| 49 | } |
| 50 | |
| 51 | func (f *SelfSignedLoader) Configure(inlineArgs []string, cfg *config.Map) error { |
| 52 | f.serverNames = inlineArgs |
| 53 | if _, err := cfg.Process(); err != nil { |
| 54 | return err |
| 55 | } |
| 56 | |
| 57 | privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
| 58 | if err != nil { |
| 59 | return err |
| 60 | } |
| 61 | |
| 62 | notBefore := time.Now() |
| 63 | notAfter := notBefore.Add(24 * time.Hour * 7) |
| 64 | serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) |
| 65 | serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) |
| 66 | if err != nil { |
| 67 | return err |
| 68 | } |
| 69 | cert := &x509.Certificate{ |
| 70 | SerialNumber: serialNumber, |
| 71 | Subject: pkix.Name{Organization: []string{"Maddy Self-Signed"}}, |
| 72 | NotBefore: notBefore, |
| 73 | NotAfter: notAfter, |
| 74 | KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, |
| 75 | ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, |
| 76 | } |
| 77 | |
| 78 | for _, name := range f.serverNames { |
| 79 | if ip := net.ParseIP(name); ip != nil { |
| 80 | cert.IPAddresses = append(cert.IPAddresses, ip) |
| 81 | } else { |
| 82 | cert.DNSNames = append(cert.DNSNames, name) |
| 83 | } |
| 84 | } |
| 85 | derBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, &privKey.PublicKey, privKey) |
| 86 | if err != nil { |
| 87 | return err |
| 88 | } |
| 89 | |
| 90 | f.cert = tls.Certificate{ |
| 91 | Certificate: [][]byte{derBytes}, |
| 92 | PrivateKey: privKey, |
| 93 | Leaf: cert, |
| 94 | } |
| 95 | return nil |
| 96 | } |
| 97 | |
| 98 | func (f *SelfSignedLoader) Name() string { |
| 99 | return "tls.loader.self_signed" |