Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

draft: Generate tls certificate with CA #9325

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

draft: Generate tls certificate with CA #9325

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
acfa947
cert: pass optional signer to GenCertPair
JssDWt Nov 29, 2024
078adc1
temp: REMOVE: target local cert package
JssDWt Nov 30, 2024
ab00183
tls_manager: generate ca certificate
JssDWt Nov 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions cert/selfsigned.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package cert

import (
"bytes"
"crypto"
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
Expand Down Expand Up @@ -200,8 +201,8 @@ func IsOutdated(cert *x509.Certificate, tlsExtraIPs,
// This function is adapted from https://github.com/btcsuite/btcd and
// https://github.com/btcsuite/btcd/btcutil
func GenCertPair(org string, tlsExtraIPs, tlsExtraDomains []string,
tlsDisableAutofill bool, certValidity time.Duration) (
[]byte, []byte, error) {
tlsDisableAutofill bool, certValidity time.Duration, caCertBytes []byte,
caKeyBytes []byte) ([]byte, []byte, error) {

now := time.Now()
validUntil := now.Add(certValidity)
Expand Down Expand Up @@ -232,6 +233,21 @@ func GenCertPair(org string, tlsExtraIPs, tlsExtraDomains []string,
return nil, nil, err
}

var caCert *x509.Certificate
isCa := true
var signerPriv crypto.PrivateKey = priv
if caKeyBytes != nil {
caCertData, parsedCaCert, err := LoadCertFromBytes(
caCertBytes, caKeyBytes,
)
if err != nil {
return nil, nil, err
}
isCa = false
signerPriv = caCertData.PrivateKey
caCert = parsedCaCert
}

// Construct the certificate template.
template := x509.Certificate{
SerialNumber: serialNumber,
Expand All @@ -248,16 +264,20 @@ func GenCertPair(org string, tlsExtraIPs, tlsExtraDomains []string,
ExtKeyUsage: []x509.ExtKeyUsage{
x509.ExtKeyUsageServerAuth,
},
IsCA: true, // so can sign self.
IsCA: isCa,
BasicConstraintsValid: true,

DNSNames: dnsNames,
IPAddresses: ipAddresses,
}

if isCa {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might want some explanatory comments around this.

caCert = &template
}

derBytes, err := x509.CreateCertificate(
rand.Reader, &template,
&template, &priv.PublicKey, priv,
caCert, &priv.PublicKey, signerPriv,
)
if err != nil {
return nil, nil, fmt.Errorf("failed to create certificate: %w",
Expand Down
8 changes: 4 additions & 4 deletions cert/selfsigned_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ func TestIsOutdatedCert(t *testing.T) {
// Generate TLS files with two extra IPs and domains.
certBytes, keyBytes, err := cert.GenCertPair(
"lnd autogenerated cert", extraIPs[:2], extraDomains[:2],
false, testTLSCertDuration,
false, testTLSCertDuration, nil, nil,
)
if err != nil {
t.Fatal(err)
Expand Down Expand Up @@ -90,7 +90,7 @@ func TestIsOutdatedPermutation(t *testing.T) {
// Generate TLS files from the IPs and domains.
certBytes, keyBytes, err := cert.GenCertPair(
"lnd autogenerated cert", extraIPs[:], extraDomains[:],
false, testTLSCertDuration,
false, testTLSCertDuration, nil, nil,
)
if err != nil {
t.Fatal(err)
Expand Down Expand Up @@ -161,7 +161,7 @@ func TestTLSDisableAutofill(t *testing.T) {
// Generate TLS files with two extra IPs and domains and no interface IPs.
certBytes, keyBytes, err := cert.GenCertPair(
"lnd autogenerated cert", extraIPs[:2], extraDomains[:2],
true, testTLSCertDuration,
true, testTLSCertDuration, nil, nil,
)
require.NoError(
t, err,
Expand Down Expand Up @@ -223,7 +223,7 @@ func TestTLSConfig(t *testing.T) {
// Generate TLS files with an extra IP and domain.
certBytes, keyBytes, err := cert.GenCertPair(
"lnd autogenerated cert", []string{extraIPs[0]},
[]string{extraDomains[0]}, false, testTLSCertDuration,
[]string{extraDomains[0]}, false, testTLSCertDuration, nil, nil,
)
require.NoError(t, err)

Expand Down