Method createSigningRequest

sign_certd.go:205–303

(rw http.ResponseWriter, req *http.Request)

}

func (h *certRequestHandler) createSigningRequest(rw http.ResponseWriter, req *http.Request) {
	err := req.ParseForm()
	if err != nil {
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}

	cert, err := h.extractCertFromRequest(req)
	if err != nil {
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}

	environment, ok := cert.Extensions["environment@cloudtools.github.io"]
	if !ok || environment == "" {
		http.Error(rw, "You forgot to send in the environment", http.StatusBadRequest)
		return
	}

	reason, ok := cert.Extensions["reason@cloudtools.github.io"]
	if !ok || reason == "" {
		http.Error(rw, "You forgot to send in a reason", http.StatusBadRequest)
		return
	}

	config, ok := h.Config[environment]
	if !ok {
		http.Error(rw, "Unknown environment.", http.StatusBadRequest)
		return
	}

	err = h.validateCert(cert, config.AuthorizedUsers)
	if err != nil {
		log.Printf("Invalid certificate signing request received from %s, ignoring", req.RemoteAddr)
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}

	// Ideally we put the critical options into the cert and let validateCert
	// do the validation. However, this also checks the signature on the cert
	// which would fail if we modified it prior to validation. So we validate
	// by hand.
	if len(config.CriticalOptions) > 0 {
		for optionName, optionVal := range config.CriticalOptions {
			cert.CriticalOptions[optionName] = optionVal
		}
	}

	requestID := make([]byte, 8)
	rand.Reader.Read(requestID)
	requestIDStr := base32.StdEncoding.EncodeToString(requestID)
	requestIDStr = strings.Replace(requestIDStr, "=", "", 10)
	// the serial number is the same as the request id, just encoded differently.
	var nextSerial uint64
	nextSerial = 0
	for _, byteVal := range requestID {
		nextSerial <<= 8
		nextSerial |= uint64(byteVal)