|
|
@ -1,28 +1,51 @@
|
|
|
|
// Copyright 2009 The Go Authors, 2015-2016 Jeremy Rand. All rights reserved.
|
|
|
|
// Copyright 2009 The Go Authors. All rights reserved.
|
|
|
|
|
|
|
|
// Modifications Copyright 2015-2018 Jeremy Rand. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
|
|
|
|
// This code is modified from the stock CreateCertificate to use a
|
|
|
|
// This code is modified from the stock CreateCertificate to use a
|
|
|
|
// pre-existing signature.
|
|
|
|
// pre-existing signature.
|
|
|
|
|
|
|
|
|
|
|
|
// Last rebased on Go 1.6.2
|
|
|
|
// Last rebased on Go 1.9
|
|
|
|
|
|
|
|
// Remove all content between "import" and "CreateCertificate" in original.
|
|
|
|
|
|
|
|
// Remove all content after "CreateCertificate" in original.
|
|
|
|
//go:generate bash install.sh
|
|
|
|
//go:generate bash install.sh
|
|
|
|
|
|
|
|
|
|
|
|
// Package x509 parses X.509-encoded keys and certificates.
|
|
|
|
// Package x509 parses X.509-encoded keys and certificates.
|
|
|
|
|
|
|
|
//
|
|
|
|
|
|
|
|
// On UNIX systems the environment variables SSL_CERT_FILE and SSL_CERT_DIR
|
|
|
|
|
|
|
|
// can be used to override the system default locations for the SSL certificate
|
|
|
|
|
|
|
|
// file and SSL certificate files directory, respectively.
|
|
|
|
package x509
|
|
|
|
package x509
|
|
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
import (
|
|
|
|
|
|
|
|
"bytes"
|
|
|
|
|
|
|
|
//"crypto"
|
|
|
|
|
|
|
|
//"crypto/dsa"
|
|
|
|
|
|
|
|
//"crypto/ecdsa"
|
|
|
|
|
|
|
|
//"crypto/elliptic"
|
|
|
|
|
|
|
|
//"crypto/rsa"
|
|
|
|
_ "crypto/sha1"
|
|
|
|
_ "crypto/sha1"
|
|
|
|
_ "crypto/sha256"
|
|
|
|
_ "crypto/sha256"
|
|
|
|
_ "crypto/sha512"
|
|
|
|
_ "crypto/sha512"
|
|
|
|
|
|
|
|
//"crypto/x509/pkix"
|
|
|
|
"encoding/asn1"
|
|
|
|
"encoding/asn1"
|
|
|
|
|
|
|
|
//"encoding/pem"
|
|
|
|
|
|
|
|
"errors"
|
|
|
|
|
|
|
|
//"fmt"
|
|
|
|
|
|
|
|
//"io"
|
|
|
|
|
|
|
|
//"math/big"
|
|
|
|
|
|
|
|
//"net"
|
|
|
|
|
|
|
|
//"strconv"
|
|
|
|
|
|
|
|
//"time"
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
// CreateCertificate creates a new certificate based on a template. The
|
|
|
|
// CreateCertificate creates a new certificate based on a template.
|
|
|
|
// following members of template are used: SerialNumber, Subject, NotBefore,
|
|
|
|
// The following members of template are used: AuthorityKeyId,
|
|
|
|
// NotAfter, KeyUsage, ExtKeyUsage, UnknownExtKeyUsage, BasicConstraintsValid,
|
|
|
|
// BasicConstraintsValid, DNSNames, ExcludedDNSDomains, ExtKeyUsage,
|
|
|
|
// IsCA, MaxPathLen, SubjectKeyId, DNSNames, PermittedDNSDomainsCritical,
|
|
|
|
// IsCA, KeyUsage, MaxPathLen, MaxPathLenZero, NotAfter, NotBefore,
|
|
|
|
// PermittedDNSDomains, SignatureAlgorithm.
|
|
|
|
// PermittedDNSDomains, PermittedDNSDomainsCritical, SerialNumber,
|
|
|
|
|
|
|
|
// SignatureAlgorithm, Subject, SubjectKeyId, and UnknownExtKeyUsage.
|
|
|
|
//
|
|
|
|
//
|
|
|
|
// The certificate is signed by parent. If parent is equal to template then the
|
|
|
|
// The certificate is signed by parent. If parent is equal to template then the
|
|
|
|
// certificate is self-signed. The parameter pub is the public key of the
|
|
|
|
// certificate is self-signed. The parameter pub is the public key of the
|
|
|
@ -32,15 +55,21 @@ import (
|
|
|
|
//
|
|
|
|
//
|
|
|
|
// All keys types that are implemented via crypto.Signer are supported (This
|
|
|
|
// All keys types that are implemented via crypto.Signer are supported (This
|
|
|
|
// includes *rsa.PublicKey and *ecdsa.PublicKey.)
|
|
|
|
// includes *rsa.PublicKey and *ecdsa.PublicKey.)
|
|
|
|
|
|
|
|
//
|
|
|
|
|
|
|
|
// The AuthorityKeyId will be taken from the SubjectKeyId of parent, if any,
|
|
|
|
|
|
|
|
// unless the resulting certificate is self-signed. Otherwise the value from
|
|
|
|
|
|
|
|
// template will be used.
|
|
|
|
//func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) {
|
|
|
|
//func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv interface{}) (cert []byte, err error) {
|
|
|
|
func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert []byte, err error) {
|
|
|
|
func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert []byte, err error) {
|
|
|
|
|
|
|
|
|
|
|
|
//key, ok := priv.(crypto.Signer)
|
|
|
|
//key, ok := priv.(crypto.Signer)
|
|
|
|
//if !ok {
|
|
|
|
//if !ok {
|
|
|
|
// return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
|
|
|
|
// return nil, errors.New("x509: certificate private key does not implement crypto.Signer")
|
|
|
|
//}
|
|
|
|
//}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if template.SerialNumber == nil {
|
|
|
|
|
|
|
|
return nil, errors.New("x509: no SerialNumber given")
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
//hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
|
|
|
|
//hashFunc, signatureAlgorithm, err := signingParamsForPublicKey(key.Public(), template.SignatureAlgorithm)
|
|
|
|
//if err != nil {
|
|
|
|
//if err != nil {
|
|
|
|
// return nil, err
|
|
|
|
// return nil, err
|
|
|
@ -60,21 +89,22 @@ func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert
|
|
|
|
return nil, err
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if len(parent.SubjectKeyId) > 0 {
|
|
|
|
asn1Issuer, err := subjectBytes(parent)
|
|
|
|
template.AuthorityKeyId = parent.SubjectKeyId
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extensions, err := buildExtensions(template)
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
asn1Issuer, err := subjectBytes(parent)
|
|
|
|
asn1Subject, err := subjectBytes(template)
|
|
|
|
if err != nil {
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
asn1Subject, err := subjectBytes(template)
|
|
|
|
authorityKeyId := template.AuthorityKeyId
|
|
|
|
|
|
|
|
if !bytes.Equal(asn1Issuer, asn1Subject) && len(parent.SubjectKeyId) > 0 {
|
|
|
|
|
|
|
|
authorityKeyId = parent.SubjectKeyId
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
extensions, err := buildExtensions(template, authorityKeyId)
|
|
|
|
if err != nil {
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -102,8 +132,17 @@ func CreateCertificateWithSplicedSignature(template, parent *Certificate) (cert
|
|
|
|
//h.Write(tbsCertContents)
|
|
|
|
//h.Write(tbsCertContents)
|
|
|
|
//digest := h.Sum(nil)
|
|
|
|
//digest := h.Sum(nil)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//var signerOpts crypto.SignerOpts
|
|
|
|
|
|
|
|
//signerOpts = hashFunc
|
|
|
|
|
|
|
|
//if template.SignatureAlgorithm != 0 && template.SignatureAlgorithm.isRSAPSS() {
|
|
|
|
|
|
|
|
// signerOpts = &rsa.PSSOptions{
|
|
|
|
|
|
|
|
// SaltLength: rsa.PSSSaltLengthEqualsHash,
|
|
|
|
|
|
|
|
// Hash: hashFunc,
|
|
|
|
|
|
|
|
// }
|
|
|
|
|
|
|
|
//}
|
|
|
|
|
|
|
|
|
|
|
|
//var signature []byte
|
|
|
|
//var signature []byte
|
|
|
|
//signature, err = key.Sign(rand, digest, hashFunc)
|
|
|
|
//signature, err = key.Sign(rand, digest, signerOpts)
|
|
|
|
//if err != nil {
|
|
|
|
//if err != nil {
|
|
|
|
// return
|
|
|
|
// return
|
|
|
|
//}
|
|
|
|
//}
|
|
|
|