devroxy

utils.go (4208B)

---

 package certificates
 
 import (
 	"bytes"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
 	"errors"
 	"fmt"
 	"math"
 	"math/big"
 	"os"
 	"time"
 
 	"github.com/valyala/bytebufferpool"
 )
 
 func readCertificate(filename string) (*x509.Certificate, error) {
 	data, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, err
 	}
 
 	block, _ := pem.Decode(data)
 	if block == nil || block.Type != "CERTIFICATE" {
 		return nil, errors.New("invalid certificate")
 	}
 
 	cert, err := x509.ParseCertificate(block.Bytes)
 	if err != nil {
 		return nil, err
 	}
 
 	return cert, nil
 }
 
 func readKey(file string) (*rsa.PrivateKey, error) {
 	data, err := os.ReadFile(file)
 	if err != nil {
 		return nil, err
 	}
 
 	block, _ := pem.Decode(data)
 	if block.Type != "RSA PRIVATE KEY" {
 		return nil, errors.New("only rsa private key is supported")
 	}
 
 	return x509.ParsePKCS1PrivateKey(block.Bytes)
 }
 
 func generateCertificateImpl(
 	filename string,
 	template *x509.Certificate,
 	key *rsa.PrivateKey,
 	parent *x509.Certificate,
 	rootKey *rsa.PrivateKey,
 ) ([]byte, error) {
 	if parent == nil {
 		parent = template
 	}
 
 	data, err := x509.CreateCertificate(
 		rand.Reader,
 		template,
 		parent,
 		key.Public(),
 		rootKey,
 	)
 	if err != nil {
 		return nil, err
 	}
 
 	buf := bytebufferpool.Get()
 	defer bytebufferpool.Put(buf)
 
 	err = pem.Encode(buf, &pem.Block{
 		Type:  "CERTIFICATE",
 		Bytes: data,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to encode certificate: %w", err)
 	}
 
 	err = os.WriteFile(filename, buf.B, 0600)
 	if err != nil {
 		return nil, err
 	}
 
 	return data, nil
 }
 
 func generateCertificate(
 	filename string,
 	domain string,
 	key *rsa.PrivateKey,
 	parent *x509.Certificate,
 	rootKey *rsa.PrivateKey,
 ) ([]byte, error) {
 	serial, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
 	if err != nil {
 		return nil, err
 	}
 
 	return generateCertificateImpl(
 		filename,
 		&x509.Certificate{
 			DNSNames:              []string{domain},
 			Subject:               pkix.Name{CommonName: domain},
 			SerialNumber:          serial,
 			NotBefore:             time.Now(),
 			NotAfter:              time.Now().AddDate(2, 0, 30),
 			KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 			BasicConstraintsValid: true,
 		},
 		key,
 		parent,
 		rootKey,
 	)
 }
 
 func generateRootCertificate(filename string, key *rsa.PrivateKey) (*x509.Certificate, error) {
 	serial, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
 	if err != nil {
 		return nil, err
 	}
 
 	template := &x509.Certificate{
 		Subject: pkix.Name{
 			CommonName: "Devroxy Internal CA ",
 		},
 		SerialNumber:          serial,
 		NotBefore:             time.Now(),
 		NotAfter:              time.Now().AddDate(2, 0, 30),
 		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}
 
 	data, err := generateCertificateImpl(
 		filename,
 		template,
 		key,
 		nil,
 		key,
 	)
 	if err != nil {
 		return nil, err
 	}
 
 	return x509.ParseCertificate(data)
 }
 
 func generateKey(filename string) (*rsa.PrivateKey, error) {
 	key, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		return nil, err
 	}
 	err = writeKey(filename, key)
 	if err != nil {
 		return nil, err
 	}
 	return key, nil
 }
 
 func writeKey(file string, key *rsa.PrivateKey) error {
 	data := x509.MarshalPKCS1PrivateKey(key)
 
 	buf := bytebufferpool.Get()
 	defer bytebufferpool.Put(buf)
 
 	err := pem.Encode(buf, &pem.Block{
 		Type:  "RSA PRIVATE KEY",
 		Bytes: data,
 	})
 	if err != nil {
 		return err
 	}
 
 	return os.WriteFile(file, buf.Bytes(), 0600)
 }
 
 func checkCertificate(cert *x509.Certificate, key *rsa.PrivateKey) error {
 	if cert.PublicKeyAlgorithm != x509.RSA {
 		return errors.New("only rsa certificate is supported")
 	}
 
 	dataA := x509.MarshalPKCS1PublicKey(cert.PublicKey.(*rsa.PublicKey))
 	dataB := x509.MarshalPKCS1PublicKey(&key.PublicKey)
 
 	if !bytes.Equal(dataA, dataB) {
 		return errors.New("public key not match")
 	}
 
 	return nil
 }