github.com/decred/dcrlnd@v0.7.6/cert/tls.go (about)

     1  package cert
     2  
     3  import (
     4  	"crypto/tls"
     5  	"crypto/x509"
     6  )
     7  
     8  var (
     9  	/*
    10  	 * tlsCipherSuites is the list of cipher suites we accept for TLS
    11  	 * connections. These cipher suites fit the following criteria:
    12  	 * - Don't use outdated algorithms like SHA-1 and 3DES
    13  	 * - Don't use ECB mode or other insecure symmetric methods
    14  	 * - Included in the TLS v1.2 suite
    15  	 * - Are available in the Go 1.7.6 standard library (more are
    16  	 *   available in 1.8.3 and will be added after lnd no longer
    17  	 *   supports 1.7, including suites that support CBC mode)
    18  	**/
    19  	tlsCipherSuites = []uint16{
    20  		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
    21  		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
    22  		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
    23  		tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
    24  	}
    25  )
    26  
    27  // LoadCert loads a certificate and its corresponding private key from the PEM
    28  // files indicated and returns the certificate in the two formats it is most
    29  // commonly used.
    30  func LoadCert(certPath, keyPath string) (tls.Certificate, *x509.Certificate,
    31  	error) {
    32  
    33  	// The certData returned here is just a wrapper around the PEM blocks
    34  	// loaded from the file. The PEM is not yet fully parsed but a basic
    35  	// check is performed that the certificate and private key actually
    36  	// belong together.
    37  	certData, err := tls.LoadX509KeyPair(certPath, keyPath)
    38  	if err != nil {
    39  		return tls.Certificate{}, nil, err
    40  	}
    41  
    42  	// Now parse the the PEM block of the certificate into its x509 data
    43  	// structure so it can be examined in more detail.
    44  	x509Cert, err := x509.ParseCertificate(certData.Certificate[0])
    45  	if err != nil {
    46  		return tls.Certificate{}, nil, err
    47  	}
    48  
    49  	return certData, x509Cert, nil
    50  }
    51  
    52  // TLSConfFromCert returns the default TLS configuration used for a server,
    53  // using the given certificate as identity.
    54  func TLSConfFromCert(certData tls.Certificate) *tls.Config {
    55  	return &tls.Config{
    56  		Certificates: []tls.Certificate{certData},
    57  		CipherSuites: tlsCipherSuites,
    58  		MinVersion:   tls.VersionTLS12,
    59  	}
    60  }