GenerateKeypair mints a fresh RSA-2048 keypair scoped to the current month's selector. PrivateKeyDER is PKCS#1 DER (parseable with x509.ParsePKCS1PrivateKey); PublicKeyDNS is the base64 SPKI value with the PEM header/footer/newlines stripped so it can be pasted straight into a TXT record's "p=" fiel
()
| 69 | // with the PEM header/footer/newlines stripped so it can be pasted |
| 70 | // straight into a TXT record's "p=" field. |
| 71 | func GenerateKeypair() (*Keypair, error) { |
| 72 | key, err := rsa.GenerateKey(rand.Reader, 2048) |
| 73 | if err != nil { |
| 74 | return nil, fmt.Errorf("rsa keygen: %w", err) |
| 75 | } |
| 76 | pubDER, err := x509.MarshalPKIXPublicKey(&key.PublicKey) |
| 77 | if err != nil { |
| 78 | return nil, fmt.Errorf("marshal public key: %w", err) |
| 79 | } |
| 80 | return &Keypair{ |
| 81 | Selector: SelectorForNow(), |
| 82 | PublicKeyDNS: base64.StdEncoding.EncodeToString(pubDER), |
| 83 | PrivateKeyDER: x509.MarshalPKCS1PrivateKey(key), |
| 84 | }, nil |
| 85 | } |
| 86 | |
| 87 | // Sign prepends a DKIM-Signature header to the given RFC 5322 message |
| 88 | // body, signed with the supplied private key for "{selector}.{domain}". |