Function generateRootCertificate

internal/pki/common.go:67–95

(
	privateKey *ecdsa.PrivateKey, serialNumber *big.Int,
)

}

func generateRootCertificate(
	privateKey *ecdsa.PrivateKey, serialNumber *big.Int,
) (*x509.Certificate, error) {
	const rootCommonName = "postgres-operator-ca"
	const rootExpiration = time.Hour * 24 * 365 * 10
	const rootStartValid = time.Hour * -1

	now := currentTime()
	template := &x509.Certificate{
		BasicConstraintsValid: true,
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
		MaxPathLenZero:        true, // there are no intermediate certificates
		NotBefore:             now.Add(rootStartValid),
		NotAfter:              now.Add(rootExpiration),
		SerialNumber:          serialNumber,
		SignatureAlgorithm:    certificateSignatureAlgorithm,
		Subject: pkix.Name{
			CommonName: rootCommonName,
		},
	}

	// A root certificate is self-signed, so pass in the template twice.
	bytes, err := x509.CreateCertificate(rand.Reader, template, template,
		privateKey.Public(), privateKey)

	parsed, _ := x509.ParseCertificate(bytes)
	return parsed, err
}