Function parseOrCreateKey

command/certificate/create.go:773–836

(ctx *cli.Context)

}

func parseOrCreateKey(ctx *cli.Context) (crypto.PublicKey, crypto.Signer, error) {
	var (
		kms     = ctx.String("kms")
		keyFile = ctx.String("key")
	)

	// Validate key parameters and generate key pair
	if keyFile == "" {
		insecureMode := ctx.Bool("insecure")
		kty, crv, size, err := utils.GetKeyDetailsFromCLI(ctx, insecureMode, "kty", "curve", "size")
		if err != nil {
			return nil, nil, err
		}
		if insecureMode { // put keyutil in insecure mode, allowing RSA keys shorter than 2048 bits
			undoInsecure := keyutil.Insecure()
			defer undoInsecure()
		}
		pub, priv, err := keyutil.GenerateKeyPair(kty, crv, size)
		if err != nil {
			return nil, nil, err
		}
		signer, ok := priv.(crypto.Signer)
		if !ok {
			return nil, nil, errors.Errorf("private key of type %T is not a crypto.Signer", priv)
		}
		return pub, signer, nil
	}

	// Validate incompatible flags and read a key file
	switch {
	case ctx.IsSet("kty"):
		return nil, nil, errs.IncompatibleFlag(ctx, "key", "kty")
	case ctx.IsSet("crv"):
		return nil, nil, errs.IncompatibleFlag(ctx, "key", "crv")
	case ctx.IsSet("size"):
		return nil, nil, errs.IncompatibleFlag(ctx, "key", "size")
	}

	opts := []pemutil.Options{}
	passFile := ctx.String("password-file")
	if passFile != "" {
		opts = append(opts, pemutil.WithPasswordFile(passFile))
	}

	var pub crypto.PublicKey
	var signer crypto.Signer

	signer, err := cryptoutil.CreateSigner(kms, keyFile, opts...)
	if err != nil {
		// TODO: check sentinel error; if it's not a signer, it could be a public key instead
		pub, err = cryptoutil.PublicKey(kms, keyFile, opts...)
		if err != nil {
			return nil, nil, err
		}
	} else {
		pub = signer.Public()
		// Make sure we can sign X509 certificates with it.
		if !cryptoutil.IsX509Signer(signer) {