c82f568b2c
We were previously issuing both client certs and server certs with both extended key usages included. Split the Issue*() methods into separate methods for issuing server certs versus client certs so they can have different extended key usages tailored for each use case. Also took the opportunity to clean up the parameters of the Issue*() methods and New() methods to more closely match how we prefer to call them. We were always only passing the common name part of the pkix.Name to New(), so now the New() method just takes the common name as a string. When making a server cert, we don't need to set the deprecated common name field, so remove that param. When making a client cert, we're always making it in the format expected by the Kube API server, so just accept the username and group as parameters directly.
40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
// Package dynamiccertauthority implements a x509 certificate authority capable of issuing
|
|
// certificates from a dynamically updating CA keypair.
|
|
package dynamiccertauthority
|
|
|
|
import (
|
|
"time"
|
|
|
|
"k8s.io/apiserver/pkg/server/dynamiccertificates"
|
|
|
|
"go.pinniped.dev/internal/certauthority"
|
|
)
|
|
|
|
// CA is a type capable of issuing certificates.
|
|
type CA struct {
|
|
provider dynamiccertificates.CertKeyContentProvider
|
|
}
|
|
|
|
// New creates a new CA, ready to issue certs whenever the provided provider has a keypair to
|
|
// provide.
|
|
func New(provider dynamiccertificates.CertKeyContentProvider) *CA {
|
|
return &CA{
|
|
provider: provider,
|
|
}
|
|
}
|
|
|
|
// IssueClientCertPEM issues a new client certificate for the given identity and duration, returning it as a
|
|
// pair of PEM-formatted byte slices for the certificate and private key.
|
|
func (c *CA) IssueClientCertPEM(username string, groups []string, ttl time.Duration) ([]byte, []byte, error) {
|
|
caCrtPEM, caKeyPEM := c.provider.CurrentCertKeyContent()
|
|
ca, err := certauthority.Load(string(caCrtPEM), string(caKeyPEM))
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
|
|
return ca.IssueClientCertPEM(username, groups, ttl)
|
|
}
|