-
Notifications
You must be signed in to change notification settings - Fork 31
/
certmanager.go
120 lines (107 loc) · 3.13 KB
/
certmanager.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
// Copyright 2023 Authors of kubean-io
// SPDX-License-Identifier: Apache-2.0
package util
import (
"bytes"
cryptorand "crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"time"
)
// certManager helps to generate certs.
type certManager struct {
Organizations []string `json:"organizations"`
EffectiveTime time.Duration `json:"effectiveTime"`
DNSNames []string `json:"DNSNames"`
CommonName string `json:"commonName"`
}
func NewCertManager(
Orz []string,
effectiveTime time.Duration,
dnsNames []string,
commonName string,
) *certManager {
return &certManager{
Organizations: Orz,
EffectiveTime: effectiveTime,
DNSNames: dnsNames,
CommonName: commonName,
}
}
// GenerateSelfSignedCerts return self-signed certs according to provided dns.
func (m *certManager) GenerateSelfSignedCerts() (*bytes.Buffer, *bytes.Buffer, error) {
var serverCertPEM *bytes.Buffer
var serverPrivateKeyPEM *bytes.Buffer
var err error
// CA config
ca := &x509.Certificate{
SerialNumber: big.NewInt(2021),
Subject: pkix.Name{
Organization: m.Organizations,
},
NotBefore: time.Now(),
NotAfter: time.Now().Add(m.EffectiveTime),
IsCA: true,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
BasicConstraintsValid: true,
}
var caPrivateKey *rsa.PrivateKey
caPrivateKey, err = rsa.GenerateKey(cryptorand.Reader, 4096)
if err != nil {
return nil, nil, err
}
// self signed CA certificate
var caBytes []byte
caBytes, err = x509.CreateCertificate(cryptorand.Reader, ca, ca, &caPrivateKey.PublicKey, caPrivateKey)
if err != nil {
return nil, nil, err
}
// PEM encode CA cert
caPEM := new(bytes.Buffer)
_ = pem.Encode(caPEM, &pem.Block{
Type: "CERTIFICATE",
Bytes: caBytes,
})
// server cert config
cert := &x509.Certificate{
DNSNames: m.DNSNames,
SerialNumber: big.NewInt(1658),
Subject: pkix.Name{
CommonName: m.CommonName,
Organization: m.Organizations,
},
NotBefore: time.Now(),
NotAfter: time.Now().AddDate(1, 0, 0),
SubjectKeyId: []byte{1, 2, 3, 4, 6},
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
KeyUsage: x509.KeyUsageDigitalSignature,
}
// server private key
var serverPrivateKey *rsa.PrivateKey
serverPrivateKey, err = rsa.GenerateKey(cryptorand.Reader, 4096)
if err != nil {
return nil, nil, err
}
// sign the server cert
var serverCertBytes []byte
serverCertBytes, err = x509.CreateCertificate(cryptorand.Reader, cert, ca, &serverPrivateKey.PublicKey, caPrivateKey)
if err != nil {
return nil, nil, err
}
// PEM encode the server cert and key
serverCertPEM = new(bytes.Buffer)
_ = pem.Encode(serverCertPEM, &pem.Block{
Type: "CERTIFICATE",
Bytes: serverCertBytes,
})
serverPrivateKeyPEM = new(bytes.Buffer)
_ = pem.Encode(serverPrivateKeyPEM, &pem.Block{
Type: "RSA PRIVATE KEY",
Bytes: x509.MarshalPKCS1PrivateKey(serverPrivateKey),
})
return serverCertPEM, serverPrivateKeyPEM, err
}