Method SignCSR

internal/cert/ca.go:186–235

SignCSR signs the given PEM-encoded CSR producing a node client certificate whose CommonName is forced to nodeID. The CSR's self-reported subject is not trusted; only its public key and signature are used.

(csrPEM []byte, nodeID string, ttl time.Duration)

// whose CommonName is forced to nodeID. The CSR's self-reported subject is not
// trusted; only its public key and signature are used.
func (ca *NodeCA) SignCSR(csrPEM []byte, nodeID string, ttl time.Duration) ([]byte, error) {
	if nodeID == "" {
		return nil, fmt.Errorf("node id is required")
	}
	if ttl <= 0 {
		return nil, fmt.Errorf("ttl must be positive")
	}

	block, _ := pem.Decode(csrPEM)
	if block == nil || block.Type != "CERTIFICATE REQUEST" {
		return nil, fmt.Errorf("decode CSR PEM: invalid block")
	}
	csr, err := x509.ParseCertificateRequest(block.Bytes)
	if err != nil {
		return nil, fmt.Errorf("parse CSR: %w", err)
	}
	if err := csr.CheckSignature(); err != nil {
		return nil, fmt.Errorf("verify CSR signature: %w", err)
	}

	serial, err := randomSerial()
	if err != nil {
		return nil, err
	}

	uri := &url.URL{Scheme: "pulse-node", Host: nodeID}

	now := time.Now()
	template := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName:   nodeID,
			Organization: []string{"pulse-node"},
		},
		NotBefore:             now.Add(-time.Minute),
		NotAfter:              now.Add(ttl),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
		BasicConstraintsValid: true,
		IsCA:                  false,
		URIs:                  []*url.URL{uri},
	}

	der, err := x509.CreateCertificate(rand.Reader, template, ca.cert, csr.PublicKey, ca.key)
	if err != nil {
		return nil, fmt.Errorf("sign certificate: %w", err)
	}

	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), nil
}

// CertPEM returns the CA's own certificate in PEM form. Safe to share with
// nodes (used as RootCA for verifying the server when establishing mTLS).