r->serialNumber = BN_to_ASN1_INTEGER(serial, r->serialNumber);
tmpser = BN_to_ASN1_INTEGER(serial, NULL);
static IMPLEMENT_LHASH_HASH_FN(index_serial_hash,const char **)static IMPLEMENT_LHASH_COMP_FN(index_serial_cmp,const char **)static IMPLEMENT_LHASH_HASH_FN(index_name_hash,const char **)static IMPLEMENT_LHASH_COMP_FN(index_name_cmp,const char **)int MAIN(int, char **);int MAIN(int argc, char **argv)	{	ENGINE *e = NULL;	char *key=NULL,*passargin=NULL;	int total=0;	int total_done=0;	int badops=0;	int ret=1;	int req=0;	int verbose=0;	int gencrl=0;	int dorevoke=0;	int doupdatedb=0;	long crldays=0;	long crlhours=0;	long errorline= -1;	char *configfile=NULL;	char *md=NULL;	char *policy=NULL;	char *keyfile=NULL;	char *certfile=NULL;	int keyform=FORMAT_PEM;	char *infile=NULL;	char *spkac_file=NULL;	char *ss_cert_file=NULL;	char *ser_status=NULL;	EVP_PKEY *pkey=NULL;	int output_der = 0;	char *outfile=NULL;	char *outdir=NULL;	char *serialfile=NULL;	char *extensions=NULL;	char *extfile=NULL;	char *subj=NULL;	char *crl_ext=NULL;	int rev_type = REV_NONE;	char *rev_arg = NULL;	BIGNUM *serial=NULL;	char *startdate=NULL;	char *enddate=NULL;	long days=0;	int batch=0;	int notext=0;	unsigned long nameopt = 0, certopt = 0;	int default_op = 1;	int ext_copy = EXT_COPY_NONE;	X509 *x509=NULL;	X509 *x=NULL;	BIO *in=NULL,*out=NULL,*Sout=NULL,*Cout=NULL;	char *dbfile=NULL;	TXT_DB *db=NULL;	X509_CRL *crl=NULL;	X509_CRL_INFO *ci=NULL;	X509_REVOKED *r=NULL;	char **pp,*p,*f;	int i,j;	long l;	const EVP_MD *dgst=NULL;	STACK_OF(CONF_VALUE) *attribs=NULL;	STACK_OF(X509) *cert_sk=NULL;#undef BSIZE#define BSIZE 256	MS_STATIC char buf[3][BSIZE];	char *randfile=NULL;	char *engine = NULL;#ifdef EFENCEEF_PROTECT_FREE=1;EF_PROTECT_BELOW=1;EF_ALIGNMENT=0;#endif	apps_startup();	conf = NULL;	key = NULL;	section = NULL;	preserve=0;	msie_hack=0;	if (bio_err == NULL)		if ((bio_err=BIO_new(BIO_s_file())) != NULL)			BIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);	argc--;	argv++;	while (argc >= 1)		{		if	(strcmp(*argv,"-verbose") == 0)			verbose=1;		else if	(strcmp(*argv,"-config") == 0)			{			if (--argc < 1) goto bad;			configfile= *(++argv);			}		else if (strcmp(*argv,"-name") == 0)			{			if (--argc < 1) goto bad;			section= *(++argv);			}		else if (strcmp(*argv,"-subj") == 0)			{			if (--argc < 1) goto bad;			subj= *(++argv);			/* preserve=1; */			}		else if (strcmp(*argv,"-startdate") == 0)			{			if (--argc < 1) goto bad;			startdate= *(++argv);			}		else if (strcmp(*argv,"-enddate") == 0)			{			if (--argc < 1) goto bad;			enddate= *(++argv);			}		else if (strcmp(*argv,"-days") == 0)			{			if (--argc < 1) goto bad;			days=atoi(*(++argv));			}		else if (strcmp(*argv,"-md") == 0)			{			if (--argc < 1) goto bad;			md= *(++argv);			}		else if (strcmp(*argv,"-policy") == 0)			{			if (--argc < 1) goto bad;			policy= *(++argv);			}		else if (strcmp(*argv,"-keyfile") == 0)			{			if (--argc < 1) goto bad;			keyfile= *(++argv);			}		else if (strcmp(*argv,"-keyform") == 0)			{			if (--argc < 1) goto bad;			keyform=str2fmt(*(++argv));			}		else if (strcmp(*argv,"-passin") == 0)			{			if (--argc < 1) goto bad;			passargin= *(++argv);			}		else if (strcmp(*argv,"-key") == 0)			{			if (--argc < 1) goto bad;			key= *(++argv);			}		else if (strcmp(*argv,"-cert") == 0)			{			if (--argc < 1) goto bad;			certfile= *(++argv);			}		else if (strcmp(*argv,"-in") == 0)			{			if (--argc < 1) goto bad;			infile= *(++argv);			req=1;			}		else if (strcmp(*argv,"-out") == 0)			{			if (--argc < 1) goto bad;			outfile= *(++argv);			}		else if (strcmp(*argv,"-outdir") == 0)			{			if (--argc < 1) goto bad;			outdir= *(++argv);			}		else if (strcmp(*argv,"-notext") == 0)			notext=1;		else if (strcmp(*argv,"-batch") == 0)			batch=1;		else if (strcmp(*argv,"-preserveDN") == 0)			preserve=1;		else if (strcmp(*argv,"-gencrl") == 0)			gencrl=1;		else if (strcmp(*argv,"-msie_hack") == 0)			msie_hack=1;		else if (strcmp(*argv,"-crldays") == 0)			{			if (--argc < 1) goto bad;			crldays= atol(*(++argv));			}		else if (strcmp(*argv,"-crlhours") == 0)			{			if (--argc < 1) goto bad;			crlhours= atol(*(++argv));			}		else if (strcmp(*argv,"-infiles") == 0)			{			argc--;			argv++;			req=1;			break;			}		else if (strcmp(*argv, "-ss_cert") == 0)			{			if (--argc < 1) goto bad;			ss_cert_file = *(++argv);			req=1;			}		else if (strcmp(*argv, "-spkac") == 0)			{			if (--argc < 1) goto bad;			spkac_file = *(++argv);			req=1;			}		else if (strcmp(*argv,"-revoke") == 0)			{			if (--argc < 1) goto bad;			infile= *(++argv);			dorevoke=1;			}		else if (strcmp(*argv,"-extensions") == 0)			{			if (--argc < 1) goto bad;			extensions= *(++argv);			}		else if (strcmp(*argv,"-extfile") == 0)			{			if (--argc < 1) goto bad;			extfile= *(++argv);			}		else if (strcmp(*argv,"-status") == 0)			{			if (--argc < 1) goto bad;			ser_status= *(++argv);			}		else if (strcmp(*argv,"-updatedb") == 0)			{			doupdatedb=1;			}		else if (strcmp(*argv,"-crlexts") == 0)			{			if (--argc < 1) goto bad;			crl_ext= *(++argv);			}		else if (strcmp(*argv,"-crl_reason") == 0)			{			if (--argc < 1) goto bad;			rev_arg = *(++argv);			rev_type = REV_CRL_REASON;			}		else if (strcmp(*argv,"-crl_hold") == 0)			{			if (--argc < 1) goto bad;			rev_arg = *(++argv);			rev_type = REV_HOLD;			}		else if (strcmp(*argv,"-crl_compromise") == 0)			{			if (--argc < 1) goto bad;			rev_arg = *(++argv);			rev_type = REV_KEY_COMPROMISE;			}		else if (strcmp(*argv,"-crl_CA_compromise") == 0)			{			if (--argc < 1) goto bad;			rev_arg = *(++argv);			rev_type = REV_CA_COMPROMISE;			}		else if (strcmp(*argv,"-engine") == 0)			{			if (--argc < 1) goto bad;			engine= *(++argv);			}		else			{bad:			BIO_printf(bio_err,"unknown option %s\n",*argv);			badops=1;			break;			}		argc--;		argv++;		}	if (badops)		{		for (pp=ca_usage; (*pp != NULL); pp++)			BIO_printf(bio_err,"%s",*pp);		goto err;		}	ERR_load_crypto_strings();        e = setup_engine(bio_err, engine, 0);	/*****************************************************************/	if (configfile == NULL) configfile = getenv("OPENSSL_CONF");	if (configfile == NULL) configfile = getenv("SSLEAY_CONF");	if (configfile == NULL)		{		/* We will just use 'buf[0]' as a temporary buffer.  */#ifdef OPENSSL_SYS_VMS		strncpy(buf[0],X509_get_default_cert_area(),			sizeof(buf[0])-1-sizeof(CONFIG_FILE));#else		strncpy(buf[0],X509_get_default_cert_area(),			sizeof(buf[0])-2-sizeof(CONFIG_FILE));		strcat(buf[0],"/");#endif		strcat(buf[0],CONFIG_FILE);		configfile=buf[0];		}	BIO_printf(bio_err,"Using configuration from %s\n",configfile);	conf = NCONF_new(NULL);	if (NCONF_load(conf,configfile,&errorline) <= 0)		{		if (errorline <= 0)			BIO_printf(bio_err,"error loading the config file '%s'\n",				configfile);		else			BIO_printf(bio_err,"error on line %ld of config file '%s'\n"				,errorline,configfile);		goto err;		}	/* Lets get the config section we are using */	if (section == NULL)		{		section=NCONF_get_string(conf,BASE_SECTION,ENV_DEFAULT_CA);		if (section == NULL)			{			lookup_fail(BASE_SECTION,ENV_DEFAULT_CA);			goto err;			}		}	if (conf != NULL)		{		p=NCONF_get_string(conf,NULL,"oid_file");		if (p == NULL)			ERR_clear_error();		if (p != NULL)			{			BIO *oid_bio;			oid_bio=BIO_new_file(p,"r");			if (oid_bio == NULL) 				{				/*				BIO_printf(bio_err,"problems opening %s for extra oid's\n",p);				ERR_print_errors(bio_err);				*/				ERR_clear_error();				}			else				{				OBJ_create_objects(oid_bio);				BIO_free(oid_bio);				}			}		if (!add_oid_section(bio_err,conf)) 			{			ERR_print_errors(bio_err);			goto err;			}		}	randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");	if (randfile == NULL)		ERR_clear_error();	app_RAND_load_file(randfile, bio_err, 0);		in=BIO_new(BIO_s_file());	out=BIO_new(BIO_s_file());	Sout=BIO_new(BIO_s_file());	Cout=BIO_new(BIO_s_file());	if ((in == NULL) || (out == NULL) || (Sout == NULL) || (Cout == NULL))		{		ERR_print_errors(bio_err);		goto err;		}	/*****************************************************************/	/* report status of cert with serial number given on command line */	if (ser_status)	{		if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)			{			lookup_fail(section,ENV_DATABASE);			goto err;			}		if (BIO_read_filename(in,dbfile) <= 0)			{			perror(dbfile);			BIO_printf(bio_err,"unable to open '%s'\n",dbfile);			goto err;			}		db=TXT_DB_read(in,DB_NUMBER);		if (db == NULL) goto err;		if (!make_serial_index(db))			goto err;		if (get_certificate_status(ser_status,db) != 1)			BIO_printf(bio_err,"Error verifying serial %s!\n",				 ser_status);		goto err;	}	/*****************************************************************/	/* we definitely need a public key, so let's get it */	if ((keyfile == NULL) && ((keyfile=NCONF_get_string(conf,		section,ENV_PRIVATE_KEY)) == NULL))		{		lookup_fail(section,ENV_PRIVATE_KEY);		goto err;		}	if (!key && !app_passwd(bio_err, passargin, NULL, &key, NULL))		{		BIO_printf(bio_err,"Error getting password\n");		goto err;		}	pkey = load_key(bio_err, keyfile, keyform, key, e, 		"CA private key");	if (key) memset(key,0,strlen(key));	if (pkey == NULL)		{		/* load_key() has already printed an appropriate message */		goto err;		}	/*****************************************************************/	/* we need a certificate */	if ((certfile == NULL) && ((certfile=NCONF_get_string(conf,		section,ENV_CERTIFICATE)) == NULL))		{		lookup_fail(section,ENV_CERTIFICATE);		goto err;		}	x509=load_cert(bio_err, certfile, FORMAT_PEM, NULL, e,		"CA certificate");	if (x509 == NULL)		goto err;	if (!X509_check_private_key(x509,pkey))		{		BIO_printf(bio_err,"CA certificate and CA private key do not match\n");		goto err;		}	f=NCONF_get_string(conf,BASE_SECTION,ENV_PRESERVE);	if (f == NULL)		ERR_clear_error();	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))		preserve=1;	f=NCONF_get_string(conf,BASE_SECTION,ENV_MSIE_HACK);	if (f == NULL)		ERR_clear_error();	if ((f != NULL) && ((*f == 'y') || (*f == 'Y')))		msie_hack=1;	f=NCONF_get_string(conf,section,ENV_NAMEOPT);	if (f)		{		if (!set_name_ex(&nameopt, f))			{			BIO_printf(bio_err, "Invalid name options: \"%s\"\n", f);			goto err;			}		default_op = 0;		}	else		ERR_clear_error();	f=NCONF_get_string(conf,section,ENV_CERTOPT);	if (f)		{		if (!set_cert_ex(&certopt, f))			{			BIO_printf(bio_err, "Invalid certificate options: \"%s\"\n", f);			goto err;			}		default_op = 0;		}	else		ERR_clear_error();	f=NCONF_get_string(conf,section,ENV_EXTCOPY);	if (f)		{		if (!set_ext_copy(&ext_copy, f))			{			BIO_printf(bio_err, "Invalid extension copy option: \"%s\"\n", f);			goto err;			}		}	else		ERR_clear_error();	/*****************************************************************/	/* lookup where to write new certificates */	if ((outdir == NULL) && (req))		{		struct stat sb;		if ((outdir=NCONF_get_string(conf,section,ENV_NEW_CERTS_DIR))			== NULL)			{			BIO_printf(bio_err,"there needs to be defined a directory for new certificate to be placed in\n");			goto err;			}#ifndef OPENSSL_SYS_VMS	    /* outdir is a directory spec, but access() for VMS demands a	       filename.  In any case, stat(), below, will catch the problem	       if outdir is not a directory spec, and the fopen() or open()	       will catch an error if there is no write access.	       Presumably, this problem could also be solved by using the DEC	       C routines to convert the directory syntax to Unixly, and give	       that to access().  However, time's too short to do that just	       now.	    */		if (access(outdir,R_OK|W_OK|X_OK) != 0)			{			BIO_printf(bio_err,"I am unable to access the %s directory\n",outdir);			perror(outdir);			goto err;			}		if (stat(outdir,&sb) != 0)			{			BIO_printf(bio_err,"unable to stat(%s)\n",outdir);			perror(outdir);			goto err;			}#ifdef S_IFDIR		if (!(sb.st_mode & S_IFDIR))			{			BIO_printf(bio_err,"%s need to be a directory\n",outdir);			perror(outdir);			goto err;			}#endif#endif		}	/*****************************************************************/	/* we need to load the database file */	if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)		{		lookup_fail(section,ENV_DATABASE);		goto err;		}	if (BIO_read_filename(in,dbfile) <= 0)		{		perror(dbfile);		BIO_printf(bio_err,"unable to open '%s'\n",dbfile);		goto err;		}	db=TXT_DB_read(in,DB_NUMBER);	if (db == NULL) goto err;	/* Lets check some fields */	for (i=0; i<sk_num(db->data); i++)		{		pp=(char **)sk_value(db->data,i);		if ((pp[DB_type][0] != DB_TYPE_REV) &&			(pp[DB_rev_date][0] != '\0'))			{			BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);			goto err;			}		if ((pp[DB_type][0] == DB_TYPE_REV) &&			!make_revoked(NULL, pp[DB_rev_date]))			{			BIO_printf(bio_err," in entry %d\n", i+1);			goto err;			}		if (!check_time_format(pp[DB_exp_date]))			{			BIO_printf(bio_err,"entry %d: invalid expiry date\n",i+1);			goto err;			}		p=pp[DB_serial];		j=strlen(p);		if (*p == '-')			{			p++;			j--;			}		if ((j&1) || (j < 2))			{			BIO_printf(bio_err,"entry %d: bad serial number length (%d)\n",i+1,j);			goto err;			}		while (*p)			{			if (!(	((*p >= '0') && (*p <= '9')) ||				((*p >= 'A') && (*p <= 'F')) ||				((*p >= 'a') && (*p <= 'f')))  )				{				BIO_printf(bio_err,"entry %d: bad serial number characters, char pos %ld, char is '%c'\n",i+1,(long)(p-pp[DB_serial]),*p);				goto err;				}			p++;			}		}	if (verbose)		{		BIO_set_fp(out,stdout,BIO_NOCLOSE|BIO_FP_TEXT); /* cannot fail */#ifdef OPENSSL_SYS_VMS		{		BIO *tmpbio = BIO_new(BIO_f_linebuffer());		out = BIO_push(tmpbio, out);		}#endif		TXT_DB_write(out,db);		BIO_printf(bio_err,"%d entries loaded from the database\n",			db->data->num);		BIO_printf(bio_err,"generating index\n");		}		if (!make_serial_index(db))		goto err;	if (!TXT_DB_create_index(db, DB_name, index_name_qual,			LHASH_HASH_FN(index_name_hash),			LHASH_COMP_FN(index_name_cmp)))		{		BIO_printf(bio_err,"error creating name index:(%ld,%ld,%ld)\n",			db->error,db->arg1,db->arg2);		goto err;		}	/*****************************************************************/	/* Update the db file for expired certificates */	if (doupdatedb)		{		if (verbose)			BIO_printf(bio_err, "Updating %s ...\n",							dbfile);		i = do_updatedb(db);		if (i == -1)			{			BIO_printf(bio_err,"Malloc failure\n");			goto err;			}		else if (i == 0)			{			if (verbose) BIO_printf(bio_err,					"No entries found to mark expired\n"); 			}	    	else			{			out = BIO_new(BIO_s_file());			if (out == NULL)				{				ERR_print_errors(bio_err);				goto err;				}#ifndef OPENSSL_SYS_VMS			j = BIO_snprintf(buf[0], sizeof buf[0], "%s.new", dbfile);#else			j = BIO_snprintf(buf[0], sizeof buf[0], "%s-new", dbfile);#endif			if (j < 0 || j >= sizeof buf[0])				{				BIO_printf(bio_err, "file name too long\n");				goto err;				}			if (BIO_write_filename(out,buf[0]) <= 0)		  		{		    		perror(dbfile);		    		BIO_printf(bio_err,"unable to open '%s'\n",									dbfile);		    		goto err;		  		}			j=TXT_DB_write(out,db);			if (j <= 0) goto err;						BIO_free(out);			out = NULL;#ifndef OPENSSL_SYS_VMS			j = BIO_snprintf(buf[1], sizeof buf[1], "%s.old", dbfile);#else			j = BIO_snprintf(buf[1], sizeof buf[1], "%s-old", dbfile);#endif			if (j < 0 || j >= sizeof buf[1])				{				BIO_printf(bio_err, "file name too long\n");				goto err;				}			if (rename(dbfile,buf[1]) < 0)		  		{		    		BIO_printf(bio_err,						"unable to rename %s to %s\n",						dbfile, buf[1]);		    		perror("reason");		    		goto err;		  		}			if (rename(buf[0],dbfile) < 0)				{		    		BIO_printf(bio_err,						"unable to rename %s to %s\n",						buf[0],dbfile);		    		perror("reason");		    		rename(buf[1],dbfile);		    		goto err;		  		}							if (verbose) BIO_printf(bio_err,				"Done. %d entries marked as expired\n",i); 	      		}			goto err;	  	} 	/*****************************************************************/	/* Read extentions config file                                   */	if (extfile)		{		extconf = NCONF_new(NULL);		if (NCONF_load(extconf,extfile,&errorline) <= 0)			{			if (errorline <= 0)				BIO_printf(bio_err, "ERROR: loading the config file '%s'\n",					extfile);			else				BIO_printf(bio_err, "ERROR: on line %ld of config file '%s'\n",					errorline,extfile);			ret = 1;			goto err;			}		if (verbose)			BIO_printf(bio_err, "Succesfully loaded extensions file %s\n", extfile);		/* We can have sections in the ext file */		if (!extensions && !(extensions = NCONF_get_string(extconf, "default", "extensions")))			extensions = "default";		}	/*****************************************************************/	if (req || gencrl)		{		if (outfile != NULL)			{			if (BIO_write_filename(Sout,outfile) <= 0)				{				perror(outfile);				goto err;				}			}		else			{			BIO_set_fp(Sout,stdout,BIO_NOCLOSE|BIO_FP_TEXT);#ifdef OPENSSL_SYS_VMS			{			BIO *tmpbio = BIO_new(BIO_f_linebuffer());			Sout = BIO_push(tmpbio, Sout);			}#endif			}		}	if (req)		{		if ((md == NULL) && ((md=NCONF_get_string(conf,			section,ENV_DEFAULT_MD)) == NULL))			{			lookup_fail(section,ENV_DEFAULT_MD);			goto err;			}		if ((dgst=EVP_get_digestbyname(md)) == NULL)			{			BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);			goto err;			}		if (verbose)			BIO_printf(bio_err,"message digest is %s\n",				OBJ_nid2ln(dgst->type));		if ((policy == NULL) && ((policy=NCONF_get_string(conf,			section,ENV_POLICY)) == NULL))			{			lookup_fail(section,ENV_POLICY);			goto err;			}		if (verbose)			BIO_printf(bio_err,"policy is %s\n",policy);		if ((serialfile=NCONF_get_string(conf,section,ENV_SERIAL))			== NULL)			{			lookup_fail(section,ENV_SERIAL);			goto err;			}		if (!extconf)			{			/* no '-extfile' option, so we look for extensions			 * in the main configuration file */			if (!extensions)				{				extensions=NCONF_get_string(conf,section,								ENV_EXTENSIONS);				if (!extensions)					ERR_clear_error();				}			if (extensions)				{				/* Check syntax of file */				X509V3_CTX ctx;				X509V3_set_ctx_test(&ctx);				X509V3_set_nconf(&ctx, conf);				if (!X509V3_EXT_add_nconf(conf, &ctx, extensions,								NULL))					{					BIO_printf(bio_err,				 	"Error Loading extension section %s\n",								 extensions);					ret = 1;					goto err;					}				}			}		if (startdate == NULL)			{			startdate=NCONF_get_string(conf,section,				ENV_DEFAULT_STARTDATE);			if (startdate == NULL)				ERR_clear_error();			}		if (startdate && !ASN1_UTCTIME_set_string(NULL,startdate))			{			BIO_printf(bio_err,"start date is invalid, it should be YYMMDDHHMMSSZ\n");			goto err;			}		if (startdate == NULL) startdate="today";		if (enddate == NULL)			{			enddate=NCONF_get_string(conf,section,				ENV_DEFAULT_ENDDATE);			if (enddate == NULL)				ERR_clear_error();			}		if (enddate && !ASN1_UTCTIME_set_string(NULL,enddate))			{			BIO_printf(bio_err,"end date is invalid, it should be YYMMDDHHMMSSZ\n");			goto err;			}		if (days == 0)			{			if(!NCONF_get_number(conf,section, ENV_DEFAULT_DAYS, &days))				days = 0;			}		if (!enddate && (days == 0))			{			BIO_printf(bio_err,"cannot lookup how many days to certify for\n");			goto err;			}		if ((serial=load_serial(serialfile)) == NULL)			{			BIO_printf(bio_err,"error while loading serial number\n");			goto err;			}		if (verbose)			{			if ((f=BN_bn2hex(serial)) == NULL) goto err;			BIO_printf(bio_err,"next serial number is %s\n",f);			OPENSSL_free(f);			}		if ((attribs=NCONF_get_section(conf,policy)) == NULL)			{			BIO_printf(bio_err,"unable to find 'section' for %s\n",policy);			goto err;			}		if ((cert_sk=sk_X509_new_null()) == NULL)			{			BIO_printf(bio_err,"Memory allocation failure\n");			goto err;			}		if (spkac_file != NULL)			{			total++;			j=certify_spkac(&x,spkac_file,pkey,x509,dgst,attribs,db,				serial,subj,startdate,enddate, days,extensions,conf,				verbose, certopt, nameopt, default_op, ext_copy);			if (j < 0) goto err;			if (j > 0)				{				total_done++;				BIO_printf(bio_err,"\n");				if (!BN_add_word(serial,1)) goto err;				if (!sk_X509_push(cert_sk,x))					{					BIO_printf(bio_err,"Memory allocation failure\n");					goto err;					}				if (outfile)					{					output_der = 1;					batch = 1;					}				}			}		if (ss_cert_file != NULL)			{			total++;			j=certify_cert(&x,ss_cert_file,pkey,x509,dgst,attribs,				db,serial,subj,startdate,enddate,days,batch,				extensions,conf,verbose, certopt, nameopt,				default_op, ext_copy, e);			if (j < 0) goto err;			if (j > 0)				{				total_done++;				BIO_printf(bio_err,"\n");				if (!BN_add_word(serial,1)) goto err;				if (!sk_X509_push(cert_sk,x))					{					BIO_printf(bio_err,"Memory allocation failure\n");					goto err;					}				}			}		if (infile != NULL)			{			total++;			j=certify(&x,infile,pkey,x509,dgst,attribs,db,				serial,subj,startdate,enddate,days,batch,				extensions,conf,verbose, certopt, nameopt,				default_op, ext_copy);			if (j < 0) goto err;			if (j > 0)				{				total_done++;				BIO_printf(bio_err,"\n");				if (!BN_add_word(serial,1)) goto err;				if (!sk_X509_push(cert_sk,x))					{					BIO_printf(bio_err,"Memory allocation failure\n");					goto err;					}				}			}		for (i=0; i<argc; i++)			{			total++;			j=certify(&x,argv[i],pkey,x509,dgst,attribs,db,				serial,subj,startdate,enddate,days,batch,				extensions,conf,verbose, certopt, nameopt,				default_op, ext_copy);			if (j < 0) goto err;			if (j > 0)				{				total_done++;				BIO_printf(bio_err,"\n");				if (!BN_add_word(serial,1)) goto err;				if (!sk_X509_push(cert_sk,x))					{					BIO_printf(bio_err,"Memory allocation failure\n");					goto err;					}				}			}			/* we have a stack of newly certified certificates		 * and a data base and serial number that need		 * updating */		if (sk_X509_num(cert_sk) > 0)			{			if (!batch)				{				BIO_printf(bio_err,"\n%d out of %d certificate requests certified, commit? [y/n]",total_done,total);				(void)BIO_flush(bio_err);				buf[0][0]='\0';				fgets(buf[0],10,stdin);				if ((buf[0][0] != 'y') && (buf[0][0] != 'Y'))					{					BIO_printf(bio_err,"CERTIFICATION CANCELED\n"); 					ret=0;					goto err;					}				}			BIO_printf(bio_err,"Write out database with %d new entries\n",sk_X509_num(cert_sk));			strncpy(buf[0],serialfile,BSIZE-4);#ifdef OPENSSL_SYS_VMS			strcat(buf[0],"-new");#else			strcat(buf[0],".new");#endif			if (!save_serial(buf[0],serial)) goto err;			strncpy(buf[1],dbfile,BSIZE-4);#ifdef OPENSSL_SYS_VMS			strcat(buf[1],"-new");#else			strcat(buf[1],".new");#endif			if (BIO_write_filename(out,buf[1]) <= 0)				{				perror(dbfile);				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);				goto err;				}			l=TXT_DB_write(out,db);			if (l <= 0) goto err;			}			if (verbose)			BIO_printf(bio_err,"writing new certificates\n");		for (i=0; i<sk_X509_num(cert_sk); i++)			{			int k;			unsigned char *n;			x=sk_X509_value(cert_sk,i);			j=x->cert_info->serialNumber->length;			p=(char *)x->cert_info->serialNumber->data;						strncpy(buf[2],outdir,BSIZE-(j*2)-6);#ifndef OPENSSL_SYS_VMS			strcat(buf[2],"/");#endif			n=(unsigned char *)&(buf[2][strlen(buf[2])]);			if (j > 0)				{				for (k=0; k<j; k++)					{					sprintf((char *)n,"%02X",(unsigned char)*(p++));					n+=2;					}				}			else				{				*(n++)='0';				*(n++)='0';				}			*(n++)='.'; *(n++)='p'; *(n++)='e'; *(n++)='m';			*n='\0';			if (verbose)				BIO_printf(bio_err,"writing %s\n",buf[2]);			if (BIO_write_filename(Cout,buf[2]) <= 0)				{				perror(buf[2]);				goto err;				}			write_new_certificate(Cout,x, 0, notext);			write_new_certificate(Sout,x, output_der, notext);			}		if (sk_X509_num(cert_sk))			{			/* Rename the database and the serial file */			strncpy(buf[2],serialfile,BSIZE-4);#ifdef OPENSSL_SYS_VMS			strcat(buf[2],"-old");#else			strcat(buf[2],".old");#endif			BIO_free(in);			BIO_free_all(out);			in=NULL;			out=NULL;			if (rename(serialfile,buf[2]) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n",					serialfile,buf[2]);				perror("reason");				goto err;				}			if (rename(buf[0],serialfile) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n",					buf[0],serialfile);				perror("reason");				rename(buf[2],serialfile);				goto err;				}			strncpy(buf[2],dbfile,BSIZE-4);#ifdef OPENSSL_SYS_VMS			strcat(buf[2],"-old");#else			strcat(buf[2],".old");#endif			if (rename(dbfile,buf[2]) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n",					dbfile,buf[2]);				perror("reason");				goto err;				}			if (rename(buf[1],dbfile) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n",					buf[1],dbfile);				perror("reason");				rename(buf[2],dbfile);				goto err;				}			BIO_printf(bio_err,"Data Base Updated\n");			}		}		/*****************************************************************/	if (gencrl)		{		int crl_v2 = 0;		if (!crl_ext)			{			crl_ext=NCONF_get_string(conf,section,ENV_CRLEXT);			if (!crl_ext)				ERR_clear_error();			}		if (crl_ext)			{			/* Check syntax of file */			X509V3_CTX ctx;			X509V3_set_ctx_test(&ctx);			X509V3_set_nconf(&ctx, conf);			if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL))				{				BIO_printf(bio_err,				 "Error Loading CRL extension section %s\n",								 crl_ext);				ret = 1;				goto err;				}			}		if (!crldays && !crlhours)			{			if (!NCONF_get_number(conf,section,				ENV_DEFAULT_CRL_DAYS, &crldays))				crldays = 0;			if (!NCONF_get_number(conf,section,				ENV_DEFAULT_CRL_HOURS, &crlhours))				crlhours = 0;			}		if ((crldays == 0) && (crlhours == 0))			{			BIO_printf(bio_err,"cannot lookup how long until the next CRL is issuer\n");			goto err;			}		if (verbose) BIO_printf(bio_err,"making CRL\n");		if ((crl=X509_CRL_new()) == NULL) goto err;		ci=crl->crl;		X509_NAME_free(ci->issuer);		ci->issuer=X509_NAME_dup(x509->cert_info->subject);		if (ci->issuer == NULL) goto err;		X509_gmtime_adj(ci->lastUpdate,0);		if (ci->nextUpdate == NULL)			ci->nextUpdate=ASN1_UTCTIME_new();		X509_gmtime_adj(ci->nextUpdate,(crldays*24+crlhours)*60*60);		for (i=0; i<sk_num(db->data); i++)			{			pp=(char **)sk_value(db->data,i);			if (pp[DB_type][0] == DB_TYPE_REV)				{				if ((r=X509_REVOKED_new()) == NULL) goto err;				j = make_revoked(r, pp[DB_rev_date]);				if (!j) goto err;				if (j == 2) crl_v2 = 1;				if (!BN_hex2bn(&serial, pp[DB_serial]))					goto err;				r->serialNumber = BN_to_ASN1_INTEGER(serial, r->serialNumber);				BN_free(serial);				serial = NULL;				if (!r->serialNumber)					goto err;				X509_CRL_add0_revoked(crl,r);				}			}		/* sort the data so it will be written in serial		 * number order */		sk_X509_REVOKED_sort(ci->revoked);		for (i=0; i<sk_X509_REVOKED_num(ci->revoked); i++)			{			r=sk_X509_REVOKED_value(ci->revoked,i);			r->sequence=i;			}		/* we now have a CRL */		if (verbose) BIO_printf(bio_err,"signing CRL\n");		if (md != NULL)			{			if ((dgst=EVP_get_digestbyname(md)) == NULL)				{				BIO_printf(bio_err,"%s is an unsupported message digest type\n",md);				goto err;				}			}		else			{#ifndef OPENSSL_NO_DSA			if (pkey->type == EVP_PKEY_DSA) 				dgst=EVP_dss1();			else#endif				dgst=EVP_md5();			}		/* Add any extensions asked for */		if (crl_ext)			{			X509V3_CTX crlctx;			if (ci->version == NULL)				if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;			X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);			X509V3_set_nconf(&crlctx, conf);			if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx,				crl_ext, crl)) goto err;			}		if (crl_ext || crl_v2)			{			if (ci->version == NULL)				if ((ci->version=ASN1_INTEGER_new()) == NULL) goto err;			ASN1_INTEGER_set(ci->version,1); /* version 2 CRL */			}		if (!X509_CRL_sign(crl,pkey,dgst)) goto err;		PEM_write_bio_X509_CRL(Sout,crl);		}	/*****************************************************************/	if (dorevoke)		{		if (infile == NULL) 			{			BIO_printf(bio_err,"no input files\n");			goto err;			}		else			{			X509 *revcert;			revcert=load_cert(bio_err, infile, FORMAT_PEM,				NULL, e, infile);			if (revcert == NULL)				goto err;			j=do_revoke(revcert,db, rev_type, rev_arg);			if (j <= 0) goto err;			X509_free(revcert);			strncpy(buf[0],dbfile,BSIZE-4);#ifndef OPENSSL_SYS_VMS			strcat(buf[0],".new");#else			strcat(buf[0],"-new");#endif			if (BIO_write_filename(out,buf[0]) <= 0)				{				perror(dbfile);				BIO_printf(bio_err,"unable to open '%s'\n",dbfile);				goto err;				}			j=TXT_DB_write(out,db);			if (j <= 0) goto err;			strncpy(buf[1],dbfile,BSIZE-4);#ifndef OPENSSL_SYS_VMS			strcat(buf[1],".old");#else			strcat(buf[1],"-old");#endif			if (rename(dbfile,buf[1]) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n", dbfile, buf[1]);				perror("reason");				goto err;				}			if (rename(buf[0],dbfile) < 0)				{				BIO_printf(bio_err,"unable to rename %s to %s\n", buf[0],dbfile);				perror("reason");				rename(buf[1],dbfile);				goto err;				}			BIO_printf(bio_err,"Data Base Updated\n"); 			}		}	/*****************************************************************/	ret=0;err:	BIO_free_all(Cout);	BIO_free_all(Sout);	BIO_free_all(out);	BIO_free_all(in);	sk_X509_pop_free(cert_sk,X509_free);	if (ret) ERR_print_errors(bio_err);	app_RAND_write_file(randfile, bio_err);	BN_free(serial);	TXT_DB_free(db);	EVP_PKEY_free(pkey);	X509_free(x509);	X509_CRL_free(crl);	NCONF_free(conf);	OBJ_cleanup();	apps_shutdown();	EXIT(ret);	}