@@ -94,7 +94,7 @@ function csr_details($id)

 function get_available_CAs()

 {

     $path = '/etc/apache2/certs/cabundle/';

-    $ret = glob($path.'*.pem');

+    $ret = glob($path . '*.pem');

     if (!$ret) {

         system_failure("Konnte die CA-Zertifikate nicht laden");

     }

@@ -116,7 +116,7 @@ function get_chain($cert)

     if ($result->rowCount() > 0) {

         $c = $result->fetch();

         //$chainfile = '/etc/apache2/certs/chains/'.$c['id'].'.pem';

-        DEBUG("identified fitting certificate chain #".$c['id']);

+        DEBUG("identified fitting certificate chain #" . $c['id']);

         return $c['id'];

     }

 }

@@ -165,7 +165,7 @@ function validate_certificate($cert, $key)

     // Prüfe ob Key und Zertifikat zusammen passen

     if (openssl_x509_check_private_key($cert, $key) !== true) {

-        DEBUG("Zertifikat und Key passen nicht zusammen: ".openssl_x509_check_private_key($cert, $key));

+        DEBUG("Zertifikat und Key passen nicht zusammen: " . openssl_x509_check_private_key($cert, $key));

         return CERT_INVALID;

     }

@@ -214,12 +214,12 @@ function parse_cert_details($cert)

         $issuer = $certdata['issuer']['O'];

     }

     if (isset($certdata['extensions']['subjectAltName'])) {

-        DEBUG("SAN: ".$certdata['extensions']['subjectAltName']);

+        DEBUG("SAN: " . $certdata['extensions']['subjectAltName']);

         $san = [];

         $raw_san = explode(', ', $certdata['extensions']['subjectAltName']);

         foreach ($raw_san as $name) {

             if (!substr($name, 0, 4) == 'DNS:') {

-                warning('Unparsable SAN: '.$name);

+                warning('Unparsable SAN: ' . $name);

                 continue;

             }

             $san[] = str_replace('DNS:', '', $name);

@@ -228,8 +228,8 @@ function parse_cert_details($cert)

     } else {

         $san = "\n";

     }

-    DEBUG("SAN: <pre>".$san."</pre>");

-    return ['subject' => $certdata['subject']['CN'].' / '.$issuer, 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']), 'issuer' => $certdata['issuer']['CN'], 'san' => $san];

+    DEBUG("SAN: <pre>" . $san . "</pre>");

+    return ['subject' => $certdata['subject']['CN'] . ' / ' . $issuer, 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']), 'issuer' => $certdata['issuer']['CN'], 'san' => $san];

 }

@@ -311,9 +311,9 @@ function create_csr($cn, $bits)

     $domains = split_cn($cn);

     $tmp = [];

     foreach ($domains as $dom) {

-        $tmp[] = 'DNS:'.$dom;

+        $tmp[] = 'DNS:' . $dom;

     }

-    $SAN = "[ v3_req ]\nsubjectAltName = ".implode(', ', $tmp);

+    $SAN = "[ v3_req ]\nsubjectAltName = " . implode(', ', $tmp);

     DEBUG($SAN);

     $cn = $domains[0];

     $bits = (int) $bits;

@@ -325,7 +325,7 @@ function create_csr($cn, $bits)

     $csrfile = tempnam(ini_get('upload_tmp_dir'), 'csr');

     $config = tempnam(ini_get('upload_tmp_dir'), 'config');

-    DEBUG("key: ".$keyfile." / csr: ".$csrfile." / config: ".$config);

+    DEBUG("key: " . $keyfile . " / csr: " . $csrfile . " / config: " . $config);

     $c = fopen($config, "w");

     fwrite($c, "[req]

@@ -358,7 +358,7 @@ commonName_default = {$cn}

     DEBUG($output);

     DEBUG($retval);

     if ($retval != 0) {

-        system_failure("Die Erzeugung des CSR ist fehlgeschlagen. Ausgabe des OpenSSL-Befehls: ".print_r($output, true));

+        system_failure("Die Erzeugung des CSR ist fehlgeschlagen. Ausgabe des OpenSSL-Befehls: " . print_r($output, true));

     }

     $csr = file_get_contents($csrfile);

@@ -95,7 +95,7 @@ function get_available_CAs()

 {

     $path = '/etc/apache2/certs/cabundle/';

     $ret = glob($path.'*.pem');

-    if (! $ret) {

+    if (!$ret) {

         system_failure("Konnte die CA-Zertifikate nicht laden");

     }

     DEBUG($ret);

@@ -109,7 +109,7 @@ function get_chain($cert)

     if ($certdata === false) {

         system_failure("Das Zertifikat konnte nicht gelesen werden");

     }

-    if (! isset($certdata['issuer']['CN'])) {

+    if (!isset($certdata['issuer']['CN'])) {

         return null;

     }

     $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", [$certdata['issuer']['CN']]);

@@ -218,7 +218,7 @@ function parse_cert_details($cert)

         $san = [];

         $raw_san = explode(', ', $certdata['extensions']['subjectAltName']);

         foreach ($raw_san as $name) {

-            if (! substr($name, 0, 4) == 'DNS:') {

+            if (!substr($name, 0, 4) == 'DNS:') {

                 warning('Unparsable SAN: '.$name);

                 continue;

             }

@@ -375,7 +375,7 @@ commonName_default = {$cn}

 function save_csr($cn, $bits, $replace = null)

 {

-    if (! $cn) {

+    if (!$cn) {

         system_failure("Sie müssen einen Domainname eingeben!");

     }

     $domains = split_cn($cn);

@@ -300,7 +300,7 @@ function split_cn($cn)

     } else {

         $domains[] = $cn;

     }

-    for ($i=0;$i!=count($domains);$i++) {

+    for ($i = 0;$i != count($domains);$i++) {

         $domains[$i] = filter_input_hostname($domains[$i], true);

     }

     return $domains;

@@ -373,7 +373,7 @@ commonName_default = {$cn}

-function save_csr($cn, $bits, $replace=null)

+function save_csr($cn, $bits, $replace = null)

 {

     if (! $cn) {

         system_failure("Sie müssen einen Domainname eingeben!");

@@ -2,14 +2,11 @@

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting

-Written 2008-2018 by schokokeks.org Hosting, namely

+Written by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

-To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

-http://creativecommons.org/publicdomain/zero/1.0/

+This code is published under a 0BSD license.

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

@@ -210,30 +210,27 @@ function validate_certificate($cert, $key)

 function parse_cert_details($cert)

 {

     $certdata = openssl_x509_parse($cert, true);

-    /*

-name => /CN=*.bwurst.org

-validFrom_time_t => 1204118790

-validTo_time_t => 1267190790

-

-

-    */

     DEBUG($certdata);

-    DEBUG("SAN: ".$certdata['extensions']['subjectAltName']);

-    //return array('subject' => $certdata['name'], 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']));

+

     $issuer = $certdata['issuer']['CN'];

     if (isset($certdata['issuer']['O'])) {

         $issuer = $certdata['issuer']['O'];

     }

-    $san = [];

-    $raw_san = explode(', ', $certdata['extensions']['subjectAltName']);

-    foreach ($raw_san as $name) {

-        if (! substr($name, 0, 4) == 'DNS:') {

-            warning('Unparsable SAN: '.$name);

-            continue;

+    if (isset($certdata['extensions']['subjectAltName'])) {

+        DEBUG("SAN: ".$certdata['extensions']['subjectAltName']);

+        $san = [];

+        $raw_san = explode(', ', $certdata['extensions']['subjectAltName']);

+        foreach ($raw_san as $name) {

+            if (! substr($name, 0, 4) == 'DNS:') {

+                warning('Unparsable SAN: '.$name);

+                continue;

+            }

+            $san[] = str_replace('DNS:', '', $name);

         }

-        $san[] = str_replace('DNS:', '', $name);

+        $san = implode("\n", $san);

+    } else {

+        $san = "\n";

     }

-    $san = implode("\n", $san);

     DEBUG("SAN: <pre>".$san."</pre>");

     return ['subject' => $certdata['subject']['CN'].' / '.$issuer, 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']), 'issuer' => $certdata['issuer']['CN'], 'san' => $san];

 }

@@ -24,8 +24,8 @@ define("CERT_NOCHAIN", 2);

 function user_certs()

 {

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=? ORDER BY cn", array($uid));

-    $ret = array();

+    $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=? ORDER BY cn", [$uid]);

+    $ret = [];

     while ($i = $result->fetch()) {

         $ret[] = $i;

     }

@@ -36,8 +36,8 @@ function user_certs()

 function user_csr()

 {

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=? ORDER BY hostname", array($uid));

-    $ret = array();

+    $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=? ORDER BY hostname", [$uid]);

+    $ret = [];

     while ($i = $result->fetch()) {

         $ret[] = $i;

     }

@@ -63,7 +63,7 @@ function cert_details($id)

     $id = (int) $id;

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, chain, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

+    $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, chain, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", [":uid" => $uid, ":id" => $id]);

     if ($result->rowCount() != 1) {

         system_failure("Ungültiges Zertifikat #{$id}");

     }

@@ -86,7 +86,7 @@ function csr_details($id)

     $id = (int) $id;

     $uid = (int) $_SESSION['userinfo']['uid'];

-    $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

+    $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", [":uid" => $uid, ":id" => $id]);

     if ($result->rowCount() != 1) {

         system_failure("Ungültiger CSR");

     }

@@ -115,7 +115,7 @@ function get_chain($cert)

     if (! isset($certdata['issuer']['CN'])) {

         return null;

     }

-    $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", array($certdata['issuer']['CN']));

+    $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", [$certdata['issuer']['CN']]);

     if ($result->rowCount() > 0) {

         $c = $result->fetch();

         //$chainfile = '/etc/apache2/certs/chains/'.$c['id'].'.pem';

@@ -162,7 +162,7 @@ function validate_certificate($cert, $key)

     if ($x509info === false) {

         system_failure("Zertifikat konnte nicht verarbeitet werden");

     }

-    if (!in_array($x509info['signatureTypeSN'], array("RSA-SHA256", "RSA-SHA385", "RSA-SHA512"))) {

+    if (!in_array($x509info['signatureTypeSN'], ["RSA-SHA256", "RSA-SHA385", "RSA-SHA512"])) {

         system_failure("Nicht unterstützer Signatur-Hashalgorithmus!");

     }

@@ -181,10 +181,10 @@ function validate_certificate($cert, $key)

         system_failure("Testsignatur ungültig, Key vermutlich fehlerhaft!");

     }

-    $cacerts = array('/etc/ssl/certs');

+    $cacerts = ['/etc/ssl/certs'];

     $chain = (int) get_chain($cert);

     if ($chain) {

-        $result = db_query("SELECT content FROM vhosts.certchain WHERE id=?", array($chain));

+        $result = db_query("SELECT content FROM vhosts.certchain WHERE id=?", [$chain]);

         $tmp = $result->fetch();

         $chaincert = $tmp['content'];

         $chainfile = tempnam(sys_get_temp_dir(), 'webinterface');

@@ -224,7 +224,7 @@ validTo_time_t => 1267190790

     if (isset($certdata['issuer']['O'])) {

         $issuer = $certdata['issuer']['O'];

     }

-    $san = array();

+    $san = [];

     $raw_san = explode(', ', $certdata['extensions']['subjectAltName']);

     foreach ($raw_san as $name) {

         if (! substr($name, 0, 4) == 'DNS:') {

@@ -235,7 +235,7 @@ validTo_time_t => 1267190790

     }

     $san = implode("\n", $san);

     DEBUG("SAN: <pre>".$san."</pre>");

-    return array('subject' => $certdata['subject']['CN'].' / '.$issuer, 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']), 'issuer' => $certdata['issuer']['CN'], 'san' => $san);

+    return ['subject' => $certdata['subject']['CN'].' / '.$issuer, 'cn' => $certdata['subject']['CN'], 'valid_from' => date('Y-m-d', $certdata['validFrom_time_t']), 'valid_until' => date('Y-m-d', $certdata['validTo_time_t']), 'issuer' => $certdata['issuer']['CN'], 'san' => $san];

 }

@@ -247,8 +247,8 @@ function save_cert($info, $cert, $key)

     db_query(

         "INSERT INTO vhosts.certs (uid, subject, cn, san, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :san, :valid_from, :valid_until, :chain, :cert, :key)",

-        array(":uid" => $uid, ":subject" => filter_input_oneline($info['subject']), ":cn" => filter_input_oneline($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

-              ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key)

+        [":uid" => $uid, ":subject" => filter_input_oneline($info['subject']), ":cn" => filter_input_oneline($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

+              ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key, ]

     );

 }

@@ -260,14 +260,14 @@ function refresh_cert($id, $info, $cert, $key = null)

     $id = (int) $id;

     $oldcert = cert_details($id);

-    $args = array(":subject" => filter_input_oneline($info['subject']),

+    $args = [":subject" => filter_input_oneline($info['subject']),

                 ":cn" => filter_input_oneline($info['cn']),

                 ":san" => $info['san'],

                 ":cert" => $cert,

                 ":valid_from" => $info['valid_from'],

                 ":valid_until" => $info['valid_until'],

                 ":chain" => get_chain($cert),

-                ":id" => $id);

+                ":id" => $id, ];

     $keyop = '';

     if ($key) {

@@ -284,7 +284,7 @@ function delete_cert($id)

     $uid = (int) $_SESSION['userinfo']['uid'];

     $id = (int) $id;

-    db_query("DELETE FROM vhosts.certs WHERE uid=? AND id=?", array($uid, $id));

+    db_query("DELETE FROM vhosts.certs WHERE uid=? AND id=?", [$uid, $id]);

 }

 function delete_csr($id)

@@ -292,13 +292,13 @@ function delete_csr($id)

     $uid = (int) $_SESSION['userinfo']['uid'];

     $id = (int) $id;

-    db_query("DELETE FROM vhosts.csr WHERE uid=? AND id=?", array($uid, $id));

+    db_query("DELETE FROM vhosts.csr WHERE uid=? AND id=?", [$uid, $id]);

 }

 function split_cn($cn)

 {

-    $domains = array();

+    $domains = [];

     if (strstr($cn, ',') or strstr($cn, "\n")) {

         $domains = preg_split("/[, \n]+/", $cn);

         DEBUG("Domains:");

@@ -315,7 +315,7 @@ function split_cn($cn)

 function create_csr($cn, $bits)

 {

     $domains = split_cn($cn);

-    $tmp = array();

+    $tmp = [];

     foreach ($domains as $dom) {

         $tmp[] = 'DNS:'.$dom;

     }

@@ -374,7 +374,7 @@ commonName_default = {$cn}

     unlink($keyfile);

     unlink($config);

-    return array($csr, $key);

+    return [$csr, $key];

 }

@@ -389,13 +389,13 @@ function save_csr($cn, $bits, $replace=null)

     $san = implode("\n", $domains);

     $csr = null;

     $key = null;

-    list($csr, $key) = create_csr(implode(',', $domains), $bits);

+    [$csr, $key] = create_csr(implode(',', $domains), $bits);

     $uid = (int) $_SESSION['userinfo']['uid'];

     db_query(

         "INSERT INTO vhosts.csr (uid, hostname, san, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :san, :bits, :replace, :csr, :key)",

-        array(":uid" => $uid, ":cn" => $cn, ":san" => $san, ":bits" => $bits,

-                 ":replace" => $replace, ":csr" => $csr, ":key" => $key)

+        [":uid" => $uid, ":cn" => $cn, ":san" => $san, ":bits" => $bits,

+                 ":replace" => $replace, ":csr" => $csr, ":key" => $key, ]

     );

     $id = db_insert_id();

     return $id;

@@ -138,20 +138,32 @@ function validate_certificate($cert, $key)

         system_failure("In dem eingetragenen Zertifikat wurde kein öffentlicher Schlüssel gefunden.");

     }

     // Parse Details über den pubkey

-    $certinfo = openssl_pkey_get_details($pubkey);

-    DEBUG($certinfo);

-    if ($certinfo === false) {

+    $pubkeyinfo = openssl_pkey_get_details($pubkey);

+    DEBUG($pubkeyinfo);

+    if ($pubkeyinfo === false) {

         system_failure("Der öffentliche Schlüssel des Zertifikats konnte nicht gelesen werden");

     }

     // Apache unterstützt nur Schlüssel vom Typ RSA oder DSA

-    if (! in_array($certinfo['type'], array(OPENSSL_KEYTYPE_RSA, OPENSSL_KEYTYPE_DSA))) {

+    if ($pubkeyinfo['type'] !== OPENSSL_KEYTYPE_RSA) {

         system_failure("Dieser Schlüssel nutzt einen nicht unterstützten Algorithmus.");

     }

     // Bei ECC-Keys treten kürzere Schlüssellängen auf, die können wir aktuell aber sowieso nicht unterstützen

-    if ($certinfo['bits'] < 2048) {

-        warning("Dieser Schlüssel hat eine sehr geringe Bitlänge und ist daher als nicht besonders sicher einzustufen!");

+    // Wir blockieren zu kurze und zu lange Schlüssel hart, da Apache sonst nicht startet

+    if ($pubkeyinfo['bits'] < 2048) {

+        system_failure("Schlüssellänge ist zu kurz");

+    }

+    if ($pubkeyinfo['bits'] > 4096) {

+        system_failure("Schlüssellänge ist zu lang");

+    }

+

+    $x509info = openssl_x509_parse($cert);

+    if ($x509info === false) {

+        system_failure("Zertifikat konnte nicht verarbeitet werden");

+    }

+    if (!in_array($x509info['signatureTypeSN'], array("RSA-SHA256", "RSA-SHA385", "RSA-SHA512"))) {

+        system_failure("Nicht unterstützer Signatur-Hashalgorithmus!");

     }

     // Prüfe ob Key und Zertifikat zusammen passen

@@ -160,6 +172,15 @@ function validate_certificate($cert, $key)

         return CERT_INVALID;

     }

+    // Check von openssl_x509_check_private_key() ist leider nicht ausreichend

+    $testdata = base64_encode(random_bytes(32));

+    if (openssl_sign($testdata, $signature, $seckey) !== true) {

+        system_failure("Kann keine Testsignatur erstellen, Key ungültig!");

+    }

+    if (openssl_verify($testdata, $signature, $pubkey) !== 1) {

+        system_failure("Testsignatur ungültig, Key vermutlich fehlerhaft!");

+    }

+

     $cacerts = array('/etc/ssl/certs');

     $chain = (int) get_chain($cert);

     if ($chain) {

@@ -228,7 +228,7 @@ function save_cert($info, $cert, $key)

         "INSERT INTO vhosts.certs (uid, subject, cn, san, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :san, :valid_from, :valid_until, :chain, :cert, :key)",

         array(":uid" => $uid, ":subject" => filter_input_oneline($info['subject']), ":cn" => filter_input_oneline($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

               ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key)

-  );

+    );

 }

@@ -375,7 +375,7 @@ function save_csr($cn, $bits, $replace=null)

         "INSERT INTO vhosts.csr (uid, hostname, san, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :san, :bits, :replace, :csr, :key)",

         array(":uid" => $uid, ":cn" => $cn, ":san" => $san, ":bits" => $bits,

                  ":replace" => $replace, ":csr" => $csr, ":key" => $key)

-  );

+    );

     $id = db_insert_id();

     return $id;

 }

@@ -226,7 +226,7 @@ function save_cert($info, $cert, $key)

     db_query(

         "INSERT INTO vhosts.certs (uid, subject, cn, san, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :san, :valid_from, :valid_until, :chain, :cert, :key)",

-        array(":uid" => $uid, ":subject" => filter_input_general($info['subject']), ":cn" => filter_input_general($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

+        array(":uid" => $uid, ":subject" => filter_input_oneline($info['subject']), ":cn" => filter_input_oneline($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

               ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key)

   );

 }

@@ -239,8 +239,8 @@ function refresh_cert($id, $info, $cert, $key = null)

     $id = (int) $id;

     $oldcert = cert_details($id);

-    $args = array(":subject" => filter_input_general($info['subject']),

-                ":cn" => filter_input_general($info['cn']),

+    $args = array(":subject" => filter_input_oneline($info['subject']),

+                ":cn" => filter_input_oneline($info['cn']),

                 ":san" => $info['san'],

                 ":cert" => $cert,

                 ":valid_from" => $info['valid_from'],

@@ -225,7 +225,7 @@ function save_cert($info, $cert, $key)

     $uid = (int) $_SESSION['userinfo']['uid'];

     db_query(

-      "INSERT INTO vhosts.certs (uid, subject, cn, san, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :san, :valid_from, :valid_until, :chain, :cert, :key)",

+        "INSERT INTO vhosts.certs (uid, subject, cn, san, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :san, :valid_from, :valid_until, :chain, :cert, :key)",

         array(":uid" => $uid, ":subject" => filter_input_general($info['subject']), ":cn" => filter_input_general($info['cn']), ":san" => $info['san'], ":valid_from" => $info['valid_from'],

               ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key)

   );

@@ -372,8 +372,8 @@ function save_csr($cn, $bits, $replace=null)

     $uid = (int) $_SESSION['userinfo']['uid'];

     db_query(

-      "INSERT INTO vhosts.csr (uid, hostname, san, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :san, :bits, :replace, :csr, :key)",

-           array(":uid" => $uid, ":cn" => $cn, ":san" => $san, ":bits" => $bits,

+        "INSERT INTO vhosts.csr (uid, hostname, san, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :san, :bits, :replace, :csr, :key)",

+        array(":uid" => $uid, ":cn" => $cn, ":san" => $san, ":bits" => $bits,

                  ":replace" => $replace, ":csr" => $csr, ":key" => $key)

   );

     $id = db_insert_id();

@@ -241,7 +241,7 @@ function refresh_cert($id, $info, $cert, $key = null)

     $oldcert = cert_details($id);

     $args = array(":subject" => filter_input_general($info['subject']),

                 ":cn" => filter_input_general($info['cn']),

-                ":san" => $san,

+                ":san" => $info['san'],

                 ":cert" => $cert,

                 ":valid_from" => $info['valid_from'],

                 ":valid_until" => $info['valid_until'],

@@ -62,7 +62,7 @@ function cert_details($id)

 {

     $id = (int) $id;

     $uid = (int) $_SESSION['userinfo']['uid'];

-  

+

     $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, chain, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

     if ($result->rowCount() != 1) {

         system_failure("Ungültiges Zertifikat #{$id}");

@@ -85,7 +85,7 @@ function csr_details($id)

 {

     $id = (int) $id;

     $uid = (int) $_SESSION['userinfo']['uid'];

-  

+

     $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

     if ($result->rowCount() != 1) {

         system_failure("Ungültiger CSR");

@@ -148,7 +148,7 @@ function validate_certificate($cert, $key)

     if (! in_array($certinfo['type'], array(OPENSSL_KEYTYPE_RSA, OPENSSL_KEYTYPE_DSA))) {

         system_failure("Dieser Schlüssel nutzt einen nicht unterstützten Algorithmus.");

     }

-    

+

     // Bei ECC-Keys treten kürzere Schlüssellängen auf, die können wir aktuell aber sowieso nicht unterstützen

     if ($certinfo['bits'] < 2048) {

         warning("Dieser Schlüssel hat eine sehr geringe Bitlänge und ist daher als nicht besonders sicher einzustufen!");

@@ -262,7 +262,7 @@ function delete_cert($id)

 {

     $uid = (int) $_SESSION['userinfo']['uid'];

     $id = (int) $id;

-  

+

     db_query("DELETE FROM vhosts.certs WHERE uid=? AND id=?", array($uid, $id));

 }

@@ -270,7 +270,7 @@ function delete_csr($id)

 {

     $uid = (int) $_SESSION['userinfo']['uid'];

     $id = (int) $id;

-  

+

     db_query("DELETE FROM vhosts.csr WHERE uid=? AND id=?", array($uid, $id));

 }

@@ -345,7 +345,7 @@ commonName_default = {$cn}

     if ($retval != 0) {

         system_failure("Die Erzeugung des CSR ist fehlgeschlagen. Ausgabe des OpenSSL-Befehls: ".print_r($output, true));

     }

-  

+

     $csr = file_get_contents($csrfile);

     $key = file_get_contents($keyfile);

@@ -369,7 +369,7 @@ function save_csr($cn, $bits, $replace=null)

     $csr = null;

     $key = null;

     list($csr, $key) = create_csr(implode(',', $domains), $bits);

-  

+

     $uid = (int) $_SESSION['userinfo']['uid'];

     db_query(

       "INSERT INTO vhosts.csr (uid, hostname, san, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :san, :bits, :replace, :csr, :key)",

@@ -8,7 +8,7 @@ Written 2008-2018 by schokokeks.org Hosting, namely

 To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

 http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

@@ -23,220 +23,223 @@ define("CERT_NOCHAIN", 2);

 function user_certs()

 {

-  $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=? ORDER BY cn", array($uid));

-  $ret = array();

-  while ($i = $result->fetch())

-    $ret[] = $i;

-  #DEBUG($ret);

-  return $ret;

+    $uid = (int) $_SESSION['userinfo']['uid'];

+    $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=? ORDER BY cn", array($uid));

+    $ret = array();

+    while ($i = $result->fetch()) {

+        $ret[] = $i;

+    }

+    #DEBUG($ret);

+    return $ret;

 }

 function user_csr()

 {

-  $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=? ORDER BY hostname", array($uid));

-  $ret = array();

-  while ($i = $result->fetch())

-    $ret[] = $i;

-  #DEBUG($ret);

-  return $ret;

+    $uid = (int) $_SESSION['userinfo']['uid'];

+    $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=? ORDER BY hostname", array($uid));

+    $ret = array();

+    while ($i = $result->fetch()) {

+        $ret[] = $i;

+    }

+    #DEBUG($ret);

+    return $ret;

 }

 function user_has_manual_certs()

 {

-  foreach (user_certs() as $c) {

-    if (!cert_is_letsencrypt($c['id'])) {

-      return true;

+    foreach (user_certs() as $c) {

+        if (!cert_is_letsencrypt($c['id'])) {

+            return true;

+        }

+    }

+    foreach (user_csr() as $c) {

+        return true;

     }

-  }

-  foreach (user_csr() as $c) {

-    return true;

-  }

 }

 function cert_details($id)

 {

-  $id = (int) $id;

-  $uid = (int) $_SESSION['userinfo']['uid'];

+    $id = (int) $id;

+    $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, chain, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

-  if ($result->rowCount() != 1)

-    system_failure("Ungültiges Zertifikat #{$id}");

-  return $result->fetch();

+    $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, chain, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

+    if ($result->rowCount() != 1) {

+        system_failure("Ungültiges Zertifikat #{$id}");

+    }

+    return $result->fetch();

 }

 function cert_is_letsencrypt($id)

 {

-  $details = cert_details($id);

-  #DEBUG($details);

-  if (strpos($details['subject'], "Let's Encrypt autogenerated") > 0) {

-    return true;

-  }

-  return false;

+    $details = cert_details($id);

+    #DEBUG($details);

+    if (strpos($details['subject'], "Let's Encrypt autogenerated") > 0) {

+        return true;

+    }

+    return false;

 }

 function csr_details($id)

 {

-  $id = (int) $id;

-  $uid = (int) $_SESSION['userinfo']['uid'];

+    $id = (int) $id;

+    $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

-  if ($result->rowCount() != 1)

-    system_failure("Ungültiger CSR");

-  return $result->fetch();

+    $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

+    if ($result->rowCount() != 1) {

+        system_failure("Ungültiger CSR");

+    }

+    return $result->fetch();

 }

 function get_available_CAs()

 {

-  $path = '/etc/apache2/certs/cabundle/';

-  $ret = glob($path.'*.pem');

-  if (! $ret)

-    system_failure("Konnte die CA-Zertifikate nicht laden");

-  DEBUG($ret);

-  return $ret;

+    $path = '/etc/apache2/certs/cabundle/';

+    $ret = glob($path.'*.pem');

+    if (! $ret) {

+        system_failure("Konnte die CA-Zertifikate nicht laden");

+    }

+    DEBUG($ret);

+    return $ret;

 }

 function get_chain($cert)

 {

-  $certdata = openssl_x509_parse($cert, true);

-  if ($certdata === FALSE) {

-    system_failure("Das Zertifikat konnte nicht gelesen werden");

-  }

-  if (! isset($certdata['issuer']['CN'])) {

-    return NULL;

-  }

-  $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", array($certdata['issuer']['CN']));

-  if ($result->rowCount() > 0)

-  {

-    $c = $result->fetch();

-    //$chainfile = '/etc/apache2/certs/chains/'.$c['id'].'.pem';

-    DEBUG("identified fitting certificate chain #".$c['id']);

-    return $c['id'];

-  }

+    $certdata = openssl_x509_parse($cert, true);

+    if ($certdata === false) {

+        system_failure("Das Zertifikat konnte nicht gelesen werden");

+    }

+    if (! isset($certdata['issuer']['CN'])) {

+        return null;

+    }

+    $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", array($certdata['issuer']['CN']));

+    if ($result->rowCount() > 0) {

+        $c = $result->fetch();

+        //$chainfile = '/etc/apache2/certs/chains/'.$c['id'].'.pem';

+        DEBUG("identified fitting certificate chain #".$c['id']);

+        return $c['id'];

+    }

 }

 function validate_certificate($cert, $key)

-{ 

-  // Lade private key 

-  $seckey = openssl_get_privatekey($key);

-  if ($seckey === FALSE) {

-    system_failure("Der private Schlüssel konnte (ohne Passwort) nicht gelesen werden.");

-  }

-  // Lade public key

-  $pubkey = openssl_get_publickey($cert);

-  if ($pubkey === FALSE) {

-    system_failure("In dem eingetragenen Zertifikat wurde kein öffentlicher Schlüssel gefunden.");

-  }

-  // Parse Details über den pubkey

-  $certinfo = openssl_pkey_get_details($pubkey);

-  DEBUG($certinfo);

-  if ($certinfo === FALSE) {

-    system_failure("Der öffentliche Schlüssel des Zertifikats konnte nicht gelesen werden");

-  }

-

-  // Apache unterstützt nur Schlüssel vom Typ RSA oder DSA

-  if (! in_array($certinfo['type'], array(OPENSSL_KEYTYPE_RSA, OPENSSL_KEYTYPE_DSA))) {

-    system_failure("Dieser Schlüssel nutzt einen nicht unterstützten Algorithmus.");

-  }

+{

+    // Lade private key

+    $seckey = openssl_get_privatekey($key);

+    if ($seckey === false) {

+        system_failure("Der private Schlüssel konnte (ohne Passwort) nicht gelesen werden.");

+    }

+    // Lade public key

+    $pubkey = openssl_get_publickey($cert);

+    if ($pubkey === false) {

+        system_failure("In dem eingetragenen Zertifikat wurde kein öffentlicher Schlüssel gefunden.");

+    }

+    // Parse Details über den pubkey

+    $certinfo = openssl_pkey_get_details($pubkey);

+    DEBUG($certinfo);

+    if ($certinfo === false) {

+        system_failure("Der öffentliche Schlüssel des Zertifikats konnte nicht gelesen werden");

+    }

+

+    // Apache unterstützt nur Schlüssel vom Typ RSA oder DSA

+    if (! in_array($certinfo['type'], array(OPENSSL_KEYTYPE_RSA, OPENSSL_KEYTYPE_DSA))) {

+        system_failure("Dieser Schlüssel nutzt einen nicht unterstützten Algorithmus.");

+    }

-  // Bei ECC-Keys treten kürzere Schlüssellängen auf, die können wir aktuell aber sowieso nicht unterstützen

-  if ($certinfo['bits'] < 2048) {

-    warning("Dieser Schlüssel hat eine sehr geringe Bitlänge und ist daher als nicht besonders sicher einzustufen!");

-  }

-

-  // Prüfe ob Key und Zertifikat zusammen passen

-  if (openssl_x509_check_private_key($cert, $key) !== true)

-  {

-    DEBUG("Zertifikat und Key passen nicht zusammen: ".openssl_x509_check_private_key($cert, $key));

-    return CERT_INVALID;

-  }

-

-  $cacerts = array('/etc/ssl/certs');

-  $chain = (int) get_chain($cert);

-  if ($chain)

-  {

-    $result = db_query("SELECT content FROM vhosts.certchain WHERE id=?", array($chain));

-    $tmp = $result->fetch();

-    $chaincert = $tmp['content'];

-    $chainfile = tempnam(sys_get_temp_dir(), 'webinterface');

-    $f = fopen($chainfile, "w");

-    fwrite($f, $chaincert);

-    fclose($f);

-    $cacerts[] = $chainfile;

-  }

-

-  $valid = openssl_x509_checkpurpose($cert, X509_PURPOSE_SSL_SERVER, $cacerts);

-  if ($chain) {

-    unlink($chainfile);

-  }

-  if ($valid !== true)

-  { 

-    DEBUG('certificate was not validated as a server certificate with the available chain');

-    return CERT_NOCHAIN;

-  }

-

-  return CERT_OK;

+    // Bei ECC-Keys treten kürzere Schlüssellängen auf, die können wir aktuell aber sowieso nicht unterstützen

+    if ($certinfo['bits'] < 2048) {

+        warning("Dieser Schlüssel hat eine sehr geringe Bitlänge und ist daher als nicht besonders sicher einzustufen!");

+    }

+

+    // Prüfe ob Key und Zertifikat zusammen passen

+    if (openssl_x509_check_private_key($cert, $key) !== true) {

+        DEBUG("Zertifikat und Key passen nicht zusammen: ".openssl_x509_check_private_key($cert, $key));

+        return CERT_INVALID;

+    }

+

+    $cacerts = array('/etc/ssl/certs');

+    $chain = (int) get_chain($cert);

+    if ($chain) {

+        $result = db_query("SELECT content FROM vhosts.certchain WHERE id=?", array($chain));

+        $tmp = $result->fetch();

+        $chaincert = $tmp['content'];

+        $chainfile = tempnam(sys_get_temp_dir(), 'webinterface');

+        $f = fopen($chainfile, "w");

+        fwrite($f, $chaincert);

+        fclose($f);

+        $cacerts[] = $chainfile;

+    }

+

+    $valid = openssl_x509_checkpurpose($cert, X509_PURPOSE_SSL_SERVER, $cacerts);

+    if ($chain) {

+        unlink($chainfile);

+    }

+    if ($valid !== true) {

+        DEBUG('certificate was not validated as a server certificate with the available chain');

+        return CERT_NOCHAIN;

+    }

+

+    return CERT_OK;

 }

 function parse_cert_details($cert)

 {

-  $certdata = openssl_x509_parse($cert, true);

-  /* 

+    $certdata = openssl_x509_parse($cert, true);

+    /*

 name => /CN=*.bwurst.org

 validFrom_time_t => 1204118790

 validTo_time_t => 1267190790

-  */

-  DEBUG($certdata);