| 51 | } |
| 52 | |
| 53 | func main() { |
| 54 | flag.Parse() |
| 55 | |
| 56 | if len(*host) == 0 { |
| 57 | log.Fatalf("Missing required --host parameter") |
| 58 | } |
| 59 | |
| 60 | var priv any |
| 61 | var err error |
| 62 | switch *ecdsaCurve { |
| 63 | case "": |
| 64 | if *ed25519Key { |
| 65 | _, priv, err = ed25519.GenerateKey(rand.Reader) |
| 66 | } else { |
| 67 | priv, err = rsa.GenerateKey(rand.Reader, *rsaBits) |
| 68 | } |
| 69 | case "P224": |
| 70 | priv, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader) |
| 71 | case "P256": |
| 72 | priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
| 73 | case "P384": |
| 74 | priv, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader) |
| 75 | case "P521": |
| 76 | priv, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader) |
| 77 | default: |
| 78 | log.Fatalf("Unrecognized elliptic curve: %q", *ecdsaCurve) |
| 79 | } |
| 80 | if err != nil { |
| 81 | log.Fatalf("Failed to generate private key: %v", err) |
| 82 | } |
| 83 | |
| 84 | // ECDSA, ED25519 and RSA subject keys should have the DigitalSignature |
| 85 | // KeyUsage bits set in the x509.Certificate template |
| 86 | keyUsage := x509.KeyUsageDigitalSignature |
| 87 | // Only RSA subject keys should have the KeyEncipherment KeyUsage bits set. In |
| 88 | // the context of TLS this KeyUsage is particular to RSA key exchange and |
| 89 | // authentication. |
| 90 | if _, isRSA := priv.(*rsa.PrivateKey); isRSA { |
| 91 | keyUsage |= x509.KeyUsageKeyEncipherment |
| 92 | } |
| 93 | |
| 94 | var notBefore time.Time |
| 95 | if len(*validFrom) == 0 { |
| 96 | notBefore = time.Now() |
| 97 | } else { |
| 98 | notBefore, err = time.Parse("Jan 2 15:04:05 2006", *validFrom) |
| 99 | if err != nil { |
| 100 | log.Fatalf("Failed to parse creation date: %v", err) |
| 101 | } |
| 102 | } |
| 103 | |
| 104 | notAfter := notBefore.Add(*validFor) |
| 105 | |
| 106 | serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) |
| 107 | serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) |
| 108 | if err != nil { |
| 109 | log.Fatalf("Failed to generate serial number: %v", err) |
| 110 | } |