Function certificateAction

command/ca/certificate.go:220–307

(ctx *cli.Context)

}

func certificateAction(ctx *cli.Context) error {
	if err := errs.MinMaxNumberOfArguments(ctx, 2, 3); err != nil {
		return err
	}

	// Allow two arguments with the attestation uri.
	if ctx.NArg() == 2 && ctx.String("attestation-uri") == "" {
		return errs.TooFewArguments(ctx)
	}

	args := ctx.Args()
	subject := args.Get(0)
	crtFile, keyFile := args.Get(1), args.Get(2)

	tok := ctx.String("token")
	offline := ctx.Bool("offline")
	sans := ctx.StringSlice("san")

	switch {
	case offline && tok != "":
		// offline and token are incompatible because the token is generated before
		// the start of the offline CA.
		return errs.IncompatibleFlagWithFlag(ctx, "offline", "token")
	case ctx.String("attestation-uri") != "" && ctx.String("kms") != "":
		// attestation-uri and kms are incompatible because the ACME-DA flow
		// expects all necessary parameters in the attestation-uri, and having
		// both can be confusing.
		return errs.IncompatibleFlagWithFlag(ctx, "attestation-uri", "kms")
	}

	// certificate flow unifies online and offline flows on a single api
	flow, err := cautils.NewCertificateFlow(ctx)
	if err != nil {
		return err
	}

	if tok == "" {
		// Use the ACME protocol with a different certificate authority.
		if ctx.IsSet("acme") {
			return cautils.ACMECreateCertFlow(ctx, "")
		}
		if tok, err = flow.GenerateToken(ctx, subject, sans); err != nil {
			var acmeTokenErr *cautils.ACMETokenError
			if errors.As(err, &acmeTokenErr) {
				return cautils.ACMECreateCertFlow(ctx, acmeTokenErr.Name)
			}
			return err
		}
	}

	req, pk, err := flow.CreateSignRequest(ctx, tok, subject, sans)
	if err != nil {
		return err
	}

	jwt, err := token.ParseInsecure(tok)
	if err != nil {
		return err