-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Handle certification of brand new plugin. * dos2unix, defer to ensure file closure. * Defer to ensure file closure. * Bump version. * Certify generates sha256 directly now. * Add more verbose logging. * Adding null check * Update to work around file handle leak. --------- Co-authored-by: Karnveer Gill <[email protected]>
- Loading branch information
1 parent
61852dc
commit ece05f0
Showing
10 changed files
with
172 additions
and
156 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,147 +1,147 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "crypto/x509" | ||
| "crypto/x509/pkix" | ||
| "encoding/pem" | ||
| "errors" | ||
| "fmt" | ||
| "math/big" | ||
| "net" | ||
| "os" | ||
| "time" | ||
| ) | ||
|
|
||
| //CertPath is the path to the cert file directory | ||
| const CertPath = "./certs/cert_files/" | ||
|
|
||
| //GenerateCerts generates a root cert, a root key, a child cert, and a child key. It then validates the root cert and returns the http client | ||
| func main() { | ||
| //generate private key and write to .pem file | ||
| privateKey, err := CreatePrivateKey("root_key.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| //get public key | ||
| publicKey := privateKey.Public() | ||
|
|
||
| //create cert template | ||
| rootCertTmpl, err := CertTemplate() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| rootCertTmpl.IsCA = true | ||
| rootCertTmpl.KeyUsage = x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature | ||
| rootCertTmpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth} | ||
| rootCertTmpl.IPAddresses = []net.IP{net.ParseIP("127.0.0.1")} | ||
|
|
||
| //create cert and write to .pem file | ||
| rootCert, err := CreateCert(rootCertTmpl, rootCertTmpl, publicKey, privateKey, "root_cert.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| servPrivateKey, err := CreatePrivateKey("serv_key.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| //get public key | ||
| servPublicKey := servPrivateKey.Public() | ||
|
|
||
| servCertTmpl, err := CertTemplate() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| servCertTmpl.KeyUsage = x509.KeyUsageDigitalSignature | ||
| servCertTmpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth} | ||
| servCertTmpl.IPAddresses = []net.IP{net.ParseIP("127.0.0.1")} | ||
|
|
||
| //create cert and write to .pem file | ||
| _, err = CreateCert(servCertTmpl, rootCert, servPublicKey, privateKey, "serv_cert.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| } | ||
|
|
||
| //CertTemplate generates a random serial number | ||
| func CertTemplate() (*x509.Certificate, error) { | ||
| // generate a random serial number (a real cert authority would have some logic behind this) | ||
| serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) | ||
| serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) | ||
| if err != nil { | ||
| return nil, errors.New("failed to generate serial number: " + err.Error()) | ||
| } | ||
|
|
||
| tmpl := x509.Certificate{ | ||
| SerialNumber: serialNumber, | ||
| Subject: pkix.Name{ | ||
| Organization: []string{"Viewpoint, Inc."}, | ||
| }, | ||
| SignatureAlgorithm: x509.SHA256WithRSA, | ||
| NotBefore: time.Now(), | ||
| NotAfter: time.Now().AddDate(0, 3, 0), // valid for a day | ||
| BasicConstraintsValid: true, | ||
| } | ||
| return &tmpl, nil | ||
| } | ||
|
|
||
| //CreatePrivateKey generates a private key and saves it to a .pem file | ||
| func CreatePrivateKey(fileName string) (privKey *rsa.PrivateKey, err error) { | ||
| privateKey, err := rsa.GenerateKey(rand.Reader, 2048) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| //encode private key | ||
| pemPrivateBlock := &pem.Block{ | ||
| Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey), | ||
| } | ||
|
|
||
| path := CertPath + fileName | ||
| //create new file for private key | ||
| pemPrivateFile, err := os.Create(path) | ||
| if err != nil { | ||
| return privateKey, err | ||
| } | ||
| //write to file and close it | ||
| err = pem.Encode(pemPrivateFile, pemPrivateBlock) | ||
| if err != nil { | ||
| return privateKey, err | ||
| } | ||
| pemPrivateFile.Close() | ||
| fmt.Println("private key generated and written to", path) | ||
| return privateKey, nil | ||
| } | ||
|
|
||
| //CreateCert creates a cert and saves it to a .pem file | ||
| func CreateCert(template, parent *x509.Certificate, pub interface{}, parentPriv interface{}, fileName string) (cert *x509.Certificate, err error) { | ||
| //cert *x509.Certificate, | ||
| certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, parentPriv) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| cert, err = x509.ParseCertificate(certDER) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| pemCertBlock := &pem.Block{Type: "CERTIFICATE", Bytes: certDER} | ||
|
|
||
| path := CertPath + fileName | ||
| //create new file for private key | ||
| pemCertFile, err := os.Create(path) | ||
| if err != nil { | ||
| return cert, err | ||
| } | ||
| //write to file and close it | ||
| err = pem.Encode(pemCertFile, pemCertBlock) | ||
| if err != nil { | ||
| return cert, err | ||
| } | ||
| pemCertFile.Close() | ||
| fmt.Println("certificate generated and written to", path) | ||
| return cert, nil | ||
| } | ||
| package main | ||
|
|
||
| import ( | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "crypto/x509" | ||
| "crypto/x509/pkix" | ||
| "encoding/pem" | ||
| "errors" | ||
| "fmt" | ||
| "math/big" | ||
| "net" | ||
| "os" | ||
| "time" | ||
| ) | ||
|
|
||
| // CertPath is the path to the cert file directory | ||
| const CertPath = "./certs/cert_files/" | ||
|
|
||
| // GenerateCerts generates a root cert, a root key, a child cert, and a child key. It then validates the root cert and returns the http client | ||
| func main() { | ||
| //generate private key and write to .pem file | ||
| privateKey, err := CreatePrivateKey("root_key.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| //get public key | ||
| publicKey := privateKey.Public() | ||
|
|
||
| //create cert template | ||
| rootCertTmpl, err := CertTemplate() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| rootCertTmpl.IsCA = true | ||
| rootCertTmpl.KeyUsage = x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature | ||
| rootCertTmpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth} | ||
| rootCertTmpl.IPAddresses = []net.IP{net.ParseIP("127.0.0.1")} | ||
|
|
||
| //create cert and write to .pem file | ||
| rootCert, err := CreateCert(rootCertTmpl, rootCertTmpl, publicKey, privateKey, "root_cert.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| servPrivateKey, err := CreatePrivateKey("serv_key.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| //get public key | ||
| servPublicKey := servPrivateKey.Public() | ||
|
|
||
| servCertTmpl, err := CertTemplate() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| servCertTmpl.KeyUsage = x509.KeyUsageDigitalSignature | ||
| servCertTmpl.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth} | ||
| servCertTmpl.IPAddresses = []net.IP{net.ParseIP("127.0.0.1")} | ||
|
|
||
| //create cert and write to .pem file | ||
| _, err = CreateCert(servCertTmpl, rootCert, servPublicKey, privateKey, "serv_cert.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| } | ||
|
|
||
| // CertTemplate generates a random serial number | ||
| func CertTemplate() (*x509.Certificate, error) { | ||
| // generate a random serial number (a real cert authority would have some logic behind this) | ||
| serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) | ||
| serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) | ||
| if err != nil { | ||
| return nil, errors.New("failed to generate serial number: " + err.Error()) | ||
| } | ||
|
|
||
| tmpl := x509.Certificate{ | ||
| SerialNumber: serialNumber, | ||
| Subject: pkix.Name{ | ||
| Organization: []string{"Viewpoint, Inc."}, | ||
| }, | ||
| SignatureAlgorithm: x509.SHA256WithRSA, | ||
| NotBefore: time.Now(), | ||
| NotAfter: time.Now().AddDate(0, 3, 0), // valid for a day | ||
| BasicConstraintsValid: true, | ||
| } | ||
| return &tmpl, nil | ||
| } | ||
|
|
||
| // CreatePrivateKey generates a private key and saves it to a .pem file | ||
| func CreatePrivateKey(fileName string) (privKey *rsa.PrivateKey, err error) { | ||
| privateKey, err := rsa.GenerateKey(rand.Reader, 2048) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| //encode private key | ||
| pemPrivateBlock := &pem.Block{ | ||
| Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey), | ||
| } | ||
|
|
||
| path := CertPath + fileName | ||
| //create new file for private key | ||
| pemPrivateFile, err := os.Create(path) | ||
| if err != nil { | ||
| return privateKey, err | ||
| } | ||
| defer pemPrivateFile.Close() | ||
| //write to file and close it | ||
| err = pem.Encode(pemPrivateFile, pemPrivateBlock) | ||
| if err != nil { | ||
| return privateKey, err | ||
| } | ||
| fmt.Println("private key generated and written to", path) | ||
| return privateKey, nil | ||
| } | ||
|
|
||
| // CreateCert creates a cert and saves it to a .pem file | ||
| func CreateCert(template, parent *x509.Certificate, pub interface{}, parentPriv interface{}, fileName string) (cert *x509.Certificate, err error) { | ||
| //cert *x509.Certificate, | ||
| certDER, err := x509.CreateCertificate(rand.Reader, template, parent, pub, parentPriv) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| cert, err = x509.ParseCertificate(certDER) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| pemCertBlock := &pem.Block{Type: "CERTIFICATE", Bytes: certDER} | ||
|
|
||
| path := CertPath + fileName | ||
| //create new file for private key | ||
| pemCertFile, err := os.Create(path) | ||
| if err != nil { | ||
| return cert, err | ||
| } | ||
| defer pemCertFile.Close() | ||
| //write to file and close it | ||
| err = pem.Encode(pemCertFile, pemCertBlock) | ||
| if err != nil { | ||
| return cert, err | ||
| } | ||
| fmt.Println("certificate generated and written to", path) | ||
| return cert, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.