134 lines
4.2 KiB
Go
134 lines
4.2 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/pem"
|
|
"log"
|
|
"math/big"
|
|
"net"
|
|
"os"
|
|
"time"
|
|
)
|
|
|
|
// serverCert returns the TLS certificate to serve: the admin-supplied PEM pair
|
|
// when both paths are set, otherwise a freshly generated in-memory self-signed
|
|
// cert for local development.
|
|
func serverCert(certPath, keyPath string) (tls.Certificate, error) {
|
|
if certPath != "" && keyPath != "" {
|
|
return tls.LoadX509KeyPair(certPath, keyPath)
|
|
}
|
|
log.Printf("tls: no tls_cert/tls_key configured - generating a self-signed certificate (dev only)")
|
|
return generateSelfSignedCert()
|
|
}
|
|
|
|
func generateSelfSignedCert() (tls.Certificate, error) {
|
|
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
return tls.Certificate{}, err
|
|
}
|
|
|
|
// Random serial: a fixed serial (1) makes every generated cert collide in a
|
|
// browser/OS trust store, so a previously-accepted cert can't be replaced.
|
|
serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
|
|
if err != nil {
|
|
return tls.Certificate{}, err
|
|
}
|
|
|
|
template := x509.Certificate{
|
|
SerialNumber: serial,
|
|
Subject: pkix.Name{Organization: []string{"urania-nadir"}},
|
|
NotBefore: time.Now(),
|
|
NotAfter: time.Now().Add(365 * 24 * time.Hour),
|
|
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
|
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
|
BasicConstraintsValid: true,
|
|
DNSNames: []string{"localhost"},
|
|
IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1), net.IPv6loopback},
|
|
}
|
|
|
|
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
|
|
if err != nil {
|
|
return tls.Certificate{}, err
|
|
}
|
|
return tls.Certificate{Certificate: [][]byte{derBytes}, PrivateKey: priv}, nil
|
|
}
|
|
|
|
// generateAndSaveCert generates a self-signed certificate and private key,
|
|
// and saves them as PEM files.
|
|
func generateAndSaveCert(certPath, keyPath string, hostname string) error {
|
|
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
template := x509.Certificate{
|
|
SerialNumber: serial,
|
|
Subject: pkix.Name{Organization: []string{"nadir-agent-tls"}},
|
|
NotBefore: time.Now(),
|
|
NotAfter: time.Now().Add(3650 * 24 * time.Hour), // 10 years
|
|
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
|
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
|
BasicConstraintsValid: true,
|
|
DNSNames: []string{"localhost"},
|
|
IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1), net.IPv6loopback},
|
|
}
|
|
|
|
if hostname != "" && hostname != "localhost" && hostname != "127.0.0.1" && hostname != "::1" {
|
|
if ip := net.ParseIP(hostname); ip != nil {
|
|
template.IPAddresses = append(template.IPAddresses, ip)
|
|
} else {
|
|
template.DNSNames = append(template.DNSNames, hostname)
|
|
}
|
|
}
|
|
|
|
// Automatically add the machine's external IP addresses to SANs so it can be verified
|
|
// correctly over the local network (e.g. Tailscale or Netbird).
|
|
if addrs, err := net.InterfaceAddrs(); err == nil {
|
|
for _, a := range addrs {
|
|
if ipnet, ok := a.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
|
|
template.IPAddresses = append(template.IPAddresses, ipnet.IP)
|
|
template.DNSNames = append(template.DNSNames, ipnet.IP.String())
|
|
}
|
|
}
|
|
}
|
|
|
|
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
certOut, err := os.Create(certPath)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer certOut.Close()
|
|
if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
|
|
return err
|
|
}
|
|
|
|
keyOut, err := os.OpenFile(keyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer keyOut.Close()
|
|
privBytes, err := x509.MarshalECPrivateKey(priv)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: privBytes}); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|