go.charczuk.com@v0.0.0-20240327042549-bc490516bd1a/sdk/certutil/cert_option.go

/*

Copyright (c) 2023 - Present. Will Charczuk. All rights reserved.
Use of this source code is governed by a MIT license that can be found in the LICENSE file at the root of the repository.

*/

package certutil

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"math/big"
	"net"
	"os"
	"time"

	"go.charczuk.com/sdk/errutil"
)

// CertOptions are required arguments when creating certificates.
type CertOptions struct {
	x509.Certificate
	PrivateKey        *rsa.PrivateKey
	NotBeforeProvider func() time.Time
	NotAfterProvider  func() time.Time
}

// ResolveCertOptions resolves the common create cert options.
func ResolveCertOptions(createOptions *CertOptions, options ...CertOption) error {
	var err error
	for _, option := range options {
		if err = option(createOptions); err != nil {
			return err
		}
	}

	if createOptions.PrivateKey == nil {
		createOptions.PrivateKey, err = rsa.GenerateKey(rand.Reader, 2048)
		if err != nil {
			return errutil.New(err)
		}
	}

	if createOptions.SerialNumber == nil {
		serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
		createOptions.SerialNumber, err = rand.Int(rand.Reader, serialNumberLimit)
		if err != nil {
			return errutil.New(err)
		}
	}

	var output CertBundle
	output.PrivateKey = createOptions.PrivateKey
	output.PublicKey = &createOptions.PrivateKey.PublicKey

	if createOptions.NotAfter.IsZero() && createOptions.NotAfterProvider != nil {
		createOptions.NotAfter = createOptions.NotAfterProvider()
	}
	if createOptions.NotAfter.IsZero() && createOptions.NotAfterProvider != nil {
		createOptions.NotAfter = createOptions.NotAfterProvider()
	}

	return nil
}

// CertOption is an option for creating certs.
type CertOption func(*CertOptions) error

// OptSubjectCommonName sets the subject common name.
func OptSubjectCommonName(commonName string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.CommonName = commonName
		return nil
	}
}

// OptSubjectOrganization sets the subject organization names.
func OptSubjectOrganization(organization ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.Organization = organization
		return nil
	}
}

// OptSubjectOrganizationalUnit sets the subject organization names.
func OptSubjectOrganizationalUnit(organizationalUnits ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.OrganizationalUnit = organizationalUnits
		return nil
	}
}

// OptSubjectCountry sets the subject country names.
func OptSubjectCountry(country ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.Country = country
		return nil
	}
}

// OptSubjectProvince sets the subject province names.
func OptSubjectProvince(province ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.Province = province
		return nil
	}
}

// OptSubjectLocality sets the subject locality names.
func OptSubjectLocality(locality ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Subject.Locality = locality
		return nil
	}
}

// OptNotAfter sets the not after time.
func OptNotAfter(notAfter time.Time) CertOption {
	return func(csr *CertOptions) error {
		csr.NotAfter = notAfter
		return nil
	}
}

// OptNotBefore sets the not before time.
func OptNotBefore(notBefore time.Time) CertOption {
	return func(csr *CertOptions) error {
		csr.NotBefore = notBefore
		return nil
	}
}

// OptIsCA sets the is certificate authority flag.
func OptIsCA(isCA bool) CertOption {
	return func(csr *CertOptions) error {
		csr.IsCA = isCA
		return nil
	}
}

// OptKeyUsage sets the key usage flags.
func OptKeyUsage(keyUsage x509.KeyUsage) CertOption {
	return func(csr *CertOptions) error {
		csr.KeyUsage = keyUsage
		return nil
	}
}

// OptDNSNames sets valid dns names for the cert.
func OptDNSNames(dnsNames ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.DNSNames = dnsNames
		return nil
	}
}

// OptIPSANs sets valid ip subject alternate names for the cert.
func OptIPSANs(ipAddresses ...string) CertOption {
	return func(csr *CertOptions) error {
		var parsedAddresses []net.IP
		for _, rawAddress := range ipAddresses {
			parsedAddresses = append(parsedAddresses, net.ParseIP(rawAddress))
		}
		csr.IPAddresses = parsedAddresses
		return nil
	}
}

// OptAddDNSNames adds valid dns names for the cert.
func OptAddDNSNames(dnsNames ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.DNSNames = append(csr.DNSNames, dnsNames...)
		return nil
	}
}

// OptSerialNumber sets the serial number for the certificate.
// If this option isn't provided, a random one is generated.
func OptSerialNumber(serialNumber *big.Int) CertOption {
	return func(cco *CertOptions) error {
		cco.SerialNumber = serialNumber
		return nil
	}
}

// OptPrivateKey sets the private key to use when generating the certificate.
// If this option isn't provided, a new one is generated.
func OptPrivateKey(privateKey *rsa.PrivateKey) CertOption {
	return func(cco *CertOptions) error {
		cco.PrivateKey = privateKey
		return nil
	}
}

// OptPrivateKeyFromPath reads a private key from a given path and parses it as PKCS1PrivateKey.
func OptPrivateKeyFromPath(path string) CertOption {
	return func(cco *CertOptions) error {
		contents, err := os.ReadFile(path)
		if err != nil {
			return errutil.New(err)
		}
		privateKey, err := x509.ParsePKCS1PrivateKey(contents)
		if err != nil {
			return errutil.New(err)
		}
		cco.PrivateKey = privateKey
		return nil
	}
}

// OptSubjectKeyID sets the subject key id.
func OptSubjectKeyID(keyID []byte) CertOption {
	return func(csr *CertOptions) error {
		csr.SubjectKeyId = keyID
		return nil
	}
}

// OptIssuerCommonName sets the subject common name.
func OptIssuerCommonName(commonName string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.CommonName = commonName
		return nil
	}
}

// OptIssuerOrganization sets the subject organization names.
func OptIssuerOrganization(organization ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.Organization = organization
		return nil
	}
}

// OptIssuerOrganization sets the subject organization names.
func OptIssuerOrganizationalUnit(organizationalUnits ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.OrganizationalUnit = organizationalUnits
		return nil
	}
}

// OptIssuerCountry sets the subject country names.
func OptIssuerCountry(country ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.Country = country
		return nil
	}
}

// OptIssuerProvince sets the subject province names.
func OptIssuerProvince(province ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.Province = province
		return nil
	}
}

// OptIssuerLocality sets the subject locality names.
func OptIssuerLocality(locality ...string) CertOption {
	return func(csr *CertOptions) error {
		csr.Issuer.Locality = locality
		return nil
	}
}