RootIsValid checks if root is valid according to this package's policies.
(root *RootCertificateAuthority)
| 97 | |
| 98 | // RootIsValid checks if root is valid according to this package's policies. |
| 99 | func RootIsValid(root *RootCertificateAuthority) bool { |
| 100 | if root == nil || root.Certificate.x509 == nil { |
| 101 | return false |
| 102 | } |
| 103 | |
| 104 | trusted := x509.NewCertPool() |
| 105 | trusted.AddCert(root.Certificate.x509) |
| 106 | |
| 107 | // Verify the certificate expiration, basic constraints, key usages, and |
| 108 | // critical extensions. Trust the certificate as an authority so it is not |
| 109 | // compared to system roots or sent to the platform certificate verifier. |
| 110 | _, err := root.Certificate.x509.Verify(x509.VerifyOptions{ |
| 111 | Roots: trusted, |
| 112 | }) |
| 113 | |
| 114 | // Its expiration, key usages, and critical extensions are good. |
| 115 | ok := err == nil |
| 116 | |
| 117 | // It is an authority with the Subject Key Identifier extension. |
| 118 | // The "crypto/x509" package adds the extension automatically since Go 1.15. |
| 119 | // - https://tools.ietf.org/html/rfc5280#section-4.2.1.2 |
| 120 | // - https://go.dev/doc/go1.15#crypto/x509 |
| 121 | ok = ok && |
| 122 | root.Certificate.x509.BasicConstraintsValid && |
| 123 | root.Certificate.x509.IsCA && |
| 124 | len(root.Certificate.x509.SubjectKeyId) > 0 |
| 125 | |
| 126 | // It is signed by this private key. |
| 127 | ok = ok && |
| 128 | root.PrivateKey.ecdsa != nil && |
| 129 | root.PrivateKey.ecdsa.PublicKey.Equal(root.Certificate.x509.PublicKey) |
| 130 | |
| 131 | return ok |
| 132 | } |
| 133 | |
| 134 | // GenerateLeafCertificate generates a new key and certificate signed by root. |
| 135 | func (root *RootCertificateAuthority) GenerateLeafCertificate( |