| 196 | } |
| 197 | |
| 198 | func (spec *Spec) validatePrivKey(privateKey interface{}) error { |
| 199 | verify := func(algo string, size int) error { |
| 200 | if spec.Request.KeyRequest.Algo() != algo { |
| 201 | return fmt.Errorf("key algo is %s, must be %s", algo, spec.Request.KeyRequest.Algo()) |
| 202 | } |
| 203 | if spec.Request.KeyRequest.Size() != size { |
| 204 | return fmt.Errorf("key size is %d, must be %d", size, spec.Request.KeyRequest.Size()) |
| 205 | } |
| 206 | return nil |
| 207 | } |
| 208 | |
| 209 | switch key := privateKey.(type) { |
| 210 | case (*rsa.PrivateKey): |
| 211 | return verify("rsa", key.N.BitLen()) |
| 212 | case (*ecdsa.PrivateKey): |
| 213 | return verify("ecdsa", key.Curve.Params().BitSize) |
| 214 | } |
| 215 | return fmt.Errorf("unsupported key algorithm: %T", privateKey) |
| 216 | } |
| 217 | |
| 218 | // UpdateIfNeeded performs a refresh only if PKI is in need of a refresh (expired, new CA, etc) |
| 219 | func (spec *Spec) UpdateIfNeeded() error { |