This repository has been archived by the owner on Jul 11, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 277
/
ca.go
106 lines (91 loc) · 3.96 KB
/
ca.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
package tresor
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"time"
"github.com/pkg/errors"
"github.com/openservicemesh/osm/pkg/certificate"
"github.com/openservicemesh/osm/pkg/certificate/pem"
"github.com/openservicemesh/osm/pkg/errcode"
)
// NewCA creates a new Certificate Authority.
func NewCA(cn certificate.CommonName, validityPeriod time.Duration, rootCertCountry, rootCertLocality, rootCertOrganization string) (certificate.Certificater, error) {
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
if err != nil {
return nil, errors.Wrap(err, errGeneratingSerialNumber.Error())
}
now := time.Now()
template := &x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{
CommonName: cn.String(),
Country: []string{rootCertCountry},
Locality: []string{rootCertLocality},
Organization: []string{rootCertOrganization},
},
NotBefore: now,
NotAfter: now.Add(validityPeriod),
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
BasicConstraintsValid: true,
IsCA: true,
}
rsaKey, err := rsa.GenerateKey(rand.Reader, rsaBits)
if err != nil {
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrGeneratingPrivateKey)).
Msgf("Error generating key for CA for org %s", rootCertOrganization)
return nil, err
}
// Self-sign the root certificate
derBytes, err := x509.CreateCertificate(rand.Reader, template, template, &rsaKey.PublicKey, rsaKey)
if err != nil {
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrCreatingRootCert)).
Msgf("Error issuing x509.CreateCertificate command for SerialNumber=%s", serialNumber)
return nil, errors.Wrap(err, errCreateCert.Error())
}
pemCert, err := certificate.EncodeCertDERtoPEM(derBytes)
if err != nil {
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrEncodingCertDERtoPEM)).
Msgf("Error encoding certificate with SerialNumber=%s", serialNumber)
return nil, err
}
pemKey, err := certificate.EncodeKeyDERtoPEM(rsaKey)
if err != nil {
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrEncodingKeyDERtoPEM)).
Msgf("Error encoding private key for certificate with SerialNumber=%s", serialNumber)
return nil, err
}
rootCertificate := Certificate{
commonName: certificate.CommonName(template.Subject.CommonName),
serialNumber: certificate.SerialNumber(serialNumber.String()),
certChain: pemCert,
privateKey: pemKey,
expiration: template.NotAfter,
}
rootCertificate.issuingCA = rootCertificate.GetCertificateChain()
return &rootCertificate, nil
}
// NewCertificateFromPEM is a helper returning a certificate.Certificater from the PEM components given.
func NewCertificateFromPEM(pemCert pem.Certificate, pemKey pem.PrivateKey, expiration time.Time) (certificate.Certificater, error) {
x509Cert, err := certificate.DecodePEMCertificate(pemCert)
if err != nil {
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrDecodingPEMCert)).
Msg("Error converting PEM cert to x509 to obtain serial number")
return nil, err
}
rootCertificate := Certificate{
commonName: certificate.CommonName(x509Cert.Subject.CommonName),
serialNumber: certificate.SerialNumber(x509Cert.SerialNumber.String()),
certChain: pemCert,
privateKey: pemKey,
expiration: expiration,
}
rootCertificate.issuingCA = rootCertificate.GetCertificateChain()
return &rootCertificate, nil
}