(certPath, keyPath string)
| 53 | } |
| 54 | |
| 55 | func loadNodeCA(certPath, keyPath string) (*NodeCA, error) { |
| 56 | certBytes, err := os.ReadFile(certPath) |
| 57 | if err != nil { |
| 58 | return nil, fmt.Errorf("read cert file: %w", err) |
| 59 | } |
| 60 | keyBytes, err := os.ReadFile(keyPath) |
| 61 | if err != nil { |
| 62 | return nil, fmt.Errorf("read key file: %w", err) |
| 63 | } |
| 64 | |
| 65 | certBlock, _ := pem.Decode(certBytes) |
| 66 | if certBlock == nil || certBlock.Type != "CERTIFICATE" { |
| 67 | return nil, fmt.Errorf("decode CA cert PEM: invalid block") |
| 68 | } |
| 69 | caCert, err := x509.ParseCertificate(certBlock.Bytes) |
| 70 | if err != nil { |
| 71 | return nil, fmt.Errorf("parse CA cert: %w", err) |
| 72 | } |
| 73 | |
| 74 | now := time.Now() |
| 75 | if now.Before(caCert.NotBefore) || now.After(caCert.NotAfter) { |
| 76 | return nil, fmt.Errorf("CA cert expired or not yet valid: notBefore=%s notAfter=%s", caCert.NotBefore, caCert.NotAfter) |
| 77 | } |
| 78 | |
| 79 | keyBlock, _ := pem.Decode(keyBytes) |
| 80 | if keyBlock == nil { |
| 81 | return nil, fmt.Errorf("decode CA key PEM: invalid block") |
| 82 | } |
| 83 | signer, err := parsePrivateKey(keyBlock) |
| 84 | if err != nil { |
| 85 | return nil, fmt.Errorf("parse CA key: %w", err) |
| 86 | } |
| 87 | |
| 88 | return &NodeCA{cert: caCert, key: signer, certPEM: certBytes}, nil |
| 89 | } |
| 90 | |
| 91 | func parsePrivateKey(block *pem.Block) (crypto.Signer, error) { |
| 92 | switch block.Type { |
no test coverage detected