diff options
| -rw-r--r-- | certificate.go | 73 | ||||
| -rw-r--r-- | flags.go | 27 |
2 files changed, 87 insertions, 13 deletions
diff --git a/certificate.go b/certificate.go index acb4b5a..0973793 100644 --- a/certificate.go +++ b/certificate.go @@ -47,7 +47,7 @@ var ( Use: "create-cert", Short: "create a certificate from a sign request", Long: "Create a certificate based on a certificate sign request.", - Example: "create-cert -private-key=foo.ecdsa -csr-path=foo.csr", + Example: "create-cert -private-key=foo.ecdsa -csr=foo.csr", Run: create_cert, } // certificate specific creation stuff @@ -92,7 +92,7 @@ type ( // add flag to load certificate flags func InitFlagCert(cmd *Command) { cmd.Flags().Int64Var(&flagContainer.certGeneration.serial, "serial", 0, "serial number of all certificates") - cmd.Flags().BoolVar(&flagContainer.certGeneration.isCA, "ca", false, "check if the resulting certificate is a ca") + cmd.Flags().BoolVar(&flagContainer.certGeneration.isCA, "is-ca", false, "check if the resulting certificate should be a ca") cmd.Flags().IntVar( &flagContainer.certGeneration. length, @@ -131,17 +131,29 @@ func InitFlagCert(cmd *Command) { // create a certificate func create_cert(cmd *Command, args []string) { - err := checkFlags(checkPrivateKey, checkOutput, checkCSR, checkCertFlags) + err := checkFlags(checkPrivateKey, checkOutput, checkCSR, checkCertFlags, checkFlagsEither(checkIsCA, checkCA)) if err != nil { crash_with_help(cmd, ErrorFlagInput, "Flags invalid: %s", err) } + var cert *pki.Certificate + if FlagCertificateGeneration.IsCA && FlagCertificate == nil { + cert, err = FlagCertificateSignRequest.ToCertificate( + FlagPrivateKey, + FlagCertificateGeneration, + nil, + ) + } else if !FlagCertificateGeneration.IsCA && FlagCertificate != nil { + cert, err = FlagCertificateSignRequest.ToCertificate( + FlagPrivateKey, + FlagCertificateGeneration, + FlagCertificate, + ) + } else { + crash_with_help(cmd, ErrorFlagInput, "Usage of 'is-ca' and 'ca' is invalid.") + } + // TODO implement flags for all certificate options - cert, err := FlagCertificateSignRequest.ToCertificate( - FlagPrivateKey, - FlagCertificateGeneration, - nil, - ) if err != nil { crash_with_help(cmd, ErrorProgram, "Error generating certificate: %s", err) } @@ -187,6 +199,14 @@ func checkCertFlags() error { return nil } +// check if the flag is enabled to make the certificate a ca +func checkIsCA() error { + if FlagCertificateGeneration.IsCA { + return nil + } + return fmt.Errorf("Not selected to be a CA") +} + // parse the key usage string func convertCertKeyUsage() error { if keyUstr := flagContainer.certGeneration.keyUsage; keyUstr != "" { @@ -229,9 +249,42 @@ func convertCertCrlUrl() error { return nil } +// add flag to load a certificate +func InitFlagCA(cmd *Command) { + cmd.Flags().StringVar(&flagContainer.caPath, "ca", "", "path to the certificate authority") +} + +// parse the certificate authority +func checkCA() error { + rest, err := ioutil.ReadFile(flagContainer.caPath) + if err != nil { + return fmt.Errorf("Error reading certificate authority: %s", err) + } + + var ca_asn1 []byte + var block *pem.Block + for len(rest) > 0 { + block, rest = pem.Decode(rest) + if block != nil && block.Type == pki.PemLabelCertificate { + ca_asn1 = block.Bytes + break + } + } + if len(ca_asn1) == 0 { + return fmt.Errorf("No certificate in '%s' found.", flagContainer.caPath) + } + + ca, err := pki.LoadCertificate(ca_asn1) + if err != nil { + return fmt.Errorf("Invalid certificate: %s", err) + } + FlagCertificate = ca + return nil +} + // add flag to load certificate sign request func InitFlagCSR(cmd *Command) { - cmd.Flags().StringVar(&flagContainer.signRequestPath, "csr-path", "", "path to the certificate sign request") + cmd.Flags().StringVar(&flagContainer.signRequestPath, "csr", "", "path to the certificate sign request") } // parse the certificate sign request @@ -245,7 +298,7 @@ func checkCSR() error { var block *pem.Block for len(rest) > 0 { block, rest = pem.Decode(rest) - if block.Type == "CERTIFICATE REQUEST" { + if block.Type == pki.PemLabelCertificateRequest { csr_asn1 = block.Bytes break } @@ -28,7 +28,7 @@ type ( certificateFlags certiticateRequestRawFlags // container for certificate related flags signature string // a base64 encoded signature certGeneration certGenerationRaw // all certificate generation flags - certificatePath string // path to a certificate + caPath string // path to a certificate authority } flagCheck func() error @@ -90,6 +90,8 @@ certificate requests and certificates and sign/verify messages.`, FlagCertificateRequestData *pki.CertificateData // the certificate sign request FlagCertificateSignRequest *pki.CertificateRequest + // the ca/certificate to use + FlagCertificate *pki.Certificate ) func InitFlags() { @@ -123,12 +125,14 @@ func InitFlags() { InitFlagOutput(CmdCreateSignRequest) InitFlagCertificateFields(CmdCreateSignRequest) // create-certificate - InitFlagPrivateKey(CmdCreateCert) - InitFlagOutput(CmdCreateCert) + InitFlagCA(CmdCreateCert) InitFlagCert(CmdCreateCert) InitFlagCSR(CmdCreateCert) + InitFlagOutput(CmdCreateCert) + InitFlagPrivateKey(CmdCreateCert) } +// check if all checks are successful func checkFlags(checks ...flagCheck) error { for _, check := range checks { if err := check(); err != nil { @@ -138,6 +142,23 @@ func checkFlags(checks ...flagCheck) error { return nil } +// check if either of the inserted checks is successful +func checkFlagsEither(checks ...flagCheck) flagCheck { + return func() error { + errors := make([]error, 0) + for _, check := range checks { + if err := check(); err != nil { + errors = append(errors, err) + } + } + // it is a success, if any check is successful + if len(checks)-len(errors) > 0 { + return nil + } + return errors[0] + } +} + // add the public key flag func InitFlagPublicKey(cmd *Command) { cmd.Flags().StringVar(&flagContainer.publicKeyPath, "public-key", "", "path to the public key (required)") |