go.charczuk.com@v0.0.0-20240327042549-bc490516bd1a/cmd/cert-gen/main.go

/*

Copyright (c) 2023 - Present. Will Charczuk. All rights reserved.
Use of this source code is governed by a MIT license that can be found in the LICENSE file at the root of the repository.

*/

package main

import (
	"fmt"
	"os"
	"time"

	"github.com/urfave/cli/v2"

	"go.charczuk.com/sdk/certutil"
	"go.charczuk.com/sdk/cliutil"
)

func main() {
	app := &cli.App{
		Name:  "cert-gen",
		Usage: "Generate certificate authorities, client, and server certificates for development or production (maybe, no guarantees).",
		Commands: []*cli.Command{
			certificateAuthority,
			server,
			client,
		},
	}
	if err := app.Run(os.Args); err != nil {
		cliutil.Fatal(err)
	}
}

var certificateAuthority = &cli.Command{
	Name:    "certificate-authority",
	Usage:   "Generate a certificate authority as a PEM encoded key pair",
	Aliases: []string{"ca"},
	Flags: []cli.Flag{
		&cli.StringFlag{
			Name:  "ca-cert",
			Value: "ca.crt",
			Usage: "the output path to the ca key pair certificate file in pem encoding",
			// Required: true,
		},
		&cli.StringFlag{
			Name:  "ca-key",
			Value: "ca.key",
			Usage: "the output path to the ca key pair key file in pem encoding",
			// Required: true,
		},
		&cli.StringFlag{
			Name:  "organization",
			Value: "Gen Cert CA",
			Usage: "the subject organization field value",
			// Required: true,
		},
		&cli.StringFlag{
			Name:  "organizational-unit",
			Value: hostname(),
			Usage: "the subject organizational unit field value",
			// Required: true,
		},
		&cli.StringFlag{
			Name:  "common-name",
			Value: "gen cert " + hostname(),
			Usage: "the subject common name field value",
			// Required: true,
		},
		&cli.StringFlag{
			Name:  "not-before",
			Value: time.Now().UTC().AddDate(0, -1, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-before field value in the certificate. must be in 2006-01-02 format.",
		},
		&cli.StringFlag{
			Name:  "not-after",
			Value: time.Now().UTC().AddDate(10, 0, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-after field value in the certificate. must be in 2006-01-02 format.",
		},
	},
	Action: func(ctx *cli.Context) error {
		opts, err := resolveNotBeforeAfter(ctx)
		if err != nil {
			return err
		}

		opts = append(opts, certutil.OptSubjectOrganization(ctx.String("organization")),
			certutil.OptSubjectOrganizationalUnit(ctx.String("organizational-unit")),
			certutil.OptSubjectCommonName(ctx.String("common-name")),
		)

		ca, err := certutil.CreateCertificateAuthority(opts...)
		if err != nil {
			return err
		}
		if err = ca.WriteCertPemPath(ctx.String("ca-cert")); err != nil {
			return err
		}
		return ca.WriteKeyPemPath(ctx.String("ca-key"))
	},
}

var server = &cli.Command{
	Name:  "server",
	Usage: "Generate a server certificate as a PEM encoded key pair",
	Flags: []cli.Flag{
		&cli.StringFlag{
			Name:  "ca-cert",
			Value: "ca.crt",
			Usage: "the input or output path to the ca key pair certificate file in pem encoding",
		},
		&cli.StringFlag{
			Name:  "ca-key",
			Value: "ca.key",
			Usage: "the input or output path to the ca key pair key file in pem encoding",
		},
		&cli.BoolFlag{
			Name:  "generate-ca",
			Value: false,
			Usage: "if we should generate a certificate authority or re-use an existing ca key pair",
		},
		&cli.StringFlag{
			Name:  "organization",
			Value: "Gen Cert Server",
			Usage: "the subject organization field value",
		},
		&cli.StringFlag{
			Name:  "organizational-unit",
			Value: hostname(),
			Usage: "the subject organizational unit field value",
		},
		&cli.StringFlag{
			Name:  "common-name",
			Value: "local.example.com",
			Usage: "the common name is the main name the clients will check against the host they're requesting",
		},
		&cli.StringSliceFlag{
			Name:  "dns-name",
			Usage: "additional names to add to the certificate signing requests in addition to the common name",
		},
		&cli.StringSliceFlag{
			Name:  "ip-san",
			Usage: "additional ip subject alternate names to add to the certificate signing requests in addition to the common name",
		},
		&cli.StringFlag{
			Name:  "cert-output",
			Value: "tls.crt",
			Usage: "the output path of the server certificate key pair certificate portion in pem encoding",
		},
		&cli.StringFlag{
			Name:  "key-output",
			Value: "tls.key",
			Usage: "the output path of the server certificate key pair key portion in pem encoding",
		},
		&cli.StringFlag{
			Name:  "not-before",
			Value: time.Now().UTC().AddDate(0, -1, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-before field value in the certificate. must be in 2006-01-02 format.",
		},
		&cli.StringFlag{
			Name:  "not-after",
			Value: time.Now().UTC().AddDate(2, 3, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-after field value in the certificate. must be in 2006-01-02 format.",
		},
	},
	Action: func(ctx *cli.Context) error {
		ca, err := resolveCA(ctx)
		if err != nil {
			return err
		}
		opts, err := resolveNotBeforeAfter(ctx)
		if err != nil {
			return err
		}
		opts = append(opts,
			certutil.OptSubjectOrganization(ctx.String("organization")),
			certutil.OptSubjectOrganizationalUnit(ctx.String("organizational-unit")),
		)
		dnsNames := ctx.StringSlice("dns-name")
		if len(dnsNames) > 0 {
			opts = append(opts, certutil.OptDNSNames(dnsNames...))
		}
		ipSANs := ctx.StringSlice("ip-san")
		if len(ipSANs) > 0 {
			opts = append(opts, certutil.OptIPSANs(ipSANs...))
		}
		server, err := certutil.CreateServer(ctx.String("common-name"), ca, opts...)
		if err != nil {
			return err
		}
		if err = server.WriteCertPemPath(ctx.String("cert-output")); err != nil {
			return err
		}
		return server.WriteKeyPemPath(ctx.String("key-output"))
	},
}

var client = &cli.Command{
	Name:  "client",
	Usage: "Generate a client certificate as a PEM encoded key pair",
	Flags: []cli.Flag{
		&cli.StringFlag{
			Name:  "ca-cert",
			Value: "ca.crt",
			Usage: "the input or output path to the ca key pair certificate file in pem encoding",
		},
		&cli.StringFlag{
			Name:  "ca-key",
			Value: "ca.key",
			Usage: "the input or output path to the ca key pair key file in pem encoding",
		},
		&cli.BoolFlag{
			Name:  "generate-ca",
			Value: false,
			Usage: "if we should generate a certificate authority or re-use an existing ca key pair",
		},
		&cli.StringFlag{
			Name:  "organization",
			Value: "Gen Cert Client",
			Usage: "the subject organization field value",
		},
		&cli.StringFlag{
			Name:  "organizational-unit",
			Value: hostname(),
			Usage: "the subject organizational unit field value",
		},
		&cli.StringFlag{
			Name:  "common-name",
			Value: "local-client.example.com",
			Usage: "the subject common name is most often used in client certificates as the username value",
		},
		&cli.StringSliceFlag{
			Name:  "dns-name",
			Usage: "additional names to add to the certificate signing requests in addition to the common name",
		},
		&cli.StringSliceFlag{
			Name:  "ip-san",
			Usage: "additional ip subject alternate names to add to the certificate signing requests in addition to the common name",
		},
		&cli.StringFlag{
			Name:  "cert-output",
			Value: "client.tls.crt",
			Usage: "the output path of the client certificate key pair certificate portion in pem encoding",
		},
		&cli.StringFlag{
			Name:  "key-output",
			Value: "client.tls.key",
			Usage: "the output path of the client certificate key pair key portion in pem encoding",
		},
		&cli.StringFlag{
			Name:  "not-before",
			Value: time.Now().UTC().AddDate(0, -1, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-before field value in the certificate. must be in 2006-01-02 format.",
		},
		&cli.StringFlag{
			Name:  "not-after",
			Value: time.Now().UTC().AddDate(2, 3, 0).Format("2006-01-02"),
			Usage: "the date to use as the not-after field value in the certificate. must be in 2006-01-02 format.",
		},
	},
	Action: func(ctx *cli.Context) error {
		ca, err := resolveCA(ctx)
		if err != nil {
			return err
		}
		opts, err := resolveNotBeforeAfter(ctx)
		if err != nil {
			return err
		}

		opts = append(opts,
			certutil.OptSubjectOrganization(ctx.String("organization")),
			certutil.OptSubjectOrganizationalUnit(ctx.String("organizational-unit")),
		)

		dnsNames := ctx.StringSlice("dns-name")
		if len(dnsNames) > 0 {
			opts = append(opts, certutil.OptDNSNames(dnsNames...))
		}
		ipSANs := ctx.StringSlice("ip-san")
		if len(ipSANs) > 0 {
			opts = append(opts, certutil.OptIPSANs(ipSANs...))
		}
		client, err := certutil.CreateClient(ctx.String("common-name"), ca, opts...)
		if err != nil {
			return err
		}
		if err = client.WriteCertPemPath(ctx.String("cert-output")); err != nil {
			return err
		}
		if err = client.WriteKeyPemPath(ctx.String("key-output")); err != nil {
			return err
		}
		return nil
	},
}

func resolveNotBeforeAfter(ctx *cli.Context) ([]certutil.CertOption, error) {
	notBefore, err := time.Parse("2006-01-02", ctx.String("not-before"))
	if err != nil {
		return nil, fmt.Errorf("invalid not-before; must be in 2006-01-02 format: %w", err)
	}
	notAfter, err := time.Parse("2006-01-02", ctx.String("not-after"))
	if err != nil {
		return nil, fmt.Errorf("invalid not-after; must be in 2006-01-02 format: %w", err)
	}
	if notBefore.IsZero() {
		return nil, fmt.Errorf("invalid not-before; must not be zero")
	}
	if notAfter.IsZero() {
		return nil, fmt.Errorf("invalid not-after; must not be zero")
	}
	if notBefore.After(notAfter) {
		return nil, fmt.Errorf("invalid not-before and not-after; not-before must be before not-after")

	}
	return []certutil.CertOption{
		certutil.OptNotBefore(notBefore),
		certutil.OptNotAfter(notAfter),
	}, nil
}

func resolveCA(ctx *cli.Context) (*certutil.CertBundle, error) {
	var ca *certutil.CertBundle
	var err error
	shouldGenerateCA := ctx.Bool("generate-ca")
	if shouldGenerateCA {
		ca, err = certutil.CreateCertificateAuthority()
	} else {
		caCertInput := ctx.String("ca-cert")
		caKeyInput := ctx.String("ca-key")
		if caCertInput == "" || caKeyInput == "" {
			return nil, fmt.Errorf("--ca-cert and --ca-key are both required to generate the ca")
		}
		ca, err = certutil.NewCertBundle(certutil.NewKeyPairFromPaths(caCertInput, caKeyInput))
	}
	if err != nil {
		return nil, err
	}
	if shouldGenerateCA {
		if err = ca.WriteCertPemPath(ctx.String("ca-cert")); err != nil {
			return nil, err
		}
		if err = ca.WriteKeyPemPath(ctx.String("ca-key")); err != nil {
			return nil, err
		}
	}
	return ca, nil
}

func hostname() (hostname string) {
	if h, err := os.Hostname(); err == nil {
		hostname = h
		return
	}
	hostname = "local"
	return
}