	x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,
		"CA certificate");
	if (x509 == NULL)
		goto err;
	if (!X509_check_private_key(x509,pkey))
		{
		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");
		goto err;
		}
	f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);
	if (f == NULL)
		ERR_clear_error();
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		preserve=1;
	f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);
	if (f == NULL)
		ERR_clear_error();
	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))
		msie_hack=1;
	f=NCONF_get_string(conf,section,ENV_NAMEOPT);
	if (f)
		{
		if (!set_name_ex(&nameopt, f))
			{
			BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);
			goto err;
			}
		default_op = 0;
		}
	else
		ERR_clear_error();
	f=NCONF_get_string(conf,section,ENV_CERTOPT);
	if (f)
		{
		if (!set_cert_ex(&certopt, f))
			{
			BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);
			goto err;
			}
		default_op = 0;
		}
	else
		ERR_clear_error();
	f=NCONF_get_string(conf,section,ENV_EXTCOPY);
	if (f)
		{
		if (!set_ext_copy(&ext_copy, f))
			{
			BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);
			goto err;
			}
		}
	else
		ERR_clear_error();
	if ((outdir == NULL) && (req))
		{
		struct stat sb;
		if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))
			== NULL)
			{
			BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");
			goto err;
			}
#ifndef OPENSSL_SYS_VMS
		if (access(outdir,R_OK|W_OK|X_OK) != 0)
			{
			BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);
			perror(outdir);
			goto err;
			}
		if (stat(outdir,&sb) != 0)
			{
			BIO_printf(bio_err,"unable to stat(%s)\n",outdir);
			perror(outdir);
			goto err;
			}
#ifdef S_IFDIR
		if (!(sb.st_mode & S_IFDIR))
			{
			BIO_printf(bio_err,"%s need to be a directory\n",outdir);
			perror(outdir);
			goto err;
			}
#endif
#endif
		}
	if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
		{
		lookup_fail(section,ENV_DATABASE);
		goto err;
		}
	if (BIO_read_filename(in,dbfile) <= 0)
		{
		perror(dbfile);
		BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
		goto err;
		}
	db=TXT_DB_read(in,DB_NUMBER);
	if (db == NULL) goto err;
	for (i=0; i<sk_num(db->data); i++)
		{
		pp=(char **)sk_value(db->data,i);
		if ((pp[DB_type][0] != DB_TYPE_REV) &&
			(pp[DB_rev_date][0] != '\0'))
			{
			BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
			goto err;
			}
		if ((pp[DB_type][0] == DB_TYPE_REV) &&
			!make_revoked(NULL, pp[DB_rev_date]))
			{
			BIO_printf(bio_err," in entry %d\n", i+1);
			goto err;
			}
		if (!check_time_format(pp[DB_exp_date]))
			{
			BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);
			goto err;
			}
		p=pp[DB_serial];
		j=strlen(p);
		if (*p == '-')
			{
			p++;
			j--;
			}
		if ((j&1) || (j < 2))
			{
			BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);
			goto err;
			}
		while (*p)
			{
			if (!(	((*p >= '0') && (*p <= '9')) ||
				((*p >= 'A') && (*p <= 'F')) ||
				((*p >= 'a') && (*p <= 'f')))  )
				{
				BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);
				goto err;
				}
			p++;
			}
		}
	if (verbose)
		{
		BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
#ifdef OPENSSL_SYS_VMS
		{
		BIO *tmpbio = BIO_new(BIO_f_linebuffer());
		out = BIO_push(tmpbio, out);
		}
#endif
		TXT_DB_write(out,db);
		BIO_printf(bio_err,"%d entries loaded from the database\n",
			db->data->num);
		BIO_printf(bio_err,"generating index\n");
		}
	if (!make_serial_index(db))
		goto err;
	if (!TXT_DB_create_index(db, DB_name, index_name_qual,
			LHASH_HASH_FN(index_name_hash),
			LHASH_COMP_FN(index_name_cmp)))
		{
		BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",
			db->error,db->arg1,db->arg2);
		goto err;
		}
	if (doupdatedb)
		{
		if (verbose)
			BIO_printf(bio_err, "Updating %s ...\n",
							dbfile);
		i = do_updatedb(db);
		if (i == -1)
			{
			BIO_printf(bio_err,"Malloc failure\n");
			goto err;
			}
		else if (i == 0)
			{
			if (verbose) BIO_printf(bio_err,
					"No entries found to mark expired\n");
			}
	    	else
			{
			out = BIO_new(BIO_s_file());
			if (out == NULL)
				{
				ERR_print_errors(bio_err);
				goto err;
				}
#ifndef OPENSSL_SYS_VMS
			j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);
#else
			j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);
#endif
			if (j < 0 || j >= sizeof buf[0])
				{
				BIO_printf(bio_err, "file name too long\n");
				goto err;
				}
			if (BIO_write_filename(out,buf[0]) <= 0)
		  		{
		    		perror(dbfile);
		    		BIO_printf(bio_err,"unable to open '%s'\n",
									dbfile);
		    		goto err;
		  		}
			j=TXT_DB_write(out,db);
			if (j <= 0) goto err;
			BIO_free(out);
			out = NULL;
#ifndef OPENSSL_SYS_VMS
			j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);
#else
			j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);
#endif
			if (j < 0 || j >= sizeof buf[1])
				{
				BIO_printf(bio_err, "file name too long\n");
				goto err;
				}
			if (rename(dbfile,buf[1]) < 0)
		  		{
		    		BIO_printf(bio_err,
						"unable to rename %s to %s\n",
						dbfile, buf[1]);
		    		perror("reason");
		    		goto err;
		  		}
			if (rename(buf[0],dbfile) < 0)
				{
		    		BIO_printf(bio_err,
						"unable to rename %s to %s\n",
						buf[0],dbfile);
		    		perror("reason");
		    		rename(buf[1],dbfile);
		    		goto err;
		  		}
			if (verbose) BIO_printf(bio_err,
				"Done. %d entries marked as expired\n",i);
	      		}
			goto err;
	  	}
	if (extfile)
		{
		extconf = NCONF_new(NULL);
		if (NCONF_load(extconf,extfile,&errorline) <= 0)
			{
			if (errorline <= 0)
				BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",
					extfile);
			else
				BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",
					errorline,extfile);
			ret = 1;
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);
		if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))
			extensions = "default";
		}
	if (req || gencrl)
		{
		if (outfile != NULL)
			{
			if (BIO_write_filename(Sout,outfile) <= 0)
				{
				perror(outfile);
				goto err;
				}
			}
		else
			{
			BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);
#ifdef OPENSSL_SYS_VMS
			{
			BIO *tmpbio = BIO_new(BIO_f_linebuffer());
			Sout = BIO_push(tmpbio, Sout);
			}
#endif
			}
		}
	if (req)
		{
		if ((md == NULL) && ((md=NCONF_get_string(conf,
			section,ENV_DEFAULT_MD)) == NULL))
			{
			lookup_fail(section,ENV_DEFAULT_MD);
			goto err;
			}
		if ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,
			section,ENV_DEFAULT_EMAIL_DN)) != NULL ))
			{
			if(strcmp(tmp_email_dn,"no") == 0)
				email_dn=0;
			}
		if ((dgst=EVP_get_digestbyname(md)) == NULL)
			{
			BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"message digest is %s\n",
				OBJ_nid2ln(dgst->type));
		if ((policy == NULL) && ((policy=NCONF_get_string(conf,
			section,ENV_POLICY)) == NULL))
			{
			lookup_fail(section,ENV_POLICY);
			goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"policy is %s\n",policy);
		if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))
			== NULL)
			{
			lookup_fail(section,ENV_SERIAL);
			goto err;
			}
		if (!extconf)
			{
			if (!extensions)
				{
				extensions=NCONF_get_string(conf,section,
								ENV_EXTENSIONS);
				if (!extensions)
					ERR_clear_error();
				}
			if (extensions)
				{
				X509V3_CTX ctx;
				X509V3_set_ctx_test(&ctx);
				X509V3_set_nconf(&ctx, conf);
				if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,
								NULL))
					{
					BIO_printf(bio_err,
				 	"Error Loading extension section %s\n",
								 extensions);
					ret = 1;
					goto err;
					}
				}
			}
		if (startdate == NULL)
			{
			startdate=NCONF_get_string(conf,section,
				ENV_DEFAULT_STARTDATE);
			if (startdate == NULL)
				ERR_clear_error();
			}
		if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))
			{
			BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
			}
		if (startdate == NULL) startdate="today";
		if (enddate == NULL)
			{
			enddate=NCONF_get_string(conf,section,
				ENV_DEFAULT_ENDDATE);
			if (enddate == NULL)
				ERR_clear_error();
			}
		if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))
			{
			BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");
			goto err;
			}
		if (days == 0)
			{
			if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))
				days = 0;
			}
		if (!enddate && (days == 0))
			{
			BIO_printf(bio_err,"cannot lookup how many days to certify for\n");
			goto err;
			}
		if ((serial=load_serial(serialfile)) == NULL)
			{
			BIO_printf(bio_err,"error while loading serial number\n");
			goto err;
			}
		if (verbose)
			{
			if ((f=BN_bn2hex(serial)) == NULL) goto err;
			BIO_printf(bio_err,"next serial number is %s\n",f);
			OPENSSL_free(f);
			}
		if ((attribs=NCONF_get_section(conf,policy)) == NULL)
			{
			BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);
			goto err;
			}
		if ((cert_sk=sk_X509_new_null()) == NULL)
			{
			BIO_printf(bio_err,"Memory allocation failure\n");
			goto err;
			}
		if (spkac_file != NULL)
			{
			total++;
			j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,
				serial,subj,email_dn,startdate,enddate,days,extensions,
				conf,verbose,certopt,nameopt,default_op,ext_copy);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_X509_push(cert_sk,x))
					{
					BIO_printf(bio_err,"Memory allocation failure\n");
					goto err;
					}
				if (outfile)
					{
					output_der = 1;
					batch = 1;
					}
				}
			}
		if (ss_cert_file != NULL)
			{
			total++;
			j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,
				db,serial,subj,email_dn,startdate,enddate,days,batch,
				extensions,conf,verbose, certopt, nameopt,
				default_op, ext_copy, e);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_X509_push(cert_sk,x))
					{
					BIO_printf(bio_err,"Memory allocation failure\n");
					goto err;
					}
				}
			}
		if (infile != NULL)
			{
			total++;
			j=certify(&x,infile,pkey,x509,dgst,attribs,db,
				serial,subj,email_dn,startdate,enddate,days,batch,
				extensions,conf,verbose, certopt, nameopt,
				default_op, ext_copy);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_X509_push(cert_sk,x))
					{
					BIO_printf(bio_err,"Memory allocation failure\n");
					goto err;
					}
				}
			}
		for (i=0; i<argc; i++)
			{
			total++;
			j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,
				serial,subj,email_dn,startdate,enddate,days,batch,
				extensions,conf,verbose, certopt, nameopt,
				default_op, ext_copy);
			if (j < 0) goto err;
			if (j > 0)
				{
				total_done++;
				BIO_printf(bio_err,"\n");
				if (!BN_add_word(serial,1)) goto err;
				if (!sk_X509_push(cert_sk,x))
					{
					BIO_printf(bio_err,"Memory allocation failure\n");
					goto err;
					}
				}
			}
		if (sk_X509_num(cert_sk) > 0)
			{
			if (!batch)
				{
				BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);
				(void)BIO_flush(bio_err);
				buf[0][0]='\0';
				fgets(buf[0],10,stdin);
				if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))
					{
					BIO_printf(bio_err,"CERTIFICATION CANCELED\n");
					ret=0;
					goto err;
					}
				}
			BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));
			strncpy(buf[0],serialfile,BSIZE-4);
			buf[0][BSIZE-4]='\0';
#ifdef OPENSSL_SYS_VMS
			strcat(buf[0],"-new");
#else
			strcat(buf[0],".new");
#endif
			if (!save_serial(buf[0],serial)) goto err;
			strncpy(buf[1],dbfile,BSIZE-4);
			buf[1][BSIZE-4]='\0';
#ifdef OPENSSL_SYS_VMS
			strcat(buf[1],"-new");
#else
			strcat(buf[1],".new");
#endif
			if (BIO_write_filename(out,buf[1]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			l=TXT_DB_write(out,db);
			if (l <= 0) goto err;
			}
		if (verbose)
			BIO_printf(bio_err,"writing new certificates\n");
		for (i=0; i<sk_X509_num(cert_sk); i++)
			{
			int k;
			unsigned char *n;
			x=sk_X509_value(cert_sk,i);
			j=x->cert_info->serialNumber->length;
			p=(char *)x->cert_info->serialNumber->data;
			strncpy(buf[2],outdir,BSIZE-(j*2)-6);
			buf[2][BSIZE-(j*2)-6]='\0';
#ifndef OPENSSL_SYS_VMS
			strcat(buf[2],"/");
#endif
			n=(unsigned char *)&(buf[2][strlen(buf[2])]);
			if (j > 0)
				{
				for (k=0; k<j; k++)
					{
					sprintf((char *)n,"%02X",(unsigned char)*(p++));
					n+=2;
					}
				}
			else
				{
				*(n++)='0';
				*(n++)='0';
				}
			*(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';
			*n='\0';
			if (verbose)
				BIO_printf(bio_err,"writing %s\n",buf[2]);
			if (BIO_write_filename(Cout,buf[2]) <= 0)
				{
				perror(buf[2]);
				goto err;
				}
			write_new_certificate(Cout,x, 0, notext);
			write_new_certificate(Sout,x, output_der, notext);
			}
		if (sk_X509_num(cert_sk))
			{
			strncpy(buf[2],serialfile,BSIZE-4);
			buf[2][BSIZE-4]='\0';
#ifdef OPENSSL_SYS_VMS
			strcat(buf[2],"-old");
#else
			strcat(buf[2],".old");
#endif
			BIO_free(in);
			BIO_free_all(out);
			in=NULL;
			out=NULL;
			if (rename(serialfile,buf[2]) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n",
					serialfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],serialfile) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n",
					buf[0],serialfile);
				perror("reason");
				rename(buf[2],serialfile);
				goto err;
				}
			strncpy(buf[2],dbfile,BSIZE-4);
			buf[2][BSIZE-4]='\0';
#ifdef OPENSSL_SYS_VMS
			strcat(buf[2],"-old");
#else
			strcat(buf[2],".old");
#endif
			if (rename(dbfile,buf[2]) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n",
					dbfile,buf[2]);
				perror("reason");
				goto err;
				}
			if (rename(buf[1],dbfile) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n",
					buf[1],dbfile);
				perror("reason");
				rename(buf[2],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n");
			}
		}
	if (gencrl)
		{
		int crl_v2 = 0;
		if (!crl_ext)
			{
			crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);
			if (!crl_ext)
				ERR_clear_error();
			}
		if (crl_ext)
			{
			X509V3_CTX ctx;
			X509V3_set_ctx_test(&ctx);
			X509V3_set_nconf(&ctx, conf);
			if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))
				{
				BIO_printf(bio_err,
				 "Error Loading CRL extension section %s\n",
								 crl_ext);
				ret = 1;
				goto err;
				}
			}
		if (!crldays && !crlhours)
			{
			if (!NCONF_get_number(conf,section,
				ENV_DEFAULT_CRL_DAYS, &crldays))
				crldays = 0;
			if (!NCONF_get_number(conf,section,
				ENV_DEFAULT_CRL_HOURS, &crlhours))
				crlhours = 0;
			}
		if ((crldays == 0) && (crlhours == 0))
			{
			BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");
			goto err;
			}
		if (verbose) BIO_printf(bio_err,"making CRL\n");
		if ((crl=X509_CRL_new()) == NULL) goto err;
		if (!X509_CRL_set_issuer_name(crl, X509_get_issuer_name(x509))) goto err;
		tmptm = ASN1_TIME_new();
		if (!tmptm) goto err;
		X509_gmtime_adj(tmptm,0);
		X509_CRL_set_lastUpdate(crl, tmptm);
		X509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);
		X509_CRL_set_nextUpdate(crl, tmptm);
		ASN1_TIME_free(tmptm);
		for (i=0; i<sk_num(db->data); i++)
			{
			pp=(char **)sk_value(db->data,i);
			if (pp[DB_type][0] == DB_TYPE_REV)
				{
				if ((r=X509_REVOKED_new()) == NULL) goto err;
				j = make_revoked(r, pp[DB_rev_date]);
				if (!j) goto err;
				if (j == 2) crl_v2 = 1;
				if (!BN_hex2bn(&serial, pp[DB_serial]))
					goto err;
				tmpser = BN_to_ASN1_INTEGER(serial, NULL);
				BN_free(serial);
				serial = NULL;
				if (!tmpser)
					goto err;
				X509_REVOKED_set_serialNumber(r, tmpser);
				ASN1_INTEGER_free(tmpser);
				X509_CRL_add0_revoked(crl,r);
				}
			}
		X509_CRL_sort(crl);
		if (verbose) BIO_printf(bio_err,"signing CRL\n");
		if (md != NULL)
			{
			if ((dgst=EVP_get_digestbyname(md)) == NULL)
				{
				BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);
				goto err;
				}
			}
		else
			{
#ifndef OPENSSL_NO_DSA
			if (pkey->type == EVP_PKEY_DSA)
				dgst=EVP_dss1();
			else
#endif
#ifndef OPENSSL_NO_ECDSA
			if (pkey->type == EVP_PKEY_ECDSA)
				dgst=EVP_ecdsa();
			else
#endif
				dgst=EVP_md5();
			}
		if (crl_ext)
			{
			X509V3_CTX crlctx;
			X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);
			X509V3_set_nconf(&crlctx, conf);
			if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,
				crl_ext, crl)) goto err;
			}
		if (crl_ext || crl_v2)
			{
			if (!X509_CRL_set_version(crl, 1))
				goto err;
			}
		if (!X509_CRL_sign(crl,pkey,dgst)) goto err;
		PEM_write_bio_X509_CRL(Sout,crl);
		}
	if (dorevoke)
		{
		if (infile == NULL)
			{
			BIO_printf(bio_err,"no input files\n");
			goto err;
			}
		else
			{
			X509 *revcert;
			revcert=load_cert(bio_err, infile, FORMAT_PEM,
				NULL, e, infile);
			if (revcert == NULL)
				goto err;
			j=do_revoke(revcert,db, rev_type, rev_arg);
			if (j <= 0) goto err;
			X509_free(revcert);
			strncpy(buf[0],dbfile,BSIZE-4);
			buf[0][BSIZE-4]='\0';
#ifndef OPENSSL_SYS_VMS
			strcat(buf[0],".new");
#else
			strcat(buf[0],"-new");
#endif
			if (BIO_write_filename(out,buf[0]) <= 0)
				{
				perror(dbfile);
				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);
				goto err;
				}
			j=TXT_DB_write(out,db);
			if (j <= 0) goto err;
			strncpy(buf[1],dbfile,BSIZE-4);
			buf[1][BSIZE-4]='\0';
#ifndef OPENSSL_SYS_VMS
			strcat(buf[1],".old");
#else
			strcat(buf[1],"-old");
#endif
			if (rename(dbfile,buf[1]) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);
				perror("reason");
				goto err;
				}
			if (rename(buf[0],dbfile) < 0)
				{
				BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);
				perror("reason");
				rename(buf[1],dbfile);
				goto err;
				}
			BIO_printf(bio_err,"Data Base Updated\n");
			}
		}
	ret=0;
err:
	BIO_free_all(Cout);
	BIO_free_all(Sout);
	BIO_free_all(out);
	BIO_free_all(in);
	sk_X509_pop_free(cert_sk,X509_free);
	if (ret) ERR_print_errors(bio_err);
	app_RAND_write_file(randfile, bio_err);
	if (free_key)
		OPENSSL_free(key);
	BN_free(serial);
	TXT_DB_free(db);
	EVP_PKEY_free(pkey);
	X509_free(x509);
	X509_CRL_free(crl);
	NCONF_free(conf);
	OBJ_cleanup();
	apps_shutdown();
	EXIT(ret);
	}
['int MAIN(int argc, char **argv)\n\t{\n\tENGINE *e = NULL;\n\tchar *key=NULL,*passargin=NULL;\n\tint free_key = 0;\n\tint total=0;\n\tint total_done=0;\n\tint badops=0;\n\tint ret=1;\n\tint email_dn=1;\n\tint req=0;\n\tint verbose=0;\n\tint gencrl=0;\n\tint dorevoke=0;\n\tint doupdatedb=0;\n\tlong crldays=0;\n\tlong crlhours=0;\n\tlong errorline= -1;\n\tchar *configfile=NULL;\n\tchar *md=NULL;\n\tchar *policy=NULL;\n\tchar *keyfile=NULL;\n\tchar *certfile=NULL;\n\tint keyform=FORMAT_PEM;\n\tchar *infile=NULL;\n\tchar *spkac_file=NULL;\n\tchar *ss_cert_file=NULL;\n\tchar *ser_status=NULL;\n\tEVP_PKEY *pkey=NULL;\n\tint output_der = 0;\n\tchar *outfile=NULL;\n\tchar *outdir=NULL;\n\tchar *serialfile=NULL;\n\tchar *extensions=NULL;\n\tchar *extfile=NULL;\n\tchar *subj=NULL;\n\tchar *tmp_email_dn=NULL;\n\tchar *crl_ext=NULL;\n\tint rev_type = REV_NONE;\n\tchar *rev_arg = NULL;\n\tBIGNUM *serial=NULL;\n\tchar *startdate=NULL;\n\tchar *enddate=NULL;\n\tlong days=0;\n\tint batch=0;\n\tint notext=0;\n\tunsigned long nameopt = 0, certopt = 0;\n\tint default_op = 1;\n\tint ext_copy = EXT_COPY_NONE;\n\tX509 *x509=NULL;\n\tX509 *x=NULL;\n\tBIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;\n\tchar *dbfile=NULL;\n\tTXT_DB *db=NULL;\n\tX509_CRL *crl=NULL;\n\tX509_REVOKED *r=NULL;\n\tASN1_TIME *tmptm;\n\tASN1_INTEGER *tmpser;\n\tchar **pp,*p,*f;\n\tint i,j;\n\tlong l;\n\tconst EVP_MD *dgst=NULL;\n\tSTACK_OF(CONF_VALUE) *attribs=NULL;\n\tSTACK_OF(X509) *cert_sk=NULL;\n#undef BSIZE\n#define BSIZE 256\n\tMS_STATIC char buf[3][BSIZE];\n\tchar *randfile=NULL;\n\tchar *engine = NULL;\n#ifdef EFENCE\nEF_PROTECT_FREE=1;\nEF_PROTECT_BELOW=1;\nEF_ALIGNMENT=0;\n#endif\n\tapps_startup();\n\tconf = NULL;\n\tkey = NULL;\n\tsection = NULL;\n\tpreserve=0;\n\tmsie_hack=0;\n\tif (bio_err == NULL)\n\t\tif ((bio_err=BIO_new(BIO_s_file())) != NULL)\n\t\t\tBIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);\n\targc--;\n\targv++;\n\twhile (argc >= 1)\n\t\t{\n\t\tif\t(strcmp(*argv,"-verbose") == 0)\n\t\t\tverbose=1;\n\t\telse if\t(strcmp(*argv,"-config") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tconfigfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-name") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tsection= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-subj") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tsubj= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-startdate") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tstartdate= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-enddate") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tenddate= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-days") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tdays=atoi(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-md") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tmd= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-policy") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tpolicy= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-keyfile") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-keyform") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkeyform=str2fmt(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-passin") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tpassargin= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-key") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tkey= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-cert") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcertfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-in") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-out") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-outdir") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\toutdir= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-notext") == 0)\n\t\t\tnotext=1;\n\t\telse if (strcmp(*argv,"-batch") == 0)\n\t\t\tbatch=1;\n\t\telse if (strcmp(*argv,"-preserveDN") == 0)\n\t\t\tpreserve=1;\n\t\telse if (strcmp(*argv,"-noemailDN") == 0)\n\t\t\temail_dn=0;\n\t\telse if (strcmp(*argv,"-gencrl") == 0)\n\t\t\tgencrl=1;\n\t\telse if (strcmp(*argv,"-msie_hack") == 0)\n\t\t\tmsie_hack=1;\n\t\telse if (strcmp(*argv,"-crldays") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrldays= atol(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crlhours") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrlhours= atol(*(++argv));\n\t\t\t}\n\t\telse if (strcmp(*argv,"-infiles") == 0)\n\t\t\t{\n\t\t\targc--;\n\t\t\targv++;\n\t\t\treq=1;\n\t\t\tbreak;\n\t\t\t}\n\t\telse if (strcmp(*argv, "-ss_cert") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tss_cert_file = *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv, "-spkac") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tspkac_file = *(++argv);\n\t\t\treq=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-revoke") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tinfile= *(++argv);\n\t\t\tdorevoke=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-extensions") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\textensions= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-extfile") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\textfile= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-status") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tser_status= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-updatedb") == 0)\n\t\t\t{\n\t\t\tdoupdatedb=1;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crlexts") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tcrl_ext= *(++argv);\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crl_reason") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\trev_arg = *(++argv);\n\t\t\trev_type = REV_CRL_REASON;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crl_hold") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\trev_arg = *(++argv);\n\t\t\trev_type = REV_HOLD;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crl_compromise") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\trev_arg = *(++argv);\n\t\t\trev_type = REV_KEY_COMPROMISE;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-crl_CA_compromise") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\trev_arg = *(++argv);\n\t\t\trev_type = REV_CA_COMPROMISE;\n\t\t\t}\n\t\telse if (strcmp(*argv,"-engine") == 0)\n\t\t\t{\n\t\t\tif (--argc < 1) goto bad;\n\t\t\tengine= *(++argv);\n\t\t\t}\n\t\telse\n\t\t\t{\nbad:\n\t\t\tBIO_printf(bio_err,"unknown option %s\\n",*argv);\n\t\t\tbadops=1;\n\t\t\tbreak;\n\t\t\t}\n\t\targc--;\n\t\targv++;\n\t\t}\n\tif (badops)\n\t\t{\n\t\tfor (pp=ca_usage; (*pp != NULL); pp++)\n\t\t\tBIO_printf(bio_err,"%s",*pp);\n\t\tgoto err;\n\t\t}\n\tERR_load_crypto_strings();\n        e = setup_engine(bio_err, engine, 0);\n\tif (configfile == NULL) configfile = getenv("OPENSSL_CONF");\n\tif (configfile == NULL) configfile = getenv("SSLEAY_CONF");\n\tif (configfile == NULL)\n\t\t{\n#ifdef OPENSSL_SYS_VMS\n\t\tstrncpy(buf[0],X509_get_default_cert_area(),\n\t\t\tsizeof(buf[0])-1-sizeof(CONFIG_FILE));\n#else\n\t\tstrncpy(buf[0],X509_get_default_cert_area(),\n\t\t\tsizeof(buf[0])-2-sizeof(CONFIG_FILE));\n\t\tbuf[0][sizeof(buf[0])-2-sizeof(CONFIG_FILE)]=\'\\0\';\n\t\tstrcat(buf[0],"/");\n#endif\n\t\tstrcat(buf[0],CONFIG_FILE);\n\t\tconfigfile=buf[0];\n\t\t}\n\tBIO_printf(bio_err,"Using configuration from %s\\n",configfile);\n\tconf = NCONF_new(NULL);\n\tif (NCONF_load(conf,configfile,&errorline) <= 0)\n\t\t{\n\t\tif (errorline <= 0)\n\t\t\tBIO_printf(bio_err,"error loading the config file \'%s\'\\n",\n\t\t\t\tconfigfile);\n\t\telse\n\t\t\tBIO_printf(bio_err,"error on line %ld of config file \'%s\'\\n"\n\t\t\t\t,errorline,configfile);\n\t\tgoto err;\n\t\t}\n\tif (!load_config(bio_err, conf))\n\t\tgoto err;\n\tif (section == NULL)\n\t\t{\n\t\tsection=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);\n\t\tif (section == NULL)\n\t\t\t{\n\t\t\tlookup_fail(BASE_SECTION,ENV_DEFAULT_CA);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tif (conf != NULL)\n\t\t{\n\t\tp=NCONF_get_string(conf,NULL,"oid_file");\n\t\tif (p == NULL)\n\t\t\tERR_clear_error();\n\t\tif (p != NULL)\n\t\t\t{\n\t\t\tBIO *oid_bio;\n\t\t\toid_bio=BIO_new_file(p,"r");\n\t\t\tif (oid_bio == NULL)\n\t\t\t\t{\n\t\t\t\tERR_clear_error();\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tOBJ_create_objects(oid_bio);\n\t\t\t\tBIO_free(oid_bio);\n\t\t\t\t}\n\t\t\t}\n\t\tif (!add_oid_section(bio_err,conf))\n\t\t\t{\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\trandfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");\n\tif (randfile == NULL)\n\t\tERR_clear_error();\n\tapp_RAND_load_file(randfile, bio_err, 0);\n\tin=BIO_new(BIO_s_file());\n\tout=BIO_new(BIO_s_file());\n\tSout=BIO_new(BIO_s_file());\n\tCout=BIO_new(BIO_s_file());\n\tif ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))\n\t\t{\n\t\tERR_print_errors(bio_err);\n\t\tgoto err;\n\t\t}\n\tif (ser_status)\n\t{\n\t\tif ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_DATABASE);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (BIO_read_filename(in,dbfile) <= 0)\n\t\t\t{\n\t\t\tperror(dbfile);\n\t\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\t\tgoto err;\n\t\t\t}\n\t\tdb=TXT_DB_read(in,DB_NUMBER);\n\t\tif (db == NULL) goto err;\n\t\tif (!make_serial_index(db))\n\t\t\tgoto err;\n\t\tif (get_certificate_status(ser_status,db) != 1)\n\t\t\tBIO_printf(bio_err,"Error verifying serial %s!\\n",\n\t\t\t\t ser_status);\n\t\tgoto err;\n\t}\n\tif ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,\n\t\tsection,ENV_PRIVATE_KEY)) == NULL))\n\t\t{\n\t\tlookup_fail(section,ENV_PRIVATE_KEY);\n\t\tgoto err;\n\t\t}\n\tif (!key)\n\t\t{\n\t\tfree_key = 1;\n\t\tif (!app_passwd(bio_err, passargin, NULL, &key, NULL))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Error getting password\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\tpkey = load_key(bio_err, keyfile, keyform, key, e,\n\t\t"CA private key");\n\tif (key) memset(key,0,strlen(key));\n\tif (pkey == NULL)\n\t\t{\n\t\tgoto err;\n\t\t}\n\tif ((certfile == NULL) && ((certfile=NCONF_get_string(conf,\n\t\tsection,ENV_CERTIFICATE)) == NULL))\n\t\t{\n\t\tlookup_fail(section,ENV_CERTIFICATE);\n\t\tgoto err;\n\t\t}\n\tx509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,\n\t\t"CA certificate");\n\tif (x509 == NULL)\n\t\tgoto err;\n\tif (!X509_check_private_key(x509,pkey))\n\t\t{\n\t\tBIO_printf(bio_err,"CA certificate and CA private key do not match\\n");\n\t\tgoto err;\n\t\t}\n\tf=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);\n\tif (f == NULL)\n\t\tERR_clear_error();\n\tif ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n\t\tpreserve=1;\n\tf=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);\n\tif (f == NULL)\n\t\tERR_clear_error();\n\tif ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n\t\tmsie_hack=1;\n\tf=NCONF_get_string(conf,section,ENV_NAMEOPT);\n\tif (f)\n\t\t{\n\t\tif (!set_name_ex(&nameopt, f))\n\t\t\t{\n\t\t\tBIO_printf(bio_err, "Invalid name options: \\"%s\\"\\n", f);\n\t\t\tgoto err;\n\t\t\t}\n\t\tdefault_op = 0;\n\t\t}\n\telse\n\t\tERR_clear_error();\n\tf=NCONF_get_string(conf,section,ENV_CERTOPT);\n\tif (f)\n\t\t{\n\t\tif (!set_cert_ex(&certopt, f))\n\t\t\t{\n\t\t\tBIO_printf(bio_err, "Invalid certificate options: \\"%s\\"\\n", f);\n\t\t\tgoto err;\n\t\t\t}\n\t\tdefault_op = 0;\n\t\t}\n\telse\n\t\tERR_clear_error();\n\tf=NCONF_get_string(conf,section,ENV_EXTCOPY);\n\tif (f)\n\t\t{\n\t\tif (!set_ext_copy(&ext_copy, f))\n\t\t\t{\n\t\t\tBIO_printf(bio_err, "Invalid extension copy option: \\"%s\\"\\n", f);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\telse\n\t\tERR_clear_error();\n\tif ((outdir == NULL) && (req))\n\t\t{\n\t\tstruct stat sb;\n\t\tif ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))\n\t\t\t== NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\\n");\n\t\t\tgoto err;\n\t\t\t}\n#ifndef OPENSSL_SYS_VMS\n\t\tif (access(outdir,R_OK|W_OK|X_OK) != 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"I am unable to access the %s directory\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (stat(outdir,&sb) != 0)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unable to stat(%s)\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n#ifdef S_IFDIR\n\t\tif (!(sb.st_mode & S_IFDIR))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"%s need to be a directory\\n",outdir);\n\t\t\tperror(outdir);\n\t\t\tgoto err;\n\t\t\t}\n#endif\n#endif\n\t\t}\n\tif ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)\n\t\t{\n\t\tlookup_fail(section,ENV_DATABASE);\n\t\tgoto err;\n\t\t}\n\tif (BIO_read_filename(in,dbfile) <= 0)\n\t\t{\n\t\tperror(dbfile);\n\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\tgoto err;\n\t\t}\n\tdb=TXT_DB_read(in,DB_NUMBER);\n\tif (db == NULL) goto err;\n\tfor (i=0; i<sk_num(db->data); i++)\n\t\t{\n\t\tpp=(char **)sk_value(db->data,i);\n\t\tif ((pp[DB_type][0] != DB_TYPE_REV) &&\n\t\t\t(pp[DB_rev_date][0] != \'\\0\'))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\\n",i+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((pp[DB_type][0] == DB_TYPE_REV) &&\n\t\t\t!make_revoked(NULL, pp[DB_rev_date]))\n\t\t\t{\n\t\t\tBIO_printf(bio_err," in entry %d\\n", i+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!check_time_format(pp[DB_exp_date]))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: invalid expiry date\\n",i+1);\n\t\t\tgoto err;\n\t\t\t}\n\t\tp=pp[DB_serial];\n\t\tj=strlen(p);\n\t\tif (*p == \'-\')\n\t\t\t{\n\t\t\tp++;\n\t\t\tj--;\n\t\t\t}\n\t\tif ((j&1) || (j < 2))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"entry %d: bad serial number length (%d)\\n",i+1,j);\n\t\t\tgoto err;\n\t\t\t}\n\t\twhile (*p)\n\t\t\t{\n\t\t\tif (!(\t((*p >= \'0\') && (*p <= \'9\')) ||\n\t\t\t\t((*p >= \'A\') && (*p <= \'F\')) ||\n\t\t\t\t((*p >= \'a\') && (*p <= \'f\')))  )\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is \'%c\'\\n",i+1,(long)(p-pp[DB_serial]),*p);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tp++;\n\t\t\t}\n\t\t}\n\tif (verbose)\n\t\t{\n\t\tBIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT);\n#ifdef OPENSSL_SYS_VMS\n\t\t{\n\t\tBIO *tmpbio = BIO_new(BIO_f_linebuffer());\n\t\tout = BIO_push(tmpbio, out);\n\t\t}\n#endif\n\t\tTXT_DB_write(out,db);\n\t\tBIO_printf(bio_err,"%d entries loaded from the database\\n",\n\t\t\tdb->data->num);\n\t\tBIO_printf(bio_err,"generating index\\n");\n\t\t}\n\tif (!make_serial_index(db))\n\t\tgoto err;\n\tif (!TXT_DB_create_index(db, DB_name, index_name_qual,\n\t\t\tLHASH_HASH_FN(index_name_hash),\n\t\t\tLHASH_COMP_FN(index_name_cmp)))\n\t\t{\n\t\tBIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\\n",\n\t\t\tdb->error,db->arg1,db->arg2);\n\t\tgoto err;\n\t\t}\n\tif (doupdatedb)\n\t\t{\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err, "Updating %s ...\\n",\n\t\t\t\t\t\t\tdbfile);\n\t\ti = do_updatedb(db);\n\t\tif (i == -1)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Malloc failure\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\telse if (i == 0)\n\t\t\t{\n\t\t\tif (verbose) BIO_printf(bio_err,\n\t\t\t\t\t"No entries found to mark expired\\n");\n\t\t\t}\n\t    \telse\n\t\t\t{\n\t\t\tout = BIO_new(BIO_s_file());\n\t\t\tif (out == NULL)\n\t\t\t\t{\n\t\t\t\tERR_print_errors(bio_err);\n\t\t\t\tgoto err;\n\t\t\t\t}\n#ifndef OPENSSL_SYS_VMS\n\t\t\tj = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);\n#else\n\t\t\tj = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);\n#endif\n\t\t\tif (j < 0 || j >= sizeof buf[0])\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "file name too long\\n");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (BIO_write_filename(out,buf[0]) <= 0)\n\t\t  \t\t{\n\t\t    \t\tperror(dbfile);\n\t\t    \t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",\n\t\t\t\t\t\t\t\t\tdbfile);\n\t\t    \t\tgoto err;\n\t\t  \t\t}\n\t\t\tj=TXT_DB_write(out,db);\n\t\t\tif (j <= 0) goto err;\n\t\t\tBIO_free(out);\n\t\t\tout = NULL;\n#ifndef OPENSSL_SYS_VMS\n\t\t\tj = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);\n#else\n\t\t\tj = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);\n#endif\n\t\t\tif (j < 0 || j >= sizeof buf[1])\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err, "file name too long\\n");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(dbfile,buf[1]) < 0)\n\t\t  \t\t{\n\t\t    \t\tBIO_printf(bio_err,\n\t\t\t\t\t\t"unable to rename %s to %s\\n",\n\t\t\t\t\t\tdbfile, buf[1]);\n\t\t    \t\tperror("reason");\n\t\t    \t\tgoto err;\n\t\t  \t\t}\n\t\t\tif (rename(buf[0],dbfile) < 0)\n\t\t\t\t{\n\t\t    \t\tBIO_printf(bio_err,\n\t\t\t\t\t\t"unable to rename %s to %s\\n",\n\t\t\t\t\t\tbuf[0],dbfile);\n\t\t    \t\tperror("reason");\n\t\t    \t\trename(buf[1],dbfile);\n\t\t    \t\tgoto err;\n\t\t  \t\t}\n\t\t\tif (verbose) BIO_printf(bio_err,\n\t\t\t\t"Done. %d entries marked as expired\\n",i);\n\t      \t\t}\n\t\t\tgoto err;\n\t  \t}\n\tif (extfile)\n\t\t{\n\t\textconf = NCONF_new(NULL);\n\t\tif (NCONF_load(extconf,extfile,&errorline) <= 0)\n\t\t\t{\n\t\t\tif (errorline <= 0)\n\t\t\t\tBIO_printf(bio_err, "ERROR: loading the config file \'%s\'\\n",\n\t\t\t\t\textfile);\n\t\t\telse\n\t\t\t\tBIO_printf(bio_err, "ERROR: on line %ld of config file \'%s\'\\n",\n\t\t\t\t\terrorline,extfile);\n\t\t\tret = 1;\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err, "Succesfully loaded extensions file %s\\n", extfile);\n\t\tif (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))\n\t\t\textensions = "default";\n\t\t}\n\tif (req || gencrl)\n\t\t{\n\t\tif (outfile != NULL)\n\t\t\t{\n\t\t\tif (BIO_write_filename(Sout,outfile) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(outfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tBIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);\n#ifdef OPENSSL_SYS_VMS\n\t\t\t{\n\t\t\tBIO *tmpbio = BIO_new(BIO_f_linebuffer());\n\t\t\tSout = BIO_push(tmpbio, Sout);\n\t\t\t}\n#endif\n\t\t\t}\n\t\t}\n\tif (req)\n\t\t{\n\t\tif ((md == NULL) && ((md=NCONF_get_string(conf,\n\t\t\tsection,ENV_DEFAULT_MD)) == NULL))\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_DEFAULT_MD);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((email_dn == 1) && ((tmp_email_dn=NCONF_get_string(conf,\n\t\t\tsection,ENV_DEFAULT_EMAIL_DN)) != NULL ))\n\t\t\t{\n\t\t\tif(strcmp(tmp_email_dn,"no") == 0)\n\t\t\t\temail_dn=0;\n\t\t\t}\n\t\tif ((dgst=EVP_get_digestbyname(md)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"%s is an unsupported message digest type\\n",md);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"message digest is %s\\n",\n\t\t\t\tOBJ_nid2ln(dgst->type));\n\t\tif ((policy == NULL) && ((policy=NCONF_get_string(conf,\n\t\t\tsection,ENV_POLICY)) == NULL))\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_POLICY);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"policy is %s\\n",policy);\n\t\tif ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))\n\t\t\t== NULL)\n\t\t\t{\n\t\t\tlookup_fail(section,ENV_SERIAL);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (!extconf)\n\t\t\t{\n\t\t\tif (!extensions)\n\t\t\t\t{\n\t\t\t\textensions=NCONF_get_string(conf,section,\n\t\t\t\t\t\t\t\tENV_EXTENSIONS);\n\t\t\t\tif (!extensions)\n\t\t\t\t\tERR_clear_error();\n\t\t\t\t}\n\t\t\tif (extensions)\n\t\t\t\t{\n\t\t\t\tX509V3_CTX ctx;\n\t\t\t\tX509V3_set_ctx_test(&ctx);\n\t\t\t\tX509V3_set_nconf(&ctx, conf);\n\t\t\t\tif (!X509V3_EXT_add_nconf(conf, &ctx, extensions,\n\t\t\t\t\t\t\t\tNULL))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t \t"Error Loading extension section %s\\n",\n\t\t\t\t\t\t\t\t extensions);\n\t\t\t\t\tret = 1;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (startdate == NULL)\n\t\t\t{\n\t\t\tstartdate=NCONF_get_string(conf,section,\n\t\t\t\tENV_DEFAULT_STARTDATE);\n\t\t\tif (startdate == NULL)\n\t\t\t\tERR_clear_error();\n\t\t\t}\n\t\tif (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (startdate == NULL) startdate="today";\n\t\tif (enddate == NULL)\n\t\t\t{\n\t\t\tenddate=NCONF_get_string(conf,section,\n\t\t\t\tENV_DEFAULT_ENDDATE);\n\t\t\tif (enddate == NULL)\n\t\t\t\tERR_clear_error();\n\t\t\t}\n\t\tif (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (days == 0)\n\t\t\t{\n\t\t\tif(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))\n\t\t\t\tdays = 0;\n\t\t\t}\n\t\tif (!enddate && (days == 0))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"cannot lookup how many days to certify for\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((serial=load_serial(serialfile)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"error while loading serial number\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\t{\n\t\t\tif ((f=BN_bn2hex(serial)) == NULL) goto err;\n\t\t\tBIO_printf(bio_err,"next serial number is %s\\n",f);\n\t\t\tOPENSSL_free(f);\n\t\t\t}\n\t\tif ((attribs=NCONF_get_section(conf,policy)) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"unable to find \'section\' for %s\\n",policy);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ((cert_sk=sk_X509_new_null()) == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"Memory allocation failure\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (spkac_file != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,subj,email_dn,startdate,enddate,days,extensions,\n\t\t\t\tconf,verbose,certopt,nameopt,default_op,ext_copy);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_X509_push(cert_sk,x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Memory allocation failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tif (outfile)\n\t\t\t\t\t{\n\t\t\t\t\toutput_der = 1;\n\t\t\t\t\tbatch = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (ss_cert_file != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,\n\t\t\t\tdb,serial,subj,email_dn,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose, certopt, nameopt,\n\t\t\t\tdefault_op, ext_copy, e);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_X509_push(cert_sk,x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Memory allocation failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (infile != NULL)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify(&x,infile,pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,subj,email_dn,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose, certopt, nameopt,\n\t\t\t\tdefault_op, ext_copy);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_X509_push(cert_sk,x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Memory allocation failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tfor (i=0; i<argc; i++)\n\t\t\t{\n\t\t\ttotal++;\n\t\t\tj=certify(&x,argv[i],pkey,x509,dgst,attribs,db,\n\t\t\t\tserial,subj,email_dn,startdate,enddate,days,batch,\n\t\t\t\textensions,conf,verbose, certopt, nameopt,\n\t\t\t\tdefault_op, ext_copy);\n\t\t\tif (j < 0) goto err;\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\ttotal_done++;\n\t\t\t\tBIO_printf(bio_err,"\\n");\n\t\t\t\tif (!BN_add_word(serial,1)) goto err;\n\t\t\t\tif (!sk_X509_push(cert_sk,x))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"Memory allocation failure\\n");\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\tif (sk_X509_num(cert_sk) > 0)\n\t\t\t{\n\t\t\tif (!batch)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"\\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);\n\t\t\t\t(void)BIO_flush(bio_err);\n\t\t\t\tbuf[0][0]=\'\\0\';\n\t\t\t\tfgets(buf[0],10,stdin);\n\t\t\t\tif ((buf[0][0] != \'y\') && (buf[0][0] != \'Y\'))\n\t\t\t\t\t{\n\t\t\t\t\tBIO_printf(bio_err,"CERTIFICATION CANCELED\\n");\n\t\t\t\t\tret=0;\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Write out database with %d new entries\\n",sk_X509_num(cert_sk));\n\t\t\tstrncpy(buf[0],serialfile,BSIZE-4);\n\t\t\tbuf[0][BSIZE-4]=\'\\0\';\n#ifdef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[0],"-new");\n#else\n\t\t\tstrcat(buf[0],".new");\n#endif\n\t\t\tif (!save_serial(buf[0],serial)) goto err;\n\t\t\tstrncpy(buf[1],dbfile,BSIZE-4);\n\t\t\tbuf[1][BSIZE-4]=\'\\0\';\n#ifdef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[1],"-new");\n#else\n\t\t\tstrcat(buf[1],".new");\n#endif\n\t\t\tif (BIO_write_filename(out,buf[1]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(dbfile);\n\t\t\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tl=TXT_DB_write(out,db);\n\t\t\tif (l <= 0) goto err;\n\t\t\t}\n\t\tif (verbose)\n\t\t\tBIO_printf(bio_err,"writing new certificates\\n");\n\t\tfor (i=0; i<sk_X509_num(cert_sk); i++)\n\t\t\t{\n\t\t\tint k;\n\t\t\tunsigned char *n;\n\t\t\tx=sk_X509_value(cert_sk,i);\n\t\t\tj=x->cert_info->serialNumber->length;\n\t\t\tp=(char *)x->cert_info->serialNumber->data;\n\t\t\tstrncpy(buf[2],outdir,BSIZE-(j*2)-6);\n\t\t\tbuf[2][BSIZE-(j*2)-6]=\'\\0\';\n#ifndef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[2],"/");\n#endif\n\t\t\tn=(unsigned char *)&(buf[2][strlen(buf[2])]);\n\t\t\tif (j > 0)\n\t\t\t\t{\n\t\t\t\tfor (k=0; k<j; k++)\n\t\t\t\t\t{\n\t\t\t\t\tsprintf((char *)n,"%02X",(unsigned char)*(p++));\n\t\t\t\t\tn+=2;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\t*(n++)=\'0\';\n\t\t\t\t*(n++)=\'0\';\n\t\t\t\t}\n\t\t\t*(n++)=\'.\'; *(n++)=\'p\'; *(n++)=\'e\'; *(n++)=\'m\';\n\t\t\t*n=\'\\0\';\n\t\t\tif (verbose)\n\t\t\t\tBIO_printf(bio_err,"writing %s\\n",buf[2]);\n\t\t\tif (BIO_write_filename(Cout,buf[2]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(buf[2]);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\twrite_new_certificate(Cout,x, 0, notext);\n\t\t\twrite_new_certificate(Sout,x, output_der, notext);\n\t\t\t}\n\t\tif (sk_X509_num(cert_sk))\n\t\t\t{\n\t\t\tstrncpy(buf[2],serialfile,BSIZE-4);\n\t\t\tbuf[2][BSIZE-4]=\'\\0\';\n#ifdef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[2],"-old");\n#else\n\t\t\tstrcat(buf[2],".old");\n#endif\n\t\t\tBIO_free(in);\n\t\t\tBIO_free_all(out);\n\t\t\tin=NULL;\n\t\t\tout=NULL;\n\t\t\tif (rename(serialfile,buf[2]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n",\n\t\t\t\t\tserialfile,buf[2]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[0],serialfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n",\n\t\t\t\t\tbuf[0],serialfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[2],serialfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrncpy(buf[2],dbfile,BSIZE-4);\n\t\t\tbuf[2][BSIZE-4]=\'\\0\';\n#ifdef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[2],"-old");\n#else\n\t\t\tstrcat(buf[2],".old");\n#endif\n\t\t\tif (rename(dbfile,buf[2]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n",\n\t\t\t\t\tdbfile,buf[2]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[1],dbfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n",\n\t\t\t\t\tbuf[1],dbfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[2],dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Data Base Updated\\n");\n\t\t\t}\n\t\t}\n\tif (gencrl)\n\t\t{\n\t\tint crl_v2 = 0;\n\t\tif (!crl_ext)\n\t\t\t{\n\t\t\tcrl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);\n\t\t\tif (!crl_ext)\n\t\t\t\tERR_clear_error();\n\t\t\t}\n\t\tif (crl_ext)\n\t\t\t{\n\t\t\tX509V3_CTX ctx;\n\t\t\tX509V3_set_ctx_test(&ctx);\n\t\t\tX509V3_set_nconf(&ctx, conf);\n\t\t\tif (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t "Error Loading CRL extension section %s\\n",\n\t\t\t\t\t\t\t\t crl_ext);\n\t\t\t\tret = 1;\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\tif (!crldays && !crlhours)\n\t\t\t{\n\t\t\tif (!NCONF_get_number(conf,section,\n\t\t\t\tENV_DEFAULT_CRL_DAYS, &crldays))\n\t\t\t\tcrldays = 0;\n\t\t\tif (!NCONF_get_number(conf,section,\n\t\t\t\tENV_DEFAULT_CRL_HOURS, &crlhours))\n\t\t\t\tcrlhours = 0;\n\t\t\t}\n\t\tif ((crldays == 0) && (crlhours == 0))\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\tif (verbose) BIO_printf(bio_err,"making CRL\\n");\n\t\tif ((crl=X509_CRL_new()) == NULL) goto err;\n\t\tif (!X509_CRL_set_issuer_name(crl, X509_get_issuer_name(x509))) goto err;\n\t\ttmptm = ASN1_TIME_new();\n\t\tif (!tmptm) goto err;\n\t\tX509_gmtime_adj(tmptm,0);\n\t\tX509_CRL_set_lastUpdate(crl, tmptm);\n\t\tX509_gmtime_adj(tmptm,(crldays*24+crlhours)*60*60);\n\t\tX509_CRL_set_nextUpdate(crl, tmptm);\n\t\tASN1_TIME_free(tmptm);\n\t\tfor (i=0; i<sk_num(db->data); i++)\n\t\t\t{\n\t\t\tpp=(char **)sk_value(db->data,i);\n\t\t\tif (pp[DB_type][0] == DB_TYPE_REV)\n\t\t\t\t{\n\t\t\t\tif ((r=X509_REVOKED_new()) == NULL) goto err;\n\t\t\t\tj = make_revoked(r, pp[DB_rev_date]);\n\t\t\t\tif (!j) goto err;\n\t\t\t\tif (j == 2) crl_v2 = 1;\n\t\t\t\tif (!BN_hex2bn(&serial, pp[DB_serial]))\n\t\t\t\t\tgoto err;\n\t\t\t\ttmpser = BN_to_ASN1_INTEGER(serial, NULL);\n\t\t\t\tBN_free(serial);\n\t\t\t\tserial = NULL;\n\t\t\t\tif (!tmpser)\n\t\t\t\t\tgoto err;\n\t\t\t\tX509_REVOKED_set_serialNumber(r, tmpser);\n\t\t\t\tASN1_INTEGER_free(tmpser);\n\t\t\t\tX509_CRL_add0_revoked(crl,r);\n\t\t\t\t}\n\t\t\t}\n\t\tX509_CRL_sort(crl);\n\t\tif (verbose) BIO_printf(bio_err,"signing CRL\\n");\n\t\tif (md != NULL)\n\t\t\t{\n\t\t\tif ((dgst=EVP_get_digestbyname(md)) == NULL)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"%s is an unsupported message digest type\\n",md);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\t{\n#ifndef OPENSSL_NO_DSA\n\t\t\tif (pkey->type == EVP_PKEY_DSA)\n\t\t\t\tdgst=EVP_dss1();\n\t\t\telse\n#endif\n#ifndef OPENSSL_NO_ECDSA\n\t\t\tif (pkey->type == EVP_PKEY_ECDSA)\n\t\t\t\tdgst=EVP_ecdsa();\n\t\t\telse\n#endif\n\t\t\t\tdgst=EVP_md5();\n\t\t\t}\n\t\tif (crl_ext)\n\t\t\t{\n\t\t\tX509V3_CTX crlctx;\n\t\t\tX509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);\n\t\t\tX509V3_set_nconf(&crlctx, conf);\n\t\t\tif (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,\n\t\t\t\tcrl_ext, crl)) goto err;\n\t\t\t}\n\t\tif (crl_ext || crl_v2)\n\t\t\t{\n\t\t\tif (!X509_CRL_set_version(crl, 1))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tif (!X509_CRL_sign(crl,pkey,dgst)) goto err;\n\t\tPEM_write_bio_X509_CRL(Sout,crl);\n\t\t}\n\tif (dorevoke)\n\t\t{\n\t\tif (infile == NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"no input files\\n");\n\t\t\tgoto err;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tX509 *revcert;\n\t\t\trevcert=load_cert(bio_err, infile, FORMAT_PEM,\n\t\t\t\tNULL, e, infile);\n\t\t\tif (revcert == NULL)\n\t\t\t\tgoto err;\n\t\t\tj=do_revoke(revcert,db, rev_type, rev_arg);\n\t\t\tif (j <= 0) goto err;\n\t\t\tX509_free(revcert);\n\t\t\tstrncpy(buf[0],dbfile,BSIZE-4);\n\t\t\tbuf[0][BSIZE-4]=\'\\0\';\n#ifndef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[0],".new");\n#else\n\t\t\tstrcat(buf[0],"-new");\n#endif\n\t\t\tif (BIO_write_filename(out,buf[0]) <= 0)\n\t\t\t\t{\n\t\t\t\tperror(dbfile);\n\t\t\t\tBIO_printf(bio_err,"unable to open \'%s\'\\n",dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tj=TXT_DB_write(out,db);\n\t\t\tif (j <= 0) goto err;\n\t\t\tstrncpy(buf[1],dbfile,BSIZE-4);\n\t\t\tbuf[1][BSIZE-4]=\'\\0\';\n#ifndef OPENSSL_SYS_VMS\n\t\t\tstrcat(buf[1],".old");\n#else\n\t\t\tstrcat(buf[1],"-old");\n#endif\n\t\t\tif (rename(dbfile,buf[1]) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n", dbfile, buf[1]);\n\t\t\t\tperror("reason");\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (rename(buf[0],dbfile) < 0)\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_err,"unable to rename %s to %s\\n", buf[0],dbfile);\n\t\t\t\tperror("reason");\n\t\t\t\trename(buf[1],dbfile);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tBIO_printf(bio_err,"Data Base Updated\\n");\n\t\t\t}\n\t\t}\n\tret=0;\nerr:\n\tBIO_free_all(Cout);\n\tBIO_free_all(Sout);\n\tBIO_free_all(out);\n\tBIO_free_all(in);\n\tsk_X509_pop_free(cert_sk,X509_free);\n\tif (ret) ERR_print_errors(bio_err);\n\tapp_RAND_write_file(randfile, bio_err);\n\tif (free_key)\n\t\tOPENSSL_free(key);\n\tBN_free(serial);\n\tTXT_DB_free(db);\n\tEVP_PKEY_free(pkey);\n\tX509_free(x509);\n\tX509_CRL_free(crl);\n\tNCONF_free(conf);\n\tOBJ_cleanup();\n\tapps_shutdown();\n\tEXIT(ret);\n\t}', 'const char *X509_get_default_cert_area(void)\n\t{ return(X509_CERT_AREA); }']