93 lines
1.9 KiB
Go
93 lines
1.9 KiB
Go
package crt
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"crypto/rsa"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"fmt"
|
|
"math/big"
|
|
"os"
|
|
"scm/model"
|
|
"scm/utils"
|
|
"time"
|
|
|
|
"github.com/youmark/pkcs8"
|
|
)
|
|
|
|
func CreateRootKeyCertificate(data model.CreateRootCertRequest) error {
|
|
privkey, err := rsa.GenerateKey(rand.Reader, 4096)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
serialNumber, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
template := x509.Certificate{
|
|
SerialNumber: serialNumber,
|
|
Subject: pkix.Name{
|
|
CommonName: data.CommonName,
|
|
OrganizationalUnit: data.OrganizationalUnit,
|
|
Organization: data.Organization,
|
|
Country: data.Country,
|
|
Locality: data.Locality,
|
|
Province: data.Province,
|
|
StreetAddress: data.StreetAddress,
|
|
PostalCode: data.PostalCode,
|
|
SerialNumber: serialNumber.String(),
|
|
},
|
|
NotBefore: time.Now(),
|
|
NotAfter: time.Now().AddDate(data.ValidityYears, 0, 0),
|
|
KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
|
|
ExtKeyUsage: []x509.ExtKeyUsage{
|
|
x509.ExtKeyUsageServerAuth,
|
|
x509.ExtKeyUsageClientAuth,
|
|
},
|
|
BasicConstraintsValid: true,
|
|
IsCA: true,
|
|
}
|
|
|
|
cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &privkey.PublicKey, privkey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
encryptedKey, err := pkcs8.ConvertPrivateKeyToPKCS8(
|
|
privkey,
|
|
[]byte(data.KeyPassword),
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = utils.CheckExistsOrCreateDir("root")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = SavePEMFile(fmt.Sprintf(
|
|
"%s/%s",
|
|
os.Getenv("CERTS_PATH"),
|
|
"root/root.crt",
|
|
),
|
|
"CERTIFICATE",
|
|
cert,
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = SavePEMFile(fmt.Sprintf(
|
|
"%s/%s",
|
|
os.Getenv("CERTS_PATH"),
|
|
"root/root.key",
|
|
), "ENCRYPTED PRIVATE KEY", encryptedKey)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|