feat: add certificate service and utility functions

- Implement CertificateService for end-to-end certificate management
- Add support for various certificate types (web, client, email, etc.)
- Include certificate generation, validation, and revocation
- Add utility functions for certificate operations and validation
- Implement comprehensive test coverage for certificate operations
- Support SAN (Subject Alternative Name) and IP address extensions
- Add proper error handling and validation for certificate requests

certificate/certificate.go

@@ -0,0 +1,835 @@
+package certificate
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.secnex.io/secnex/certman/certificate/utils"
+	"git.secnex.io/secnex/certman/models"
+	"git.secnex.io/secnex/certman/repositories"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// CertificateService handles certificate operations
+type CertificateService struct {
+	certRepo   *repositories.CertificateRepository
+	caRepo     *repositories.CertificateAuthorityRepository
+	csrRepo    *repositories.CertificateRequestRepository
+	certDir    string
+	privateDir string
+	caService  *CertificateAuthorityService
+}
+
+// NewCertificateService creates a new certificate service
+func NewCertificateService(
+	db *gorm.DB,
+	certDir string,
+	privateDir string,
+	caService *CertificateAuthorityService,
+) *CertificateService {
+	return &CertificateService{
+		certRepo:   repositories.NewCertificateRepository(db),
+		caRepo:     repositories.NewCertificateAuthorityRepository(db),
+		csrRepo:    repositories.NewCertificateRequestRepository(db),
+		certDir:    certDir,
+		privateDir: privateDir,
+		caService:  caService,
+	}
+}
+
+// CreateCertificate creates a new certificate from a request
+func (s *CertificateService) CreateCertificate(req *CreateCertificateRequest) (*models.Certificate, error) {
+	// Validate request
+	if err := s.validateCreateCertificateRequest(req); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	// Get CA
+	ca, err := s.caRepo.GetByID(req.CertificateAuthorityID.String())
+	if err != nil {
+		return nil, fmt.Errorf("CA not found: %w", err)
+	}
+
+	// Load CA certificate and private key
+	caCert, caPrivateKey, err := s.caService.loadCACertificateAndKey(&ca)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load CA certificate: %w", err)
+	}
+
+	// Create certificate configuration (iOS-compatible by default for web certificates)
+	config := s.createCertificateConfig(req)
+	
+	// Ensure proper certificate configuration
+	config.SubjectKeyID = true
+	config.AuthorityKeyID = true
+
+	// Validate configuration
+	if err := utils.ValidateCertificateConfig(config); err != nil {
+		return nil, fmt.Errorf("invalid certificate configuration: %w", err)
+	}
+
+	// Generate certificate and private key
+	generator := utils.NewCertificateGenerator(config)
+	cert, privateKey, err := generator.GenerateCertificate(caCert, caPrivateKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate certificate: %w", err)
+	}
+
+	// Save certificate and private key to files
+	certFileID, err := s.saveCertificate(cert, req.Type)
+	if err != nil {
+		return nil, fmt.Errorf("failed to save certificate: %w", err)
+	}
+
+	privateKeyFileID, err := s.savePrivateKey(privateKey, req.Type)
+	if err != nil {
+		return nil, fmt.Errorf("failed to save private key: %w", err)
+	}
+
+	// Create certificate model
+	certModel := &models.Certificate{
+		Name:                            req.Name,
+		Description:                     req.Description,
+		SerialNumber:                    cert.SerialNumber.String(),
+		AttributeCommonName:             cert.Subject.CommonName,
+		AttributeSubjectAlternativeName: s.formatSANs(cert.DNSNames, cert.IPAddresses, cert.EmailAddresses, cert.URIs),
+		AttributeOrganization:           cert.Subject.Organization[0],
+		AttributeOrganizationUnit:       cert.Subject.OrganizationalUnit[0],
+		AttributeCountry:                cert.Subject.Country[0],
+		AttributeState:                  cert.Subject.Province[0],
+		AttributeLocality:               cert.Subject.Locality[0],
+		AttributeStreet:                 cert.Subject.StreetAddress[0],
+		AttributeEmail:                  req.Email,
+		AttributeAddress:                req.Address,
+		AttributePostalCode:             cert.Subject.PostalCode[0],
+		AttributeNotBefore:              cert.NotBefore,
+		AttributeNotAfter:               cert.NotAfter,
+		Type:                            req.Type,
+		Status:                          models.CertificateStatusActive,
+		CertificateAuthorityID:          req.CertificateAuthorityID,
+		RequestID:                       req.RequestID,
+		FileID:                          certFileID,
+		PrivateKeyID:                    privateKeyFileID,
+		Generated:                       true,
+		GeneratedAt:                     &time.Time{},
+	}
+
+	// Set generated time
+	now := time.Now()
+	certModel.GeneratedAt = &now
+
+	// Save to database
+	if err := s.certRepo.Create(*certModel); err != nil {
+		// Clean up files if database save fails
+		s.cleanupFiles(certFileID, privateKeyFileID)
+		return nil, fmt.Errorf("failed to save certificate to database: %w", err)
+	}
+
+	return certModel, nil
+}
+
+// CreateCertificateFromCSR creates a certificate from a Certificate Signing Request
+func (s *CertificateService) CreateCertificateFromCSR(req *CreateCertificateFromCSRRequest) (*models.Certificate, error) {
+	// Validate request
+	if err := s.validateCreateCertificateFromCSRRequest(req); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	// Get CSR
+	csr, err := s.csrRepo.GetByID(req.CSRID.String())
+	if err != nil {
+		return nil, fmt.Errorf("CSR not found: %w", err)
+	}
+
+	// Get CA
+	ca, err := s.caRepo.GetByID(req.CertificateAuthorityID.String())
+	if err != nil {
+		return nil, fmt.Errorf("CA not found: %w", err)
+	}
+
+	// Load CA certificate and private key
+	caCert, caPrivateKey, err := s.caService.loadCACertificateAndKey(&ca)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load CA certificate: %w", err)
+	}
+
+	// Parse CSR
+	csrParsed, err := x509.ParseCertificateRequest(csr.CSRData)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse CSR: %w", err)
+	}
+
+	// Create certificate configuration from CSR
+	config := s.createCertificateConfigFromCSR(req, csrParsed)
+
+	// Validate configuration
+	if err := utils.ValidateCertificateConfig(config); err != nil {
+		return nil, fmt.Errorf("invalid certificate configuration: %w", err)
+	}
+
+	// Generate certificate
+	generator := utils.NewCertificateGenerator(config)
+	cert, privateKey, err := generator.GenerateCertificate(caCert, caPrivateKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate certificate: %w", err)
+	}
+
+	// Save certificate and private key to files
+	certFileID, err := s.saveCertificate(cert, req.Type)
+	if err != nil {
+		return nil, fmt.Errorf("failed to save certificate: %w", err)
+	}
+
+	privateKeyFileID, err := s.savePrivateKey(privateKey, req.Type)
+	if err != nil {
+		return nil, fmt.Errorf("failed to save private key: %w", err)
+	}
+
+	// Create certificate model
+	certModel := &models.Certificate{
+		Name:                            req.Name,
+		Description:                     req.Description,
+		SerialNumber:                    cert.SerialNumber.String(),
+		AttributeCommonName:             cert.Subject.CommonName,
+		AttributeSubjectAlternativeName: s.formatSANs(cert.DNSNames, cert.IPAddresses, cert.EmailAddresses, cert.URIs),
+		AttributeOrganization:           cert.Subject.Organization[0],
+		AttributeOrganizationUnit:       cert.Subject.OrganizationalUnit[0],
+		AttributeCountry:                cert.Subject.Country[0],
+		AttributeState:                  cert.Subject.Province[0],
+		AttributeLocality:               cert.Subject.Locality[0],
+		AttributeStreet:                 cert.Subject.StreetAddress[0],
+		AttributeEmail:                  "",
+		AttributeAddress:                "",
+		AttributePostalCode:             cert.Subject.PostalCode[0],
+		AttributeNotBefore:              cert.NotBefore,
+		AttributeNotAfter:               cert.NotAfter,
+		Type:                            req.Type,
+		Status:                          models.CertificateStatusActive,
+		CertificateAuthorityID:          req.CertificateAuthorityID,
+		RequestID:                       &req.CSRID,
+		FileID:                          certFileID,
+		PrivateKeyID:                    privateKeyFileID,
+		Generated:                       true,
+		GeneratedAt:                     &time.Time{},
+	}
+
+	// Set generated time
+	now := time.Now()
+	certModel.GeneratedAt = &now
+
+	// Save to database
+	if err := s.certRepo.Create(*certModel); err != nil {
+		// Clean up files if database save fails
+		s.cleanupFiles(certFileID, privateKeyFileID)
+		return nil, fmt.Errorf("failed to save certificate to database: %w", err)
+	}
+
+	return certModel, nil
+}
+
+// GetCertificate retrieves a certificate by ID
+func (s *CertificateService) GetCertificate(id string) (*models.Certificate, error) {
+	cert, err := s.certRepo.GetByID(id)
+	if err != nil {
+		return nil, fmt.Errorf("certificate not found: %w", err)
+	}
+	return &cert, nil
+}
+
+// GetAllCertificates retrieves all certificates
+func (s *CertificateService) GetAllCertificates() ([]models.Certificate, error) {
+	certs, err := s.certRepo.GetAll()
+	if err != nil {
+		return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
+	}
+	return certs, nil
+}
+
+// GetCertificatesByType retrieves certificates by type
+func (s *CertificateService) GetCertificatesByType(certType models.CertificateType) ([]models.Certificate, error) {
+	certs, err := s.certRepo.GetAll()
+	if err != nil {
+		return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
+	}
+
+	var filteredCerts []models.Certificate
+	for _, cert := range certs {
+		if cert.Type == certType {
+			filteredCerts = append(filteredCerts, cert)
+		}
+	}
+
+	return filteredCerts, nil
+}
+
+// GetCertificatesByCA retrieves certificates issued by a specific CA
+func (s *CertificateService) GetCertificatesByCA(caID string) ([]models.Certificate, error) {
+	certs, err := s.certRepo.GetAll()
+	if err != nil {
+		return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
+	}
+
+	var filteredCerts []models.Certificate
+	for _, cert := range certs {
+		if cert.CertificateAuthorityID.String() == caID {
+			filteredCerts = append(filteredCerts, cert)
+		}
+	}
+
+	return filteredCerts, nil
+}
+
+// GetCertificateFile retrieves the certificate file
+func (s *CertificateService) GetCertificateFile(certID string) (*x509.Certificate, error) {
+	cert, err := s.certRepo.GetByID(certID)
+	if err != nil {
+		return nil, fmt.Errorf("certificate not found: %w", err)
+	}
+
+	certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", cert.FileID))
+	certPEM, err := os.ReadFile(certPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read certificate file: %w", err)
+	}
+
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode certificate PEM")
+	}
+
+	certParsed, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse certificate: %w", err)
+	}
+
+	return certParsed, nil
+}
+
+// GetPrivateKeyFile retrieves the private key file
+func (s *CertificateService) GetPrivateKeyFile(certID string) (interface{}, error) {
+	cert, err := s.certRepo.GetByID(certID)
+	if err != nil {
+		return nil, fmt.Errorf("certificate not found: %w", err)
+	}
+
+	keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", cert.PrivateKeyID))
+	keyPEM, err := os.ReadFile(keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read private key file: %w", err)
+	}
+
+	block, _ := pem.Decode(keyPEM)
+	if block == nil {
+		return nil, fmt.Errorf("failed to decode private key PEM")
+	}
+
+	var privateKey interface{}
+	switch block.Type {
+	case "RSA PRIVATE KEY":
+		privateKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
+	case "EC PRIVATE KEY":
+		privateKey, err = x509.ParseECPrivateKey(block.Bytes)
+	default:
+		return nil, fmt.Errorf("unsupported private key type: %s", block.Type)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse private key: %w", err)
+	}
+
+	return privateKey, nil
+}
+
+// UpdateCertificate updates a certificate
+func (s *CertificateService) UpdateCertificate(cert *models.Certificate) error {
+	return s.certRepo.Update(*cert)
+}
+
+// RevokeCertificate revokes a certificate
+func (s *CertificateService) RevokeCertificate(certID string, reason string) error {
+	cert, err := s.certRepo.GetByID(certID)
+	if err != nil {
+		return fmt.Errorf("certificate not found: %w", err)
+	}
+
+	// Update certificate with revocation information
+	cert.Status = models.CertificateStatusRevoked
+	cert.RevocationReason = reason
+	now := time.Now()
+	cert.RevokedAt = &now
+
+	if err := s.certRepo.Update(cert); err != nil {
+		return fmt.Errorf("failed to revoke certificate: %w", err)
+	}
+
+	return nil
+}
+
+// DeleteCertificate deletes a certificate
+func (s *CertificateService) DeleteCertificate(certID string) error {
+	cert, err := s.certRepo.GetByID(certID)
+	if err != nil {
+		return fmt.Errorf("certificate not found: %w", err)
+	}
+
+	// Delete from database
+	if err := s.certRepo.Delete(certID); err != nil {
+		return fmt.Errorf("failed to delete certificate from database: %w", err)
+	}
+
+	// Clean up files
+	s.cleanupFiles(cert.FileID, cert.PrivateKeyID)
+
+	return nil
+}
+
+// ValidateCertificate validates a certificate
+func (s *CertificateService) ValidateCertificate(certID string) error {
+	cert, err := s.certRepo.GetByID(certID)
+	if err != nil {
+		return fmt.Errorf("certificate not found: %w", err)
+	}
+
+	// Load certificate
+	certParsed, err := s.GetCertificateFile(certID)
+	if err != nil {
+		return fmt.Errorf("failed to load certificate: %w", err)
+	}
+
+	// Check validity period
+	now := time.Now()
+	if now.Before(certParsed.NotBefore) {
+		return fmt.Errorf("certificate is not yet valid")
+	}
+	if now.After(certParsed.NotAfter) {
+		return fmt.Errorf("certificate has expired")
+	}
+
+	// Check status
+	if cert.Status == models.CertificateStatusRevoked {
+		return fmt.Errorf("certificate has been revoked: %s", cert.RevocationReason)
+	}
+
+	return nil
+}
+
+// ExportCertificate exports a certificate in various formats
+func (s *CertificateService) ExportCertificate(certID string, format string) ([]byte, error) {
+	certParsed, err := s.GetCertificateFile(certID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load certificate: %w", err)
+	}
+
+	exporter := utils.NewCertificateExporter()
+
+	switch format {
+	case "pem":
+		return exporter.ExportCertificateToPEM(certParsed)
+	case "der":
+		return exporter.ExportCertificateToDER(certParsed), nil
+	default:
+		return nil, fmt.Errorf("unsupported export format: %s", format)
+	}
+}
+
+// ExportPrivateKey exports a private key in various formats
+func (s *CertificateService) ExportPrivateKey(certID string, format string) ([]byte, error) {
+	privateKey, err := s.GetPrivateKeyFile(certID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load private key: %w", err)
+	}
+
+	exporter := utils.NewCertificateExporter()
+
+	switch format {
+	case "pem":
+		return exporter.ExportPrivateKeyToPEM(privateKey)
+	case "der":
+		return exporter.ExportPrivateKeyToDER(privateKey)
+	default:
+		return nil, fmt.Errorf("unsupported export format: %s", format)
+	}
+}
+
+// Helper methods
+
+// createCertificateConfig creates a certificate configuration from a request
+func (s *CertificateService) createCertificateConfig(req *CreateCertificateRequest) *utils.CertificateConfig {
+	config := utils.DefaultCertificateConfig(req.Type)
+
+	// Set basic information
+	config.CommonName = req.CommonName
+	config.Organization = req.Organization
+	config.OrganizationalUnit = req.OrganizationalUnit
+	config.Country = req.Country
+	config.State = req.State
+	config.Locality = req.Locality
+	config.Street = req.Street
+	config.PostalCode = req.PostalCode
+	config.Email = req.Email
+
+	// Set validity period
+	if req.NotBefore != nil {
+		config.NotBefore = *req.NotBefore
+	}
+	if req.NotAfter != nil {
+		config.NotAfter = *req.NotAfter
+	}
+	if req.ValidityYears > 0 {
+		config.ValidityYears = req.ValidityYears
+		config.NotAfter = config.NotBefore.AddDate(req.ValidityYears, 0, 0)
+	}
+
+	// Set SANs
+	config.DNSNames = req.DNSNames
+	config.IPAddresses = req.IPAddresses
+	config.EmailAddresses = req.EmailAddresses
+	config.URIs = req.URIs
+
+	// Set key configuration
+	if req.KeyType != "" {
+		config.KeyType = utils.KeyType(req.KeyType)
+	}
+	if req.KeySize != 0 {
+		config.KeySize = utils.KeySize(req.KeySize)
+	}
+	if req.Curve != "" {
+		config.Curve = utils.Curve(req.Curve)
+	}
+
+	// Set custom key usage and extended key usage
+	if req.KeyUsage != nil {
+		config.DigitalSignature = req.KeyUsage.DigitalSignature
+		config.ContentCommitment = req.KeyUsage.ContentCommitment
+		config.KeyEncipherment = req.KeyUsage.KeyEncipherment
+		config.DataEncipherment = req.KeyUsage.DataEncipherment
+		config.KeyAgreement = req.KeyUsage.KeyAgreement
+		config.KeyCertSign = req.KeyUsage.KeyCertSign
+		config.CRLSign = req.KeyUsage.CRLSign
+		config.EncipherOnly = req.KeyUsage.EncipherOnly
+		config.DecipherOnly = req.KeyUsage.DecipherOnly
+	}
+
+	if req.ExtendedKeyUsage != nil {
+		config.ServerAuth = req.ExtendedKeyUsage.ServerAuth
+		config.ClientAuth = req.ExtendedKeyUsage.ClientAuth
+		config.CodeSigning = req.ExtendedKeyUsage.CodeSigning
+		config.EmailProtection = req.ExtendedKeyUsage.EmailProtection
+		config.TimeStamping = req.ExtendedKeyUsage.TimeStamping
+		config.OCSPSigning = req.ExtendedKeyUsage.OCSPSigning
+	}
+
+	return config
+}
+
+// createCertificateConfigFromCSR creates a certificate configuration from a CSR
+func (s *CertificateService) createCertificateConfigFromCSR(req *CreateCertificateFromCSRRequest, csr *x509.CertificateRequest) *utils.CertificateConfig {
+	config := utils.DefaultCertificateConfig(req.Type)
+
+	// Set basic information from CSR
+	config.CommonName = csr.Subject.CommonName
+	if len(csr.Subject.Organization) > 0 {
+		config.Organization = csr.Subject.Organization[0]
+	}
+	if len(csr.Subject.OrganizationalUnit) > 0 {
+		config.OrganizationalUnit = csr.Subject.OrganizationalUnit[0]
+	}
+	if len(csr.Subject.Country) > 0 {
+		config.Country = csr.Subject.Country[0]
+	}
+	if len(csr.Subject.Province) > 0 {
+		config.State = csr.Subject.Province[0]
+	}
+	if len(csr.Subject.Locality) > 0 {
+		config.Locality = csr.Subject.Locality[0]
+	}
+	if len(csr.Subject.StreetAddress) > 0 {
+		config.Street = csr.Subject.StreetAddress[0]
+	}
+	if len(csr.Subject.PostalCode) > 0 {
+		config.PostalCode = csr.Subject.PostalCode[0]
+	}
+
+	// Set validity period
+	if req.NotBefore != nil {
+		config.NotBefore = *req.NotBefore
+	}
+	if req.NotAfter != nil {
+		config.NotAfter = *req.NotAfter
+	}
+	if req.ValidityYears > 0 {
+		config.ValidityYears = req.ValidityYears
+		config.NotAfter = config.NotBefore.AddDate(req.ValidityYears, 0, 0)
+	}
+
+	// Set SANs from CSR
+	config.DNSNames = csr.DNSNames
+	config.IPAddresses = csr.IPAddresses
+	config.EmailAddresses = csr.EmailAddresses
+	config.URIs = s.parseURIsFromCSR(csr.URIs)
+
+	// Set key configuration
+	if req.KeyType != "" {
+		config.KeyType = utils.KeyType(req.KeyType)
+	}
+	if req.KeySize != 0 {
+		config.KeySize = utils.KeySize(req.KeySize)
+	}
+	if req.Curve != "" {
+		config.Curve = utils.Curve(req.Curve)
+	}
+
+	// Set custom key usage and extended key usage
+	if req.KeyUsage != nil {
+		config.DigitalSignature = req.KeyUsage.DigitalSignature
+		config.ContentCommitment = req.KeyUsage.ContentCommitment
+		config.KeyEncipherment = req.KeyUsage.KeyEncipherment
+		config.DataEncipherment = req.KeyUsage.DataEncipherment
+		config.KeyAgreement = req.KeyUsage.KeyAgreement
+		config.KeyCertSign = req.KeyUsage.KeyCertSign
+		config.CRLSign = req.KeyUsage.CRLSign
+		config.EncipherOnly = req.KeyUsage.EncipherOnly
+		config.DecipherOnly = req.KeyUsage.DecipherOnly
+	}
+
+	if req.ExtendedKeyUsage != nil {
+		config.ServerAuth = req.ExtendedKeyUsage.ServerAuth
+		config.ClientAuth = req.ExtendedKeyUsage.ClientAuth
+		config.CodeSigning = req.ExtendedKeyUsage.CodeSigning
+		config.EmailProtection = req.ExtendedKeyUsage.EmailProtection
+		config.TimeStamping = req.ExtendedKeyUsage.TimeStamping
+		config.OCSPSigning = req.ExtendedKeyUsage.OCSPSigning
+	}
+
+	return config
+}
+
+// formatSANs formats SANs for storage
+func (s *CertificateService) formatSANs(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) string {
+	var sans []string
+
+	for _, dns := range dnsNames {
+		sans = append(sans, dns)
+	}
+
+	for _, ip := range ipAddresses {
+		sans = append(sans, ip.String())
+	}
+
+	for _, email := range emailAddresses {
+		sans = append(sans, email)
+	}
+
+	for _, uri := range uris {
+		sans = append(sans, uri.String())
+	}
+
+	return strings.Join(sans, ",")
+}
+
+// parseURIsFromCSR parses URIs from CSR
+func (s *CertificateService) parseURIsFromCSR(uris []*url.URL) []string {
+	var uriStrings []string
+	for _, uri := range uris {
+		uriStrings = append(uriStrings, uri.String())
+	}
+	return uriStrings
+}
+
+// saveCertificate saves a certificate to a file and returns the file ID
+func (s *CertificateService) saveCertificate(cert *x509.Certificate, certType models.CertificateType) (string, error) {
+	// Create certificate directory if it doesn't exist
+	if err := os.MkdirAll(s.certDir, 0755); err != nil {
+		return "", fmt.Errorf("failed to create certificate directory: %w", err)
+	}
+
+	// Generate file ID
+	fileID := fmt.Sprintf("%s-%s", certType, uuid.New().String())
+
+	// Export certificate to PEM
+	exporter := utils.NewCertificateExporter()
+	certPEM, err := exporter.ExportCertificateToPEM(cert)
+	if err != nil {
+		return "", fmt.Errorf("failed to export certificate to PEM: %w", err)
+	}
+
+	// Save to file
+	certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", fileID))
+	if err := os.WriteFile(certPath, certPEM, 0644); err != nil {
+		return "", fmt.Errorf("failed to write certificate file: %w", err)
+	}
+
+	return fileID, nil
+}
+
+// savePrivateKey saves a private key to a file and returns the file ID
+func (s *CertificateService) savePrivateKey(privateKey interface{}, certType models.CertificateType) (string, error) {
+	// Create private key directory if it doesn't exist
+	if err := os.MkdirAll(s.privateDir, 0700); err != nil {
+		return "", fmt.Errorf("failed to create private key directory: %w", err)
+	}
+
+	// Generate file ID
+	fileID := fmt.Sprintf("%s-%s", certType, uuid.New().String())
+
+	// Export private key to PEM
+	exporter := utils.NewCertificateExporter()
+	keyPEM, err := exporter.ExportPrivateKeyToPEM(privateKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to export private key to PEM: %w", err)
+	}
+
+	// Save to file
+	keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", fileID))
+	if err := os.WriteFile(keyPath, keyPEM, 0600); err != nil {
+		return "", fmt.Errorf("failed to write private key file: %w", err)
+	}
+
+	return fileID, nil
+}
+
+// cleanupFiles removes certificate and private key files
+func (s *CertificateService) cleanupFiles(certFileID, privateKeyFileID string) {
+	if certFileID != "" {
+		certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", certFileID))
+		os.Remove(certPath)
+	}
+
+	if privateKeyFileID != "" {
+		keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", privateKeyFileID))
+		os.Remove(keyPath)
+	}
+}
+
+// validateCreateCertificateRequest validates a certificate creation request
+func (s *CertificateService) validateCreateCertificateRequest(req *CreateCertificateRequest) error {
+	if req.Name == "" {
+		return fmt.Errorf("name is required")
+	}
+	if req.CommonName == "" {
+		return fmt.Errorf("common name is required")
+	}
+	if req.Organization == "" {
+		return fmt.Errorf("organization is required")
+	}
+	if req.Country == "" {
+		return fmt.Errorf("country is required")
+	}
+	if req.CertificateAuthorityID == uuid.Nil {
+		return fmt.Errorf("certificate authority ID is required")
+	}
+	return nil
+}
+
+// validateCreateCertificateFromCSRRequest validates a certificate creation from CSR request
+func (s *CertificateService) validateCreateCertificateFromCSRRequest(req *CreateCertificateFromCSRRequest) error {
+	if req.Name == "" {
+		return fmt.Errorf("name is required")
+	}
+	if req.CSRID == uuid.Nil {
+		return fmt.Errorf("CSR ID is required")
+	}
+	if req.CertificateAuthorityID == uuid.Nil {
+		return fmt.Errorf("certificate authority ID is required")
+	}
+	return nil
+}
+
+// Request structures
+
+// CreateCertificateRequest represents a request to create a certificate
+type CreateCertificateRequest struct {
+	Name                   string
+	Description            string
+	CommonName             string
+	Organization           string
+	OrganizationalUnit     string
+	Country                string
+	State                  string
+	Locality               string
+	Street                 string
+	Address                string
+	PostalCode             string
+	Email                  string
+	Type                   models.CertificateType
+	CertificateAuthorityID uuid.UUID
+	RequestID              *uuid.UUID
+
+	// Validity period
+	NotBefore     *time.Time
+	NotAfter      *time.Time
+	ValidityYears int // Custom validity period in years (overrides NotAfter if set)
+
+	// Subject Alternative Names
+	DNSNames       []string
+	IPAddresses    []net.IP
+	EmailAddresses []string
+	URIs           []string
+
+	// Key configuration
+	KeyType string // "rsa" or "ecdsa"
+	KeySize int    // RSA key size (2048, 3072, 4096)
+	Curve   string // ECDSA curve ("P-256", "P-384", "P-521")
+
+	// Custom key usage
+	KeyUsage *KeyUsageConfig
+
+	// Custom extended key usage
+	ExtendedKeyUsage *ExtendedKeyUsageConfig
+}
+
+// CreateCertificateFromCSRRequest represents a request to create a certificate from a CSR
+type CreateCertificateFromCSRRequest struct {
+	Name                   string
+	Description            string
+	Type                   models.CertificateType
+	CSRID                  uuid.UUID
+	CertificateAuthorityID uuid.UUID
+
+	// Validity period
+	NotBefore     *time.Time
+	NotAfter      *time.Time
+	ValidityYears int // Custom validity period in years (overrides NotAfter if set)
+
+	// Key configuration
+	KeyType string // "rsa" or "ecdsa"
+	KeySize int    // RSA key size (2048, 3072, 4096)
+	Curve   string // ECDSA curve ("P-256", "P-384", "P-521")
+
+	// Custom key usage
+	KeyUsage *KeyUsageConfig
+
+	// Custom extended key usage
+	ExtendedKeyUsage *ExtendedKeyUsageConfig
+}
+
+// KeyUsageConfig represents key usage configuration
+type KeyUsageConfig struct {
+	DigitalSignature  bool
+	ContentCommitment bool
+	KeyEncipherment   bool
+	DataEncipherment  bool
+	KeyAgreement      bool
+	KeyCertSign       bool
+	CRLSign           bool
+	EncipherOnly      bool
+	DecipherOnly      bool
+}
+
+// ExtendedKeyUsageConfig represents extended key usage configuration
+type ExtendedKeyUsageConfig struct {
+	ServerAuth      bool
+	ClientAuth      bool
+	CodeSigning     bool
+	EmailProtection bool
+	TimeStamping    bool
+	OCSPSigning     bool
+}

certificate/certificate_test.go

@@ -0,0 +1,403 @@
+package certificate
+
+import (
+	"net"
+	"testing"
+	"time"
+
+	"git.secnex.io/secnex/certman/models"
+	"github.com/google/uuid"
+)
+
+func TestCreateCertificateRequest(t *testing.T) {
+	service := &CertificateService{}
+
+	tests := []struct {
+		name    string
+		req     *CreateCertificateRequest
+		wantErr bool
+	}{
+		{
+			name: "valid web certificate request",
+			req: &CreateCertificateRequest{
+				Name:                   "Test Web Certificate",
+				CommonName:             "example.com",
+				Organization:           "Test Org",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid client certificate request",
+			req: &CreateCertificateRequest{
+				Name:                   "Test Client Certificate",
+				CommonName:             "user@example.com",
+				Organization:           "Test Org",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeClient,
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid IoT certificate request",
+			req: &CreateCertificateRequest{
+				Name:                   "Test IoT Certificate",
+				CommonName:             "device.example.com",
+				Organization:           "Test Org",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeIoT,
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing name",
+			req: &CreateCertificateRequest{
+				CommonName:             "example.com",
+				Organization:           "Test Org",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing common name",
+			req: &CreateCertificateRequest{
+				Name:                   "Test Certificate",
+				Organization:           "Test Org",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing organization",
+			req: &CreateCertificateRequest{
+				Name:                   "Test Certificate",
+				CommonName:             "example.com",
+				Country:                "DE",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing country",
+			req: &CreateCertificateRequest{
+				Name:                   "Test Certificate",
+				CommonName:             "example.com",
+				Organization:           "Test Org",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing CA ID",
+			req: &CreateCertificateRequest{
+				Name:         "Test Certificate",
+				CommonName:   "example.com",
+				Organization: "Test Org",
+				Country:      "DE",
+				Type:         models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := service.validateCreateCertificateRequest(test.req)
+			if (err != nil) != test.wantErr {
+				t.Errorf("validateCreateCertificateRequest() error = %v, wantErr %v", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestCreateCertificateFromCSRRequest(t *testing.T) {
+	service := &CertificateService{}
+
+	tests := []struct {
+		name    string
+		req     *CreateCertificateFromCSRRequest
+		wantErr bool
+	}{
+		{
+			name: "valid CSR request",
+			req: &CreateCertificateFromCSRRequest{
+				Name:                   "Test Certificate from CSR",
+				CSRID:                  uuid.New(),
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing name",
+			req: &CreateCertificateFromCSRRequest{
+				CSRID:                  uuid.New(),
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing CSR ID",
+			req: &CreateCertificateFromCSRRequest{
+				Name:                   "Test Certificate from CSR",
+				CertificateAuthorityID: uuid.New(),
+				Type:                   models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing CA ID",
+			req: &CreateCertificateFromCSRRequest{
+				Name:  "Test Certificate from CSR",
+				CSRID: uuid.New(),
+				Type:  models.CertificateTypeWeb,
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := service.validateCreateCertificateFromCSRRequest(test.req)
+			if (err != nil) != test.wantErr {
+				t.Errorf("validateCreateCertificateFromCSRRequest() error = %v, wantErr %v", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestCertificateRequestStructures(t *testing.T) {
+	// Test CreateCertificateRequest structure
+	req := &CreateCertificateRequest{
+		Name:                   "Test Certificate",
+		Description:            "Test Description",
+		CommonName:             "test.example.com",
+		Organization:           "Test Organization",
+		OrganizationalUnit:     "Test Unit",
+		Country:                "DE",
+		State:                  "Bavaria",
+		Locality:               "Munich",
+		Street:                 "Test Street",
+		Address:                "Test Address",
+		PostalCode:             "80331",
+		Email:                  "test@example.com",
+		Type:                   models.CertificateTypeWeb,
+		CertificateAuthorityID: uuid.New(),
+		NotAfter:               func() *time.Time { t := time.Now().AddDate(1, 0, 0); return &t }(),
+		DNSNames:               []string{"test.example.com", "www.test.example.com"},
+		IPAddresses:            []net.IP{net.ParseIP("192.168.1.1")},
+		EmailAddresses:         []string{"test@example.com"},
+		URIs:                   []string{"https://test.example.com"},
+		KeyType:                "rsa",
+		KeySize:                2048,
+		Curve:                  "P-256",
+		KeyUsage: &KeyUsageConfig{
+			DigitalSignature: true,
+			KeyEncipherment:  true,
+		},
+		ExtendedKeyUsage: &ExtendedKeyUsageConfig{
+			ServerAuth: true,
+		},
+	}
+
+	if req.Name == "" {
+		t.Error("Certificate request name should not be empty")
+	}
+	if req.CommonName == "" {
+		t.Error("Certificate request common name should not be empty")
+	}
+	if req.CertificateAuthorityID == uuid.Nil {
+		t.Error("Certificate request CA ID should not be nil")
+	}
+	if req.Type == "" {
+		t.Error("Certificate request type should not be empty")
+	}
+	if len(req.DNSNames) == 0 {
+		t.Error("Certificate request should have DNS names")
+	}
+	if len(req.IPAddresses) == 0 {
+		t.Error("Certificate request should have IP addresses")
+	}
+	if req.KeyUsage == nil {
+		t.Error("Certificate request should have key usage")
+	}
+	if req.ExtendedKeyUsage == nil {
+		t.Error("Certificate request should have extended key usage")
+	}
+}
+
+func TestKeyUsageConfig(t *testing.T) {
+	keyUsage := &KeyUsageConfig{
+		DigitalSignature: true,
+		KeyEncipherment:  true,
+	}
+
+	if !keyUsage.DigitalSignature {
+		t.Error("Digital signature should be enabled")
+	}
+	if !keyUsage.KeyEncipherment {
+		t.Error("Key encipherment should be enabled")
+	}
+}
+
+func TestExtendedKeyUsageConfig(t *testing.T) {
+	extKeyUsage := &ExtendedKeyUsageConfig{
+		ServerAuth: true,
+		ClientAuth: false,
+	}
+
+	if !extKeyUsage.ServerAuth {
+		t.Error("Server auth should be enabled")
+	}
+	if extKeyUsage.ClientAuth {
+		t.Error("Client auth should be disabled")
+	}
+}
+
+func TestCertificateServiceCreation(t *testing.T) {
+	// Test that we can create a service instance
+	service := NewCertificateService(nil, "/tmp/certs", "/tmp/private", nil)
+
+	if service == nil {
+		t.Error("CertificateService should not be nil")
+	}
+
+	if service.certDir != "/tmp/certs" {
+		t.Errorf("Expected certDir to be /tmp/certs, got %s", service.certDir)
+	}
+
+	if service.privateDir != "/tmp/private" {
+		t.Errorf("Expected privateDir to be /tmp/private, got %s", service.privateDir)
+	}
+}
+
+func TestCertificateTypes(t *testing.T) {
+	// Test that all certificate types are defined
+	certTypes := []models.CertificateType{
+		models.CertificateTypeWeb,
+		models.CertificateTypeServer,
+		models.CertificateTypeClient,
+		models.CertificateTypeUser,
+		models.CertificateTypeEmail,
+		models.CertificateTypeCode,
+		models.CertificateTypeCA,
+		models.CertificateTypeIoT,
+		models.CertificateTypeDevice,
+		models.CertificateTypeSensor,
+		models.CertificateTypeVPN,
+		models.CertificateTypeOpenVPN,
+		models.CertificateTypeWireGuard,
+		models.CertificateTypeDatabase,
+		models.CertificateTypeMySQL,
+		models.CertificateTypePostgreSQL,
+		models.CertificateTypeMongoDB,
+		models.CertificateTypeAPI,
+		models.CertificateTypeService,
+		models.CertificateTypeMicroservice,
+		models.CertificateTypeDocker,
+		models.CertificateTypeKubernetes,
+		models.CertificateTypeContainer,
+		models.CertificateTypeCloud,
+		models.CertificateTypeAWS,
+		models.CertificateTypeAzure,
+		models.CertificateTypeGCP,
+		models.CertificateTypeNetwork,
+		models.CertificateTypeFirewall,
+		models.CertificateTypeProxy,
+		models.CertificateTypeLoadBalancer,
+		models.CertificateTypeMobile,
+		models.CertificateTypeAndroid,
+		models.CertificateTypeiOS,
+		models.CertificateTypeApp,
+		models.CertificateTypeDocument,
+		models.CertificateTypePDF,
+		models.CertificateTypeOffice,
+		models.CertificateTypeTimestamp,
+		models.CertificateTypeOCSP,
+		models.CertificateTypeCustom,
+		models.CertificateTypeSpecial,
+	}
+
+	for _, certType := range certTypes {
+		if certType == "" {
+			t.Errorf("Certificate type should not be empty")
+		}
+	}
+}
+
+func TestCertificateTypeCategories(t *testing.T) {
+	// Test web certificates
+	webTypes := []models.CertificateType{
+		models.CertificateTypeWeb,
+		models.CertificateTypeServer,
+	}
+
+	for _, certType := range webTypes {
+		if certType == "" {
+			t.Errorf("Web certificate type should not be empty: %s", certType)
+		}
+	}
+
+	// Test client certificates
+	clientTypes := []models.CertificateType{
+		models.CertificateTypeClient,
+		models.CertificateTypeUser,
+	}
+
+	for _, certType := range clientTypes {
+		if certType == "" {
+			t.Errorf("Client certificate type should not be empty: %s", certType)
+		}
+	}
+
+	// Test IoT certificates
+	iotTypes := []models.CertificateType{
+		models.CertificateTypeIoT,
+		models.CertificateTypeDevice,
+		models.CertificateTypeSensor,
+	}
+
+	for _, certType := range iotTypes {
+		if certType == "" {
+			t.Errorf("IoT certificate type should not be empty: %s", certType)
+		}
+	}
+
+	// Test VPN certificates
+	vpnTypes := []models.CertificateType{
+		models.CertificateTypeVPN,
+		models.CertificateTypeOpenVPN,
+		models.CertificateTypeWireGuard,
+	}
+
+	for _, certType := range vpnTypes {
+		if certType == "" {
+			t.Errorf("VPN certificate type should not be empty: %s", certType)
+		}
+	}
+
+	// Test database certificates
+	dbTypes := []models.CertificateType{
+		models.CertificateTypeDatabase,
+		models.CertificateTypeMySQL,
+		models.CertificateTypePostgreSQL,
+		models.CertificateTypeMongoDB,
+	}
+
+	for _, certType := range dbTypes {
+		if certType == "" {
+			t.Errorf("Database certificate type should not be empty: %s", certType)
+		}
+	}
+}

certificate/utils/certificate.go

@@ -0,0 +1,783 @@
+package utils
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"net"
+	"net/url"
+	"strings"
+	"time"
+
+	"git.secnex.io/secnex/certman/models"
+)
+
+// KeyType represents the type of cryptographic key
+type KeyType string
+
+const (
+	KeyTypeRSA   KeyType = "rsa"
+	KeyTypeECDSA KeyType = "ecdsa"
+)
+
+// KeySize represents the size of RSA keys
+type KeySize int
+
+const (
+	KeySize2048 KeySize = 2048
+	KeySize3072 KeySize = 3072
+	KeySize4096 KeySize = 4096
+)
+
+// Curve represents ECDSA curves
+type Curve string
+
+const (
+	CurveP256 Curve = "P-256"
+	CurveP384 Curve = "P-384"
+	CurveP521 Curve = "P-521"
+)
+
+// CertificateConfig holds configuration for certificate generation
+type CertificateConfig struct {
+	// Basic Information
+	CommonName         string
+	Organization       string
+	OrganizationalUnit string
+	Country            string
+	State              string
+	Locality           string
+	Street             string
+	PostalCode         string
+	Email              string
+
+	// Certificate Details
+	SerialNumber    *big.Int
+	NotBefore       time.Time
+	NotAfter        time.Time
+	CertificateType models.CertificateType
+
+	// Subject Alternative Names
+	DNSNames       []string
+	IPAddresses    []net.IP
+	EmailAddresses []string
+	URIs           []string
+
+	// Key Configuration
+	KeyType KeyType
+	KeySize KeySize // Only used for RSA
+	Curve   Curve   // Only used for ECDSA
+
+	// CA Configuration
+	IsCA                  bool
+	MaxPathLen            int
+	MaxPathLenZero        bool
+	BasicConstraintsValid bool
+
+	// Key Usage
+	DigitalSignature  bool
+	ContentCommitment bool
+	KeyEncipherment   bool
+	DataEncipherment  bool
+	KeyAgreement      bool
+	KeyCertSign       bool
+	CRLSign           bool
+	EncipherOnly      bool
+	DecipherOnly      bool
+
+	// Extended Key Usage
+	ServerAuth      bool
+	ClientAuth      bool
+	CodeSigning     bool
+	EmailProtection bool
+	TimeStamping    bool
+	OCSPSigning     bool
+
+	// Additional Extensions
+	SubjectKeyID          bool
+	AuthorityKeyID        bool
+	CRLDistributionPoints []string
+	OCSPServers           []string
+
+	// iOS-specific extensions
+	AuthorityInfoAccess   []string // AIA URLs for iOS compatibility
+	IssuingCertificateURL string   // URL to issuing certificate
+
+	// Validity period configuration
+	ValidityYears int // Custom validity period in years (overrides default)
+
+	// Platform compatibility
+	UseSHA256ForKeyIDs bool // Use SHA-256 for Key IDs (iOS compatible, MacBook compatible)
+
+}
+
+// DefaultCertificateConfig returns a default configuration for the given certificate type
+func DefaultCertificateConfig(certType models.CertificateType) *CertificateConfig {
+	config := &CertificateConfig{
+		CommonName:         "",
+		Organization:       "",
+		OrganizationalUnit: "",
+		Country:            "DE",
+		State:              "",
+		Locality:           "",
+		Street:             "",
+		PostalCode:         "",
+		Email:              "",
+
+		SerialNumber:    generateSerialNumber(),
+		NotBefore:       time.Now(),
+		NotAfter:        time.Now().AddDate(0, 3, 0), // 3 months default
+		CertificateType: certType,
+
+		DNSNames:       []string{},
+		IPAddresses:    []net.IP{},
+		EmailAddresses: []string{},
+		URIs:           []string{},
+
+		KeyType: KeyTypeRSA,
+		KeySize: KeySize2048,
+		Curve:   CurveP256,
+
+		IsCA:                  false,
+		MaxPathLen:            -1,
+		MaxPathLenZero:        false,
+		BasicConstraintsValid: true,
+
+		SubjectKeyID:          true,
+		AuthorityKeyID:        true,
+		CRLDistributionPoints: []string{},
+		OCSPServers:           []string{},
+
+		// iOS-specific defaults
+		AuthorityInfoAccess:   []string{},
+		IssuingCertificateURL: "",
+
+		// Validity period defaults
+		ValidityYears: 0, // 0 means use default
+
+		// Platform compatibility defaults
+		UseSHA256ForKeyIDs: true, // Use SHA-256 for modern compatibility (iOS + MacBook)
+
+	}
+
+	// Set defaults based on certificate type
+	switch certType {
+	case models.CertificateTypeCA:
+		config.IsCA = true
+		config.KeyCertSign = true
+		config.CRLSign = true
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 10) // Default 10 years for CA
+		config.MaxPathLen = 0
+
+	case models.CertificateTypeWeb, models.CertificateTypeServer:
+		config.DigitalSignature = true
+		config.KeyEncipherment = true
+		config.ServerAuth = true
+		config.NotAfter = calculateValidityPeriodMonths(config.NotBefore, config.ValidityYears, 3) // Default 3 months for web/server
+
+		// Enterprise defaults: Use larger key size if not specified
+		if config.KeySize == KeySize2048 && config.ValidityYears > 1 {
+			config.KeySize = KeySize4096 // Use 4096 bit for enterprise certificates
+		}
+
+		// iOS-compatibility: Always ensure Common Name is in SAN
+		if config.CommonName != "" {
+			found := false
+			for _, dns := range config.DNSNames {
+				if dns == config.CommonName {
+					found = true
+					break
+				}
+			}
+			if !found {
+				config.DNSNames = append(config.DNSNames, config.CommonName)
+			}
+		}
+
+		// iOS-compatibility: Add Authority Information Access
+		config.AuthorityInfoAccess = []string{"http://ca.secnex.internal/ca.crt"}
+		config.IssuingCertificateURL = "http://ca.secnex.internal/ca.crt"
+
+	case models.CertificateTypeClient:
+		config.DigitalSignature = true
+		config.KeyEncipherment = true
+		config.ClientAuth = true
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 1) // Default 1 year for client
+
+	case models.CertificateTypeEmail:
+		config.DigitalSignature = true
+		config.KeyEncipherment = true
+		config.EmailProtection = true
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 1) // Default 1 year for email
+
+	case models.CertificateTypeCode:
+		config.DigitalSignature = true
+		config.CodeSigning = true
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 2) // Default 2 years for code signing
+	}
+
+	return config
+}
+
+// CACertificateConfig returns a configuration specifically for CA certificates
+func CACertificateConfig(isRoot bool) *CertificateConfig {
+	config := DefaultCertificateConfig(models.CertificateTypeCA)
+	config.IsCA = true
+	config.KeyCertSign = true
+	config.CRLSign = true
+
+	if isRoot {
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 20) // Default 20 years for root CA
+		config.MaxPathLen = -1                                                                // No limit for root CA
+	} else {
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, config.ValidityYears, 10) // Default 10 years for intermediate CA
+		config.MaxPathLen = 0                                                                 // Intermediate CA cannot issue other CAs by default
+	}
+
+	return config
+}
+
+// CACertificateConfigWithValidity returns a CA configuration with custom validity period
+func CACertificateConfigWithValidity(isRoot bool, validityYears int) *CertificateConfig {
+	config := CACertificateConfig(isRoot)
+	config.ValidityYears = validityYears
+
+	if isRoot {
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, validityYears, 20)
+	} else {
+		config.NotAfter = calculateValidityPeriod(config.NotBefore, validityYears, 10)
+	}
+
+	return config
+}
+
+// WebServerCertificateConfig returns a configuration for web server certificates
+func WebServerCertificateConfig(domains []string) *CertificateConfig {
+	config := DefaultCertificateConfig(models.CertificateTypeWeb)
+	config.DNSNames = domains
+	config.DigitalSignature = true
+	config.KeyEncipherment = true
+	config.ServerAuth = true
+	config.NotAfter = config.NotBefore.AddDate(0, 3, 0) // 3 months for web certificates
+	return config
+}
+
+// ClientCertificateConfig returns a configuration for client certificates
+func ClientCertificateConfig() *CertificateConfig {
+	config := DefaultCertificateConfig(models.CertificateTypeClient)
+	config.DigitalSignature = true
+	config.KeyEncipherment = true
+	config.ClientAuth = true
+	return config
+}
+
+// EmailCertificateConfig returns a configuration for email certificates
+func EmailCertificateConfig(email string) *CertificateConfig {
+	config := DefaultCertificateConfig(models.CertificateTypeEmail)
+	config.EmailAddresses = []string{email}
+	config.DigitalSignature = true
+	config.KeyEncipherment = true
+	config.EmailProtection = true
+	return config
+}
+
+// CodeSigningCertificateConfig returns a configuration for code signing certificates
+func CodeSigningCertificateConfig() *CertificateConfig {
+	config := DefaultCertificateConfig(models.CertificateTypeCode)
+	config.DigitalSignature = true
+	config.CodeSigning = true
+	return config
+}
+
+// CertificateGenerator handles certificate generation
+type CertificateGenerator struct {
+	config *CertificateConfig
+}
+
+// NewCertificateGenerator creates a new certificate generator
+func NewCertificateGenerator(config *CertificateConfig) *CertificateGenerator {
+	return &CertificateGenerator{
+		config: config,
+	}
+}
+
+// GenerateKeyPair generates a key pair based on the configuration
+func (cg *CertificateGenerator) GenerateKeyPair() (interface{}, error) {
+	switch cg.config.KeyType {
+	case KeyTypeRSA:
+		return rsa.GenerateKey(rand.Reader, int(cg.config.KeySize))
+	case KeyTypeECDSA:
+		var curve elliptic.Curve
+		switch cg.config.Curve {
+		case CurveP256:
+			curve = elliptic.P256()
+		case CurveP384:
+			curve = elliptic.P384()
+		case CurveP521:
+			curve = elliptic.P521()
+		default:
+			return nil, fmt.Errorf("unsupported ECDSA curve: %s", cg.config.Curve)
+		}
+		return ecdsa.GenerateKey(curve, rand.Reader)
+	default:
+		return nil, fmt.Errorf("unsupported key type: %s", cg.config.KeyType)
+	}
+}
+
+// GenerateSelfSignedCertificate generates a self-signed certificate
+func (cg *CertificateGenerator) GenerateSelfSignedCertificate() (*x509.Certificate, interface{}, error) {
+	// Generate key pair
+	privateKey, err := cg.GenerateKeyPair()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to generate key pair: %w", err)
+	}
+
+	// Create certificate template
+	template := cg.createCertificateTemplate()
+
+	// Generate certificate
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, cg.getPublicKey(privateKey), privateKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+	}
+
+	// Parse certificate
+	cert, err := x509.ParseCertificate(certDER)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse certificate: %w", err)
+	}
+
+	return cert, privateKey, nil
+}
+
+// GenerateCertificate generates a certificate signed by a CA
+func (cg *CertificateGenerator) GenerateCertificate(caCert *x509.Certificate, caPrivateKey interface{}) (*x509.Certificate, interface{}, error) {
+	// Generate key pair
+	privateKey, err := cg.GenerateKeyPair()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to generate key pair: %w", err)
+	}
+
+	// Create certificate template
+	template := cg.createCertificateTemplate()
+
+	// Generate certificate
+	certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, cg.getPublicKey(privateKey), caPrivateKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
+	}
+
+	// Parse certificate
+	cert, err := x509.ParseCertificate(certDER)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse certificate: %w", err)
+	}
+
+	return cert, privateKey, nil
+}
+
+// createCertificateTemplate creates an x509.Certificate template from the configuration
+func (cg *CertificateGenerator) createCertificateTemplate() *x509.Certificate {
+	template := &x509.Certificate{
+		SerialNumber: cg.config.SerialNumber,
+		Subject: pkix.Name{
+			CommonName:         cg.config.CommonName,
+			Organization:       []string{cg.config.Organization},
+			OrganizationalUnit: []string{cg.config.OrganizationalUnit},
+			Country:            []string{cg.config.Country},
+			Province:           []string{cg.config.State},
+			Locality:           []string{cg.config.Locality},
+			StreetAddress:      []string{cg.config.Street},
+			PostalCode:         []string{cg.config.PostalCode},
+		},
+		NotBefore:      cg.config.NotBefore,
+		NotAfter:       cg.config.NotAfter,
+		DNSNames:       cg.config.DNSNames,
+		IPAddresses:    cg.config.IPAddresses,
+		EmailAddresses: cg.config.EmailAddresses,
+		URIs:           parseURIs(cg.config.URIs),
+	}
+
+	// Set key usage
+	var keyUsage x509.KeyUsage
+	if cg.config.DigitalSignature {
+		keyUsage |= x509.KeyUsageDigitalSignature
+	}
+	if cg.config.ContentCommitment {
+		keyUsage |= x509.KeyUsageContentCommitment
+	}
+	if cg.config.KeyEncipherment {
+		keyUsage |= x509.KeyUsageKeyEncipherment
+	}
+	if cg.config.DataEncipherment {
+		keyUsage |= x509.KeyUsageDataEncipherment
+	}
+	if cg.config.KeyAgreement {
+		keyUsage |= x509.KeyUsageKeyAgreement
+	}
+	if cg.config.KeyCertSign {
+		keyUsage |= x509.KeyUsageCertSign
+	}
+	if cg.config.CRLSign {
+		keyUsage |= x509.KeyUsageCRLSign
+	}
+	if cg.config.EncipherOnly {
+		keyUsage |= x509.KeyUsageEncipherOnly
+	}
+	if cg.config.DecipherOnly {
+		keyUsage |= x509.KeyUsageDecipherOnly
+	}
+	template.KeyUsage = keyUsage
+
+	// Set extended key usage
+	var extKeyUsage []x509.ExtKeyUsage
+	if cg.config.ServerAuth {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageServerAuth)
+	}
+	if cg.config.ClientAuth {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageClientAuth)
+	}
+	if cg.config.CodeSigning {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageCodeSigning)
+	}
+	if cg.config.EmailProtection {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageEmailProtection)
+	}
+	if cg.config.TimeStamping {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageTimeStamping)
+	}
+	if cg.config.OCSPSigning {
+		extKeyUsage = append(extKeyUsage, x509.ExtKeyUsageOCSPSigning)
+	}
+	template.ExtKeyUsage = extKeyUsage
+
+	// Set basic constraints
+	if cg.config.BasicConstraintsValid {
+		template.BasicConstraintsValid = true
+		template.IsCA = cg.config.IsCA
+		if cg.config.IsCA {
+			template.MaxPathLen = cg.config.MaxPathLen
+			template.MaxPathLenZero = cg.config.MaxPathLenZero
+		}
+	}
+
+	// Set subject key identifier
+	if cg.config.SubjectKeyID {
+		template.SubjectKeyId = generateSubjectKeyID(cg.getPublicKey(nil))
+	}
+
+	// Set authority key identifier
+	if cg.config.AuthorityKeyID {
+		template.AuthorityKeyId = generateAuthorityKeyID(cg.getPublicKey(nil))
+	}
+
+	// Add CRL distribution points
+	if len(cg.config.CRLDistributionPoints) > 0 {
+		template.CRLDistributionPoints = cg.config.CRLDistributionPoints
+	}
+
+	// Add OCSP servers
+	if len(cg.config.OCSPServers) > 0 {
+		template.OCSPServer = cg.config.OCSPServers
+	}
+
+	// Add Authority Information Access (AIA) for iOS compatibility
+	if len(cg.config.AuthorityInfoAccess) > 0 {
+		template.IssuingCertificateURL = cg.config.AuthorityInfoAccess
+	}
+
+	return template
+}
+
+// getPublicKey extracts the public key from a private key
+func (cg *CertificateGenerator) getPublicKey(privateKey interface{}) interface{} {
+	if privateKey == nil {
+		return nil
+	}
+
+	switch k := privateKey.(type) {
+	case *rsa.PrivateKey:
+		return &k.PublicKey
+	case *ecdsa.PrivateKey:
+		return &k.PublicKey
+	default:
+		return nil
+	}
+}
+
+// CertificateExporter handles certificate export functionality
+type CertificateExporter struct{}
+
+// NewCertificateExporter creates a new certificate exporter
+func NewCertificateExporter() *CertificateExporter {
+	return &CertificateExporter{}
+}
+
+// ExportCertificateToPEM exports a certificate to PEM format
+func (ce *CertificateExporter) ExportCertificateToPEM(cert *x509.Certificate) ([]byte, error) {
+	return pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: cert.Raw,
+	}), nil
+}
+
+// ExportPrivateKeyToPEM exports a private key to PEM format
+func (ce *CertificateExporter) ExportPrivateKeyToPEM(privateKey interface{}) ([]byte, error) {
+	var pemType string
+	var keyBytes []byte
+	var err error
+
+	switch k := privateKey.(type) {
+	case *rsa.PrivateKey:
+		pemType = "RSA PRIVATE KEY"
+		keyBytes = x509.MarshalPKCS1PrivateKey(k)
+	case *ecdsa.PrivateKey:
+		pemType = "EC PRIVATE KEY"
+		keyBytes, err = x509.MarshalECPrivateKey(k)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal ECDSA private key: %w", err)
+		}
+	default:
+		return nil, fmt.Errorf("unsupported private key type")
+	}
+
+	return pem.EncodeToMemory(&pem.Block{
+		Type:  pemType,
+		Bytes: keyBytes,
+	}), nil
+}
+
+// ExportCertificateToDER exports a certificate to DER format
+func (ce *CertificateExporter) ExportCertificateToDER(cert *x509.Certificate) []byte {
+	return cert.Raw
+}
+
+// ExportPrivateKeyToDER exports a private key to DER format
+func (ce *CertificateExporter) ExportPrivateKeyToDER(privateKey interface{}) ([]byte, error) {
+	switch k := privateKey.(type) {
+	case *rsa.PrivateKey:
+		return x509.MarshalPKCS1PrivateKey(k), nil
+	case *ecdsa.PrivateKey:
+		return x509.MarshalECPrivateKey(k)
+	default:
+		return nil, fmt.Errorf("unsupported private key type")
+	}
+}
+
+// Utility functions
+
+// calculateValidityPeriod calculates the validity period based on custom years or default
+func calculateValidityPeriod(notBefore time.Time, customYears int, defaultYears int) time.Time {
+	if customYears > 0 {
+		return notBefore.AddDate(customYears, 0, 0)
+	}
+	return notBefore.AddDate(defaultYears, 0, 0)
+}
+
+// calculateValidityPeriodMonths calculates the validity period based on custom years or default months
+func calculateValidityPeriodMonths(notBefore time.Time, customYears int, defaultMonths int) time.Time {
+	if customYears > 0 {
+		return notBefore.AddDate(customYears, 0, 0)
+	}
+	return notBefore.AddDate(0, defaultMonths, 0)
+}
+
+// generateSerialNumber generates a random serial number
+func generateSerialNumber() *big.Int {
+	serial, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	return serial
+}
+
+// generateSubjectKeyID generates a subject key identifier using SHA-256 (modern compatibility)
+func generateSubjectKeyID(publicKey interface{}) []byte {
+	if publicKey == nil {
+		return nil
+	}
+
+	var publicKeyBytes []byte
+	var err error
+
+	switch k := publicKey.(type) {
+	case *rsa.PublicKey:
+		publicKeyBytes, err = asn1.Marshal(k)
+	case *ecdsa.PublicKey:
+		publicKeyBytes, err = asn1.Marshal(k)
+	default:
+		return nil
+	}
+
+	if err != nil {
+		return nil
+	}
+
+	// Use SHA-256 for modern compatibility (iOS + MacBook + modern browsers)
+	hash := sha256.Sum256(publicKeyBytes)
+	return hash[:]
+}
+
+// generateAuthorityKeyID generates an authority key identifier
+func generateAuthorityKeyID(publicKey interface{}) []byte {
+	return generateSubjectKeyID(publicKey)
+}
+
+// parseURIs converts string URIs to *url.URL
+func parseURIs(uriStrings []string) []*url.URL {
+	var uris []*url.URL
+	for _, uriStr := range uriStrings {
+		if uri, err := url.Parse(uriStr); err == nil {
+			uris = append(uris, uri)
+		}
+	}
+	return uris
+}
+
+// ParseSANs parses Subject Alternative Names from a string
+func ParseSANs(sans string) ([]string, []net.IP, []string, []string) {
+	var dnsNames []string
+	var ipAddresses []net.IP
+	var emailAddresses []string
+	var uris []string
+
+	if sans == "" {
+		return dnsNames, ipAddresses, emailAddresses, uris
+	}
+
+	parts := strings.Split(sans, ",")
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		// Check if it's an IP address
+		if ip := net.ParseIP(part); ip != nil {
+			ipAddresses = append(ipAddresses, ip)
+			continue
+		}
+
+		// Check if it's an email address
+		if strings.Contains(part, "@") {
+			emailAddresses = append(emailAddresses, part)
+			continue
+		}
+
+		// Check if it's a URI
+		if strings.HasPrefix(part, "http://") || strings.HasPrefix(part, "https://") {
+			uris = append(uris, part)
+			continue
+		}
+
+		// Default to DNS name
+		dnsNames = append(dnsNames, part)
+	}
+
+	return dnsNames, ipAddresses, emailAddresses, uris
+}
+
+// ValidateCertificateConfig validates a certificate configuration
+func ValidateCertificateConfig(config *CertificateConfig) error {
+	if config.CommonName == "" {
+		return fmt.Errorf("common name is required")
+	}
+
+	if config.Organization == "" {
+		return fmt.Errorf("organization is required")
+	}
+
+	if config.Country == "" {
+		return fmt.Errorf("country is required")
+	}
+
+	if config.NotBefore.After(config.NotAfter) {
+		return fmt.Errorf("not before date must be before not after date")
+	}
+
+	if config.IsCA && !config.KeyCertSign {
+		return fmt.Errorf("CA certificates must have key cert sign usage")
+	}
+
+	// Modern browser and iOS validations
+	if config.CertificateType == models.CertificateTypeWeb {
+		// Ensure Common Name is in SAN (required by modern browsers and iOS)
+		if config.CommonName != "" {
+			found := false
+			for _, dns := range config.DNSNames {
+				if dns == config.CommonName {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return fmt.Errorf("Common Name must be included in Subject Alternative Names for modern browser compatibility")
+			}
+		}
+
+		// Validate key size (minimum 2048 bits required)
+		if config.KeyType == KeyTypeRSA && config.KeySize < KeySize2048 {
+			return fmt.Errorf("RSA keys must be at least 2048 bits")
+		}
+
+		// Validate validity period (maximum 825 days, recommended 398 days)
+		validityDays := int(config.NotAfter.Sub(config.NotBefore).Hours() / 24)
+		if validityDays > 825 {
+			return fmt.Errorf("certificate validity period exceeds 825 days (current: %d days)", validityDays)
+		}
+	}
+
+	return nil
+}
+
+// CreateCertificateFromModel creates a certificate configuration from a model
+func CreateCertificateFromModel(cert *models.Certificate) *CertificateConfig {
+	config := DefaultCertificateConfig(cert.Type)
+
+	config.CommonName = cert.AttributeCommonName
+	config.Organization = cert.AttributeOrganization
+	config.OrganizationalUnit = cert.AttributeOrganizationUnit
+	config.Country = cert.AttributeCountry
+	config.State = cert.AttributeState
+	config.Locality = cert.AttributeLocality
+	config.Street = cert.AttributeStreet
+	config.PostalCode = cert.AttributePostalCode
+	config.Email = cert.AttributeEmail
+	config.NotBefore = cert.AttributeNotBefore
+	config.NotAfter = cert.AttributeNotAfter
+
+	// Parse SANs
+	if cert.AttributeSubjectAlternativeName != "" {
+		dnsNames, ipAddresses, emailAddresses, uris := ParseSANs(cert.AttributeSubjectAlternativeName)
+		config.DNSNames = dnsNames
+		config.IPAddresses = ipAddresses
+		config.EmailAddresses = emailAddresses
+		config.URIs = uris
+	}
+
+	return config
+}
+
+// CreateCAFromModel creates a CA configuration from a model
+func CreateCAFromModel(ca *models.CertificateAuthority) *CertificateConfig {
+	config := CACertificateConfig(ca.Root)
+
+	config.CommonName = ca.AttributeCommonName
+	config.Organization = ca.AttributeOrganization
+	config.OrganizationalUnit = ca.AttributeOrganizationUnit
+	config.Country = ca.AttributeCountry
+	config.State = ca.AttributeState
+	config.Locality = ca.AttributeLocality
+	config.Street = ca.AttributeStreet
+	config.PostalCode = ca.AttributePostalCode
+	config.Email = ca.AttributeEmail
+	config.NotBefore = ca.AttributeNotBefore
+	config.NotAfter = ca.AttributeNotAfter
+
+	return config
+}

certificate/utils/certificate_test.go

@@ -0,0 +1,537 @@
+package utils
+
+import (
+	"crypto/x509"
+	"testing"
+	"time"
+
+	"git.secnex.io/secnex/certman/models"
+)
+
+func TestDefaultCertificateConfig(t *testing.T) {
+	tests := []struct {
+		certType models.CertificateType
+		expected bool
+	}{
+		{models.CertificateTypeCA, true},
+		{models.CertificateTypeWeb, true},
+		{models.CertificateTypeClient, true},
+		{models.CertificateTypeEmail, true},
+		{models.CertificateTypeCode, true},
+		{models.CertificateTypeServer, true},
+	}
+	
+	for _, test := range tests {
+		config := DefaultCertificateConfig(test.certType)
+		if config.CertificateType != test.certType {
+			t.Errorf("Expected certificate type %s, got %s", test.certType, config.CertificateType)
+		}
+		if config.SerialNumber == nil {
+			t.Error("Serial number should not be nil")
+		}
+		if config.NotBefore.After(config.NotAfter) {
+			t.Error("NotBefore should be before NotAfter")
+		}
+	}
+}
+
+func TestCACertificateConfig(t *testing.T) {
+	// Test root CA
+	rootConfig := CACertificateConfig(true)
+	if !rootConfig.IsCA {
+		t.Error("Root CA should have IsCA = true")
+	}
+	if !rootConfig.KeyCertSign {
+		t.Error("Root CA should have KeyCertSign = true")
+	}
+	if !rootConfig.CRLSign {
+		t.Error("Root CA should have CRLSign = true")
+	}
+	if rootConfig.MaxPathLen != -1 {
+		t.Error("Root CA should have MaxPathLen = -1")
+	}
+	
+	// Test intermediate CA
+	intermediateConfig := CACertificateConfig(false)
+	if !intermediateConfig.IsCA {
+		t.Error("Intermediate CA should have IsCA = true")
+	}
+	if !intermediateConfig.KeyCertSign {
+		t.Error("Intermediate CA should have KeyCertSign = true")
+	}
+	if !intermediateConfig.CRLSign {
+		t.Error("Intermediate CA should have CRLSign = true")
+	}
+	if intermediateConfig.MaxPathLen != 0 {
+		t.Error("Intermediate CA should have MaxPathLen = 0")
+	}
+}
+
+func TestWebServerCertificateConfig(t *testing.T) {
+	domains := []string{"example.com", "www.example.com"}
+	config := WebServerCertificateConfig(domains)
+	
+	if config.CertificateType != models.CertificateTypeWeb {
+		t.Error("Should be web certificate type")
+	}
+	if !config.DigitalSignature {
+		t.Error("Should have digital signature")
+	}
+	if !config.KeyEncipherment {
+		t.Error("Should have key encipherment")
+	}
+	if !config.ServerAuth {
+		t.Error("Should have server auth")
+	}
+	if len(config.DNSNames) != len(domains) {
+		t.Error("DNS names should match input domains")
+	}
+}
+
+func TestClientCertificateConfig(t *testing.T) {
+	config := ClientCertificateConfig()
+	
+	if config.CertificateType != models.CertificateTypeClient {
+		t.Error("Should be client certificate type")
+	}
+	if !config.DigitalSignature {
+		t.Error("Should have digital signature")
+	}
+	if !config.KeyEncipherment {
+		t.Error("Should have key encipherment")
+	}
+	if !config.ClientAuth {
+		t.Error("Should have client auth")
+	}
+}
+
+func TestEmailCertificateConfig(t *testing.T) {
+	email := "test@example.com"
+	config := EmailCertificateConfig(email)
+	
+	if config.CertificateType != models.CertificateTypeEmail {
+		t.Error("Should be email certificate type")
+	}
+	if !config.DigitalSignature {
+		t.Error("Should have digital signature")
+	}
+	if !config.KeyEncipherment {
+		t.Error("Should have key encipherment")
+	}
+	if !config.EmailProtection {
+		t.Error("Should have email protection")
+	}
+	if len(config.EmailAddresses) != 1 || config.EmailAddresses[0] != email {
+		t.Error("Email addresses should match input")
+	}
+}
+
+func TestCodeSigningCertificateConfig(t *testing.T) {
+	config := CodeSigningCertificateConfig()
+	
+	if config.CertificateType != models.CertificateTypeCode {
+		t.Error("Should be code signing certificate type")
+	}
+	if !config.DigitalSignature {
+		t.Error("Should have digital signature")
+	}
+	if !config.CodeSigning {
+		t.Error("Should have code signing")
+	}
+}
+
+func TestGenerateKeyPair(t *testing.T) {
+	tests := []struct {
+		keyType KeyType
+		keySize KeySize
+		curve   Curve
+	}{
+		{KeyTypeRSA, KeySize2048, CurveP256},
+		{KeyTypeRSA, KeySize3072, CurveP256},
+		{KeyTypeRSA, KeySize4096, CurveP256},
+		{KeyTypeECDSA, KeySize2048, CurveP256},
+		{KeyTypeECDSA, KeySize2048, CurveP384},
+		{KeyTypeECDSA, KeySize2048, CurveP521},
+	}
+	
+	for _, test := range tests {
+		config := DefaultCertificateConfig(models.CertificateTypeWeb)
+		config.KeyType = test.keyType
+		config.KeySize = test.keySize
+		config.Curve = test.curve
+		
+		generator := NewCertificateGenerator(config)
+		key, err := generator.GenerateKeyPair()
+		if err != nil {
+			t.Errorf("Failed to generate key pair for %s: %v", test.keyType, err)
+		}
+		if key == nil {
+			t.Errorf("Generated key should not be nil for %s", test.keyType)
+		}
+	}
+}
+
+func TestGenerateSelfSignedCertificate(t *testing.T) {
+	config := CACertificateConfig(true)
+	config.CommonName = "Test Root CA"
+	config.Organization = "Test Org"
+	config.Country = "DE"
+	
+	generator := NewCertificateGenerator(config)
+	cert, privateKey, err := generator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate self-signed certificate: %v", err)
+	}
+	
+	if cert == nil {
+		t.Error("Certificate should not be nil")
+	}
+	if privateKey == nil {
+		t.Error("Private key should not be nil")
+	}
+	if !cert.IsCA {
+		t.Error("CA certificate should have IsCA = true")
+	}
+	if cert.Subject.CommonName != config.CommonName {
+		t.Error("Certificate subject should match configuration")
+	}
+}
+
+func TestGenerateCertificate(t *testing.T) {
+	// Generate root CA first
+	rootConfig := CACertificateConfig(true)
+	rootConfig.CommonName = "Test Root CA"
+	rootConfig.Organization = "Test Org"
+	rootConfig.Country = "DE"
+	
+	rootGenerator := NewCertificateGenerator(rootConfig)
+	rootCert, rootPrivateKey, err := rootGenerator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate root CA: %v", err)
+	}
+	
+	// Generate intermediate CA
+	intermediateConfig := CACertificateConfig(false)
+	intermediateConfig.CommonName = "Test Intermediate CA"
+	intermediateConfig.Organization = "Test Org"
+	intermediateConfig.Country = "DE"
+	
+	intermediateGenerator := NewCertificateGenerator(intermediateConfig)
+	intermediateCert, intermediatePrivateKey, err := intermediateGenerator.GenerateCertificate(rootCert, rootPrivateKey)
+	if err != nil {
+		t.Fatalf("Failed to generate intermediate CA: %v", err)
+	}
+	
+	if intermediateCert == nil {
+		t.Error("Intermediate certificate should not be nil")
+	}
+	if intermediatePrivateKey == nil {
+		t.Error("Intermediate private key should not be nil")
+	}
+	if !intermediateCert.IsCA {
+		t.Error("Intermediate CA certificate should have IsCA = true")
+	}
+	if intermediateCert.Issuer.CommonName != rootCert.Subject.CommonName {
+		t.Error("Intermediate certificate issuer should match root certificate subject")
+	}
+	
+	// Generate end entity certificate
+	endConfig := WebServerCertificateConfig([]string{"example.com"})
+	endConfig.CommonName = "example.com"
+	endConfig.Organization = "Test Org"
+	endConfig.Country = "DE"
+	
+	endGenerator := NewCertificateGenerator(endConfig)
+	endCert, endPrivateKey, err := endGenerator.GenerateCertificate(intermediateCert, intermediatePrivateKey)
+	if err != nil {
+		t.Fatalf("Failed to generate end entity certificate: %v", err)
+	}
+	
+	if endCert == nil {
+		t.Error("End entity certificate should not be nil")
+	}
+	if endPrivateKey == nil {
+		t.Error("End entity private key should not be nil")
+	}
+	if endCert.IsCA {
+		t.Error("End entity certificate should not have IsCA = true")
+	}
+	if endCert.Issuer.CommonName != intermediateCert.Subject.CommonName {
+		t.Error("End entity certificate issuer should match intermediate certificate subject")
+	}
+}
+
+func TestValidateCertificateConfig(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  *CertificateConfig
+		wantErr bool
+	}{
+		{
+			name: "valid config",
+			config: &CertificateConfig{
+				CommonName:   "example.com",
+				Organization: "Test Org",
+				Country:      "DE",
+				NotBefore:    time.Now(),
+				NotAfter:     time.Now().AddDate(1, 0, 0),
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing common name",
+			config: &CertificateConfig{
+				Organization: "Test Org",
+				Country:      "DE",
+				NotBefore:    time.Now(),
+				NotAfter:     time.Now().AddDate(1, 0, 0),
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing organization",
+			config: &CertificateConfig{
+				CommonName: "example.com",
+				Country:    "DE",
+				NotBefore:  time.Now(),
+				NotAfter:   time.Now().AddDate(1, 0, 0),
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing country",
+			config: &CertificateConfig{
+				CommonName:   "example.com",
+				Organization: "Test Org",
+				NotBefore:    time.Now(),
+				NotAfter:     time.Now().AddDate(1, 0, 0),
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid date range",
+			config: &CertificateConfig{
+				CommonName:   "example.com",
+				Organization: "Test Org",
+				Country:      "DE",
+				NotBefore:    time.Now().AddDate(1, 0, 0),
+				NotAfter:     time.Now(),
+			},
+			wantErr: true,
+		},
+		{
+			name: "CA without key cert sign",
+			config: &CertificateConfig{
+				CommonName:   "example.com",
+				Organization: "Test Org",
+				Country:      "DE",
+				NotBefore:    time.Now(),
+				NotAfter:     time.Now().AddDate(1, 0, 0),
+				IsCA:         true,
+				KeyCertSign:  false,
+			},
+			wantErr: true,
+		},
+	}
+	
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ValidateCertificateConfig(test.config)
+			if (err != nil) != test.wantErr {
+				t.Errorf("ValidateCertificateConfig() error = %v, wantErr %v", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestParseSANs(t *testing.T) {
+	tests := []struct {
+		input           string
+		expectedDNS     []string
+		expectedIPs     int
+		expectedEmails  []string
+		expectedURIs    []string
+	}{
+		{
+			input:           "example.com,www.example.com",
+			expectedDNS:     []string{"example.com", "www.example.com"},
+			expectedIPs:     0,
+			expectedEmails:  []string{},
+			expectedURIs:    []string{},
+		},
+		{
+			input:           "example.com,192.168.1.1,user@example.com,https://example.com",
+			expectedDNS:     []string{"example.com"},
+			expectedIPs:     1,
+			expectedEmails:  []string{"user@example.com"},
+			expectedURIs:    []string{"https://example.com"},
+		},
+		{
+			input:           "",
+			expectedDNS:     []string{},
+			expectedIPs:     0,
+			expectedEmails:  []string{},
+			expectedURIs:    []string{},
+		},
+	}
+	
+	for _, test := range tests {
+		dnsNames, ipAddresses, emailAddresses, uris := ParseSANs(test.input)
+		
+		if len(dnsNames) != len(test.expectedDNS) {
+			t.Errorf("Expected %d DNS names, got %d", len(test.expectedDNS), len(dnsNames))
+		}
+		
+		if len(ipAddresses) != test.expectedIPs {
+			t.Errorf("Expected %d IP addresses, got %d", test.expectedIPs, len(ipAddresses))
+		}
+		
+		if len(emailAddresses) != len(test.expectedEmails) {
+			t.Errorf("Expected %d email addresses, got %d", len(test.expectedEmails), len(emailAddresses))
+		}
+		
+		if len(uris) != len(test.expectedURIs) {
+			t.Errorf("Expected %d URIs, got %d", len(test.expectedURIs), len(uris))
+		}
+	}
+}
+
+func TestExportCertificateToPEM(t *testing.T) {
+	// Generate a test certificate
+	config := CACertificateConfig(true)
+	config.CommonName = "Test CA"
+	config.Organization = "Test Org"
+	config.Country = "DE"
+	
+	generator := NewCertificateGenerator(config)
+	cert, _, err := generator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate certificate: %v", err)
+	}
+	
+	exporter := NewCertificateExporter()
+	pemData, err := exporter.ExportCertificateToPEM(cert)
+	if err != nil {
+		t.Fatalf("Failed to export certificate to PEM: %v", err)
+	}
+	
+	if len(pemData) == 0 {
+		t.Error("PEM data should not be empty")
+	}
+	
+	// Verify PEM format
+	if !contains(pemData, []byte("-----BEGIN CERTIFICATE-----")) {
+		t.Error("PEM data should contain certificate header")
+	}
+	if !contains(pemData, []byte("-----END CERTIFICATE-----")) {
+		t.Error("PEM data should contain certificate footer")
+	}
+}
+
+func TestExportPrivateKeyToPEM(t *testing.T) {
+	// Generate a test certificate with private key
+	config := CACertificateConfig(true)
+	config.CommonName = "Test CA"
+	config.Organization = "Test Org"
+	config.Country = "DE"
+	
+	generator := NewCertificateGenerator(config)
+	_, privateKey, err := generator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate certificate: %v", err)
+	}
+	
+	exporter := NewCertificateExporter()
+	pemData, err := exporter.ExportPrivateKeyToPEM(privateKey)
+	if err != nil {
+		t.Fatalf("Failed to export private key to PEM: %v", err)
+	}
+	
+	if len(pemData) == 0 {
+		t.Error("PEM data should not be empty")
+	}
+	
+	// Verify PEM format
+	if !contains(pemData, []byte("-----BEGIN")) {
+		t.Error("PEM data should contain private key header")
+	}
+	if !contains(pemData, []byte("-----END")) {
+		t.Error("PEM data should contain private key footer")
+	}
+}
+
+func TestExportCertificateToDER(t *testing.T) {
+	// Generate a test certificate
+	config := CACertificateConfig(true)
+	config.CommonName = "Test CA"
+	config.Organization = "Test Org"
+	config.Country = "DE"
+	
+	generator := NewCertificateGenerator(config)
+	cert, _, err := generator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate certificate: %v", err)
+	}
+	
+	exporter := NewCertificateExporter()
+	derData := exporter.ExportCertificateToDER(cert)
+	
+	if len(derData) == 0 {
+		t.Error("DER data should not be empty")
+	}
+	
+	// Verify DER format by parsing it
+	_, err = x509.ParseCertificate(derData)
+	if err != nil {
+		t.Errorf("DER data should be valid certificate: %v", err)
+	}
+}
+
+func TestExportPrivateKeyToDER(t *testing.T) {
+	// Generate a test certificate with private key
+	config := CACertificateConfig(true)
+	config.CommonName = "Test CA"
+	config.Organization = "Test Org"
+	config.Country = "DE"
+	
+	generator := NewCertificateGenerator(config)
+	_, privateKey, err := generator.GenerateSelfSignedCertificate()
+	if err != nil {
+		t.Fatalf("Failed to generate certificate: %v", err)
+	}
+	
+	exporter := NewCertificateExporter()
+	derData, err := exporter.ExportPrivateKeyToDER(privateKey)
+	if err != nil {
+		t.Fatalf("Failed to export private key to DER: %v", err)
+	}
+	
+	if len(derData) == 0 {
+		t.Error("DER data should not be empty")
+	}
+}
+
+// Helper function to check if a slice contains a subslice
+func contains(s, subslice []byte) bool {
+	if len(subslice) > len(s) {
+		return false
+	}
+	for i := 0; i <= len(s)-len(subslice); i++ {
+		if bytesEqual(s[i:i+len(subslice)], subslice) {
+			return true
+		}
+	}
+	return false
+}
+
+func bytesEqual(a, b []byte) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}