Function initAction

command/ca/init.go:220–718

(ctx *cli.Context)

}

func initAction(ctx *cli.Context) (err error) {
	if err := assertCryptoRand(); err != nil {
		return err
	}

	var rootCrt *x509.Certificate
	var rootKey interface{}

	caURL := ctx.String("with-ca-url")
	root := ctx.String("root")
	key := ctx.String("key")
	ra := strings.ToLower(ctx.String("ra"))
	kmsName := strings.ToLower(ctx.String("kms"))
	pkiOnly := ctx.Bool("pki")
	noDB := ctx.Bool("no-db")
	helm := ctx.Bool("helm")
	enableRemoteManagement := ctx.Bool("remote-management")
	addDefaultACMEProvisioner := ctx.Bool("acme")
	firstSuperAdminSubject := ctx.String("admin-subject")

	switch {
	case root != "" && key == "":
		return errs.RequiredWithFlag(ctx, "root", "key")
	case root == "" && key != "":
		return errs.RequiredWithFlag(ctx, "key", "root")
	case root != "" && key != "":
		opts := []pemutil.Options{}
		if keyPasswordFile := ctx.String("key-password-file"); keyPasswordFile != "" {
			opts = append(opts, pemutil.WithPasswordFile(keyPasswordFile))
		}
		if rootCrt, err = pemutil.ReadCertificate(root); err != nil {
			return err
		}
		if rootKey, err = pemutil.Read(key, opts...); err != nil {
			return err
		}
	case ra != "" && ra != apiv1.CloudCAS && ra != apiv1.StepCAS:
		return errs.InvalidFlagValue(ctx, "ra", ctx.String("ra"), "StepCAS or CloudCAS")
	case kmsName != "" && kmsName != "azurekms":
		return errs.InvalidFlagValue(ctx, "kms", ctx.String("kms"), "azurekms")
	case kmsName != "" && ra != "":
		return errs.IncompatibleFlagWithFlag(ctx, "kms", "ra")
	case pkiOnly && noDB:
		return errs.IncompatibleFlagWithFlag(ctx, "pki", "no-db")
	case pkiOnly && helm:
		return errs.IncompatibleFlagWithFlag(ctx, "pki", "helm")
	case enableRemoteManagement && noDB:
		// remote management via the Admin API requires a database configuration
		return errs.IncompatibleFlagWithFlag(ctx, "remote-management", "no-db")
	case addDefaultACMEProvisioner && noDB:
		// ACME functionality requires a database configuration
		return errs.IncompatibleFlagWithFlag(ctx, "acme", "no-db")
	case firstSuperAdminSubject != "" && helm:
		// providing the first super admin subject is not (yet) supported with Helm output
		return errs.IncompatibleFlagWithFlag(ctx, "admin-subject", "helm")
	case firstSuperAdminSubject != "" && !enableRemoteManagement:
		// providing the first super admin subject only works with DB-backed provisioners,
		// thus remote management should be enabled.