| 89 | } |
| 90 | |
| 91 | func parsePrivateKey(block *pem.Block) (crypto.Signer, error) { |
| 92 | switch block.Type { |
| 93 | case "RSA PRIVATE KEY": |
| 94 | k, err := x509.ParsePKCS1PrivateKey(block.Bytes) |
| 95 | if err != nil { |
| 96 | return nil, err |
| 97 | } |
| 98 | return k, nil |
| 99 | case "PRIVATE KEY": |
| 100 | k, err := x509.ParsePKCS8PrivateKey(block.Bytes) |
| 101 | if err != nil { |
| 102 | return nil, err |
| 103 | } |
| 104 | s, ok := k.(crypto.Signer) |
| 105 | if !ok { |
| 106 | return nil, fmt.Errorf("PKCS8 key is not a signer") |
| 107 | } |
| 108 | return s, nil |
| 109 | case "EC PRIVATE KEY": |
| 110 | k, err := x509.ParseECPrivateKey(block.Bytes) |
| 111 | if err != nil { |
| 112 | return nil, err |
| 113 | } |
| 114 | return k, nil |
| 115 | default: |
| 116 | return nil, fmt.Errorf("unsupported key PEM type: %s", block.Type) |
| 117 | } |
| 118 | } |
| 119 | |
| 120 | func createNodeCA(certPath, keyPath string) (*NodeCA, error) { |
| 121 | priv, err := rsa.GenerateKey(rand.Reader, 4096) |