<?PHP
#frmo.inc.php-The things that Moailla on FreeBSD will understand as a certificate request
switch ($part)
{
	case "display":
		$osbrdisplay="Mozilla on FreeBSD";
		break;
	case "header":			##What goes into the header called between processing the command and sending the page
						##This is used when the page for filling out name parts is presented.
		echo "</HEAD>";
		echo "<BODY>";	#might have an onload component
?>
<?PHP
		break;
	case "form":			##FORM statement for this browser-os system
		echo "Afterpressing the button, it will appear that nothing happened.  This might be the case but it is more likely that your new certificate is installed and you can start playing with it.";
		echo "<FORM METHOD=POST ACTION='".$_SERVER["PHP_SELF"]."' NAME='GenReqForm'>";
		echo "<KEYGEN NAME=\"SPKAC\" CHALLENGE=\"challengePassword\">";
		break;
	case "certheader":		#Again the transition from HEAD to BODY, this time for returning the certificate
?>
<?PHP
		echo "</HEAD>";
		echo "<BODY>";
		echo "\n\n--".MIME_BOUNDARY;
		echo "\nContent-Type: application/x-x509-user-cert";
		echo "\n\n$cert";
		echo "\n\n--".MIME_BOUNDARY;
		echo "\nContent-Type: text/html\n\n";
		break;
	case "makecert":		#Actual certificate construction commands
		$req_names = array('commonName', 'emailAddress', 'organizationName',
                 'organizationalUnitName', 'localityName', 'stateOrProvinceName',
                 'countryName');
		$reqp=fopen($req_file,"w");
		$nnames=count($req_names);
		for ($i=0;$i<$nnames;$i++)
		{
			$id=$req_names[$i];
			$value=str_replace("\r\n","",$_REQUEST[$id]);
			fwrite($reqp,sprintf("%s = %s\n",$id,$value));
		}
		fwrite($reqp,sprintf("SPKAC = %s\n",str_replace("\r\n","",$_REQUEST["SPKAC"])));
		fclose($reqp);
		$cmd="$openssldir/openssl ca -batch -config $cnffile -extensions "
			."certificate_extensions $CACERT "
			."$CAKEY "
			."-verbose -spkac $req_file $DAYS "
			."2>$ERRORFILE";
		$cert = shell_exec ($cmd);
		header("Content-Type: multipart/x-mixed-replace; boundary=\"".MIME_BOUNDARY."\"");
		#header("Content-Type: application/x-x509-user-cert");
		#	header("Content-Length: ".strlen($cert));
		#	header("Location: $PHP_SELF?command=info");
		$page="done";
		echo $cert;
		break;
	case "findit":
		echo "So you've acquired a new certificate from ".OURNAME." and now you want to look at it and admire it.  ";
		echo "The first thing to do is to open your browser.  Since you are reading this page, you probably already have it open. ";
		echo "Next, click on the Edit menu and then the Preferences... option.  This should give you a dialog box with a scrolling list on the left.  In that list click the little plus sign in the box next to \"Privacy & Security\" and in the list that appears when you click it, click on \"Certificates\".  This should cause the right side of the dialog box to change.  In the middle, click the button that says \"Manage Certificates...\" to get a new dialog box.  ";
		echo "Across the top are four tabs and \"Your Certificates\" should be highlighted.  Below that should be a list with all of the certificates you own.  I hope you recognize your name.  You might also recognize the serial number.  You can click on it and hit \"View\" or just double-click on it.  This shows you a summary of the certificate. For more details click the \"Details\" tab at the top.  As you click on items on the top, they are described below.  Note that you can see whether your certificate is valid or expired by clicking on the NotBefore and NotAfter items.  ";
		echo "<P>If you are one of the fortunate/intelligent people to have your certificate mounted on a removable token or smart card, you may need to install driver software.  This is the set of commands which allow general commands from the Software Security Device to talk to the specific hardware of your token.  On Windows, it is typically in a file named something.dll, on honest systems it's something.so where \"something\" is an invention of the manufacturer.  Sometimes, you can convince this software to install itself automatically.  Other times, you install it yourself.  First, place the something.so file on the computer.  If you go back to the Preferences dialog, instead of clicking \"Manage Certificates...\", you can click on \"Manage Security Devices\".  This is where we control all of these devices";
		break;
	case "howto":
		echo "So you've acquired a new certificate from ".OURNAME." and now you want to use it.  ";
		echo "This really is not very difficult as people make browsers so as to hide as much of this as possible from you.  ";
		echo "Primarily, you use https instead of http and go to a site which wants client certificates.  ";
		echo "When you do so the first time since you started your browser, you will be asked for the master password for the Software Security Device.  ";
		echo "Type in this password and you're in.  ";
		echo "If you have only one certificate, the browser will present it to the site.  ";
		echo "If you have multiple certificates, the browser will either ask you which one to use or choose one for you.  ";
		echo "(This behaviour can be configured in the Preferences dialog in the Edit menu.)  ";
		echo "At that point you should be in.  ";
		echo "When you go to a different site that expects certificates, you will have already opened the Software Security Device so your change will seem seamless.  ";
		echo "<P>Unfortunately, there are a few things that can happen:<UL>";
		echo "<LI>The site won't recognize the signer (root certificate) of your certificate.  This is a problem with the site and your major choices are not to use that site, to convince the site manager to add the signer to its list of acceptable roots, or to get a certificate signed by a certificate which the site will accept.</LI>";
		echo "<LI>The site won't recognize your certificate specifically.  This is mostlikely because you haven't registered for the site or have not told it about your new certificate.  A good site should have hints about what to do in this case.</LI>";
		echo "<LI>The site will say that your certificate is no good.  This might mean that your signer (root certificate) has revoked your certificate or it might mean that your certificate is out of date.  Your certificate is given specific start and end dates.  Because of the crazy patchwork by which carbon-based life forms measure time, your certificate might not be ready yet.  We really do try to avoid this.  Alternatively, your certificate might have run its useful life. This means that its expiration date is in the past and you have to get a new one.</LI>";
		echo "<LI>You might also have the usual problems that plague us all, server down, browser messed up the protocol, or whatever.  </LI>";
		echo "</UL>";
		echo "<P>I should also mention that if you enter the password and get incomprehensible error messages, it just might be that you are one of the fortunate/intelligent people who placed the certificate on a removable token or smart card.  This means that your token should be plugged in.  If you are using a new computer, you might also have to give it the driver for your token and register the driver with the Software Security Device.  This registration is more in the lines of <A href=findit.php?osbr=$osbr>Examining your Certificate</A> page.  ";
		break;
	default:
		break;
}
?>
