Add support for client certificates

[jtdowney]

This change adds a new flag for client certificates. When this flag is passed, the extended key usage for the generated certificate is for client authentication instead of server authentication.

I am not 100% sure this is a good idea, but I found myself needing to generate both server and client certificates for a project and thought that mkcert could fit both of those cases.

The change was remarkably easy to make so I figured I'd submit a PR.

[adamdecaf]

Why not just add ClientAuth as a usage if the flag is set?

[jtdowney]

In my case, I wanted separate certificates. If the certificate is meant for client auth, then it doesn't need the server auth extension. To me, it would seem weird that a client certificate could be used for server authentication as well.

[bombsimon]

Hi! I would like to see this kind of change as well. Will this this PR be merged or does it break your thoughts about simplicity?

Personally I don't mind adding the extended key usage for both client and server if that's more in line with your thoughts. This is the only diff I needed to fix my issues:

diff --git a/cert.go b/cert.go
index 13ed35f..8c40aa8 100644
--- a/cert.go
+++ b/cert.go
@@ -62,7 +62,7 @@ func (m *mkcert) makeCert(hosts []string) {
                NotBefore: time.Now(),

                KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-               ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+               ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
                BasicConstraintsValid: true,
        }
        for _, h := range hosts {

[FiloSottile]

Rebased and merged, thank you!

[erikh]

\o/!!!!!

…

On Sat, Feb 2, 2019 at 1:28 PM Filippo Valsorda ***@***.***> wrote: Rebased and merged, thank you! — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#89 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABJ68JKq_qlSiqUxp6Q9txy7jfXvwRLks5vJgLpgaJpZM4YMT6Z> .