helper_cert.go

// Copyright © 2017 Aeneas Rekkas <aeneas+oss@aeneas.io>
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package server

import (
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"strings"
	"time"

	"github.com/ory/hydra/config"
	"github.com/ory/hydra/jwk"
	"github.com/ory/hydra/pkg"
	"github.com/pkg/errors"
	"github.com/spf13/cobra"
	"github.com/spf13/viper"
	"github.com/square/go-jose"
)

const (
	tlsKeyName = "hydra.https-tls"
)

func loadCertificateFromFile(cmd *cobra.Command, c *config.Config) *tls.Certificate {
	keyPath := viper.GetString("HTTPS_TLS_KEY_PATH")
	certPath := viper.GetString("HTTPS_TLS_CERT_PATH")
	if kp, _ := cmd.Flags().GetString("https-tls-key-path"); kp != "" {
		keyPath = kp
	} else if cp, _ := cmd.Flags().GetString("https-tls-cert-path"); cp != "" {
		certPath = cp
	} else if keyPath == "" || certPath == "" {
		return nil
	}

	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
	if err != nil {
		c.GetLogger().Warn("Could not load x509 key pair: %s", cert)
		return nil
	}
	return &cert
}

func loadCertificateFromEnv(c *config.Config) *tls.Certificate {
	keyString := viper.GetString("HTTPS_TLS_KEY")
	certString := viper.GetString("HTTPS_TLS_CERT")
	if keyString == "" || certString == "" {
		return nil
	}

	keyString = strings.Replace(keyString, "\\n", "\n", -1)
	certString = strings.Replace(certString, "\\n", "\n", -1)

	var cert tls.Certificate
	var err error
	if cert, err = tls.X509KeyPair([]byte(certString), []byte(keyString)); err != nil {
		c.GetLogger().Warningf("Could not parse x509 key pair from env: %s", cert)
		return nil
	}

	return &cert
}

func getOrCreateTLSCertificate(cmd *cobra.Command, c *config.Config) tls.Certificate {
	if cert := loadCertificateFromFile(cmd, c); cert != nil {
		c.GetLogger().Info("Loaded tls certificate from file")
		return *cert
	} else if cert := loadCertificateFromEnv(c); cert != nil {
		c.GetLogger().Info("Loaded certificate from environment variable")
		return *cert
	}

	ctx := c.Context()
	keys, err := ctx.KeyManager.GetKey(tlsKeyName, "private")
	if errors.Cause(err) == pkg.ErrNotFound {
		c.GetLogger().Warn("No TLS Key / Certificate for HTTPS found. Generating self-signed certificate.")

		keys, err = new(jwk.ECDSA256Generator).Generate("")
		pkg.Must(err, "Could not generate key: %s", err)

		cert, err := createSelfSignedCertificate(jwk.First(keys.Key("private")).Key)
		pkg.Must(err, "Could not create X509 PEM Key Pair: %s", err)

		private := jwk.First(keys.Key("private"))
		private.Certificates = []*x509.Certificate{cert}
		keys = &jose.JSONWebKeySet{
			Keys: []jose.JSONWebKey{
				*private,
				*jwk.First(keys.Key("public")),
			},
		}

		err = ctx.KeyManager.AddKeySet(tlsKeyName, keys)
		pkg.Must(err, "Could not persist key: %s", err)
	} else {
		pkg.Must(err, "Could not retrieve key: %s", err)
	}

	private := jwk.First(keys.Key("private"))
	block, err := jwk.PEMBlockForKey(private.Key)
	if err != nil {
		pkg.Must(err, "Could not encode key to PEM: %s", err)
	}

	if len(private.Certificates) == 0 {
		c.GetLogger().Fatal("TLS certificate chain can not be empty")
	}

	pemCert := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: private.Certificates[0].Raw})
	pemKey := pem.EncodeToMemory(block)
	cert, err := tls.X509KeyPair(pemCert, pemKey)
	pkg.Must(err, "Could not decode certificate: %s", err)

	return cert
}

func createSelfSignedCertificate(key interface{}) (cert *x509.Certificate, err error) {
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return cert, errors.Errorf("Failed to generate serial number: %s", err)
	}

	certificate := &x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"Hydra"},
			CommonName:   "Hydra",
		},
		Issuer: pkix.Name{
			Organization: []string{"Hydra"},
			CommonName:   "Hydra",
		},
		NotBefore:             time.Now().UTC(),
		NotAfter:              time.Now().UTC().Add(time.Hour * 24 * 7),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	certificate.IsCA = true
	certificate.KeyUsage |= x509.KeyUsageCertSign
	certificate.DNSNames = append(certificate.DNSNames, "localhost")
	der, err := x509.CreateCertificate(rand.Reader, certificate, certificate, publicKey(key), key)
	if err != nil {
		return cert, errors.Errorf("Failed to create certificate: %s", err)
	}

	cert, err = x509.ParseCertificate(der)
	if err != nil {
		return cert, errors.Errorf("Failed to encode private key: %s", err)
	}
	return cert, nil
}