Use ECDSA keys by default
This commit is contained in:
parent
1490bf6a75
commit
95716296b4
25
cert.go
25
cert.go
|
@ -2,7 +2,9 @@ package gemini
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"crypto"
|
"crypto"
|
||||||
|
"crypto/ecdsa"
|
||||||
"crypto/ed25519"
|
"crypto/ed25519"
|
||||||
|
"crypto/elliptic"
|
||||||
"crypto/rand"
|
"crypto/rand"
|
||||||
"crypto/tls"
|
"crypto/tls"
|
||||||
"crypto/x509"
|
"crypto/x509"
|
||||||
|
@ -93,6 +95,7 @@ type CertificateOptions struct {
|
||||||
DNSNames []string
|
DNSNames []string
|
||||||
Subject pkix.Name
|
Subject pkix.Name
|
||||||
Duration time.Duration
|
Duration time.Duration
|
||||||
|
ED25519 bool
|
||||||
}
|
}
|
||||||
|
|
||||||
// CreateCertificate creates a new TLS certificate.
|
// CreateCertificate creates a new TLS certificate.
|
||||||
|
@ -110,15 +113,27 @@ func CreateCertificate(options CertificateOptions) (tls.Certificate, error) {
|
||||||
|
|
||||||
// newX509KeyPair creates and returns a new certificate and private key.
|
// newX509KeyPair creates and returns a new certificate and private key.
|
||||||
func newX509KeyPair(options CertificateOptions) (*x509.Certificate, crypto.PrivateKey, error) {
|
func newX509KeyPair(options CertificateOptions) (*x509.Certificate, crypto.PrivateKey, error) {
|
||||||
|
var pub crypto.PublicKey
|
||||||
|
var priv crypto.PrivateKey
|
||||||
|
if options.ED25519 {
|
||||||
// Generate an ED25519 private key
|
// Generate an ED25519 private key
|
||||||
_, priv, err := ed25519.GenerateKey(rand.Reader)
|
var err error
|
||||||
|
pub, priv, err = ed25519.GenerateKey(rand.Reader)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, nil, err
|
return nil, nil, err
|
||||||
}
|
}
|
||||||
public := priv.Public()
|
} else {
|
||||||
|
// Generate an ECDSA private key
|
||||||
|
private, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||||
|
if err != nil {
|
||||||
|
return nil, nil, err
|
||||||
|
}
|
||||||
|
priv = private
|
||||||
|
pub = &private.PublicKey
|
||||||
|
}
|
||||||
|
|
||||||
// ED25519 keys should have the DigitalSignature KeyUsage bits set
|
// ECDSA and ED25519 keys should have the DigitalSignature KeyUsage bits
|
||||||
// in the x509.Certificate template
|
// set in the x509.Certificate template
|
||||||
keyUsage := x509.KeyUsageDigitalSignature
|
keyUsage := x509.KeyUsageDigitalSignature
|
||||||
|
|
||||||
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
||||||
|
@ -142,7 +157,7 @@ func newX509KeyPair(options CertificateOptions) (*x509.Certificate, crypto.Priva
|
||||||
Subject: options.Subject,
|
Subject: options.Subject,
|
||||||
}
|
}
|
||||||
|
|
||||||
crt, err := x509.CreateCertificate(rand.Reader, &template, &template, public, priv)
|
crt, err := x509.CreateCertificate(rand.Reader, &template, &template, pub, priv)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, nil, err
|
return nil, nil, err
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user