Function tlsLoadX509KeyPair

command/ca/renew.go:656–679

(kms, certFile, keyFile, passFile string)

}

func tlsLoadX509KeyPair(kms, certFile, keyFile, passFile string) (tls.Certificate, error) {
	x509Chain, err := pemutil.ReadCertificateBundle(certFile)
	if err != nil {
		return tls.Certificate{}, errs.Wrap(err, "error reading certificate chain")
	}
	x509ChainBytes := make([][]byte, len(x509Chain))
	for i, c := range x509Chain {
		x509ChainBytes[i] = c.Raw
	}

	opts := []pemutil.Options{pemutil.WithFilename(keyFile)}
	if passFile != "" {
		opts = append(opts, pemutil.WithPasswordFile(passFile))
	}
	signer, err := cryptoutil.CreateSigner(kms, keyFile, opts...)
	if err != nil {
		return tls.Certificate{}, errs.Wrap(err, "error loading private key")
	}
	return tls.Certificate{
		Certificate: x509ChainBytes,
		PrivateKey:  signer,
		Leaf:        x509Chain[0],
	}, nil
}