include/ssl_key_handler.hpp - gbmcweb - Git at Google

 #ifndef THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_
 #define THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_

 #ifdef GOOGLE3_GBMCWEB_BUILD
 #include <openssl/asn1.h>
 #include <openssl/digest.h>
 #include <openssl/ec.h>
 #include <openssl/ec_key.h>
 #include <openssl/nid.h>
 #include <openssl/obj.h>
 #include <openssl/x509.h>
 #endif

 #include <openssl/bio.h>
 #include <openssl/dh.h>   // NOLINT
 #include <openssl/dsa.h>  // NOLINT
 #include <openssl/err.h>
 #include <openssl/evp.h>  // NOLINT
 #include <openssl/pem.h>
 #include <openssl/rand.h>
 #include <openssl/rsa.h>
 #include <openssl/ssl.h>

 #include <cstdio>
 #include <iostream>
 #include <limits>
 #include <memory>
 #include <optional>
 #include <random>
 #include <string>

 #include "boost/asio/ssl/context.hpp"  // NOLINT
 #include "logging.hpp"
 #include "random.hpp"

 namespace ensuressl {
 constexpr char const* trustStorePath = "/etc/ssl/certs/authority";
 constexpr char const* x509Comment = "Generated from OpenBMC service";
 static void initOpenssl();
 static EVP_PKEY* createEcKey();

 // Trust chain related errors.`
 inline bool isTrustChainError(int errnum) {
   return (errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
          (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
          (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
          (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
          (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
 }

 inline bool validateCertificate(X509* const cert) {
   // Create an empty X509_STORE structure for certificate validation.
   X509_STORE* x509_store = X509_STORE_new();
   if (x509_store == nullptr) {
     BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call";
     return false;
   }

   // Load Certificate file into the X509 structure.
   X509_STORE_CTX* store_ctx = X509_STORE_CTX_new();
   if (store_ctx == nullptr) {
     BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call";
     X509_STORE_free(x509_store);
     return false;
   }

   int err_code = X509_STORE_CTX_init(store_ctx, x509_store, cert, nullptr);
   if (err_code != 1) {
     BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call";
     X509_STORE_CTX_free(store_ctx);
     X509_STORE_free(x509_store);
     return false;
   }

   err_code = X509_verify_cert(store_ctx);
   if (err_code == 1) {
     BMCWEB_LOG_INFO << "Certificate verification is success";
     X509_STORE_CTX_free(store_ctx);
     X509_STORE_free(x509_store);
     return true;
   }
   if (err_code == 0) {
     err_code = X509_STORE_CTX_get_error(store_ctx);
     X509_STORE_CTX_free(store_ctx);
     X509_STORE_free(x509_store);
     if (isTrustChainError(err_code)) {
       BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
                        << X509_verify_cert_error_string(err_code);
       return true;
     }
     BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
                      << X509_verify_cert_error_string(err_code);
     return false;
   }

   BMCWEB_LOG_ERROR << "Error occurred during X509_verify_cert call. ErrorCode: "
                    << err_code;
   X509_STORE_CTX_free(store_ctx);
   X509_STORE_free(x509_store);
   return false;
 }

 inline bool verifyOpensslKeyCert(const std::string& filepath) {
   bool private_key_valid = false;
   bool cert_valid = false;

   std::cout << "Checking certs in file " << filepath << "\n";

   FILE* file = fopen(filepath.c_str(), "r");
   if (file != nullptr) {
     EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
     if (pkey != nullptr) {
 #if (OPENSSL_VERSION_NUMBER < 0x30000000L)
       RSA* rsa = EVP_PKEY_get1_RSA(pkey);
       if (rsa != nullptr) {
         std::cout << "Found an RSA key\n";
         if (RSA_check_key(rsa) == 1) {
           private_key_valid = true;
         } else {
           std::cerr << "Key not valid error number " << ERR_get_error() << "\n";
         }
         RSA_free(rsa);
       } else {
         EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
         if (ec != nullptr) {
           std::cout << "Found an EC key\n";
           if (EC_KEY_check_key(ec) == 1) {
             private_key_valid = true;
           } else {
             std::cerr << "Key not valid error number " << ERR_get_error()
                       << "\n";
           }
           EC_KEY_free(ec);
         }
       }
 #else
       EVP_PKEY_CTX* pkeyCtx =
           EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, nullptr);

       if (pkeyCtx == nullptr) {
         std::cerr << "Unable to allocate pkeyCtx " << ERR_get_error() << "\n";
       } else if (EVP_PKEY_check(pkeyCtx) == 1) {
         private_key_valid = true;
       } else {
         std::cerr << "Key not valid error number " << ERR_get_error() << "\n";
       }
 #endif

       if (private_key_valid) {
         // If the order is certificate followed by key in input file
         // then, certificate read will fail. So, setting the file
         // pointer to point beginning of file to avoid certificate and
         // key order issue.
         fseek(file, 0, SEEK_SET);

         X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
         if (x509 == nullptr) {
           std::cout << "error getting x509 cert " << ERR_get_error() << "\n";
         } else {
           cert_valid = validateCertificate(x509);
           X509_free(x509);
         }
       }

 #if (OPENSSL_VERSION_NUMBER > 0x30000000L)
       EVP_PKEY_CTX_free(pkeyCtx);
 #endif
       EVP_PKEY_free(pkey);
     }
     fclose(file);
   }
   return cert_valid;
 }

 inline X509* loadCert(const std::string& filePath) {
   BIO* cert_file_bio = BIO_new_file(filePath.c_str(), "rb");
   if (cert_file_bio == nullptr) {
     BMCWEB_LOG_ERROR << "Error occured during BIO_new_file call, "
                      << "FILE= " << filePath;
     return nullptr;
   }

   X509* cert = X509_new();
   if (cert == nullptr) {
     BMCWEB_LOG_ERROR << "Error occured during X509_new call, "
                      << ERR_get_error();
     BIO_free(cert_file_bio);
     return nullptr;
   }

   if (PEM_read_bio_X509(cert_file_bio, &cert, nullptr, nullptr) == nullptr) {
     BMCWEB_LOG_ERROR << "Error occured during PEM_read_bio_X509 call, "
                      << "FILE= " << filePath;

     BIO_free(cert_file_bio);
     X509_free(cert);
     return nullptr;
   }
   BIO_free(cert_file_bio);
   return cert;
 }

 inline int addExt(X509* cert, int nid, const char* value) {
   X509_EXTENSION* ex = nullptr;
   X509V3_CTX ctx{};
   X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);

   // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
   ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value));
   if (ex == nullptr) {
     BMCWEB_LOG_ERROR << "Error: In X509V3_EXT_conf_nidn: " << value;
     return -1;
   }
   X509_add_ext(cert, ex, -1);
   X509_EXTENSION_free(ex);
   return 0;
 }

 inline void generateSslCertificate(const std::string& filepath,
                                    const std::string& cn) {
   FILE* p_file = nullptr;
   std::cout << "Generating new keys\n";
   initOpenssl();

   std::cerr << "Generating EC key\n";
   EVP_PKEY* p_priv_key = createEcKey();
   if (p_priv_key != nullptr) {
     std::cerr << "Generating x509 Certificate\n";
     // Use this code to directly generate a certificate
     X509* x509 = X509_new();
     if (x509 != nullptr) {
       // get a random number from the RNG for the certificate serial
       // number If this is not random, regenerating certs throws browser
       // errors
       bmcweb::OpenSSLGenerator gen;
       std::uniform_int_distribution<int> dis(1,
                                              std::numeric_limits<int>::max());
       int serial = dis(gen);

       ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);

       // not before this moment
       X509_gmtime_adj(X509_get_notBefore(x509), 0);
       // Cert is valid for 10 years
       X509_gmtime_adj(X509_get_notAfter(x509), 60L * 60L * 24L * 365L * 10L);

       // set the public key to the key we just generated
       X509_set_pubkey(x509, p_priv_key);

       // get the subject name
       X509_NAME* name = X509_get_subject_name(x509);

       using x509String = const unsigned char;
       // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
       x509String* country = reinterpret_cast<x509String*>("US");
       // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
       x509String* company = reinterpret_cast<x509String*>("OpenBMC");
       // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
       x509String* cn_str = reinterpret_cast<x509String*>(cn.c_str());

       X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1, 0);
       X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1, 0);
       X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cn_str, -1, -1, 0);
       // set the CSR options
       X509_set_issuer_name(x509, name);

       X509_set_version(x509, 2);
       addExt(x509, NID_basic_constraints, ("critical,CA:TRUE"));
       addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str());
       addExt(x509, NID_subject_key_identifier, ("hash"));
       addExt(x509, NID_authority_key_identifier, ("keyid"));
       addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment"));
       addExt(x509, NID_ext_key_usage, ("serverAuth"));
       addExt(x509, NID_netscape_comment, (x509Comment));

       // Sign the certificate with our private key
       X509_sign(x509, p_priv_key, EVP_sha256());

       p_file = fopen(filepath.c_str(), "wt");

       if (p_file != nullptr) {
         PEM_write_PrivateKey(p_file, p_priv_key, nullptr, nullptr, 0, nullptr,
                              nullptr);

         PEM_write_X509(p_file, x509);
         fclose(p_file);
         p_file = nullptr;
       }

       X509_free(x509);
     }

     EVP_PKEY_free(p_priv_key);
     p_priv_key = nullptr;
   }

   // cleanup_openssl();
 }

 EVP_PKEY* createEcKey() {
   EVP_PKEY* p_key = nullptr;

 #if (OPENSSL_VERSION_NUMBER < 0x30000000L)
   int eccgrp = 0;
   eccgrp = OBJ_txt2nid("secp384r1");

   EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
   if (myecc != nullptr) {
     EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
     EC_KEY_generate_key(myecc);
     p_key = EVP_PKEY_new();
     if (p_key != nullptr) {
       if (EVP_PKEY_assign(p_key, EVP_PKEY_EC, myecc) != 0) {
         /* p_key owns myecc from now */
         if (EC_KEY_check_key(myecc) <= 0) {
           std::cerr << "EC_check_key failed.\n";
         }
       }
     }
   }
 #else
   // Create context for curve parameter generation.
   std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{
       EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free};
   if (!ctx) {
     return nullptr;
   }

   // Set up curve parameters.
   EVP_PKEY* params = nullptr;
   if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) ||
       (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <= 0) ||
       (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <= 0) ||
       (EVP_PKEY_paramgen(ctx.get(), &params) <= 0)) {
     return nullptr;
   }

   // Set up RAII holder for params.
   std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{
       params, &::EVP_PKEY_free};

   // Set new context for key generation, using curve parameters.
   ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr));
   if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0)) {
     return nullptr;
   }

   // Generate key.
   if (EVP_PKEY_keygen(ctx.get(), &p_key) <= 0) {
     return nullptr;
   }
 #endif

   return p_key;
 }

 void initOpenssl() {
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
   SSL_load_error_strings();
   OpenSSL_add_all_algorithms();
   RAND_load_file("/dev/urandom", 1024);
 #endif
 }

 inline void ensureOpensslKeyPresentAndValid(const std::string& filepath) {
   bool pem_file_valid = false;

   pem_file_valid = verifyOpensslKeyCert(filepath);

   if (!pem_file_valid) {
     std::cerr << "Error in verifying signature, regenerating\n";
     generateSslCertificate(filepath, "testhost");
   }
 }

 inline std::shared_ptr<boost::asio::ssl::context> getSslContext(
     const std::string& sslPemFile) {
   std::shared_ptr<boost::asio::ssl::context> m_ssl_context =
       std::make_shared<boost::asio::ssl::context>(
           boost::asio::ssl::context::tls_server);
   m_ssl_context->set_options(boost::asio::ssl::context::default_workarounds |
                              boost::asio::ssl::context::no_sslv2 |
                              boost::asio::ssl::context::no_sslv3 |
                              boost::asio::ssl::context::single_dh_use |
                              boost::asio::ssl::context::no_tlsv1 |
                              boost::asio::ssl::context::no_tlsv1_1);

   // BIG WARNING: This needs to stay disabled, as there will always be
   // unauthenticated endpoints
   // m_ssl_context->set_verify_mode(boost::asio::ssl::verify_peer);

   SSL_CTX_set_options(m_ssl_context->native_handle(), SSL_OP_NO_RENEGOTIATION);

   BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
   m_ssl_context->add_verify_path(trustStorePath);

   m_ssl_context->use_certificate_file(sslPemFile,
                                       boost::asio::ssl::context::pem);
   m_ssl_context->use_private_key_file(sslPemFile,
                                       boost::asio::ssl::context::pem);

   // Set up EC curves to auto (boost asio doesn't have a method for this)
   // There is a pull request to add this.  Once this is included in an asio
   // drop, use the right way
   // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
   if (SSL_CTX_set_ecdh_auto(m_ssl_context->native_handle(), 1) != 1) {
     BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
   }

   std::string mozilla_modern =
       "ECDHE-ECDSA-AES256-GCM-SHA384:"
       "ECDHE-RSA-AES256-GCM-SHA384:"
       "ECDHE-ECDSA-CHACHA20-POLY1305:"
       "ECDHE-RSA-CHACHA20-POLY1305:"
       "ECDHE-ECDSA-AES128-GCM-SHA256:"
       "ECDHE-RSA-AES128-GCM-SHA256:"
       "ECDHE-ECDSA-AES256-SHA384:"
       "ECDHE-RSA-AES256-SHA384:"
       "ECDHE-ECDSA-AES128-SHA256:"
       "ECDHE-RSA-AES128-SHA256";

   if (SSL_CTX_set_cipher_list(m_ssl_context->native_handle(),
                               mozilla_modern.c_str()) != 1) {
     BMCWEB_LOG_ERROR << "Error setting cipher list\n";
   }
   return m_ssl_context;
 }

 inline std::optional<boost::asio::ssl::context> getSSLClientContext() {
   boost::asio::ssl::context ssl_ctx(boost::asio::ssl::context::tls_client);

   boost::system::error_code ec;

   // Support only TLS v1.2 & v1.3
   // NOLINTNEXTLINE(bugprone-unused-return-value)
   ssl_ctx.set_options(boost::asio::ssl::context::default_workarounds |
                           boost::asio::ssl::context::no_sslv2 |
                           boost::asio::ssl::context::no_sslv3 |
                           boost::asio::ssl::context::single_dh_use |
                           boost::asio::ssl::context::no_tlsv1 |
                           boost::asio::ssl::context::no_tlsv1_1,
                       ec);
   if (ec) {
     BMCWEB_LOG_ERROR << "SSL context set_options failed";
     return std::nullopt;
   }

   // Add a directory containing certificate authority files to be used
   // for performing verification.
   // NOLINTNEXTLINE(bugprone-unused-return-value)
   ssl_ctx.set_default_verify_paths(ec);
   if (ec) {
     BMCWEB_LOG_ERROR << "SSL context set_default_verify failed";
     return std::nullopt;
   }

   // Verify the remote server's certificate
   // NOLINTNEXTLINE(bugprone-unused-return-value)
   ssl_ctx.set_verify_mode(boost::asio::ssl::verify_peer, ec);
   if (ec) {
     BMCWEB_LOG_ERROR << "SSL context set_verify_mode failed";
     return std::nullopt;
   }

   // All cipher suites are set as per OWASP datasheet.
   // https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html
   constexpr const char* ssl_ciphers =
       "ECDHE-ECDSA-AES128-GCM-SHA256:"
       "ECDHE-RSA-AES128-GCM-SHA256:"
       "ECDHE-ECDSA-AES256-GCM-SHA384:"
       "ECDHE-RSA-AES256-GCM-SHA384:"
       "ECDHE-ECDSA-CHACHA20-POLY1305:"
       "ECDHE-RSA-CHACHA20-POLY1305:"
       "DHE-RSA-AES128-GCM-SHA256:"
       "DHE-RSA-AES256-GCM-SHA384"
       "TLS_AES_128_GCM_SHA256:"
       "TLS_AES_256_GCM_SHA384:"
       "TLS_CHACHA20_POLY1305_SHA256";

   if (SSL_CTX_set_cipher_list(ssl_ctx.native_handle(), ssl_ciphers) != 1) {
     BMCWEB_LOG_ERROR << "SSL_CTX_set_cipher_list failed";
     return std::nullopt;
   }

   return ssl_ctx;
 }

 }  // namespace ensuressl

 #endif  // THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_
	#ifndef THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_
	#define THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_

	#ifdef GOOGLE3_GBMCWEB_BUILD
	#include <openssl/asn1.h>
	#include <openssl/digest.h>
	#include <openssl/ec.h>
	#include <openssl/ec_key.h>
	#include <openssl/nid.h>
	#include <openssl/obj.h>
	#include <openssl/x509.h>
	#endif

	#include <openssl/bio.h>
	#include <openssl/dh.h> // NOLINT
	#include <openssl/dsa.h> // NOLINT
	#include <openssl/err.h>
	#include <openssl/evp.h> // NOLINT
	#include <openssl/pem.h>
	#include <openssl/rand.h>
	#include <openssl/rsa.h>
	#include <openssl/ssl.h>

	#include <cstdio>
	#include <iostream>
	#include <limits>
	#include <memory>
	#include <optional>
	#include <random>
	#include <string>

	#include "boost/asio/ssl/context.hpp" // NOLINT
	#include "logging.hpp"
	#include "random.hpp"

	namespace ensuressl {
	constexpr char const* trustStorePath = "/etc/ssl/certs/authority";
	constexpr char const* x509Comment = "Generated from OpenBMC service";
	static void initOpenssl();
	static EVP_PKEY* createEcKey();

	// Trust chain related errors.`
	inline bool isTrustChainError(int errnum) {
	return (errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) \|\|
	(errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) \|\|
	(errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) \|\|
	(errnum == X509_V_ERR_CERT_UNTRUSTED) \|\|
	(errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
	}

	inline bool validateCertificate(X509* const cert) {
	// Create an empty X509_STORE structure for certificate validation.
	X509_STORE* x509_store = X509_STORE_new();
	if (x509_store == nullptr) {
	BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call";
	return false;
	}

	// Load Certificate file into the X509 structure.
	X509_STORE_CTX* store_ctx = X509_STORE_CTX_new();
	if (store_ctx == nullptr) {
	BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call";
	X509_STORE_free(x509_store);
	return false;
	}

	int err_code = X509_STORE_CTX_init(store_ctx, x509_store, cert, nullptr);
	if (err_code != 1) {
	BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call";
	X509_STORE_CTX_free(store_ctx);
	X509_STORE_free(x509_store);
	return false;
	}

	err_code = X509_verify_cert(store_ctx);
	if (err_code == 1) {
	BMCWEB_LOG_INFO << "Certificate verification is success";
	X509_STORE_CTX_free(store_ctx);
	X509_STORE_free(x509_store);
	return true;
	}
	if (err_code == 0) {
	err_code = X509_STORE_CTX_get_error(store_ctx);
	X509_STORE_CTX_free(store_ctx);
	X509_STORE_free(x509_store);
	if (isTrustChainError(err_code)) {
	BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
	<< X509_verify_cert_error_string(err_code);
	return true;
	}
	BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
	<< X509_verify_cert_error_string(err_code);
	return false;
	}

	BMCWEB_LOG_ERROR << "Error occurred during X509_verify_cert call. ErrorCode: "
	<< err_code;
	X509_STORE_CTX_free(store_ctx);
	X509_STORE_free(x509_store);
	return false;
	}

	inline bool verifyOpensslKeyCert(const std::string& filepath) {
	bool private_key_valid = false;
	bool cert_valid = false;

	std::cout << "Checking certs in file " << filepath << "\n";

	FILE* file = fopen(filepath.c_str(), "r");
	if (file != nullptr) {
	EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
	if (pkey != nullptr) {
	#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
	RSA* rsa = EVP_PKEY_get1_RSA(pkey);
	if (rsa != nullptr) {
	std::cout << "Found an RSA key\n";
	if (RSA_check_key(rsa) == 1) {
	private_key_valid = true;
	} else {
	std::cerr << "Key not valid error number " << ERR_get_error() << "\n";
	}
	RSA_free(rsa);
	} else {
	EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
	if (ec != nullptr) {
	std::cout << "Found an EC key\n";
	if (EC_KEY_check_key(ec) == 1) {
	private_key_valid = true;
	} else {
	std::cerr << "Key not valid error number " << ERR_get_error()
	<< "\n";
	}
	EC_KEY_free(ec);
	}
	}
	#else
	EVP_PKEY_CTX* pkeyCtx =
	EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, nullptr);

	if (pkeyCtx == nullptr) {
	std::cerr << "Unable to allocate pkeyCtx " << ERR_get_error() << "\n";
	} else if (EVP_PKEY_check(pkeyCtx) == 1) {
	private_key_valid = true;
	} else {
	std::cerr << "Key not valid error number " << ERR_get_error() << "\n";
	}
	#endif

	if (private_key_valid) {
	// If the order is certificate followed by key in input file
	// then, certificate read will fail. So, setting the file
	// pointer to point beginning of file to avoid certificate and
	// key order issue.
	fseek(file, 0, SEEK_SET);

	X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
	if (x509 == nullptr) {
	std::cout << "error getting x509 cert " << ERR_get_error() << "\n";
	} else {
	cert_valid = validateCertificate(x509);
	X509_free(x509);
	}
	}

	#if (OPENSSL_VERSION_NUMBER > 0x30000000L)
	EVP_PKEY_CTX_free(pkeyCtx);
	#endif
	EVP_PKEY_free(pkey);
	}
	fclose(file);
	}
	return cert_valid;
	}

	inline X509* loadCert(const std::string& filePath) {
	BIO* cert_file_bio = BIO_new_file(filePath.c_str(), "rb");
	if (cert_file_bio == nullptr) {
	BMCWEB_LOG_ERROR << "Error occured during BIO_new_file call, "
	<< "FILE= " << filePath;
	return nullptr;
	}

	X509* cert = X509_new();
	if (cert == nullptr) {
	BMCWEB_LOG_ERROR << "Error occured during X509_new call, "
	<< ERR_get_error();
	BIO_free(cert_file_bio);
	return nullptr;
	}

	if (PEM_read_bio_X509(cert_file_bio, &cert, nullptr, nullptr) == nullptr) {
	BMCWEB_LOG_ERROR << "Error occured during PEM_read_bio_X509 call, "
	<< "FILE= " << filePath;

	BIO_free(cert_file_bio);
	X509_free(cert);
	return nullptr;
	}
	BIO_free(cert_file_bio);
	return cert;
	}

	inline int addExt(X509* cert, int nid, const char* value) {
	X509_EXTENSION* ex = nullptr;
	X509V3_CTX ctx{};
	X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);

	// NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
	ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value));
	if (ex == nullptr) {
	BMCWEB_LOG_ERROR << "Error: In X509V3_EXT_conf_nidn: " << value;
	return -1;
	}
	X509_add_ext(cert, ex, -1);
	X509_EXTENSION_free(ex);
	return 0;
	}

	inline void generateSslCertificate(const std::string& filepath,
	const std::string& cn) {
	FILE* p_file = nullptr;
	std::cout << "Generating new keys\n";
	initOpenssl();

	std::cerr << "Generating EC key\n";
	EVP_PKEY* p_priv_key = createEcKey();
	if (p_priv_key != nullptr) {
	std::cerr << "Generating x509 Certificate\n";
	// Use this code to directly generate a certificate
	X509* x509 = X509_new();
	if (x509 != nullptr) {
	// get a random number from the RNG for the certificate serial
	// number If this is not random, regenerating certs throws browser
	// errors
	bmcweb::OpenSSLGenerator gen;
	std::uniform_int_distribution<int> dis(1,
	std::numeric_limits<int>::max());
	int serial = dis(gen);

	ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);

	// not before this moment
	X509_gmtime_adj(X509_get_notBefore(x509), 0);
	// Cert is valid for 10 years
	X509_gmtime_adj(X509_get_notAfter(x509), 60L * 60L * 24L * 365L * 10L);

	// set the public key to the key we just generated
	X509_set_pubkey(x509, p_priv_key);

	// get the subject name
	X509_NAME* name = X509_get_subject_name(x509);

	using x509String = const unsigned char;
	// NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
	x509String* country = reinterpret_cast<x509String*>("US");
	// NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
	x509String* company = reinterpret_cast<x509String*>("OpenBMC");
	// NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
	x509String* cn_str = reinterpret_cast<x509String*>(cn.c_str());

	X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1, 0);
	X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cn_str, -1, -1, 0);
	// set the CSR options
	X509_set_issuer_name(x509, name);

	X509_set_version(x509, 2);
	addExt(x509, NID_basic_constraints, ("critical,CA:TRUE"));
	addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str());
	addExt(x509, NID_subject_key_identifier, ("hash"));
	addExt(x509, NID_authority_key_identifier, ("keyid"));
	addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment"));
	addExt(x509, NID_ext_key_usage, ("serverAuth"));
	addExt(x509, NID_netscape_comment, (x509Comment));

	// Sign the certificate with our private key
	X509_sign(x509, p_priv_key, EVP_sha256());

	p_file = fopen(filepath.c_str(), "wt");

	if (p_file != nullptr) {
	PEM_write_PrivateKey(p_file, p_priv_key, nullptr, nullptr, 0, nullptr,
	nullptr);

	PEM_write_X509(p_file, x509);
	fclose(p_file);
	p_file = nullptr;
	}

	X509_free(x509);
	}

	EVP_PKEY_free(p_priv_key);
	p_priv_key = nullptr;
	}

	// cleanup_openssl();
	}

	EVP_PKEY* createEcKey() {
	EVP_PKEY* p_key = nullptr;

	#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
	int eccgrp = 0;
	eccgrp = OBJ_txt2nid("secp384r1");

	EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
	if (myecc != nullptr) {
	EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
	EC_KEY_generate_key(myecc);
	p_key = EVP_PKEY_new();
	if (p_key != nullptr) {
	if (EVP_PKEY_assign(p_key, EVP_PKEY_EC, myecc) != 0) {
	/* p_key owns myecc from now */
	if (EC_KEY_check_key(myecc) <= 0) {
	std::cerr << "EC_check_key failed.\n";
	}
	}
	}
	}
	#else
	// Create context for curve parameter generation.
	std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{
	EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free};
	if (!ctx) {
	return nullptr;
	}

	// Set up curve parameters.
	EVP_PKEY* params = nullptr;
	if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) \|\|
	(EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <= 0) \|\|
	(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <= 0) \|\|
	(EVP_PKEY_paramgen(ctx.get(), &params) <= 0)) {
	return nullptr;
	}

	// Set up RAII holder for params.
	std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{
	params, &::EVP_PKEY_free};

	// Set new context for key generation, using curve parameters.
	ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr));
	if (!ctx \|\| (EVP_PKEY_keygen_init(ctx.get()) <= 0)) {
	return nullptr;
	}

	// Generate key.
	if (EVP_PKEY_keygen(ctx.get(), &p_key) <= 0) {
	return nullptr;
	}
	#endif

	return p_key;
	}

	void initOpenssl() {
	#if OPENSSL_VERSION_NUMBER < 0x10100000L
	SSL_load_error_strings();
	OpenSSL_add_all_algorithms();
	RAND_load_file("/dev/urandom", 1024);
	#endif
	}

	inline void ensureOpensslKeyPresentAndValid(const std::string& filepath) {
	bool pem_file_valid = false;

	pem_file_valid = verifyOpensslKeyCert(filepath);

	if (!pem_file_valid) {
	std::cerr << "Error in verifying signature, regenerating\n";
	generateSslCertificate(filepath, "testhost");
	}
	}

	inline std::shared_ptr<boost::asio::ssl::context> getSslContext(
	const std::string& sslPemFile) {
	std::shared_ptr<boost::asio::ssl::context> m_ssl_context =
	std::make_shared<boost::asio::ssl::context>(
	boost::asio::ssl::context::tls_server);
	m_ssl_context->set_options(boost::asio::ssl::context::default_workarounds \|
	boost::asio::ssl::context::no_sslv2 \|
	boost::asio::ssl::context::no_sslv3 \|
	boost::asio::ssl::context::single_dh_use \|
	boost::asio::ssl::context::no_tlsv1 \|
	boost::asio::ssl::context::no_tlsv1_1);

	// BIG WARNING: This needs to stay disabled, as there will always be
	// unauthenticated endpoints
	// m_ssl_context->set_verify_mode(boost::asio::ssl::verify_peer);

	SSL_CTX_set_options(m_ssl_context->native_handle(), SSL_OP_NO_RENEGOTIATION);

	BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
	m_ssl_context->add_verify_path(trustStorePath);

	m_ssl_context->use_certificate_file(sslPemFile,
	boost::asio::ssl::context::pem);
	m_ssl_context->use_private_key_file(sslPemFile,
	boost::asio::ssl::context::pem);

	// Set up EC curves to auto (boost asio doesn't have a method for this)
	// There is a pull request to add this. Once this is included in an asio
	// drop, use the right way
	// http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
	if (SSL_CTX_set_ecdh_auto(m_ssl_context->native_handle(), 1) != 1) {
	BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
	}

	std::string mozilla_modern =
	"ECDHE-ECDSA-AES256-GCM-SHA384:"
	"ECDHE-RSA-AES256-GCM-SHA384:"
	"ECDHE-ECDSA-CHACHA20-POLY1305:"
	"ECDHE-RSA-CHACHA20-POLY1305:"
	"ECDHE-ECDSA-AES128-GCM-SHA256:"
	"ECDHE-RSA-AES128-GCM-SHA256:"
	"ECDHE-ECDSA-AES256-SHA384:"
	"ECDHE-RSA-AES256-SHA384:"
	"ECDHE-ECDSA-AES128-SHA256:"
	"ECDHE-RSA-AES128-SHA256";

	if (SSL_CTX_set_cipher_list(m_ssl_context->native_handle(),
	mozilla_modern.c_str()) != 1) {
	BMCWEB_LOG_ERROR << "Error setting cipher list\n";
	}
	return m_ssl_context;
	}

	inline std::optional<boost::asio::ssl::context> getSSLClientContext() {
	boost::asio::ssl::context ssl_ctx(boost::asio::ssl::context::tls_client);

	boost::system::error_code ec;

	// Support only TLS v1.2 & v1.3
	// NOLINTNEXTLINE(bugprone-unused-return-value)
	ssl_ctx.set_options(boost::asio::ssl::context::default_workarounds \|
	boost::asio::ssl::context::no_sslv2 \|
	boost::asio::ssl::context::no_sslv3 \|
	boost::asio::ssl::context::single_dh_use \|
	boost::asio::ssl::context::no_tlsv1 \|
	boost::asio::ssl::context::no_tlsv1_1,
	ec);
	if (ec) {
	BMCWEB_LOG_ERROR << "SSL context set_options failed";
	return std::nullopt;
	}

	// Add a directory containing certificate authority files to be used
	// for performing verification.
	// NOLINTNEXTLINE(bugprone-unused-return-value)
	ssl_ctx.set_default_verify_paths(ec);
	if (ec) {
	BMCWEB_LOG_ERROR << "SSL context set_default_verify failed";
	return std::nullopt;
	}

	// Verify the remote server's certificate
	// NOLINTNEXTLINE(bugprone-unused-return-value)
	ssl_ctx.set_verify_mode(boost::asio::ssl::verify_peer, ec);
	if (ec) {
	BMCWEB_LOG_ERROR << "SSL context set_verify_mode failed";
	return std::nullopt;
	}

	// All cipher suites are set as per OWASP datasheet.
	// https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html
	constexpr const char* ssl_ciphers =
	"ECDHE-ECDSA-AES128-GCM-SHA256:"
	"ECDHE-RSA-AES128-GCM-SHA256:"
	"ECDHE-ECDSA-AES256-GCM-SHA384:"
	"ECDHE-RSA-AES256-GCM-SHA384:"
	"ECDHE-ECDSA-CHACHA20-POLY1305:"
	"ECDHE-RSA-CHACHA20-POLY1305:"
	"DHE-RSA-AES128-GCM-SHA256:"
	"DHE-RSA-AES256-GCM-SHA384"
	"TLS_AES_128_GCM_SHA256:"
	"TLS_AES_256_GCM_SHA384:"
	"TLS_CHACHA20_POLY1305_SHA256";

	if (SSL_CTX_set_cipher_list(ssl_ctx.native_handle(), ssl_ciphers) != 1) {
	BMCWEB_LOG_ERROR << "SSL_CTX_set_cipher_list failed";
	return std::nullopt;
	}

	return ssl_ctx;
	}

	} // namespace ensuressl

	#endif // THIRD_PARTY_GBMCWEB_INCLUDE_SSL_KEY_HANDLER_H_