FilesExpand file tree

main

/

generate_cert.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

171 lines (151 loc) · 4.83 KB

main

/

generate_cert.go

Copy path

Top

File metadata and controls

• Code
• Blame

171 lines (151 loc) · 4.83 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

// Copyright 2009 The Go Authors. All rights reserved.

// Use of this source code is governed by a BSD-style

// license that can be found in the LICENSE-Go file.

//go:build ignore

// Generate a self-signed X.509 certificate for a TLS server. Outputs to

// 'cert.pem' and 'key.pem' and will overwrite existing files.

package main

import (

"crypto/ecdsa"

"crypto/ed25519"

"crypto/elliptic"

"crypto/rand"

"crypto/rsa"

"crypto/x509"

"crypto/x509/pkix"

"encoding/pem"

"flag"

"log"

"math/big"

"net"

"os"

"strings"

"time"

)

var (

host = flag.String("host", "", "Comma-separated hostnames and IPs to generate a certificate for")

validFrom = flag.String("start-date", "", "Creation date formatted as Jan 1 15:04:05 2011")

validFor = flag.Duration("duration", 365*24*time.Hour, "Duration that certificate is valid for")

isCA = flag.Bool("ca", false, "whether this cert should be its own Certificate Authority")

rsaBits = flag.Int("rsa-bits", 2048, "Size of RSA key to generate. Ignored if --ecdsa-curve is set")

ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to generate a key. Valid values are P224, P256 (recommended), P384, P521")

ed25519Key = flag.Bool("ed25519", false, "Generate an Ed25519 key")

)

func publicKey(priv any) any {

switch k := priv.(type) {

case *rsa.PrivateKey:

return &k.PublicKey

case *ecdsa.PrivateKey:

return &k.PublicKey

case ed25519.PrivateKey:

return k.Public().(ed25519.PublicKey)

default:

return nil

}

}

func main() {

flag.Parse()

if len(*host) == 0 {

log.Fatalf("Missing required --host parameter")

}

var priv any

var err error

switch *ecdsaCurve {

case "":

if *ed25519Key {

_, priv, err = ed25519.GenerateKey(rand.Reader)

} else {

priv, err = rsa.GenerateKey(rand.Reader, *rsaBits)

}

case "P224":

priv, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader)

case "P256":

priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

case "P384":

priv, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)

case "P521":

priv, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)

default:

log.Fatalf("Unrecognized elliptic curve: %q", *ecdsaCurve)

}

if err != nil {

log.Fatalf("Failed to generate private key: %v", err)

}

// ECDSA, ED25519 and RSA subject keys should have the DigitalSignature

// KeyUsage bits set in the x509.Certificate template

keyUsage := x509.KeyUsageDigitalSignature

// Only RSA subject keys should have the KeyEncipherment KeyUsage bits set. In

// the context of TLS this KeyUsage is particular to RSA key exchange and

// authentication.

if _, isRSA := priv.(*rsa.PrivateKey); isRSA {

keyUsage |= x509.KeyUsageKeyEncipherment

}

var notBefore time.Time

if len(*validFrom) == 0 {

notBefore = time.Now()

} else {

notBefore, err = time.Parse("Jan 2 15:04:05 2006", *validFrom)

if err != nil {

log.Fatalf("Failed to parse creation date: %v", err)

}

}

notAfter := notBefore.Add(*validFor)

serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)

serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)

if err != nil {

log.Fatalf("Failed to generate serial number: %v", err)

}

template := x509.Certificate{

SerialNumber: serialNumber,

Subject: pkix.Name{

Organization: []string{"Acme Co"},

},

NotBefore: notBefore,

NotAfter: notAfter,

KeyUsage: keyUsage,

ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},

BasicConstraintsValid: true,

}

hosts := strings.Split(*host, ",")

for _, h := range hosts {

if ip := net.ParseIP(h); ip != nil {

template.IPAddresses = append(template.IPAddresses, ip)

} else {

template.DNSNames = append(template.DNSNames, h)

}

}

if *isCA {

template.IsCA = true

template.KeyUsage |= x509.KeyUsageCertSign

}

derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, publicKey(priv), priv)

if err != nil {

log.Fatalf("Failed to create certificate: %v", err)

}

certOut, err := os.Create("cert.pem")

if err != nil {

log.Fatalf("Failed to open cert.pem for writing: %v", err)

}

if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {

log.Fatalf("Failed to write data to cert.pem: %v", err)

}

if err := certOut.Close(); err != nil {

log.Fatalf("Error closing cert.pem: %v", err)

}

log.Print("wrote cert.pem\n")

keyOut, err := os.OpenFile("key.pem", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)

if err != nil {

log.Fatalf("Failed to open key.pem for writing: %v", err)

}

privBytes, err := x509.MarshalPKCS8PrivateKey(priv)

if err != nil {

log.Fatalf("Unable to marshal private key: %v", err)

}

if err := pem.Encode(keyOut, &pem.Block{Type: "PRIVATE KEY", Bytes: privBytes}); err != nil {

log.Fatalf("Failed to write data to key.pem: %v", err)

}

if err := keyOut.Close(); err != nil {

log.Fatalf("Error closing key.pem: %v", err)

}

log.Print("wrote key.pem\n")

}