func (ca *CA) newCertificate(id string, pub *ecdsa.PublicKey, timestamp int64, opt ...pkix.Extension) ([]byte, error) {
Trace.Println("creating certificate for " + id)
notBefore := time.Now()
notAfter := notBefore.Add(time.Hour * 24 * 90)
isCA := ca.cert == nil
tmpl := x509.Certificate{
SerialNumber: big.NewInt(1),
Subject: pkix.Name{
CommonName: "OBC",
Organization: []string{"IBM"},
Country: []string{"US"},
},
NotBefore: notBefore,
NotAfter: notAfter,
SubjectKeyId: []byte{1, 2, 3, 4},
SignatureAlgorithm: x509.ECDSAWithSHA384,
KeyUsage: x509.KeyUsageDigitalSignature,
BasicConstraintsValid: true,
IsCA: isCA,
}
if len(opt) > 0 {
tmpl.Extensions = opt
tmpl.ExtraExtensions = opt
}
parent := ca.cert
if isCA {
parent = &tmpl
}
raw, err := x509.CreateCertificate(
rand.Reader,
&tmpl,
parent,
pub,
ca.priv,
)
if isCA && err != nil {
Panic.Panicln(err)
}
hash := sha3.New384()
hash.Write(raw)
if _, err = ca.db.Exec("INSERT INTO Certificates (id, timestamp, cert, hash) VALUES (?, ?, ?, ?)", id, timestamp, raw, hash.Sum(nil)); err != nil {
if isCA {
Panic.Panicln(err)
} else {
Error.Println(err)
}
}
return raw, err
}
// When comparing certificates created at different times for equality, we do
// not want to worry about fields which are dependent on the time of creation.
// Thus we nullify these fields before comparing the certificates.
func nullifyTimeDependency(cert *x509.Certificate) *x509.Certificate {
cert.Raw = nil
cert.RawTBSCertificate = nil
cert.RawSubjectPublicKeyInfo = nil
cert.Signature = nil
cert.PublicKey = nil
cert.SerialNumber = nil
cert.NotBefore = time.Time{}
cert.NotAfter = time.Time{}
cert.Extensions = nil
cert.SubjectKeyId = nil
cert.AuthorityKeyId = nil
return cert
}
func (ca *CA) newCertificateFromSpec(spec *CertificateSpec) ([]byte, error) {
notBefore := spec.GetNotBefore()
notAfter := spec.GetNotAfter()
parent := ca.cert
isCA := parent == nil
tmpl := x509.Certificate{
SerialNumber: spec.GetSerialNumber(),
Subject: pkix.Name{
CommonName: spec.GetCommonName(),
Organization: []string{spec.GetOrganization()},
Country: []string{spec.GetCountry()},
},
NotBefore: *notBefore,
NotAfter: *notAfter,
SubjectKeyId: *spec.GetSubjectKeyID(),
SignatureAlgorithm: spec.GetSignatureAlgorithm(),
KeyUsage: spec.GetUsage(),
BasicConstraintsValid: true,
IsCA: isCA,
}
if len(*spec.GetExtensions()) > 0 {
tmpl.Extensions = *spec.GetExtensions()
tmpl.ExtraExtensions = *spec.GetExtensions()
}
if isCA {
parent = &tmpl
}
raw, err := x509.CreateCertificate(
rand.Reader,
&tmpl,
parent,
spec.GetPublicKey(),
ca.priv,
)
if isCA && err != nil {
caLogger.Panic(err)
}
return raw, err
}
func (ca *CA) newCertificate(id string, pub interface{}, usage x509.KeyUsage, ext []pkix.Extension) ([]byte, error) {
notBefore := time.Now()
notAfter := notBefore.Add(time.Hour * 24 * 90)
parent := ca.cert
isCA := parent == nil
tmpl := x509.Certificate{
SerialNumber: big.NewInt(1),
Subject: pkix.Name{
CommonName: id,
Organization: []string{"IBM"},
Country: []string{"US"},
},
NotBefore: notBefore,
NotAfter: notAfter,
SubjectKeyId: []byte{1, 2, 3, 4},
SignatureAlgorithm: x509.ECDSAWithSHA384,
KeyUsage: usage,
BasicConstraintsValid: true,
IsCA: isCA,
}
if len(ext) > 0 {
tmpl.Extensions = ext
tmpl.ExtraExtensions = ext
}
if isCA {
parent = &tmpl
}
raw, err := x509.CreateCertificate(
rand.Reader,
&tmpl,
parent,
pub,
ca.priv,
)
if isCA && err != nil {
Panic.Panicln(err)
}
return raw, err
}
// NewSPKACx509 creates a new x509 self-signed cert based on the SPKAC value
func NewSPKACx509(uri string, name string, spkacBase64 string) ([]byte, error) {
public, err := ParseSPKAC(spkacBase64)
if err != nil {
return nil, err
}
pubKey := public.(*rsa.PublicKey)
rsaPub, err := x509.MarshalPKIXPublicKey(pubKey)
if err != nil {
return nil, err
}
h := sha1.New()
pubSha1 := h.Sum(rsaPub)[:20]
priv, err := rsa.GenerateKey(rand.Reader, 1024)
if err != nil {
return nil, err
}
template := x509.Certificate{
SerialNumber: new(big.Int).SetInt64(42),
Subject: pkix.Name{
CommonName: name,
Organization: []string{"WebID"},
// Country: []string{"US"},
},
NotBefore: notBefore,
NotAfter: notAfter,
SubjectKeyId: pubSha1,
BasicConstraintsValid: true,
}
// add WebID in the subjectAltName field
var rawValues []asn1.RawValue
rawValues = append(rawValues, asn1.RawValue{Class: 2, Tag: 6, Bytes: []byte(uri)})
values, err := asn1.Marshal(rawValues)
if err != nil {
return nil, err
}
template.ExtraExtensions = []pkix.Extension{{Id: subjectAltName, Value: values}}
template.Extensions = template.ExtraExtensions
certDerBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, public, priv)
return certDerBytes, nil
}
