| 69 | } |
| 70 | |
| 71 | func (ca *CA) WriteCertificate(template *x509.Certificate, certPath string, keyPath string) error { |
| 72 | key, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader) |
| 73 | if err != nil { |
| 74 | return err |
| 75 | } |
| 76 | |
| 77 | keyBytes, err := x509.MarshalECPrivateKey(key) |
| 78 | if err != nil { |
| 79 | return err |
| 80 | } |
| 81 | |
| 82 | if err := writeExclusivePEMFile(keyPath, "PRIVATE KEY", 0600, keyBytes); err != nil { |
| 83 | return err |
| 84 | } |
| 85 | |
| 86 | template.IsCA = false |
| 87 | template.NotBefore = time.Now() |
| 88 | if template.NotAfter.IsZero() { |
| 89 | template.NotAfter = time.Now().Add(time.Hour * 24 * 180) |
| 90 | } |
| 91 | template.SerialNumber = ca.serial.Add(ca.serial, big.NewInt(1)) |
| 92 | |
| 93 | derBytes, err := x509.CreateCertificate(rand.Reader, template, ca.cert, key.Public(), ca.key) |
| 94 | if err != nil { |
| 95 | return err |
| 96 | } |
| 97 | |
| 98 | return writeExclusivePEMFile(certPath, "CERTIFICATE", 0644, derBytes) |
| 99 | } |