Method Sign

utils/cautils/certificate_flow.go:250–293

Sign signs the CSR using the online or the offline certificate authority.

(ctx *cli.Context, tok string, csr api.CertificateRequest, crtFile string)

// Sign signs the CSR using the online or the offline certificate authority.
func (f *CertificateFlow) Sign(ctx *cli.Context, tok string, csr api.CertificateRequest, crtFile string) error {
	client, err := f.GetClient(ctx, tok)
	if err != nil {
		return err
	}

	// parse times or durations
	notBefore, notAfter, err := flags.ParseTimeDuration(ctx)
	if err != nil {
		return err
	}

	// parse template data
	templateData, err := flags.ParseTemplateData(ctx)
	if err != nil {
		return err
	}

	req := &api.SignRequest{
		CsrPEM:       csr,
		OTT:          tok,
		NotBefore:    notBefore,
		NotAfter:     notAfter,
		TemplateData: templateData,
	}

	resp, err := client.Sign(req)
	if err != nil {
		return err
	}

	if len(resp.CertChainPEM) == 0 {
		resp.CertChainPEM = []api.Certificate{resp.ServerPEM, resp.CaPEM}
	}
	var data []byte
	for _, certPEM := range resp.CertChainPEM {
		pemblk, err := pemutil.Serialize(certPEM.Certificate)
		if err != nil {
			return errors.Wrap(err, "error serializing from step-ca API response")
		}
		data = append(data, pem.EncodeToMemory(pemblk)...)
	}
	return fileutil.WriteFile(crtFile, data, 0o600)
}

// CreateSignRequest is a helper function that given an x509 OTT returns a
// simple but secure sign request as well as the private key used.