| 221 | } |
| 222 | |
| 223 | func generateCertificates(gatewayHost string) ([]byte, tls.Certificate, error) { |
| 224 | caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
| 225 | if err != nil { |
| 226 | return nil, tls.Certificate{}, err |
| 227 | } |
| 228 | |
| 229 | notBefore := time.Now().Add(-time.Hour) |
| 230 | notAfter := time.Now().Add(24 * time.Hour) |
| 231 | |
| 232 | caTemplate := &x509.Certificate{ |
| 233 | SerialNumber: big.NewInt(1), |
| 234 | Subject: pkix.Name{CommonName: "gh api_host test CA"}, |
| 235 | NotBefore: notBefore, |
| 236 | NotAfter: notAfter, |
| 237 | KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature, |
| 238 | BasicConstraintsValid: true, |
| 239 | IsCA: true, |
| 240 | } |
| 241 | |
| 242 | caDER, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, &caKey.PublicKey, caKey) |
| 243 | if err != nil { |
| 244 | return nil, tls.Certificate{}, err |
| 245 | } |
| 246 | caCert, err := x509.ParseCertificate(caDER) |
| 247 | if err != nil { |
| 248 | return nil, tls.Certificate{}, err |
| 249 | } |
| 250 | |
| 251 | serverKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
| 252 | if err != nil { |
| 253 | return nil, tls.Certificate{}, err |
| 254 | } |
| 255 | |
| 256 | serverTemplate := &x509.Certificate{ |
| 257 | SerialNumber: big.NewInt(2), |
| 258 | Subject: pkix.Name{CommonName: gatewayHost}, |
| 259 | NotBefore: notBefore, |
| 260 | NotAfter: notAfter, |
| 261 | KeyUsage: x509.KeyUsageDigitalSignature, |
| 262 | ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, |
| 263 | DNSNames: []string{gatewayHost}, |
| 264 | IPAddresses: []net.IP{net.IPv4(127, 0, 0, 1), net.IPv4(127, 0, 0, 2)}, |
| 265 | } |
| 266 | |
| 267 | serverDER, err := x509.CreateCertificate(rand.Reader, serverTemplate, caCert, &serverKey.PublicKey, caKey) |
| 268 | if err != nil { |
| 269 | return nil, tls.Certificate{}, err |
| 270 | } |
| 271 | |
| 272 | caPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: caDER}) |
| 273 | |
| 274 | return caPEM, tls.Certificate{ |
| 275 | Certificate: [][]byte{serverDER, caDER}, |
| 276 | PrivateKey: serverKey, |
| 277 | }, nil |
| 278 | } |
| 279 | |
| 280 | type recorder struct { |