| 51 | } |
| 52 | |
| 53 | func (s *Java) CheckCA(ca *CA) (bool, error) { |
| 54 | s.init() |
| 55 | |
| 56 | if s.keytoolPath == "" { |
| 57 | return false, Error{ |
| 58 | Op: OpCheck, |
| 59 | Warning: ErrNoKeytool, |
| 60 | } |
| 61 | } |
| 62 | |
| 63 | // exists returns true if the given x509.Certificate's fingerprint |
| 64 | // is in the keytool -list output |
| 65 | exists := func(c *x509.Certificate, h hash.Hash, keytoolOutput []byte) bool { |
| 66 | h.Write(c.Raw) |
| 67 | fp := strings.ToUpper(hex.EncodeToString(h.Sum(nil))) |
| 68 | return bytes.Contains(keytoolOutput, []byte(fp)) |
| 69 | } |
| 70 | |
| 71 | args := []string{ |
| 72 | "-list", |
| 73 | "-keystore", s.cacertsPath, |
| 74 | "-storepass", s.StorePass, |
| 75 | } |
| 76 | |
| 77 | keytoolOutput, err := s.SysFS.Exec(s.SysFS.Command(s.keytoolPath, args...)) |
| 78 | if err != nil { |
| 79 | return false, fatalCmdErr(err, "keytool -list", keytoolOutput) |
| 80 | } |
| 81 | |
| 82 | // keytool outputs SHA1 and SHA256 (Java 9+) certificates in uppercase hex |
| 83 | // with each octet pair delimitated by ":". Drop them from the keytool output |
| 84 | keytoolOutput = bytes.Replace(keytoolOutput, []byte(":"), nil, -1) |
| 85 | |
| 86 | // pre-Java 9 uses SHA1 fingerprints |
| 87 | s1, s256 := sha1.New(), sha256.New() |
| 88 | return exists(ca.Certificate, s1, keytoolOutput) || exists(ca.Certificate, s256, keytoolOutput), nil |
| 89 | } |
| 90 | |
| 91 | func (s *Java) InstallCA(ca *CA) (bool, error) { |
| 92 | s.init() |