| 302 | } |
| 303 | |
| 304 | CertChainRef makeCertChain(Arena& arena, VectorRef<CertSpecRef> specs, CertAndKeyRef rootAuthority) { |
| 305 | ASSERT_GT(specs.size(), 0); |
| 306 | // if rootAuthority is empty, use last element in specs to make root CA |
| 307 | auto const needRootCA = rootAuthority.empty(); |
| 308 | if (needRootCA) { |
| 309 | int const chainLength = specs.size(); |
| 310 | auto chain = new (arena) CertAndKeyRef[chainLength]; |
| 311 | auto caNative = makeCertNative(specs.back(), CertAndKeyNative{} /* empty issuer == self-signed */); |
| 312 | chain[chainLength - 1] = caNative.toPem(arena); |
| 313 | for (auto i = chainLength - 2; i >= 0; i--) { |
| 314 | auto cnkNative = makeCertNative(specs[i], caNative); |
| 315 | chain[i] = cnkNative.toPem(arena); |
| 316 | caNative = cnkNative; |
| 317 | } |
| 318 | return CertChainRef(chain, chainLength); |
| 319 | } else { |
| 320 | int const chainLength = specs.size() + 1; /* account for deep-copied rootAuthority */ |
| 321 | auto chain = new (arena) CertAndKeyRef[chainLength]; |
| 322 | auto caNative = CertAndKeyNative::fromPem(rootAuthority); |
| 323 | chain[chainLength - 1] = rootAuthority.deepCopy(arena); |
| 324 | for (auto i = chainLength - 2; i >= 0; i--) { |
| 325 | auto cnkNative = makeCertNative(specs[i], caNative); |
| 326 | chain[i] = cnkNative.toPem(arena); |
| 327 | caNative = cnkNative; |
| 328 | } |
| 329 | return CertChainRef(chain, chainLength); |
| 330 | } |
| 331 | } |
| 332 | |
| 333 | VectorRef<CertSpecRef> makeCertChainSpec(Arena& arena, unsigned length, ESide side) { |
| 334 | if (!length) |