Function mkcrt

plugins/certifier/certifier.cc:347–395

Local helper function that generates a X509 certificate based on SNI

/// Local helper function that generates a X509 certificate based on SNI
static scoped_X509
mkcrt(const std::string &commonName, int serial)
{
  scoped_EVP_PKEY pktmp;
  scoped_X509     cert;

  cert.reset(X509_new());

  // Set X509V3
  if (X509_set_version(cert.get(), 2) == 0) {
    TSError("[%s] %s: failed to set X509V3", PLUGIN_NAME, __func__);
    return nullptr;
  }

  // Set serial number
  ASN1_INTEGER_set(X509_get_serialNumber(cert.get()), serial);

  // Set issuer from CA cert
  if (X509_set_issuer_name(cert.get(), X509_get_subject_name(ca_cert_scoped.get())) == 0) {
    TSError("[%s] %s: failed to set certificate issuer", PLUGIN_NAME, __func__);
    return nullptr;
  }

  // Set certificate time
  X509_gmtime_adj(X509_get_notBefore(cert.get()), 0);
  X509_gmtime_adj(X509_get_notAfter(cert.get()), static_cast<long>(3650) * 24 * 3600);

  // Get handle to subject name
  X509_NAME *n = X509_get_subject_name(cert.get());
  // Set common name field
  if (X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (unsigned char *)commonName.c_str(), -1, -1, 0) != 1) {
    TSError("[%s] %s: failed to add certificate subject CN", PLUGIN_NAME, __func__);
    return nullptr;
  }

  // Set Traffic Server public key
  if (X509_set_pubkey(cert.get(), ca_pkey_scoped.get()) == 0) {
    TSError("[%s] %s: failed to set certificate public key", PLUGIN_NAME, __func__);
    return nullptr;
  }

  // Add the Subject Alternative Name (SAN) extension
  addSANExtToCert(cert.get(), commonName);

  // Sign the certificate
  X509_sign(cert.get(), ca_pkey_scoped.get(), EVP_sha256());

  return cert;
}

static int
shadow_cert_generator(TSCont contp, TSEvent /* event ATS_UNUSED */, void * /* edata ATS_UNUSED */)