aipper/mkcert
1
0
Fork 0
mirror of https://github.com/FiloSottile/mkcert.git synced 2025-10-14 00:41:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add a SubjectKeyId to the root CA

Browse Source 
Not really useful for #47, but good to have and a RFC 5280 MUST.

See https://twitter.com/FiloSottile/status/1023564776834826240
This commit is contained in:
Filippo Valsorda
2018-07-30 03:14:15 +02:00
parent c3bf865b0c
commit 9e258bad93
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
cert.go
View File

@@ -7,8 +7,10 @@ package main
import ( import (
"crypto/rand" "crypto/rand"
"crypto/rsa" "crypto/rsa"
"crypto/sha1"
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"encoding/asn1"
"encoding/pem" "encoding/pem"
"io/ioutil" "io/ioutil"
"log" "log"
@@ -134,17 +136,31 @@ func (m *mkcert) loadCA() {
func (m *mkcert) newCA() { func (m *mkcert) newCA() {
priv, err := rsa.GenerateKey(rand.Reader, 3072) priv, err := rsa.GenerateKey(rand.Reader, 3072)
fatalIfErr(err, "failed to generate the CA key") fatalIfErr(err, "failed to generate the CA key")
pub := priv.PublicKey
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
fatalIfErr(err, "failed to generate serial number") fatalIfErr(err, "failed to generate serial number")
spkiASN1, err := x509.MarshalPKIXPublicKey(&pub)
fatalIfErr(err, "failed to encode public key")
var spki struct {
Algorithm pkix.AlgorithmIdentifier
SubjectPublicKey asn1.BitString
}
_, err = asn1.Unmarshal(spkiASN1, &spki)
fatalIfErr(err, "failed to decode public key")
skid := sha1.Sum(spki.SubjectPublicKey.Bytes)
tpl := &x509.Certificate{ tpl := &x509.Certificate{
SerialNumber: serialNumber, SerialNumber: serialNumber,
Subject: pkix.Name{ Subject: pkix.Name{
Organization: []string{"mkcert development CA"}, Organization: []string{"mkcert development CA"},
OrganizationalUnit: []string{userAndHostname}, OrganizationalUnit: []string{userAndHostname},
}, },
SubjectKeyId: skid[:],
NotAfter: time.Now().AddDate(10, 0, 0), NotAfter: time.Now().AddDate(10, 0, 0),
NotBefore: time.Now(), NotBefore: time.Now(),
@@ -156,7 +172,6 @@ func (m *mkcert) newCA() {
MaxPathLenZero: true, MaxPathLenZero: true,
} }
pub := priv.PublicKey
cert, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &pub, priv) cert, err := x509.CreateCertificate(rand.Reader, tpl, tpl, &pub, priv)
fatalIfErr(err, "failed to generate CA certificate") fatalIfErr(err, "failed to generate CA certificate")