1515// code is based on the snippet https://gist.github.com/shaneutt/5e1995295cff6721c89a71d13a71c251
1616// with a permissive (Public Domain) License.
1717
18+ // TODO(dmitris) - refactor to move the code generating certificates and writing to files
19+ // to a separate function.
20+
1821package main
1922
2023import (
@@ -23,6 +26,7 @@ import (
2326 "crypto/x509"
2427 "crypto/x509/pkix"
2528 "encoding/pem"
29+ "flag"
2630 "log"
2731 "math/big"
2832 "net"
@@ -31,16 +35,21 @@ import (
3135)
3236
3337func main () {
38+ var genIntermediate = flag .Bool ("intermediate" , false , "generate intermediate CA" )
39+ var outputSuffix = flag .String ("output-suffix" , "" , "suffix to append to generated files before the extension" )
40+ flag .Parse ()
41+
3442 // set up our CA certificate
3543 ca := & x509.Certificate {
3644 SerialNumber : big .NewInt (2019 ),
3745 Subject : pkix.Name {
38- Organization : []string {"CA Company, INC." },
39- Country : []string {"US" },
40- Province : []string {"" },
41- Locality : []string {"San Francisco" },
42- StreetAddress : []string {"Golden Gate Bridge" },
43- PostalCode : []string {"94016" },
46+ Organization : []string {"CA Company, INC." },
47+ OrganizationalUnit : []string {"CA Root Team" },
48+ Country : []string {"US" },
49+ Province : []string {"" },
50+ Locality : []string {"San Francisco" },
51+ StreetAddress : []string {"Golden Gate Bridge" },
52+ PostalCode : []string {"94016" },
4453 },
4554 NotBefore : time .Now (),
4655 NotAfter : time .Now ().AddDate (10 , 0 , 0 ),
@@ -64,19 +73,20 @@ func main() {
6473 }
6574
6675 // pem encode
67- caCertFile , err := os .OpenFile ("cacert.pem" , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0644 )
76+ fname := "ca-root" + * outputSuffix + ".pem"
77+ caCertFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0644 )
6878 if err != nil {
69- log .Fatalf ("unable to write to cacert.pem : %v" , err )
79+ log .Fatalf ("unable to write to %s : %v" , fname , err )
7080 }
7181 err = pem .Encode (caCertFile , & pem.Block {
7282 Type : "CERTIFICATE" ,
7383 Bytes : caBytes ,
7484 })
7585 if err != nil {
76- log .Fatalf ("unable to write to cacert.pem : %v" , err )
86+ log .Fatalf ("unable to write to %s : %v" , fname , err )
7787 }
78-
79- caPrivKeyFile , err := os .OpenFile ("ca-key.pem" , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0400 )
88+ fname = "ca-key" + * outputSuffix + ".pem"
89+ caPrivKeyFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0400 )
8090 if err != nil {
8191 log .Fatal (err )
8292 }
@@ -86,19 +96,82 @@ func main() {
8696 Bytes : x509 .MarshalPKCS1PrivateKey (caPrivKey ),
8797 })
8898 if err != nil {
89- log .Fatalf ("unable to create to ca-key.pem : %v" , err ) //nolint:gocritic
99+ log .Fatalf ("unable to create to %s : %v" , fname , err ) //nolint:gocritic
90100 }
91101
102+ // generate intermediate CA if requested
103+ var caIntermediate * x509.Certificate
104+ var caIntermediatePrivKey * rsa.PrivateKey
105+ if * genIntermediate {
106+ caIntermediate = & x509.Certificate {
107+ SerialNumber : big .NewInt (2019 ),
108+ Subject : pkix.Name {
109+ Organization : []string {"CA Company, INC." },
110+ OrganizationalUnit : []string {"CA Intermediate Team" },
111+ Country : []string {"US" },
112+ Province : []string {"" },
113+ Locality : []string {"San Francisco" },
114+ StreetAddress : []string {"Golden Gate Bridge" },
115+ PostalCode : []string {"94016" },
116+ },
117+ NotBefore : time .Now (),
118+ NotAfter : time .Now ().AddDate (10 , 0 , 0 ),
119+ IsCA : true ,
120+ ExtKeyUsage : []x509.ExtKeyUsage {x509 .ExtKeyUsageCodeSigning /*, x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth */ },
121+ KeyUsage : x509 .KeyUsageDigitalSignature | x509 .KeyUsageCertSign ,
122+ BasicConstraintsValid : true ,
123+ EmailAddresses : []string {"ca@example.com" },
124+ }
125+ // create our private and public key
126+ caIntermediatePrivKey , err = rsa .GenerateKey (rand .Reader , 4096 )
127+ if err != nil {
128+ log .Fatal (err )
129+ }
130+
131+ // create the Intermediate CA
132+ caIntermediateBytes , err := x509 .CreateCertificate (rand .Reader , caIntermediate , ca , & caIntermediatePrivKey .PublicKey , caPrivKey )
133+ if err != nil {
134+ log .Fatal (err )
135+ }
136+
137+ // pem encode
138+ fname = "ca-intermediate" + * outputSuffix + ".pem"
139+ caIntermediateCertFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0644 )
140+ if err != nil {
141+ log .Fatalf ("unable to write to %s: %v" , fname , err )
142+ }
143+ err = pem .Encode (caIntermediateCertFile , & pem.Block {
144+ Type : "CERTIFICATE" ,
145+ Bytes : caIntermediateBytes ,
146+ })
147+ if err != nil {
148+ log .Fatalf ("unable to write to %s: %v" , fname , err )
149+ }
150+ fname = "ca-intermediate-key" + * outputSuffix + ".pem"
151+ caIntermediatePrivKeyFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0400 )
152+ if err != nil {
153+ log .Fatal (err )
154+ }
155+ defer caIntermediatePrivKeyFile .Close ()
156+ err = pem .Encode (caIntermediatePrivKeyFile , & pem.Block {
157+ Type : "RSA PRIVATE KEY" ,
158+ Bytes : x509 .MarshalPKCS1PrivateKey (caIntermediatePrivKey ),
159+ })
160+ if err != nil {
161+ log .Fatalf ("unable to create to %s: %v" , fname , err ) //nolint:gocritic
162+ }
163+ }
92164 // set up our server certificate
93165 cert := & x509.Certificate {
94166 SerialNumber : big .NewInt (2019 ),
95167 Subject : pkix.Name {
96- Organization : []string {"Company, INC." },
97- Country : []string {"US" },
98- Province : []string {"" },
99- Locality : []string {"San Francisco" },
100- StreetAddress : []string {"Golden Gate Bridge" },
101- PostalCode : []string {"94016" },
168+ Organization : []string {"End User" },
169+ OrganizationalUnit : []string {"End Node Team" },
170+ Country : []string {"US" },
171+ Province : []string {"" },
172+ Locality : []string {"San Francisco" },
173+ StreetAddress : []string {"Golden Gate Bridge" },
174+ PostalCode : []string {"94016" },
102175 },
103176 IPAddresses : []net.IP {net .IPv4 (127 , 0 , 0 , 1 ), net .IPv6loopback },
104177 NotBefore : time .Now (),
@@ -115,12 +188,18 @@ func main() {
115188 log .Fatal (err )
116189 }
117190
118- certBytes , err := x509 .CreateCertificate (rand .Reader , cert , ca , & certPrivKey .PublicKey , caPrivKey )
191+ var certBytes []byte
192+ if ! * genIntermediate {
193+ certBytes , err = x509 .CreateCertificate (rand .Reader , cert , ca , & certPrivKey .PublicKey , caPrivKey )
194+ } else {
195+ certBytes , err = x509 .CreateCertificate (rand .Reader , cert , caIntermediate , & caIntermediatePrivKey .PublicKey , caIntermediatePrivKey )
196+ }
119197 if err != nil {
120198 log .Fatal (err )
121199 }
122200
123- certFile , err := os .OpenFile ("cert.pem" , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0644 )
201+ fname = "cert" + * outputSuffix + ".pem"
202+ certFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0644 )
124203 if err != nil {
125204 log .Fatal (err )
126205 }
@@ -133,7 +212,8 @@ func main() {
133212 log .Fatalf ("failed to encode cert: %v" , err )
134213 }
135214
136- keyFile , err := os .OpenFile ("key.pem" , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0400 )
215+ fname = "key" + * outputSuffix + ".pem"
216+ keyFile , err := os .OpenFile (fname , os .O_RDWR | os .O_CREATE | os .O_TRUNC , 0400 )
137217 if err != nil {
138218 log .Fatal (err )
139219 }
@@ -143,6 +223,6 @@ func main() {
143223 Bytes : x509 .MarshalPKCS1PrivateKey (certPrivKey ),
144224 })
145225 if err != nil {
146- log .Fatalf ("failed to encode private key: %v" , err )
226+ log .Fatalf ("failed to encode private key to %s : %v" , fname , err )
147227 }
148228}
0 commit comments