<?PHP
#wiff.inc.php-The things that Firefox on Windows will understand as a certificate request
$bugsy.="<BR>We are at $part in ".__FILE__.".";
switch ($part)
{
	case "display":
		$osbrdisplay="Firefox on Windows";
		break;
	case "header":			##What goes into the header called between processing the command and sending the page
						##This is used when the page for filling out name parts is presented.
		echo "</HEAD>";
		echo "<BODY>";	#might have an onload component
?>
<?PHP
		break;
	case "form":			##FORM statement for this browser-os system
		echo "After pressing the button, it will appear that nothing happens.  This might be the case but "
			."it is more likely that your new certificate is installed and you can start playing with it.";
		echo "<FORM METHOD=POST ACTION='".$_SERVER["PHP_SELF"]."' $other>";
		echo "<KEYGEN NAME=\"SPKAC\" CHALLENGE=\"challengePassword\">";
		break;
	case "certheader":		#Again the transition from HEAD to BODY, this time for returning the certificate
		echo "</HEAD>";
		echo "<BODY>";
		break;
	case "makecert":		#Actual certificate construction commands
    $dir=UPLOADDIRECTORY."/$enrollee_id";
    $cnffile="$dir/cnf";
      shell_exec("echo ##Configuration file for $enrollee_id.>$cnffile");
      shell_exec("echo dir = $dir>>$cnffile");
      shell_exec("echo signdir = ".HARDTOGET."/webvivos/4/certs >> $cnffile");
      shell_exec("echo id = $enrollee_id >> $cnffile");
      shell_exec("cat stub.cnf >> $cnffile");
    $serialfile=UPLOADDIRECTORY."/$enrollee_id/serial";
      shell_exec("echo ".sprintf("%X ",intval($enrollee_id)).">$serialfile");
    $req_file="$dir/req";
		  $reqp=fopen($req_file,"w");
      fwrite($reqp,sprintf("emailAddress = %s\n",$enrollee["email"]));
      fwrite($reqp,"commonName = Reliable ID Provisional Identity Certificate\n");
      if (!is_null($enrollee["first_name"])) fwrite($reqp,sprintf("firstName = %s\n",$enrollee["first_name"]));
      if (!is_null($enrollee["middle_name"])) fwrite($reqp,sprintf("initial = %s\n",$enrollee["middle_name"]));
      if (!is_null($enrollee["last_name"])) fwrite($reqp,sprintf("surname = %s\n",$enrollee["last_name"]));
		  fwrite($reqp,sprintf("SPKAC = %s\n",str_replace("\r\n","",$_REQUEST["SPKAC"])));
		  fclose($reqp);
		  
    $CACERT="-cert ".CACERT;          ##CACERT, CAKEYFILE, CAKEY are defined in .htconfig
    $CAKEYFILE="-keyfile ".CAKEYFILE;
    $DAYS=" -days ".PROVISIONALDAYS;
    $CAKEY="-key ".CAKEY;    ##formerly mad3mad
    $CONFIG="-config $cnffile";
    $ERRORFILE="errors";

		$cmd=OPENSSLDIR."/openssl ca -batch $CONFIG "
			." $CAKEY "
			."-verbose -spkac $req_file "
			."2>errors";
		$cert = shell_exec ($cmd);
    if ($cert)
    {
		  header("Content-Type: application/x-x509-user-cert");
		  #	header("Content-Length: ".strlen($cert));
		  #	header("Location: $PHP_SELF?command=info");
		  echo $cert;
		  $page="done";
      buggywuggy("The openssl command<BR>$cmd<BR>yielded a certificate of<BR>$cert");
      loggywoggy("The openssl command<BR>$cmd<BR>yielded a certificate of<BR>$cert");
      loggywoggy("Certificate $enrollee_id has been downloaded.");
    }
    else
    {
      $req=file_get_contents($req_file);
      loggywoggy("Request\n$req\nsubjected to command\n$cmd\ngot no certificate.");
      echo "The errors in ";echo $ERRORFILE;echo " are:<BR>";
      echo file_get_contents($ERRORFILE);
    }
		break;
  case "presentcert":     ##Instructions on how to get your browser to present a certificate
  ?>
<H2>Presenting a client certificate to a web site</H2>
<P>There are three things that must happen in order for you to get your personal certificate to the web site which asks for it:<OL>
  <LI>The web site must ask for it.  This is out of your control but I assure you that we are asking for it.  At least, I think we are.
  We had a lot of technicians spending a lot of time trying to figure out why it stopped asking and we tested it before we took this page live.
  </LI>
  <LI>You must have a certificate.  If you are reading this, then you should have already registered with us and we should have downloaded your certificate to your Firefox browser.
  If you didn't see any error message and you got our email telling you how to continue, then you should have the certificate.
  To check whether you have the certificate, click on the Tools menu and choose the Options item.
  This should open a dialog box titled "Options" with seven icons across the top.
  Please click on the icon that says "Advanced".  This will give you four tabs across the top.
  Click on the tab that says "Encryption".
  This makes the box talk about certificates.
  Just as an aside, you should probably click both the SSLv3 and the TLSv1 boxes.  They are very nearly the same thing and most web sites now will use TLS but why take the chance on breaking down in the middle of nowhere.
  We'll get to the question in the middle on the way back out.
  There are four buttons below, choose "View Certificates".
  This will pop up a new dialog box named "Certificate Manager" with four tabs.
  Please click the tab named "Personal Certificates".
  This will expose your personal certificates.
  At the very least, you should now have one named "Reliable ID Provisional Identity Certificate".
  For the process of applying for a Reliable ID certificate, this is the one you want.
  If it's there, you are ready for the next step.
  <BR>If it's not there, then something failed in the installation of the certificate.
  Please respond to the email we sent to you and tell us your problem.
  Your phone number might help.
  I'm afraid that's the best we can do for you until one of our people looks more closely at this.</BR>
  </LI>
  <LI>You must present the certificate.
  If you haven't closed the list of certificates, do so now.
  If you have closed it, you have the box with the "View Certificates" button.  Don't click it.
  If you closed the whole thing, you have to redo most of the previous step: Tools->Options->Advanced->Encryption.
  You should have the dialog with the four buttons.
  Above the buttons, you should see two choices: "Select one automatically" and "Ask me every time".
  If your list of personal certificates has only one entry, either one will do.
  If you have more than one personal certificate, you're safer with "Ask me every time" but that does get tedious.
  Automatic selection takes away that control and you will probably present either the top certificate in the list or the most recent.
  There ought to be a way to choose your own default, but I haven't found it yet.
  If you choose automatic selection and get a thoroughly nasty message from us, go back and seize control by clicking the "Ask me" button.
  <BR>When you're done, remeber to click OK buttons on the way out or you'll have to redo all the changes.</BR>
  </LI>
</OL>
  If you think you have done all this correctly and still have trouble, please respond to your email and tell us what you see as the problem.
  Your phone number could help.
  <?PHP
	default:
    reporterror("bad part,".((isset($part))?($part):"not set").", in ".__FILE__." for enrollee ".((isset($enrollee_id))?($enrollee_id):("unknown enrollee_id")));
		break;
}
$part="";
?>
