aboutsummaryrefslogtreecommitdiff
path: root/x509.go
diff options
context:
space:
mode:
authorRasmus Dahlberg <rasmus.dahlberg@kau.se>2020-11-05 12:31:34 +0100
committerRasmus Dahlberg <rasmus.dahlberg@kau.se>2020-11-05 12:31:34 +0100
commit0b9ce0c5e42e7818febddb7bd8c6b0cb7c07b012 (patch)
treec82df4051c9d94d15e54922bfd91094530c53688 /x509.go
parentcb8498119a0a3aaf34e09191e5e172173fdbc8ca (diff)
moved publlic x509 helpers into a separate package
Diffstat (limited to 'x509.go')
-rw-r--r--x509.go130
1 files changed, 3 insertions, 127 deletions
diff --git a/x509.go b/x509.go
index 7f74e93..c65043b 100644
--- a/x509.go
+++ b/x509.go
@@ -5,139 +5,15 @@ import (
"time"
"crypto"
- "crypto/ed25519"
"crypto/rand"
"crypto/tls"
"crypto/x509"
- "encoding/pem"
- "io/ioutil"
-)
-
-// LoadTrustAnchors loads a list of PEM-encoded certificates from file
-func LoadTrustAnchors(path string) ([]*x509.Certificate, *x509.CertPool, error) {
- rest, err := ioutil.ReadFile(path)
- if err != nil {
- return nil, nil, fmt.Errorf("failed reading trust anchors: %v", err)
- }
-
- pool := x509.NewCertPool()
- var anchors []*x509.Certificate
- for len(rest) > 0 {
- var block *pem.Block
- block, rest = pem.Decode(rest)
- if block == nil {
- break
- }
- if block.Type != "CERTIFICATE" {
- return nil, nil, fmt.Errorf("unexpected PEM block type: %s", block.Type)
- }
-
- certificate, err := x509.ParseCertificate(block.Bytes)
- if err != nil {
- return nil, nil, fmt.Errorf("invalid trust anchor before rest(%s): %v", rest, err)
- }
- anchors = append(anchors, certificate)
- pool.AddCert(certificate)
- }
-
- if len(anchors) == 0 {
- return nil, nil, fmt.Errorf("found no valid trust anchor in: %s", path)
- }
- return anchors, pool, nil
-}
-
-// LoadEd25519SigningKey loads an Ed25519 private key from a given path
-func LoadEd25519SigningKey(path string) (ed25519.PrivateKey, error) {
- data, err := ioutil.ReadFile(path)
- if err != nil {
- return nil, fmt.Errorf("failed reading private key: %v", err)
- }
- return ParseEd25519PrivateKey(data)
-}
-
-// ParseEd25519PrivateKey parses a PEM-encoded private key block
-func ParseEd25519PrivateKey(data []byte) (ed25519.PrivateKey, error) {
- block, rest := pem.Decode(data)
- if block == nil {
- return nil, fmt.Errorf("pem block: is empty")
- }
- if block.Type != "PRIVATE KEY" {
- return nil, fmt.Errorf("bad pem block type: %v", block.Type)
- }
- if len(rest) != 0 {
- return nil, fmt.Errorf("pem block: trailing data")
- }
-
- key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
- if err != nil {
- fmt.Errorf("x509 parser failed: %v", err)
- }
- switch t := key.(type) {
- case ed25519.PrivateKey:
- return key.(ed25519.PrivateKey), nil
- default:
- return nil, fmt.Errorf("unexpected signing key type: %v", t)
- }
-}
-
-// LoadChain loads a PEM-encoded certificate chain from a given path
-func LoadChain(path string) ([]*x509.Certificate, error) {
- blob, err := ioutil.ReadFile(path)
- if err != nil {
- return nil, fmt.Errorf("failed reading certificate chain: %v", err)
- }
- return ParseChain(blob)
-}
-
-// ParseChain parses a PEM-encoded certificate chain
-func ParseChain(rest []byte) ([]*x509.Certificate, error) {
- var chain []*x509.Certificate
- for len(rest) > 0 {
- var block *pem.Block
- block, rest = pem.Decode(rest)
- if block == nil {
- break
- }
- if block.Type != "CERTIFICATE" {
- return nil, fmt.Errorf("unexpected pem block type: %v", block.Type)
- }
-
- certificate, err := x509.ParseCertificate(block.Bytes)
- if err != nil {
- return nil, fmt.Errorf("failed parsing x509 certificate: %v", err)
- }
- chain = append(chain, certificate)
- }
- return chain, nil
-}
-
-// ParseDerChain parses a list of base64 DER-encoded X.509 certificates, such
-// that the first (zero-index) string is interpretted as an end-entity
-// certificate and the remaining ones as the an intermediate CertPool.
-func ParseDerChain(chain [][]byte) (*x509.Certificate, *x509.CertPool, error) {
- var certificate *x509.Certificate
- intermediatePool := x509.NewCertPool()
- for index, der := range chain {
- c, err := x509.ParseCertificate(der)
- if err != nil {
- return nil, nil, fmt.Errorf("certificate decoding failed: %v", err)
- }
-
- if index == 0 {
- certificate = c
- } else {
- intermediatePool.AddCert(c)
- }
- }
- if certificate == nil {
- return nil, nil, fmt.Errorf("certificate chain is empty")
- }
- return certificate, intermediatePool, nil
-}
+ "github.com/system-transparency/stfe/x509util"
+)
func (lp *LogParameters) buildChainFromDerList(derChain [][]byte) ([]*x509.Certificate, error) {
- certificate, intermediatePool, err := ParseDerChain(derChain)
+ certificate, intermediatePool, err := x509util.ParseDerChain(derChain)
if err != nil {
return nil, err
}