123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431 |
- '***************************************************************************
- '* _ _ ____ _
- '* Project ___| | | | _ \| |
- '* / __| | | | |_) | |
- '* | (__| |_| | _ <| |___
- '* \___|\___/|_| \_\_____|
- '*
- '* Copyright (C) 1998 - 2014, Daniel Stenberg, <[email protected]>, et al.
- '*
- '* This software is licensed as described in the file COPYING, which
- '* you should have received as part of this distribution. The terms
- '* are also available at https://curl.haxx.se/docs/copyright.html.
- '*
- '* You may opt to use, copy, modify, merge, publish, distribute and/or sell
- '* copies of the Software, and permit persons to whom the Software is
- '* furnished to do so, under the terms of the COPYING file.
- '*
- '* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- '* KIND, either express or implied.
- '*
- '***************************************************************************
- '* Script to fetch certdata.txt from Mozilla.org site and create a
- '* ca-bundle.crt for use with OpenSSL / libcurl / libcurl bindings
- '* Requires WinHttp.WinHttpRequest.5.1 and ADODB.Stream which are part of
- '* W2000 SP3 or later, WXP SP1 or later, W2003 Server SP1 or later.
- '* Hacked by Guenter Knauf
- '***************************************************************************
- Option Explicit
- Const myVersion = "0.4.0"
- Const myUrl = "https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt"
- Const myOpenSSL = "openssl.exe"
- Dim myUseOpenSSL
- myUseOpenSSL = TRUE ' Flag: TRUE to use OpenSSL. If TRUE and is not
- ' found then a warning is shown before continuing.
- Const myCdSavF = TRUE ' Flag: save downloaded data to file certdata.txt
- Const myCaBakF = TRUE ' Flag: backup existing ca-bundle certificate
- Const myAskLiF = TRUE ' Flag: display certdata.txt license agreement
- Const myWrapLe = 76 ' Default length of base64 output lines
- ' cert info code doesn't work properly with any recent openssl, leave disabled.
- ' Also: we want our certificate output by default to be as similar as possible
- ' to mk-ca-bundle.pl and setting this TRUE changes the base64 width to
- ' OpenSSL's built-in default width, which is not the same as mk-ca-bundle.pl.
- Const myAskTiF = FALSE ' Flag: ask to include certificate text info
- '
- '******************* Nothing to configure below! *******************
- '
- Const adTypeBinary = 1
- Const adTypeText = 2
- Const adSaveCreateNotExist = 1
- Const adSaveCreateOverWrite = 2
- Dim objShell, objNetwork, objFSO, objHttp
- Dim myBase, mySelf, myStream, myTmpFh, myCdData, myCdFile
- Dim myCaFile, myTmpName, myBakNum, myOptTxt, i
- Set objNetwork = WScript.CreateObject("WScript.Network")
- Set objShell = WScript.CreateObject("WScript.Shell")
- Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
- Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest.5.1")
- If objHttp Is Nothing Then Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest")
- myBase = Left(WScript.ScriptFullName, InstrRev(WScript.ScriptFullName, "\"))
- mySelf = Left(WScript.ScriptName, InstrRev(WScript.ScriptName, ".") - 1) & " " & myVersion
- myCdFile = Mid(myUrl, InstrRev(myUrl, "/") + 1)
- myCaFile = "ca-bundle.crt"
- myTmpName = InputBox("It will take a minute to download and parse the " & _
- "certificate data." & _
- vbLf & vbLf & _
- "Please enter the output filename:", mySelf, myCaFile)
- If (myTmpName = "") Then
- WScript.Quit 1
- End If
- myCaFile = myTmpName
- If (myCdFile = "") Then
- MsgBox("URL does not contain filename!"), vbCritical, mySelf
- WScript.Quit 1
- End If
- ' Don't use OpenSSL if it's not present.
- If (myUseOpenSSL = TRUE) Then
- Dim errnum
- On Error Resume Next
- Call objShell.Run("""" & myOpenSSL & """ version", 0, TRUE)
- errnum = Err.Number
- On Error GoTo 0
- If Not (errnum = 0) Then
- myUseOpenSSL = FALSE
- MsgBox("OpenSSL was not found so the certificate bundle will not " & _
- "include the SHA256 hash of the raw certificate data file " & _
- "that was used to generate the certificates in the bundle. " & _
- vbLf & vbLf & _
- "This does not have any effect on the certificate output, " & _
- "so this script will continue." & _
- vbLf & vbLf & _
- "If you want to set a custom location for OpenSSL or disable " & _
- "this message then edit the variables at the start of the " & _
- "script."), vbInformation, mySelf
- End If
- End If
- If (myAskTiF = TRUE) And (myUseOpenSSL = TRUE) Then
- If (6 = objShell.PopUp("Do you want to include text information about " & _
- "each certificate?" & vbLf & _
- "(Requires OpenSSL.exe in the current directory " & _
- "or search path)",, _
- mySelf, vbQuestion + vbYesNo + vbDefaultButton2)) Then
- myOptTxt = TRUE
- Else
- myOptTxt = FALSE
- End If
- End If
- ' Uncomment the line below to ignore SSL invalid cert errors
- ' objHttp.Option(4) = 256 + 512 + 4096 + 8192
- objHttp.SetTimeouts 0, 5000, 10000, 10000
- objHttp.Open "GET", myUrl, FALSE
- objHttp.setRequestHeader "User-Agent", WScript.ScriptName & "/" & myVersion
- objHttp.Send ""
- If Not (objHttp.Status = 200) Then
- MsgBox("Failed to download '" & myCdFile & "': " & objHttp.Status & " - " & objHttp.StatusText), vbCritical, mySelf
- WScript.Quit 1
- End If
- ' Write received data to file if enabled
- If (myCdSavF = TRUE) Then
- Call SaveBinaryData(myCdFile, objHttp.ResponseBody)
- End If
- ' Convert data from ResponseBody instead of using ResponseText because of UTF-8
- myCdData = ConvertBinaryToUTF8(objHttp.ResponseBody)
- Set objHttp = Nothing
- ' Backup exitsing ca-bundle certificate file
- If (myCaBakF = TRUE) Then
- If objFSO.FileExists(myCaFile) Then
- Dim myBakFile, b
- b = 1
- myBakFile = myCaFile & ".~" & b & "~"
- While objFSO.FileExists(myBakFile)
- b = b + 1
- myBakFile = myCaFile & ".~" & b & "~"
- Wend
- Set myTmpFh = objFSO.GetFile(myCaFile)
- myTmpFh.Move myBakFile
- End If
- End If
- ' Process the received data
- Dim myLines, myPattern, myInsideCert, myInsideLicense, myLicenseText, myNumCerts, myNumSkipped
- Dim myLabel, myOctets, myData, myPem, myRev, myUntrusted, j
- myNumSkipped = 0
- myNumCerts = 0
- myData = ""
- myLines = Split(myCdData, vbLf, -1)
- Set myStream = CreateObject("ADODB.Stream")
- myStream.Open
- myStream.Type = adTypeText
- myStream.Charset = "utf-8"
- myStream.WriteText "##" & vbLf & _
- "## Bundle of CA Root Certificates" & vbLf & _
- "##" & vbLf & _
- "## Certificate data from Mozilla as of: " & _
- ConvertDateToString(LocalDateToUTC(Now)) & " GMT" & vbLf & _
- "##" & vbLf & _
- "## This is a bundle of X.509 certificates of public Certificate Authorities" & vbLf & _
- "## (CA). These were automatically extracted from Mozilla's root certificates" & vbLf & _
- "## file (certdata.txt). This file can be found in the mozilla source tree:" & vbLf & _
- "## " & myUrl & vbLf & _
- "##" & vbLf & _
- "## It contains the certificates in PEM format and therefore" & vbLf & _
- "## can be directly used with curl / libcurl / php_curl, or with" & vbLf & _
- "## an Apache+mod_ssl webserver for SSL client authentication." & vbLf & _
- "## Just configure this file as the SSLCACertificateFile." & vbLf & _
- "##" & vbLf & _
- "## Conversion done with mk-ca-bundle.vbs version " & myVersion & "." & vbLf
- If (myCdSavF = TRUE) And (myUseOpenSSL = TRUE) Then
- myStream.WriteText "## SHA256: " & FileSHA256(myCdFile) & vbLf
- End If
- myStream.WriteText "##" & vbLf & vbLf
- myStream.WriteText vbLf
- For i = 0 To UBound(myLines)
- If InstrRev(myLines(i), "CKA_LABEL ") Then
- myPattern = "^CKA_LABEL\s+[A-Z0-9]+\s+""(.+?)"""
- myLabel = RegExprFirst(myPattern, myLines(i))
- End If
- If (myInsideCert = TRUE) Then
- If InstrRev(myLines(i), "END") Then
- myInsideCert = FALSE
- While (i < UBound(myLines)) And Not (myLines(i) = "#")
- i = i + 1
- If InstrRev(myLines(i), "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR") Then
- myUntrusted = FALSE
- End If
- Wend
- If (myUntrusted = TRUE) Then
- myNumSkipped = myNumSkipped + 1
- Else
- myStream.WriteText myLabel & vbLf
- myStream.WriteText String(Len(myLabel), "=") & vbLf
- myPem = "-----BEGIN CERTIFICATE-----" & vbLf & _
- Base64Encode(myData) & vbLf & _
- "-----END CERTIFICATE-----" & vbLf
- If (myOptTxt = FALSE) Then
- myStream.WriteText myPem & vbLf
- Else
- Dim myCmd, myRval, myTmpIn, myTmpOut
- myTmpIn = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
- myTmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
- Set myTmpFh = objFSO.OpenTextFile(myTmpIn, 2, TRUE)
- myTmpFh.Write myPem
- myTmpFh.Close
- myCmd = """" & myOpenSSL & """ x509 -md5 -fingerprint -text " & _
- "-inform PEM -in " & myTmpIn & " -out " & myTmpOut
- myRval = objShell.Run (myCmd, 0, TRUE)
- objFSO.DeleteFile myTmpIn, TRUE
- If Not (myRval = 0) Then
- MsgBox("Failed to process PEM cert with OpenSSL commandline!"), vbCritical, mySelf
- objFSO.DeleteFile myTmpOut, TRUE
- WScript.Quit 3
- End If
- Set myTmpFh = objFSO.OpenTextFile(myTmpOut, 1)
- myStream.WriteText myTmpFh.ReadAll & vbLf
- myTmpFh.Close
- objFSO.DeleteFile myTmpOut, TRUE
- End If
- myNumCerts = myNumCerts + 1
- End If
- Else
- myOctets = Split(myLines(i), "\")
- For j = 1 To UBound(myOctets)
- myData = myData & Chr(CByte("&o" & myOctets(j)))
- Next
- End If
- End If
- If InstrRev(myLines(i), "CVS_ID ") Then
- myPattern = "^CVS_ID\s+""(.+?)"""
- myRev = RegExprFirst(myPattern, myLines(i))
- myStream.WriteText "# " & myRev & vbLf & vbLf
- End If
- If InstrRev(myLines(i), "CKA_VALUE MULTILINE_OCTAL") Then
- myInsideCert = TRUE
- myUntrusted = TRUE
- myData = ""
- End If
- If InstrRev(myLines(i), "***** BEGIN LICENSE BLOCK *****") Then
- myInsideLicense = TRUE
- End If
- If (myInsideLicense = TRUE) Then
- myStream.WriteText myLines(i) & vbLf
- myLicenseText = myLicenseText & Mid(myLines(i), 2) & vbLf
- End If
- If InstrRev(myLines(i), "***** END LICENSE BLOCK *****") Then
- myInsideLicense = FALSE
- If (myAskLiF = TRUE) Then
- If Not (6 = objShell.PopUp(myLicenseText & vbLf & _
- "Do you agree to the license shown above (required to proceed) ?",, _
- mySelf, vbQuestion + vbYesNo + vbDefaultButton1)) Then
- myStream.Close
- objFSO.DeleteFile myCaFile, TRUE
- WScript.Quit 2
- End If
- End If
- End If
- Next
- ' To stop the UTF-8 BOM from being written the stream has to be copied and
- ' then saved as binary.
- Dim myCopy
- Set myCopy = CreateObject("ADODB.Stream")
- myCopy.Type = adTypeBinary
- myCopy.Open
- myStream.Position = 3 ' Skip UTF-8 BOM
- myStream.CopyTo myCopy
- myCopy.SaveToFile myCaFile, adSaveCreateOverWrite
- myCopy.Close
- myStream.Close
- Set myCopy = Nothing
- Set myStream = Nothing
- ' Done
- objShell.PopUp "Done (" & myNumCerts & " CA certs processed, " & myNumSkipped & _
- " untrusted skipped).", 20, mySelf, vbInformation
- WScript.Quit 0
- Function ConvertBinaryToUTF8(arrBytes)
- Dim objStream
- Set objStream = CreateObject("ADODB.Stream")
- objStream.Open
- objStream.Type = adTypeBinary
- objStream.Write arrBytes
- objStream.Position = 0
- objStream.Type = adTypeText
- objStream.Charset = "utf-8"
- ConvertBinaryToUTF8 = objStream.ReadText
- Set objStream = Nothing
- End Function
- Function SaveBinaryData(filename, data)
- Dim objStream
- Set objStream = CreateObject("ADODB.Stream")
- objStream.Type = adTypeBinary
- objStream.Open
- objStream.Write data
- objStream.SaveToFile filename, adSaveCreateOverWrite
- objStream.Close
- Set objStream = Nothing
- End Function
- Function RegExprFirst(SearchPattern, TheString)
- Dim objRegExp, Matches ' create variables.
- Set objRegExp = New RegExp ' create a regular expression.
- objRegExp.Pattern = SearchPattern ' sets the search pattern.
- objRegExp.IgnoreCase = TRUE ' set to ignores case.
- objRegExp.Global = TRUE ' set to gloabal search.
- Set Matches = objRegExp.Execute(TheString) ' do the search.
- If (Matches.Count) Then
- RegExprFirst = Matches(0).SubMatches(0) ' return first match.
- Else
- RegExprFirst = ""
- End If
- Set objRegExp = Nothing
- End Function
- Function Base64Encode(inData)
- Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
- Dim cOut, sOut, lWrap, I
- lWrap = Int(myWrapLe * 3 / 4)
- 'For each group of 3 bytes
- For I = 1 To Len(inData) Step 3
- Dim nGroup, pOut, sGroup
- 'Create one long from this 3 bytes.
- nGroup = &H10000 * Asc(Mid(inData, I, 1)) + _
- &H100 * MyASC(Mid(inData, I + 1, 1)) + _
- MyASC(Mid(inData, I + 2, 1))
- 'Oct splits the long To 8 groups with 3 bits
- nGroup = Oct(nGroup)
- 'Add leading zeros
- nGroup = String(8 - Len(nGroup), "0") & nGroup
- 'Convert To base64
- pOut = Mid(Base64, CLng("&o" & Mid(nGroup, 1, 2)) + 1, 1) & _
- Mid(Base64, CLng("&o" & Mid(nGroup, 3, 2)) + 1, 1) & _
- Mid(Base64, CLng("&o" & Mid(nGroup, 5, 2)) + 1, 1) & _
- Mid(Base64, CLng("&o" & Mid(nGroup, 7, 2)) + 1, 1)
- 'Add the part To OutPut string
- sOut = sOut + pOut
- 'Add a new line For Each myWrapLe chars In dest
- If (I < Len(inData) - 2) Then
- If (I + 2) Mod lWrap = 0 Then sOut = sOut & vbLf
- End If
- Next
- Select Case Len(inData) Mod 3
- Case 1: '8 bit final
- sOut = Left(sOut, Len(sOut) - 2) & "=="
- Case 2: '16 bit final
- sOut = Left(sOut, Len(sOut) - 1) & "="
- End Select
- Base64Encode = sOut
- End Function
- Function MyASC(OneChar)
- If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar)
- End Function
- ' Return the date in the same format as perl to match mk-ca-bundle.pl output:
- ' Wed Sep 7 03:12:05 2016
- Function ConvertDateToString(input)
- Dim output
- output = WeekDayName(WeekDay(input), TRUE) & " " & _
- MonthName(Month(input), TRUE) & " "
- If (Len(Day(input)) = 1) Then
- output = output & " "
- End If
- output = output & _
- Day(input) & " " & _
- FormatDateTime(input, vbShortTime) & ":"
- If (Len(Second(input)) = 1) Then
- output = output & "0"
- End If
- output = output & _
- Second(input) & " " & _
- Year(input)
- ConvertDateToString = output
- End Function
- ' Convert local Date to UTC. Microsoft says:
- ' Use Win32_ComputerSystem CurrentTimeZone property, because it automatically
- ' adjusts the Time Zone bias for daylight saving time; Win32_Time Zone Bias
- ' property does not.
- ' https://msdn.microsoft.com/en-us/library/windows/desktop/ms696015.aspx
- Function LocalDateToUTC(localdate)
- Dim item, offset
- For Each item In GetObject("winmgmts:").InstancesOf("Win32_ComputerSystem")
- offset = item.CurrentTimeZone ' the offset in minutes
- Next
- If (offset < 0) Then
- LocalDateToUTC = DateAdd("n", ABS(offset), localdate)
- Else
- LocalDateToUTC = DateAdd("n", -ABS(offset), localdate)
- End If
- 'objShell.PopUp LocalDateToUTC
- End Function
- Function FileSHA256(filename)
- Dim cmd, rval, tmpOut, tmpFh
- if (myUseOpenSSL = TRUE) Then
- tmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
- cmd = """" & myOpenSSL & """ dgst -r -sha256 -out """ & tmpOut & """ """ & filename & """"
- rval = objShell.Run(cmd, 0, TRUE)
- If Not (rval = 0) Then
- MsgBox("Failed to get sha256 of """ & filename & """ with OpenSSL commandline!"), vbCritical, mySelf
- objFSO.DeleteFile tmpOut, TRUE
- WScript.Quit 3
- End If
- Set tmpFh = objFSO.OpenTextFile(tmpOut, 1)
- FileSHA256 = RegExprFirst("^([0-9a-f]{64}) .+", tmpFh.ReadAll)
- tmpFh.Close
- objFSO.DeleteFile tmpOut, TRUE
- Else
- FileSHA256 = ""
- End If
- End Function
|