How to generate certificates example the easy way

[toby]

Fibonacci said :
No. Why should it if both Now() and LNow return the same type? Now() is already TDateTime, dont cast it to TDateTime, it wont do anything.

then why is it in his code?
LNow := TDateTime(Now());
L10Now := TDateTime(IncYear(Now(), 10));

i am on linux btw

[Fibonacci]

I have no idea Thats not my code. You can shorten it to:

Code: Pascal  [Select][+][-]

1. LNow := Now;
2. L10Now := IncYear(LNow, 10);

[toby]

Fibonacci i assume you are using windows

i get the same with thaddy's original code where there is no direct use of now and now + 10 yeears  so it should default to 30 days

is there a problem in the linux fpopenssl.pp?

[Fibonacci]

May be. Lets wait for someone else to confirm (on Linux), and then perhaps we can report an issue.

EDIT: Actually, I checked it myself. Linux Mint.

Code: Pascal  [Select][+][-]

1.         Version: 1 (0x0)
2.         Serial Number: 10 (0xa)
3.         Signature Algorithm: sha1WithRSAEncryption
4.         Issuer: C = DZ, CN = uc1.uccenos.net, O = uccen
5.         Validity
6.             Not Before: Bad time value
7.             Not After : Bad time value
8.         Subject: C = DZ, CN = uc1.uccenos.net, O = uccen

OpenSSL 3.0.2 15 Mar 2022

[toby]

i'm gonna take a guess that the problem is in this fpopenssl.pp  procedure

Code: Pascal  [Select][+][-]

1. Procedure TOpenSSLX509Certificate.SetTimes(x : PX509);
2. var
3.   Utc : PASN1_UTCTIME;
4. begin
5.   Utc:=Asn1UtctimeNew;
6.   try
7. ASN1UtcTimeSetString(Utc,PAnsiChar(FormatDateTime('YYMMDDHHNNSS',ValidFrom)));
8.     X509SetNotBefore(x, Utc);
9. SN1UtcTimeSetString(Utc,PAnsiChar(FormatDateTime('YYMMDDHHNNSS',ValidTo)));
10.     X509SetNotAfter(x,Utc);
11.   finally
12.     Asn1UtctimeFree(Utc);
13.   end;
14. end;
15.  

[Fibonacci]

Probably. In trunk this proc looks different.

3 months ago this was changed:
https://gitlab.com/freepascal.org/fpc/source/-/commit/fb9bcac2d3c1dd1178b6a7ce090e0345014ad04f

How old is your installation? Cos mine is surely older than 3 months


This is it. Confirmed. Update the unit and it works fine.

[toby]

for sure - 6 months
fpc-3.3.1 9/15/23

[BSaidus]

I've tested the prog using trunk version of fpc. It works well.

Fibonacci said :
No. Why should it if both Now() and LNow return the same type? Now() is already TDateTime, dont cast it to TDateTime, it wont do anything.

then why is it in his code?
LNow := TDateTime(Now());
L10Now := TDateTime(IncYear(Now(), 10));

i am on linux btw

Yes then Now() return TDateTime, I did that just to be sur I do well, but you can do without casting.

It will be better to add property 'SUBJECT' of type string to mimic the openssl subject.
trying to decode the generated certificate it lakes some params & SHA1 is depricated

Certificate Information:
Common Name: uc1.uccenos.net
Subject Alternative Names (SANs): N/A
Organization: uccen
Locality: N/A
State: N/A
Country: DZ
Valid From: 2024-03-17 23:43:24 UTC
Valid To: 2034-03-17 23:43:24 UTC
Issuer: uc1.uccenos.net
Serial Number: 0A
Algorithm: sha1WithRSAEncryption
Key size: 2048

[toby]

BSaidus

yes very nice now with the updated fpopenssl.pp (also needed to update the openssl.pp)-

your adding the
XL509 : TOpenSSLX509Certificate;
class code is a very nice addition/completion to the original posters code.

adding openssl Subject woruld be good

you can 'decode' the cert with
openssl x509 -in x509.txt -text -noout

[Thaddy]

expect newer examples soon. michael authored some neat new code in trunk from saturday. (examples in fcl-hash)

[toby]

BSaidus

to not need incyear (just to reduce needing dateutils in uses clause)

//L10Now := lnow + 3.6520000000000000E+003; // 10 year
L10Now := lnow + 3.6500000000000000E+002; // 1 year


however 'removing' dateutils didn't reduce size of resulting executable - so it must be used in one of the other units
same with classes and openssl