mk-ca-bundle.vbs 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431
  1. '***************************************************************************
  2. '* _ _ ____ _
  3. '* Project ___| | | | _ \| |
  4. '* / __| | | | |_) | |
  5. '* | (__| |_| | _ <| |___
  6. '* \___|\___/|_| \_\_____|
  7. '*
  8. '* Copyright (C) 1998 - 2014, Daniel Stenberg, <[email protected]>, et al.
  9. '*
  10. '* This software is licensed as described in the file COPYING, which
  11. '* you should have received as part of this distribution. The terms
  12. '* are also available at https://curl.haxx.se/docs/copyright.html.
  13. '*
  14. '* You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. '* copies of the Software, and permit persons to whom the Software is
  16. '* furnished to do so, under the terms of the COPYING file.
  17. '*
  18. '* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. '* KIND, either express or implied.
  20. '*
  21. '***************************************************************************
  22. '* Script to fetch certdata.txt from Mozilla.org site and create a
  23. '* ca-bundle.crt for use with OpenSSL / libcurl / libcurl bindings
  24. '* Requires WinHttp.WinHttpRequest.5.1 and ADODB.Stream which are part of
  25. '* W2000 SP3 or later, WXP SP1 or later, W2003 Server SP1 or later.
  26. '* Hacked by Guenter Knauf
  27. '***************************************************************************
  28. Option Explicit
  29. Const myVersion = "0.4.0"
  30. Const myUrl = "https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt"
  31. Const myOpenSSL = "openssl.exe"
  32. Dim myUseOpenSSL
  33. myUseOpenSSL = TRUE ' Flag: TRUE to use OpenSSL. If TRUE and is not
  34. ' found then a warning is shown before continuing.
  35. Const myCdSavF = TRUE ' Flag: save downloaded data to file certdata.txt
  36. Const myCaBakF = TRUE ' Flag: backup existing ca-bundle certificate
  37. Const myAskLiF = TRUE ' Flag: display certdata.txt license agreement
  38. Const myWrapLe = 76 ' Default length of base64 output lines
  39. ' cert info code doesn't work properly with any recent openssl, leave disabled.
  40. ' Also: we want our certificate output by default to be as similar as possible
  41. ' to mk-ca-bundle.pl and setting this TRUE changes the base64 width to
  42. ' OpenSSL's built-in default width, which is not the same as mk-ca-bundle.pl.
  43. Const myAskTiF = FALSE ' Flag: ask to include certificate text info
  44. '
  45. '******************* Nothing to configure below! *******************
  46. '
  47. Const adTypeBinary = 1
  48. Const adTypeText = 2
  49. Const adSaveCreateNotExist = 1
  50. Const adSaveCreateOverWrite = 2
  51. Dim objShell, objNetwork, objFSO, objHttp
  52. Dim myBase, mySelf, myStream, myTmpFh, myCdData, myCdFile
  53. Dim myCaFile, myTmpName, myBakNum, myOptTxt, i
  54. Set objNetwork = WScript.CreateObject("WScript.Network")
  55. Set objShell = WScript.CreateObject("WScript.Shell")
  56. Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
  57. Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest.5.1")
  58. If objHttp Is Nothing Then Set objHttp = WScript.CreateObject("WinHttp.WinHttpRequest")
  59. myBase = Left(WScript.ScriptFullName, InstrRev(WScript.ScriptFullName, "\"))
  60. mySelf = Left(WScript.ScriptName, InstrRev(WScript.ScriptName, ".") - 1) & " " & myVersion
  61. myCdFile = Mid(myUrl, InstrRev(myUrl, "/") + 1)
  62. myCaFile = "ca-bundle.crt"
  63. myTmpName = InputBox("It will take a minute to download and parse the " & _
  64. "certificate data." & _
  65. vbLf & vbLf & _
  66. "Please enter the output filename:", mySelf, myCaFile)
  67. If (myTmpName = "") Then
  68. WScript.Quit 1
  69. End If
  70. myCaFile = myTmpName
  71. If (myCdFile = "") Then
  72. MsgBox("URL does not contain filename!"), vbCritical, mySelf
  73. WScript.Quit 1
  74. End If
  75. ' Don't use OpenSSL if it's not present.
  76. If (myUseOpenSSL = TRUE) Then
  77. Dim errnum
  78. On Error Resume Next
  79. Call objShell.Run("""" & myOpenSSL & """ version", 0, TRUE)
  80. errnum = Err.Number
  81. On Error GoTo 0
  82. If Not (errnum = 0) Then
  83. myUseOpenSSL = FALSE
  84. MsgBox("OpenSSL was not found so the certificate bundle will not " & _
  85. "include the SHA256 hash of the raw certificate data file " & _
  86. "that was used to generate the certificates in the bundle. " & _
  87. vbLf & vbLf & _
  88. "This does not have any effect on the certificate output, " & _
  89. "so this script will continue." & _
  90. vbLf & vbLf & _
  91. "If you want to set a custom location for OpenSSL or disable " & _
  92. "this message then edit the variables at the start of the " & _
  93. "script."), vbInformation, mySelf
  94. End If
  95. End If
  96. If (myAskTiF = TRUE) And (myUseOpenSSL = TRUE) Then
  97. If (6 = objShell.PopUp("Do you want to include text information about " & _
  98. "each certificate?" & vbLf & _
  99. "(Requires OpenSSL.exe in the current directory " & _
  100. "or search path)",, _
  101. mySelf, vbQuestion + vbYesNo + vbDefaultButton2)) Then
  102. myOptTxt = TRUE
  103. Else
  104. myOptTxt = FALSE
  105. End If
  106. End If
  107. ' Uncomment the line below to ignore SSL invalid cert errors
  108. ' objHttp.Option(4) = 256 + 512 + 4096 + 8192
  109. objHttp.SetTimeouts 0, 5000, 10000, 10000
  110. objHttp.Open "GET", myUrl, FALSE
  111. objHttp.setRequestHeader "User-Agent", WScript.ScriptName & "/" & myVersion
  112. objHttp.Send ""
  113. If Not (objHttp.Status = 200) Then
  114. MsgBox("Failed to download '" & myCdFile & "': " & objHttp.Status & " - " & objHttp.StatusText), vbCritical, mySelf
  115. WScript.Quit 1
  116. End If
  117. ' Write received data to file if enabled
  118. If (myCdSavF = TRUE) Then
  119. Call SaveBinaryData(myCdFile, objHttp.ResponseBody)
  120. End If
  121. ' Convert data from ResponseBody instead of using ResponseText because of UTF-8
  122. myCdData = ConvertBinaryToUTF8(objHttp.ResponseBody)
  123. Set objHttp = Nothing
  124. ' Backup exitsing ca-bundle certificate file
  125. If (myCaBakF = TRUE) Then
  126. If objFSO.FileExists(myCaFile) Then
  127. Dim myBakFile, b
  128. b = 1
  129. myBakFile = myCaFile & ".~" & b & "~"
  130. While objFSO.FileExists(myBakFile)
  131. b = b + 1
  132. myBakFile = myCaFile & ".~" & b & "~"
  133. Wend
  134. Set myTmpFh = objFSO.GetFile(myCaFile)
  135. myTmpFh.Move myBakFile
  136. End If
  137. End If
  138. ' Process the received data
  139. Dim myLines, myPattern, myInsideCert, myInsideLicense, myLicenseText, myNumCerts, myNumSkipped
  140. Dim myLabel, myOctets, myData, myPem, myRev, myUntrusted, j
  141. myNumSkipped = 0
  142. myNumCerts = 0
  143. myData = ""
  144. myLines = Split(myCdData, vbLf, -1)
  145. Set myStream = CreateObject("ADODB.Stream")
  146. myStream.Open
  147. myStream.Type = adTypeText
  148. myStream.Charset = "utf-8"
  149. myStream.WriteText "##" & vbLf & _
  150. "## Bundle of CA Root Certificates" & vbLf & _
  151. "##" & vbLf & _
  152. "## Certificate data from Mozilla as of: " & _
  153. ConvertDateToString(LocalDateToUTC(Now)) & " GMT" & vbLf & _
  154. "##" & vbLf & _
  155. "## This is a bundle of X.509 certificates of public Certificate Authorities" & vbLf & _
  156. "## (CA). These were automatically extracted from Mozilla's root certificates" & vbLf & _
  157. "## file (certdata.txt). This file can be found in the mozilla source tree:" & vbLf & _
  158. "## " & myUrl & vbLf & _
  159. "##" & vbLf & _
  160. "## It contains the certificates in PEM format and therefore" & vbLf & _
  161. "## can be directly used with curl / libcurl / php_curl, or with" & vbLf & _
  162. "## an Apache+mod_ssl webserver for SSL client authentication." & vbLf & _
  163. "## Just configure this file as the SSLCACertificateFile." & vbLf & _
  164. "##" & vbLf & _
  165. "## Conversion done with mk-ca-bundle.vbs version " & myVersion & "." & vbLf
  166. If (myCdSavF = TRUE) And (myUseOpenSSL = TRUE) Then
  167. myStream.WriteText "## SHA256: " & FileSHA256(myCdFile) & vbLf
  168. End If
  169. myStream.WriteText "##" & vbLf & vbLf
  170. myStream.WriteText vbLf
  171. For i = 0 To UBound(myLines)
  172. If InstrRev(myLines(i), "CKA_LABEL ") Then
  173. myPattern = "^CKA_LABEL\s+[A-Z0-9]+\s+""(.+?)"""
  174. myLabel = RegExprFirst(myPattern, myLines(i))
  175. End If
  176. If (myInsideCert = TRUE) Then
  177. If InstrRev(myLines(i), "END") Then
  178. myInsideCert = FALSE
  179. While (i < UBound(myLines)) And Not (myLines(i) = "#")
  180. i = i + 1
  181. If InstrRev(myLines(i), "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR") Then
  182. myUntrusted = FALSE
  183. End If
  184. Wend
  185. If (myUntrusted = TRUE) Then
  186. myNumSkipped = myNumSkipped + 1
  187. Else
  188. myStream.WriteText myLabel & vbLf
  189. myStream.WriteText String(Len(myLabel), "=") & vbLf
  190. myPem = "-----BEGIN CERTIFICATE-----" & vbLf & _
  191. Base64Encode(myData) & vbLf & _
  192. "-----END CERTIFICATE-----" & vbLf
  193. If (myOptTxt = FALSE) Then
  194. myStream.WriteText myPem & vbLf
  195. Else
  196. Dim myCmd, myRval, myTmpIn, myTmpOut
  197. myTmpIn = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
  198. myTmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
  199. Set myTmpFh = objFSO.OpenTextFile(myTmpIn, 2, TRUE)
  200. myTmpFh.Write myPem
  201. myTmpFh.Close
  202. myCmd = """" & myOpenSSL & """ x509 -md5 -fingerprint -text " & _
  203. "-inform PEM -in " & myTmpIn & " -out " & myTmpOut
  204. myRval = objShell.Run (myCmd, 0, TRUE)
  205. objFSO.DeleteFile myTmpIn, TRUE
  206. If Not (myRval = 0) Then
  207. MsgBox("Failed to process PEM cert with OpenSSL commandline!"), vbCritical, mySelf
  208. objFSO.DeleteFile myTmpOut, TRUE
  209. WScript.Quit 3
  210. End If
  211. Set myTmpFh = objFSO.OpenTextFile(myTmpOut, 1)
  212. myStream.WriteText myTmpFh.ReadAll & vbLf
  213. myTmpFh.Close
  214. objFSO.DeleteFile myTmpOut, TRUE
  215. End If
  216. myNumCerts = myNumCerts + 1
  217. End If
  218. Else
  219. myOctets = Split(myLines(i), "\")
  220. For j = 1 To UBound(myOctets)
  221. myData = myData & Chr(CByte("&o" & myOctets(j)))
  222. Next
  223. End If
  224. End If
  225. If InstrRev(myLines(i), "CVS_ID ") Then
  226. myPattern = "^CVS_ID\s+""(.+?)"""
  227. myRev = RegExprFirst(myPattern, myLines(i))
  228. myStream.WriteText "# " & myRev & vbLf & vbLf
  229. End If
  230. If InstrRev(myLines(i), "CKA_VALUE MULTILINE_OCTAL") Then
  231. myInsideCert = TRUE
  232. myUntrusted = TRUE
  233. myData = ""
  234. End If
  235. If InstrRev(myLines(i), "***** BEGIN LICENSE BLOCK *****") Then
  236. myInsideLicense = TRUE
  237. End If
  238. If (myInsideLicense = TRUE) Then
  239. myStream.WriteText myLines(i) & vbLf
  240. myLicenseText = myLicenseText & Mid(myLines(i), 2) & vbLf
  241. End If
  242. If InstrRev(myLines(i), "***** END LICENSE BLOCK *****") Then
  243. myInsideLicense = FALSE
  244. If (myAskLiF = TRUE) Then
  245. If Not (6 = objShell.PopUp(myLicenseText & vbLf & _
  246. "Do you agree to the license shown above (required to proceed) ?",, _
  247. mySelf, vbQuestion + vbYesNo + vbDefaultButton1)) Then
  248. myStream.Close
  249. objFSO.DeleteFile myCaFile, TRUE
  250. WScript.Quit 2
  251. End If
  252. End If
  253. End If
  254. Next
  255. ' To stop the UTF-8 BOM from being written the stream has to be copied and
  256. ' then saved as binary.
  257. Dim myCopy
  258. Set myCopy = CreateObject("ADODB.Stream")
  259. myCopy.Type = adTypeBinary
  260. myCopy.Open
  261. myStream.Position = 3 ' Skip UTF-8 BOM
  262. myStream.CopyTo myCopy
  263. myCopy.SaveToFile myCaFile, adSaveCreateOverWrite
  264. myCopy.Close
  265. myStream.Close
  266. Set myCopy = Nothing
  267. Set myStream = Nothing
  268. ' Done
  269. objShell.PopUp "Done (" & myNumCerts & " CA certs processed, " & myNumSkipped & _
  270. " untrusted skipped).", 20, mySelf, vbInformation
  271. WScript.Quit 0
  272. Function ConvertBinaryToUTF8(arrBytes)
  273. Dim objStream
  274. Set objStream = CreateObject("ADODB.Stream")
  275. objStream.Open
  276. objStream.Type = adTypeBinary
  277. objStream.Write arrBytes
  278. objStream.Position = 0
  279. objStream.Type = adTypeText
  280. objStream.Charset = "utf-8"
  281. ConvertBinaryToUTF8 = objStream.ReadText
  282. Set objStream = Nothing
  283. End Function
  284. Function SaveBinaryData(filename, data)
  285. Dim objStream
  286. Set objStream = CreateObject("ADODB.Stream")
  287. objStream.Type = adTypeBinary
  288. objStream.Open
  289. objStream.Write data
  290. objStream.SaveToFile filename, adSaveCreateOverWrite
  291. objStream.Close
  292. Set objStream = Nothing
  293. End Function
  294. Function RegExprFirst(SearchPattern, TheString)
  295. Dim objRegExp, Matches ' create variables.
  296. Set objRegExp = New RegExp ' create a regular expression.
  297. objRegExp.Pattern = SearchPattern ' sets the search pattern.
  298. objRegExp.IgnoreCase = TRUE ' set to ignores case.
  299. objRegExp.Global = TRUE ' set to gloabal search.
  300. Set Matches = objRegExp.Execute(TheString) ' do the search.
  301. If (Matches.Count) Then
  302. RegExprFirst = Matches(0).SubMatches(0) ' return first match.
  303. Else
  304. RegExprFirst = ""
  305. End If
  306. Set objRegExp = Nothing
  307. End Function
  308. Function Base64Encode(inData)
  309. Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
  310. Dim cOut, sOut, lWrap, I
  311. lWrap = Int(myWrapLe * 3 / 4)
  312. 'For each group of 3 bytes
  313. For I = 1 To Len(inData) Step 3
  314. Dim nGroup, pOut, sGroup
  315. 'Create one long from this 3 bytes.
  316. nGroup = &H10000 * Asc(Mid(inData, I, 1)) + _
  317. &H100 * MyASC(Mid(inData, I + 1, 1)) + _
  318. MyASC(Mid(inData, I + 2, 1))
  319. 'Oct splits the long To 8 groups with 3 bits
  320. nGroup = Oct(nGroup)
  321. 'Add leading zeros
  322. nGroup = String(8 - Len(nGroup), "0") & nGroup
  323. 'Convert To base64
  324. pOut = Mid(Base64, CLng("&o" & Mid(nGroup, 1, 2)) + 1, 1) & _
  325. Mid(Base64, CLng("&o" & Mid(nGroup, 3, 2)) + 1, 1) & _
  326. Mid(Base64, CLng("&o" & Mid(nGroup, 5, 2)) + 1, 1) & _
  327. Mid(Base64, CLng("&o" & Mid(nGroup, 7, 2)) + 1, 1)
  328. 'Add the part To OutPut string
  329. sOut = sOut + pOut
  330. 'Add a new line For Each myWrapLe chars In dest
  331. If (I < Len(inData) - 2) Then
  332. If (I + 2) Mod lWrap = 0 Then sOut = sOut & vbLf
  333. End If
  334. Next
  335. Select Case Len(inData) Mod 3
  336. Case 1: '8 bit final
  337. sOut = Left(sOut, Len(sOut) - 2) & "=="
  338. Case 2: '16 bit final
  339. sOut = Left(sOut, Len(sOut) - 1) & "="
  340. End Select
  341. Base64Encode = sOut
  342. End Function
  343. Function MyASC(OneChar)
  344. If OneChar = "" Then MyASC = 0 Else MyASC = Asc(OneChar)
  345. End Function
  346. ' Return the date in the same format as perl to match mk-ca-bundle.pl output:
  347. ' Wed Sep 7 03:12:05 2016
  348. Function ConvertDateToString(input)
  349. Dim output
  350. output = WeekDayName(WeekDay(input), TRUE) & " " & _
  351. MonthName(Month(input), TRUE) & " "
  352. If (Len(Day(input)) = 1) Then
  353. output = output & " "
  354. End If
  355. output = output & _
  356. Day(input) & " " & _
  357. FormatDateTime(input, vbShortTime) & ":"
  358. If (Len(Second(input)) = 1) Then
  359. output = output & "0"
  360. End If
  361. output = output & _
  362. Second(input) & " " & _
  363. Year(input)
  364. ConvertDateToString = output
  365. End Function
  366. ' Convert local Date to UTC. Microsoft says:
  367. ' Use Win32_ComputerSystem CurrentTimeZone property, because it automatically
  368. ' adjusts the Time Zone bias for daylight saving time; Win32_Time Zone Bias
  369. ' property does not.
  370. ' https://msdn.microsoft.com/en-us/library/windows/desktop/ms696015.aspx
  371. Function LocalDateToUTC(localdate)
  372. Dim item, offset
  373. For Each item In GetObject("winmgmts:").InstancesOf("Win32_ComputerSystem")
  374. offset = item.CurrentTimeZone ' the offset in minutes
  375. Next
  376. If (offset < 0) Then
  377. LocalDateToUTC = DateAdd("n", ABS(offset), localdate)
  378. Else
  379. LocalDateToUTC = DateAdd("n", -ABS(offset), localdate)
  380. End If
  381. 'objShell.PopUp LocalDateToUTC
  382. End Function
  383. Function FileSHA256(filename)
  384. Dim cmd, rval, tmpOut, tmpFh
  385. if (myUseOpenSSL = TRUE) Then
  386. tmpOut = objFSO.GetSpecialFolder(2).Path & "\" & objFSO.GetTempName
  387. cmd = """" & myOpenSSL & """ dgst -r -sha256 -out """ & tmpOut & """ """ & filename & """"
  388. rval = objShell.Run(cmd, 0, TRUE)
  389. If Not (rval = 0) Then
  390. MsgBox("Failed to get sha256 of """ & filename & """ with OpenSSL commandline!"), vbCritical, mySelf
  391. objFSO.DeleteFile tmpOut, TRUE
  392. WScript.Quit 3
  393. End If
  394. Set tmpFh = objFSO.OpenTextFile(tmpOut, 1)
  395. FileSHA256 = RegExprFirst("^([0-9a-f]{64}) .+", tmpFh.ReadAll)
  396. tmpFh.Close
  397. objFSO.DeleteFile tmpOut, TRUE
  398. Else
  399. FileSHA256 = ""
  400. End If
  401. End Function