Method createAndSignPairWithValidity

pkg/certs/certs.go:155–233

(
	host string,
	notBefore,
	notAfter time.Time,
	usage CertType,
	altDNSNames []string,
)

}

func (pair KeyPair) createAndSignPairWithValidity(
	host string,
	notBefore,
	notAfter time.Time,
	usage CertType,
	altDNSNames []string,
) (*KeyPair, error) {
	caCertificate, err := pair.ParseCertificate()
	if err != nil {
		return nil, err
	}

	caPrivateKey, err := pair.ParseECPrivateKey()
	if err != nil {
		return nil, err
	}

	// Generate a new private key
	leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}

	// Sign the public part of this key with the CA
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, fmt.Errorf("can't generate serial number: %w", err)
	}

	leafTemplate := x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		BasicConstraintsValid: true,
		IsCA:                  false,
		Subject: pkix.Name{
			CommonName: host,
		},
		DNSNames: altDNSNames,
	}

	leafTemplate.KeyUsage = x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement
	switch usage {
	case CertTypeClient:
		leafTemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}

	case CertTypeServer:
		leafTemplate.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}
		leafTemplate.KeyUsage |= x509.KeyUsageKeyEncipherment

		hosts := strings.Split(host, ",")
		for _, h := range hosts {
			if ip := net.ParseIP(h); ip != nil {
				leafTemplate.IPAddresses = append(leafTemplate.IPAddresses, ip)
				continue
			}
			if !slices.Contains(leafTemplate.DNSNames, h) {