| 5 | use std::path::{Path, PathBuf}; |
| 6 | |
| 7 | pub fn generate_certificates(certs_path: &PathBuf, rest_host: &str) -> Result<(), Error> { |
| 8 | /* Generate the CA certificate */ |
| 9 | let mut ca_params = CertificateParams::new(vec![ |
| 10 | "cln Root REST CA".to_string(), |
| 11 | "cln".to_string(), |
| 12 | "localhost".to_string(), |
| 13 | ])?; |
| 14 | ca_params.is_ca = rcgen::IsCa::Ca(rcgen::BasicConstraints::Unconstrained); |
| 15 | ca_params |
| 16 | .key_usages |
| 17 | .push(rcgen::KeyUsagePurpose::KeyCertSign); |
| 18 | ca_params.use_authority_key_identifier_extension = true; |
| 19 | let ca_key = KeyPair::generate()?; |
| 20 | let ca_cert = ca_params.self_signed(&ca_key)?; |
| 21 | let ca_issuer = Issuer::from_params(&ca_params, &ca_key); |
| 22 | |
| 23 | fs::create_dir_all(certs_path)?; |
| 24 | |
| 25 | fs::write(certs_path.join("ca.pem"), ca_cert.pem())?; |
| 26 | fs::write( |
| 27 | certs_path.join("ca-key.pem"), |
| 28 | ca_key.serialize_pem().as_bytes(), |
| 29 | )?; |
| 30 | |
| 31 | /* Generate the server certificate signed by the CA */ |
| 32 | let mut server_params = CertificateParams::new(vec![ |
| 33 | format!("cln rest server"), |
| 34 | "cln".to_string(), |
| 35 | "localhost".to_string(), |
| 36 | ])?; |
| 37 | server_params.is_ca = rcgen::IsCa::NoCa; |
| 38 | server_params |
| 39 | .key_usages |
| 40 | .push(rcgen::KeyUsagePurpose::DigitalSignature); |
| 41 | server_params |
| 42 | .key_usages |
| 43 | .push(rcgen::KeyUsagePurpose::KeyEncipherment); |
| 44 | server_params |
| 45 | .key_usages |
| 46 | .push(rcgen::KeyUsagePurpose::KeyAgreement); |
| 47 | server_params.use_authority_key_identifier_extension = true; |
| 48 | server_params.distinguished_name = DistinguishedName::new(); |
| 49 | server_params |
| 50 | .distinguished_name |
| 51 | .push(rcgen::DnType::CommonName, "cln rest server"); |
| 52 | if let Ok(ip) = rest_host.parse::<IpAddr>() { |
| 53 | server_params |
| 54 | .subject_alt_names |
| 55 | .push(rcgen::SanType::IpAddress(ip)); |
| 56 | } |
| 57 | let server_key = KeyPair::generate()?; |
| 58 | let server_pem = server_params.signed_by(&server_key, &ca_issuer)?.pem(); |
| 59 | |
| 60 | fs::write(certs_path.join("server.pem"), server_pem)?; |
| 61 | fs::write( |
| 62 | certs_path.join("server-key.pem"), |
| 63 | server_key.serialize_pem().as_bytes(), |
| 64 | )?; |