1 /*
2  * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * Redistributions of source code must retain the above copyright notice, this
8  * list of conditions and the following disclaimer.
9  *
10  * Redistributions in binary form must reproduce the above copyright notice,
11  * this list of conditions and the following disclaimer in the documentation
12  * and/or other materials provided with the distribution.
13  *
14  * Neither the name of ARM nor the names of its contributors may be used
15  * to endorse or promote products derived from this software without specific
16  * prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 #include <getopt.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 
36 #include <openssl/conf.h>
37 #include <openssl/engine.h>
38 #include <openssl/err.h>
39 #include <openssl/pem.h>
40 #include <openssl/sha.h>
41 #include <openssl/x509v3.h>
42 
43 #include "cert.h"
44 #include "debug.h"
45 #include "ext.h"
46 #include "key.h"
47 #include "platform_oid.h"
48 #include "sha.h"
49 #include "tbb_ext.h"
50 #include "tbb_cert.h"
51 #include "tbb_key.h"
52 
53 /*
54  * Helper macros to simplify the code. This macro assigns the return value of
55  * the 'fn' function to 'v' and exits if the value is NULL.
56  */
57 #define CHECK_NULL(v, fn) \
58 	do { \
59 		v = fn; \
60 		if (v == NULL) { \
61 			ERROR("NULL object at %s:%d\n", __FILE__, __LINE__); \
62 			exit(1); \
63 		} \
64 	} while (0)
65 
66 /*
67  * This macro assigns the NID corresponding to 'oid' to 'v' and exits if the
68  * NID is undefined.
69  */
70 #define CHECK_OID(v, oid) \
71 	do { \
72 		v = OBJ_txt2nid(oid); \
73 		if (v == NID_undef) { \
74 			ERROR("Cannot find TBB extension %s\n", oid); \
75 			exit(1); \
76 		} \
77 	} while (0)
78 
79 #define MAX_FILENAME_LEN		1024
80 #define VAL_DAYS			7300
81 #define ID_TO_BIT_MASK(id)		(1 << id)
82 #define NVCOUNTER_VALUE			0
83 
84 /* Files */
85 enum {
86 	/* Image file names (inputs) */
87 	BL2_ID = 0,
88 	BL30_ID,
89 	BL31_ID,
90 	BL32_ID,
91 	BL33_ID,
92 	/* Certificate file names (outputs) */
93 	BL2_CERT_ID,
94 	TRUSTED_KEY_CERT_ID,
95 	BL30_KEY_CERT_ID,
96 	BL30_CERT_ID,
97 	BL31_KEY_CERT_ID,
98 	BL31_CERT_ID,
99 	BL32_KEY_CERT_ID,
100 	BL32_CERT_ID,
101 	BL33_KEY_CERT_ID,
102 	BL33_CERT_ID,
103 	/* Key file names (input/output) */
104 	ROT_KEY_ID,
105 	TRUSTED_WORLD_KEY_ID,
106 	NON_TRUSTED_WORLD_KEY_ID,
107 	BL30_KEY_ID,
108 	BL31_KEY_ID,
109 	BL32_KEY_ID,
110 	BL33_KEY_ID,
111 	NUM_OPTS
112 };
113 
114 /* Global options */
115 static int new_keys;
116 static int save_keys;
117 static int print_cert;
118 static int bl30_present;
119 static int bl32_present;
120 
121 /* We are not checking nvcounters in TF. Include them in the certificates but
122  * the value will be set to 0 */
123 static int tf_nvcounter;
124 static int non_tf_nvcounter;
125 
126 /* Info messages created in the Makefile */
127 extern const char build_msg[];
128 extern const char platform_msg[];
129 
130 
strdup(const char * str)131 static char *strdup(const char *str)
132 {
133 	int n = strlen(str) + 1;
134 	char *dup = malloc(n);
135 	if (dup) {
136 		strcpy(dup, str);
137 	}
138 	return dup;
139 }
140 
141 /* Command line options */
142 static const struct option long_opt[] = {
143 	/* Binary images */
144 	{"bl2", required_argument, 0, BL2_ID},
145 	{"bl30", required_argument, 0, BL30_ID},
146 	{"bl31", required_argument, 0, BL31_ID},
147 	{"bl32", required_argument, 0, BL32_ID},
148 	{"bl33", required_argument, 0, BL33_ID},
149 	/* Certificate files */
150 	{"bl2-cert", required_argument, 0, BL2_CERT_ID},
151 	{"trusted-key-cert", required_argument, 0, TRUSTED_KEY_CERT_ID},
152 	{"bl30-key-cert", required_argument, 0, BL30_KEY_CERT_ID},
153 	{"bl30-cert", required_argument, 0, BL30_CERT_ID},
154 	{"bl31-key-cert", required_argument, 0, BL31_KEY_CERT_ID},
155 	{"bl31-cert", required_argument, 0, BL31_CERT_ID},
156 	{"bl32-key-cert", required_argument, 0, BL32_KEY_CERT_ID},
157 	{"bl32-cert", required_argument, 0, BL32_CERT_ID},
158 	{"bl33-key-cert", required_argument, 0, BL33_KEY_CERT_ID},
159 	{"bl33-cert", required_argument, 0, BL33_CERT_ID},
160 	/* Private key files */
161 	{"rot-key", required_argument, 0, ROT_KEY_ID},
162 	{"trusted-world-key", required_argument, 0, TRUSTED_WORLD_KEY_ID},
163 	{"non-trusted-world-key", required_argument, 0, NON_TRUSTED_WORLD_KEY_ID},
164 	{"bl30-key", required_argument, 0, BL30_KEY_ID},
165 	{"bl31-key", required_argument, 0, BL31_KEY_ID},
166 	{"bl32-key", required_argument, 0, BL32_KEY_ID},
167 	{"bl33-key", required_argument, 0, BL33_KEY_ID},
168 	/* Common options */
169 	{"help", no_argument, 0, 'h'},
170 	{"save-keys", no_argument, 0, 'k'},
171 	{"new-chain", no_argument, 0, 'n'},
172 	{"print-cert", no_argument, 0, 'p'},
173 	{0, 0, 0, 0}
174 };
175 
print_help(const char * cmd)176 static void print_help(const char *cmd)
177 {
178 	int i = 0;
179 	printf("\n\n");
180 	printf("The certificate generation tool loads the binary images and\n"
181 	       "optionally the RSA keys, and outputs the key and content\n"
182 	       "certificates properly signed to implement the chain of trust.\n"
183 	       "If keys are provided, they must be in PEM format.\n"
184 	       "Certificates are generated in DER format.\n");
185 	printf("\n");
186 	printf("Usage:\n\n");
187 	printf("    %s [-hknp] \\\n", cmd);
188 	for (i = 0; i < NUM_OPTS; i++) {
189 		printf("        --%s <file>  \\\n", long_opt[i].name);
190 	}
191 	printf("\n");
192 	printf("-h    Print help and exit\n");
193 	printf("-k    Save key pairs into files. Filenames must be provided\n");
194 	printf("-n    Generate new key pairs if no key files are provided\n");
195 	printf("-p    Print the certificates in the standard output\n");
196 	printf("\n");
197 
198 	exit(0);
199 }
200 
check_cmd_params(void)201 static void check_cmd_params(void)
202 {
203 	/* BL2, BL31 and BL33 are mandatory */
204 	if (certs[BL2_CERT].bin == NULL) {
205 		ERROR("BL2 image not specified\n");
206 		exit(1);
207 	}
208 
209 	if (certs[BL31_CERT].bin == NULL) {
210 		ERROR("BL31 image not specified\n");
211 		exit(1);
212 	}
213 
214 	if (certs[BL33_CERT].bin == NULL) {
215 		ERROR("BL33 image not specified\n");
216 		exit(1);
217 	}
218 
219 	/* BL30 and BL32 are optional */
220 	if (certs[BL30_CERT].bin != NULL) {
221 		bl30_present = 1;
222 	}
223 
224 	if (certs[BL32_CERT].bin != NULL) {
225 		bl32_present = 1;
226 	}
227 
228 	/* TODO: Certificate filenames */
229 
230 	/* Filenames to store keys must be specified */
231 	if (save_keys || !new_keys) {
232 		if (keys[ROT_KEY].fn == NULL) {
233 			ERROR("ROT key not specified\n");
234 			exit(1);
235 		}
236 
237 		if (keys[TRUSTED_WORLD_KEY].fn == NULL) {
238 			ERROR("Trusted World key not specified\n");
239 			exit(1);
240 		}
241 
242 		if (keys[NON_TRUSTED_WORLD_KEY].fn == NULL) {
243 			ERROR("Non-trusted World key not specified\n");
244 			exit(1);
245 		}
246 
247 		if (keys[BL31_KEY].fn == NULL) {
248 			ERROR("BL31 key not specified\n");
249 			exit(1);
250 		}
251 
252 		if (keys[BL33_KEY].fn == NULL) {
253 			ERROR("BL33 key not specified\n");
254 			exit(1);
255 		}
256 
257 		if (bl30_present && (keys[BL30_KEY].fn == NULL)) {
258 			ERROR("BL30 key not specified\n");
259 			exit(1);
260 		}
261 
262 		if (bl32_present && (keys[BL32_KEY].fn == NULL)) {
263 			ERROR("BL32 key not specified\n");
264 			exit(1);
265 		}
266 	}
267 }
268 
main(int argc,char * argv[])269 int main(int argc, char *argv[])
270 {
271 	STACK_OF(X509_EXTENSION) * sk = NULL;
272 	X509_EXTENSION *hash_ext = NULL;
273 	X509_EXTENSION *nvctr_ext = NULL;
274 	X509_EXTENSION *trusted_key_ext = NULL;
275 	X509_EXTENSION *non_trusted_key_ext = NULL;
276 	FILE *file = NULL;
277 	int i, tz_nvctr_nid, ntz_nvctr_nid, hash_nid, pk_nid;
278 	int c, opt_idx = 0;
279 	unsigned char md[SHA256_DIGEST_LENGTH];
280 
281 	NOTICE("CoT Generation Tool: %s\n", build_msg);
282 	NOTICE("Target platform: %s\n", platform_msg);
283 
284 	while (1) {
285 		/* getopt_long stores the option index here. */
286 		c = getopt_long(argc, argv, "hknp", long_opt, &opt_idx);
287 
288 		/* Detect the end of the options. */
289 		if (c == -1) {
290 			break;
291 		}
292 
293 		switch (c) {
294 		case 'h':
295 			print_help(argv[0]);
296 			break;
297 		case 'k':
298 			save_keys = 1;
299 			break;
300 		case 'n':
301 			new_keys = 1;
302 			break;
303 		case 'p':
304 			print_cert = 1;
305 			break;
306 		case BL2_ID:
307 			certs[BL2_CERT].bin = strdup(optarg);
308 			break;
309 		case BL30_ID:
310 			certs[BL30_CERT].bin = strdup(optarg);
311 			break;
312 		case BL31_ID:
313 			certs[BL31_CERT].bin = strdup(optarg);
314 			break;
315 		case BL32_ID:
316 			certs[BL32_CERT].bin = strdup(optarg);
317 			break;
318 		case BL33_ID:
319 			certs[BL33_CERT].bin = strdup(optarg);
320 			break;
321 		case BL2_CERT_ID:
322 			certs[BL2_CERT].fn = strdup(optarg);
323 			break;
324 		case TRUSTED_KEY_CERT_ID:
325 			certs[TRUSTED_KEY_CERT].fn = strdup(optarg);
326 			break;
327 		case BL30_KEY_CERT_ID:
328 			certs[BL30_KEY_CERT].fn = strdup(optarg);
329 			break;
330 		case BL30_CERT_ID:
331 			certs[BL30_CERT].fn = strdup(optarg);
332 			break;
333 		case BL31_KEY_CERT_ID:
334 			certs[BL31_KEY_CERT].fn = strdup(optarg);
335 			break;
336 		case BL31_CERT_ID:
337 			certs[BL31_CERT].fn = strdup(optarg);
338 			break;
339 		case BL32_KEY_CERT_ID:
340 			certs[BL32_KEY_CERT].fn = strdup(optarg);
341 			break;
342 		case BL32_CERT_ID:
343 			certs[BL32_CERT].fn = strdup(optarg);
344 			break;
345 		case BL33_KEY_CERT_ID:
346 			certs[BL33_KEY_CERT].fn = strdup(optarg);
347 			break;
348 		case BL33_CERT_ID:
349 			certs[BL33_CERT].fn = strdup(optarg);
350 			break;
351 		case ROT_KEY_ID:
352 			keys[ROT_KEY].fn = strdup(optarg);
353 			break;
354 		case TRUSTED_WORLD_KEY_ID:
355 			keys[TRUSTED_WORLD_KEY].fn = strdup(optarg);
356 			break;
357 		case NON_TRUSTED_WORLD_KEY_ID:
358 			keys[NON_TRUSTED_WORLD_KEY].fn = strdup(optarg);
359 			break;
360 		case BL30_KEY_ID:
361 			keys[BL30_KEY].fn = strdup(optarg);
362 			break;
363 		case BL31_KEY_ID:
364 			keys[BL31_KEY].fn = strdup(optarg);
365 			break;
366 		case BL32_KEY_ID:
367 			keys[BL32_KEY].fn = strdup(optarg);
368 			break;
369 		case BL33_KEY_ID:
370 			keys[BL33_KEY].fn = strdup(optarg);
371 			break;
372 		case '?':
373 		default:
374 			printf("%s\n", optarg);
375 			exit(1);
376 		}
377 	}
378 
379 	/* Set the value of the NVCounters */
380 	tf_nvcounter = NVCOUNTER_VALUE;
381 	non_tf_nvcounter = NVCOUNTER_VALUE;
382 
383 	/* Check command line arguments */
384 	check_cmd_params();
385 
386 	/* Register the new types and OIDs for the extensions */
387 	if (ext_init(tbb_ext) != 0) {
388 		ERROR("Cannot initialize TBB extensions\n");
389 		exit(1);
390 	}
391 
392 	/* Get non-volatile counters NIDs */
393 	CHECK_OID(tz_nvctr_nid, TZ_FW_NVCOUNTER_OID);
394 	CHECK_OID(ntz_nvctr_nid, NTZ_FW_NVCOUNTER_OID);
395 
396 	/* Load private keys from files (or generate new ones) */
397 	if (new_keys) {
398 		for (i = 0 ; i < NUM_KEYS ; i++) {
399 			if (!key_new(&keys[i])) {
400 				ERROR("Error creating %s\n", keys[i].desc);
401 				exit(1);
402 			}
403 		}
404 	} else {
405 		for (i = 0 ; i < NUM_KEYS ; i++) {
406 			if (!key_load(&keys[i])) {
407 				ERROR("Error loading %s\n", keys[i].desc);
408 				exit(1);
409 			}
410 		}
411 	}
412 
413 	/* *********************************************************************
414 	 * BL2 certificate (Trusted Boot Firmware certificate):
415 	 *     - Self-signed with OEM ROT private key
416 	 *     - Extensions:
417 	 *         - TrustedFirmwareNVCounter (TODO)
418 	 *         - BL2 hash
419 	 **********************************************************************/
420 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
421 
422 	/* Add the NVCounter as a critical extension */
423 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
424 			tf_nvcounter));
425 	sk_X509_EXTENSION_push(sk, nvctr_ext);
426 
427 	/* Add hash of BL2 as an extension */
428 	if (!sha_file(certs[BL2_CERT].bin, md)) {
429 		ERROR("Cannot calculate the hash of %s\n", certs[BL2_CERT].bin);
430 		exit(1);
431 	}
432 	CHECK_OID(hash_nid, BL2_HASH_OID);
433 	CHECK_NULL(hash_ext, ext_new_hash(hash_nid, EXT_CRIT, md,
434 			SHA256_DIGEST_LENGTH));
435 	sk_X509_EXTENSION_push(sk, hash_ext);
436 
437 	/* Create certificate. Signed with ROT key */
438 	if (!cert_new(&certs[BL2_CERT], VAL_DAYS, 0, sk)) {
439 		ERROR("Cannot create %s\n", certs[BL2_CERT].cn);
440 		exit(1);
441 	}
442 	sk_X509_EXTENSION_free(sk);
443 
444 	/* *********************************************************************
445 	 * Trusted Key certificate:
446 	 *     - Self-signed with OEM ROT private key
447 	 *     - Extensions:
448 	 *         - TrustedFirmwareNVCounter (TODO)
449 	 *         - TrustedWorldPK
450 	 *         - NonTrustedWorldPK
451 	 **********************************************************************/
452 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
453 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
454 			tf_nvcounter));
455 	sk_X509_EXTENSION_push(sk, nvctr_ext);
456 	CHECK_OID(pk_nid, TZ_WORLD_PK_OID);
457 	CHECK_NULL(trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
458 			keys[TRUSTED_WORLD_KEY].key));
459 	sk_X509_EXTENSION_push(sk, trusted_key_ext);
460 	CHECK_OID(pk_nid, NTZ_WORLD_PK_OID);
461 	CHECK_NULL(non_trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
462 			keys[NON_TRUSTED_WORLD_KEY].key));
463 	sk_X509_EXTENSION_push(sk, non_trusted_key_ext);
464 	if (!cert_new(&certs[TRUSTED_KEY_CERT], VAL_DAYS, 0, sk)) {
465 		ERROR("Cannot create %s\n", certs[TRUSTED_KEY_CERT].cn);
466 		exit(1);
467 	}
468 	sk_X509_EXTENSION_free(sk);
469 
470 	/* *********************************************************************
471 	 * BL30 Key certificate (Trusted SCP Firmware Key certificate):
472 	 *     - Self-signed with Trusted World key
473 	 *     - Extensions:
474 	 *         - TrustedFirmwareNVCounter (TODO)
475 	 *         - SCPFirmwareContentCertPK
476 	 **********************************************************************/
477 	if (bl30_present) {
478 		CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
479 		CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
480 				tf_nvcounter));
481 		sk_X509_EXTENSION_push(sk, nvctr_ext);
482 		CHECK_OID(pk_nid, BL30_CONTENT_CERT_PK_OID);
483 		CHECK_NULL(trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
484 				keys[BL30_KEY].key));
485 		sk_X509_EXTENSION_push(sk, trusted_key_ext);
486 		if (!cert_new(&certs[BL30_KEY_CERT], VAL_DAYS, 0, sk)) {
487 			ERROR("Cannot create %s\n", certs[BL30_KEY_CERT].cn);
488 			exit(1);
489 		}
490 		sk_X509_EXTENSION_free(sk);
491 	}
492 
493 	/* *********************************************************************
494 	 * BL30 certificate (SCP Firmware Content certificate):
495 	 *     - Signed with Trusted World Key
496 	 *     - Extensions:
497 	 *         - TrustedFirmwareNVCounter (TODO)
498 	 *         - SCPFirmwareHash
499 	 **********************************************************************/
500 	if (bl30_present) {
501 		CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
502 		CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
503 				tf_nvcounter));
504 		sk_X509_EXTENSION_push(sk, nvctr_ext);
505 
506 		if (!sha_file(certs[BL30_CERT].bin, md)) {
507 			ERROR("Cannot calculate the hash of %s\n",
508 					certs[BL30_CERT].bin);
509 			exit(1);
510 		}
511 		CHECK_OID(hash_nid, BL30_HASH_OID);
512 		CHECK_NULL(hash_ext, ext_new_hash(hash_nid, EXT_CRIT, md,
513 				SHA256_DIGEST_LENGTH));
514 		sk_X509_EXTENSION_push(sk, hash_ext);
515 
516 		if (!cert_new(&certs[BL30_CERT], VAL_DAYS, 0, sk)) {
517 			ERROR("Cannot create %s\n", certs[BL30_CERT].cn);
518 			exit(1);
519 		}
520 
521 		sk_X509_EXTENSION_free(sk);
522 	}
523 
524 	/* *********************************************************************
525 	 * BL31 Key certificate (Trusted SoC Firmware Key certificate):
526 	 *     - Self-signed with Trusted World key
527 	 *     - Extensions:
528 	 *         - TrustedFirmwareNVCounter (TODO)
529 	 *         - SoCFirmwareContentCertPK
530 	 **********************************************************************/
531 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
532 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
533 			tf_nvcounter));
534 	sk_X509_EXTENSION_push(sk, nvctr_ext);
535 	CHECK_OID(pk_nid, BL31_CONTENT_CERT_PK_OID);
536 	CHECK_NULL(trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
537 			keys[BL31_KEY].key));
538 	sk_X509_EXTENSION_push(sk, trusted_key_ext);
539 	if (!cert_new(&certs[BL31_KEY_CERT], VAL_DAYS, 0, sk)) {
540 		ERROR("Cannot create %s\n", certs[BL31_KEY_CERT].cn);
541 		exit(1);
542 	}
543 	sk_X509_EXTENSION_free(sk);
544 
545 	/* *********************************************************************
546 	 * BL31 certificate (SOC Firmware Content certificate):
547 	 *     - Signed with Trusted World Key
548 	 *     - Extensions:
549 	 *         - TrustedFirmwareNVCounter (TODO)
550 	 *         - BL31 hash
551 	 **********************************************************************/
552 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
553 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
554 			tf_nvcounter));
555 	sk_X509_EXTENSION_push(sk, nvctr_ext);
556 
557 	if (!sha_file(certs[BL31_CERT].bin, md)) {
558 		ERROR("Cannot calculate the hash of %s\n", certs[BL31_CERT].bin);
559 		exit(1);
560 	}
561 	CHECK_OID(hash_nid, BL31_HASH_OID);
562 	CHECK_NULL(hash_ext, ext_new_hash(hash_nid, EXT_CRIT, md,
563 			SHA256_DIGEST_LENGTH));
564 	sk_X509_EXTENSION_push(sk, hash_ext);
565 
566 	if (!cert_new(&certs[BL31_CERT], VAL_DAYS, 0, sk)) {
567 		ERROR("Cannot create %s\n", certs[BL31_CERT].cn);
568 		exit(1);
569 	}
570 
571 	sk_X509_EXTENSION_free(sk);
572 
573 	/* *********************************************************************
574 	 * BL32 Key certificate (Trusted OS Firmware Key certificate):
575 	 *     - Self-signed with Trusted World key
576 	 *     - Extensions:
577 	 *         - TrustedFirmwareNVCounter (TODO)
578 	 *         - TrustedOSFirmwareContentCertPK
579 	 **********************************************************************/
580 	if (bl32_present) {
581 		CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
582 		CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
583 				tf_nvcounter));
584 		sk_X509_EXTENSION_push(sk, nvctr_ext);
585 		CHECK_OID(pk_nid, BL32_CONTENT_CERT_PK_OID);
586 		CHECK_NULL(trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
587 				keys[BL32_KEY].key));
588 		sk_X509_EXTENSION_push(sk, trusted_key_ext);
589 		if (!cert_new(&certs[BL32_KEY_CERT], VAL_DAYS, 0, sk)) {
590 			ERROR("Cannot create %s\n", certs[BL32_KEY_CERT].cn);
591 			exit(1);
592 		}
593 		sk_X509_EXTENSION_free(sk);
594 	}
595 
596 	/* *********************************************************************
597 	 * BL32 certificate (TrustedOS Firmware Content certificate):
598 	 *     - Signed with Trusted World Key
599 	 *     - Extensions:
600 	 *         - TrustedFirmwareNVCounter (TODO)
601 	 *         - BL32 hash
602 	 **********************************************************************/
603 	if (bl32_present) {
604 		CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
605 		CHECK_NULL(nvctr_ext, ext_new_nvcounter(tz_nvctr_nid, EXT_CRIT,
606 				tf_nvcounter));
607 		sk_X509_EXTENSION_push(sk, nvctr_ext);
608 
609 		if (!sha_file(certs[BL32_CERT].bin, md)) {
610 			ERROR("Cannot calculate the hash of %s\n",
611 					certs[BL32_CERT].bin);
612 			exit(1);
613 		}
614 		CHECK_OID(hash_nid, BL32_HASH_OID);
615 		CHECK_NULL(hash_ext, ext_new_hash(hash_nid, EXT_CRIT, md,
616 				SHA256_DIGEST_LENGTH));
617 		sk_X509_EXTENSION_push(sk, hash_ext);
618 
619 		if (!cert_new(&certs[BL32_CERT], VAL_DAYS, 0, sk)) {
620 			ERROR("Cannot create %s\n", certs[BL32_CERT].cn);
621 			exit(1);
622 		}
623 
624 		sk_X509_EXTENSION_free(sk);
625 	}
626 
627 	/* *********************************************************************
628 	 * BL33 Key certificate (Non Trusted Firmware Key certificate):
629 	 *     - Self-signed with Non Trusted World key
630 	 *     - Extensions:
631 	 *         - NonTrustedFirmwareNVCounter (TODO)
632 	 *         - NonTrustedFirmwareContentCertPK
633 	 **********************************************************************/
634 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
635 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(ntz_nvctr_nid, EXT_CRIT,
636 			non_tf_nvcounter));
637 	sk_X509_EXTENSION_push(sk, nvctr_ext);
638 	CHECK_OID(pk_nid, BL33_CONTENT_CERT_PK_OID);
639 	CHECK_NULL(non_trusted_key_ext, ext_new_key(pk_nid, EXT_CRIT,
640 			keys[BL33_KEY].key));
641 	sk_X509_EXTENSION_push(sk, non_trusted_key_ext);
642 	if (!cert_new(&certs[BL33_KEY_CERT], VAL_DAYS, 0, sk)) {
643 		ERROR("Cannot create %s\n", certs[BL33_KEY_CERT].cn);
644 		exit(1);
645 	}
646 	sk_X509_EXTENSION_free(sk);
647 
648 	/* *********************************************************************
649 	 * BL33 certificate (Non-Trusted World Content certificate):
650 	 *     - Signed with Non-Trusted World Key
651 	 *     - Extensions:
652 	 *         - NonTrustedFirmwareNVCounter (TODO)
653 	 *         - BL33 hash
654 	 **********************************************************************/
655 	CHECK_NULL(sk, sk_X509_EXTENSION_new_null());
656 	CHECK_NULL(nvctr_ext, ext_new_nvcounter(ntz_nvctr_nid, EXT_CRIT,
657 			non_tf_nvcounter));
658 	sk_X509_EXTENSION_push(sk, nvctr_ext);
659 
660 	if (!sha_file(certs[BL33_CERT].bin, md)) {
661 		ERROR("Cannot calculate the hash of %s\n", certs[BL33_CERT].bin);
662 		exit(1);
663 	}
664 	CHECK_OID(hash_nid, BL33_HASH_OID);
665 	CHECK_NULL(hash_ext, ext_new_hash(hash_nid, EXT_CRIT, md,
666 			SHA256_DIGEST_LENGTH));
667 	sk_X509_EXTENSION_push(sk, hash_ext);
668 
669 	if (!cert_new(&certs[BL33_CERT], VAL_DAYS, 0, sk)) {
670 		ERROR("Cannot create %s\n", certs[BL33_CERT].cn);
671 		exit(1);
672 	}
673 	sk_X509_EXTENSION_free(sk);
674 
675 	/* Print the certificates */
676 	if (print_cert) {
677 		for (i = 0 ; i < NUM_CERTIFICATES ; i++) {
678 			if (!certs[i].x) {
679 				continue;
680 			}
681 			printf("\n\n=====================================\n\n");
682 			X509_print_fp(stdout, certs[i].x);
683 		}
684 	}
685 
686 	/* Save created certificates to files */
687 	for (i = 0 ; i < NUM_CERTIFICATES ; i++) {
688 		if (certs[i].x && certs[i].fn) {
689 			file = fopen(certs[i].fn, "w");
690 			if (file != NULL) {
691 				i2d_X509_fp(file, certs[i].x);
692 				fclose(file);
693 			} else {
694 				ERROR("Cannot create file %s\n", certs[i].fn);
695 			}
696 		}
697 	}
698 
699 	/* Save keys */
700 	if (save_keys) {
701 		for (i = 0 ; i < NUM_KEYS ; i++) {
702 			if (!key_store(&keys[i])) {
703 				ERROR("Cannot save %s\n", keys[i].desc);
704 			}
705 		}
706 	}
707 
708 	X509_EXTENSION_free(hash_ext);
709 	X509_EXTENSION_free(nvctr_ext);
710 	X509_EXTENSION_free(trusted_key_ext);
711 	X509_EXTENSION_free(non_trusted_key_ext);
712 
713 #ifndef OPENSSL_NO_ENGINE
714 	ENGINE_cleanup();
715 #endif
716 	CRYPTO_cleanup_all_ex_data();
717 
718 	return 0;
719 }
720