d9726d9204
- Implement CertificateService for end-to-end certificate management - Add support for various certificate types (web, client, email, etc.) - Include certificate generation, validation, and revocation - Add utility functions for certificate operations and validation - Implement comprehensive test coverage for certificate operations - Support SAN (Subject Alternative Name) and IP address extensions - Add proper error handling and validation for certificate requests
836 lines
25 KiB
Go
836 lines
25 KiB
Go
package certificate
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"encoding/pem"
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
|
|
"git.secnex.io/secnex/certman/certificate/utils"
|
|
"git.secnex.io/secnex/certman/models"
|
|
"git.secnex.io/secnex/certman/repositories"
|
|
"github.com/google/uuid"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
// CertificateService handles certificate operations
|
|
type CertificateService struct {
|
|
certRepo *repositories.CertificateRepository
|
|
caRepo *repositories.CertificateAuthorityRepository
|
|
csrRepo *repositories.CertificateRequestRepository
|
|
certDir string
|
|
privateDir string
|
|
caService *CertificateAuthorityService
|
|
}
|
|
|
|
// NewCertificateService creates a new certificate service
|
|
func NewCertificateService(
|
|
db *gorm.DB,
|
|
certDir string,
|
|
privateDir string,
|
|
caService *CertificateAuthorityService,
|
|
) *CertificateService {
|
|
return &CertificateService{
|
|
certRepo: repositories.NewCertificateRepository(db),
|
|
caRepo: repositories.NewCertificateAuthorityRepository(db),
|
|
csrRepo: repositories.NewCertificateRequestRepository(db),
|
|
certDir: certDir,
|
|
privateDir: privateDir,
|
|
caService: caService,
|
|
}
|
|
}
|
|
|
|
// CreateCertificate creates a new certificate from a request
|
|
func (s *CertificateService) CreateCertificate(req *CreateCertificateRequest) (*models.Certificate, error) {
|
|
// Validate request
|
|
if err := s.validateCreateCertificateRequest(req); err != nil {
|
|
return nil, fmt.Errorf("invalid request: %w", err)
|
|
}
|
|
|
|
// Get CA
|
|
ca, err := s.caRepo.GetByID(req.CertificateAuthorityID.String())
|
|
if err != nil {
|
|
return nil, fmt.Errorf("CA not found: %w", err)
|
|
}
|
|
|
|
// Load CA certificate and private key
|
|
caCert, caPrivateKey, err := s.caService.loadCACertificateAndKey(&ca)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to load CA certificate: %w", err)
|
|
}
|
|
|
|
// Create certificate configuration (iOS-compatible by default for web certificates)
|
|
config := s.createCertificateConfig(req)
|
|
|
|
// Ensure proper certificate configuration
|
|
config.SubjectKeyID = true
|
|
config.AuthorityKeyID = true
|
|
|
|
// Validate configuration
|
|
if err := utils.ValidateCertificateConfig(config); err != nil {
|
|
return nil, fmt.Errorf("invalid certificate configuration: %w", err)
|
|
}
|
|
|
|
// Generate certificate and private key
|
|
generator := utils.NewCertificateGenerator(config)
|
|
cert, privateKey, err := generator.GenerateCertificate(caCert, caPrivateKey)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate certificate: %w", err)
|
|
}
|
|
|
|
// Save certificate and private key to files
|
|
certFileID, err := s.saveCertificate(cert, req.Type)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save certificate: %w", err)
|
|
}
|
|
|
|
privateKeyFileID, err := s.savePrivateKey(privateKey, req.Type)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save private key: %w", err)
|
|
}
|
|
|
|
// Create certificate model
|
|
certModel := &models.Certificate{
|
|
Name: req.Name,
|
|
Description: req.Description,
|
|
SerialNumber: cert.SerialNumber.String(),
|
|
AttributeCommonName: cert.Subject.CommonName,
|
|
AttributeSubjectAlternativeName: s.formatSANs(cert.DNSNames, cert.IPAddresses, cert.EmailAddresses, cert.URIs),
|
|
AttributeOrganization: cert.Subject.Organization[0],
|
|
AttributeOrganizationUnit: cert.Subject.OrganizationalUnit[0],
|
|
AttributeCountry: cert.Subject.Country[0],
|
|
AttributeState: cert.Subject.Province[0],
|
|
AttributeLocality: cert.Subject.Locality[0],
|
|
AttributeStreet: cert.Subject.StreetAddress[0],
|
|
AttributeEmail: req.Email,
|
|
AttributeAddress: req.Address,
|
|
AttributePostalCode: cert.Subject.PostalCode[0],
|
|
AttributeNotBefore: cert.NotBefore,
|
|
AttributeNotAfter: cert.NotAfter,
|
|
Type: req.Type,
|
|
Status: models.CertificateStatusActive,
|
|
CertificateAuthorityID: req.CertificateAuthorityID,
|
|
RequestID: req.RequestID,
|
|
FileID: certFileID,
|
|
PrivateKeyID: privateKeyFileID,
|
|
Generated: true,
|
|
GeneratedAt: &time.Time{},
|
|
}
|
|
|
|
// Set generated time
|
|
now := time.Now()
|
|
certModel.GeneratedAt = &now
|
|
|
|
// Save to database
|
|
if err := s.certRepo.Create(*certModel); err != nil {
|
|
// Clean up files if database save fails
|
|
s.cleanupFiles(certFileID, privateKeyFileID)
|
|
return nil, fmt.Errorf("failed to save certificate to database: %w", err)
|
|
}
|
|
|
|
return certModel, nil
|
|
}
|
|
|
|
// CreateCertificateFromCSR creates a certificate from a Certificate Signing Request
|
|
func (s *CertificateService) CreateCertificateFromCSR(req *CreateCertificateFromCSRRequest) (*models.Certificate, error) {
|
|
// Validate request
|
|
if err := s.validateCreateCertificateFromCSRRequest(req); err != nil {
|
|
return nil, fmt.Errorf("invalid request: %w", err)
|
|
}
|
|
|
|
// Get CSR
|
|
csr, err := s.csrRepo.GetByID(req.CSRID.String())
|
|
if err != nil {
|
|
return nil, fmt.Errorf("CSR not found: %w", err)
|
|
}
|
|
|
|
// Get CA
|
|
ca, err := s.caRepo.GetByID(req.CertificateAuthorityID.String())
|
|
if err != nil {
|
|
return nil, fmt.Errorf("CA not found: %w", err)
|
|
}
|
|
|
|
// Load CA certificate and private key
|
|
caCert, caPrivateKey, err := s.caService.loadCACertificateAndKey(&ca)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to load CA certificate: %w", err)
|
|
}
|
|
|
|
// Parse CSR
|
|
csrParsed, err := x509.ParseCertificateRequest(csr.CSRData)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse CSR: %w", err)
|
|
}
|
|
|
|
// Create certificate configuration from CSR
|
|
config := s.createCertificateConfigFromCSR(req, csrParsed)
|
|
|
|
// Validate configuration
|
|
if err := utils.ValidateCertificateConfig(config); err != nil {
|
|
return nil, fmt.Errorf("invalid certificate configuration: %w", err)
|
|
}
|
|
|
|
// Generate certificate
|
|
generator := utils.NewCertificateGenerator(config)
|
|
cert, privateKey, err := generator.GenerateCertificate(caCert, caPrivateKey)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to generate certificate: %w", err)
|
|
}
|
|
|
|
// Save certificate and private key to files
|
|
certFileID, err := s.saveCertificate(cert, req.Type)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save certificate: %w", err)
|
|
}
|
|
|
|
privateKeyFileID, err := s.savePrivateKey(privateKey, req.Type)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to save private key: %w", err)
|
|
}
|
|
|
|
// Create certificate model
|
|
certModel := &models.Certificate{
|
|
Name: req.Name,
|
|
Description: req.Description,
|
|
SerialNumber: cert.SerialNumber.String(),
|
|
AttributeCommonName: cert.Subject.CommonName,
|
|
AttributeSubjectAlternativeName: s.formatSANs(cert.DNSNames, cert.IPAddresses, cert.EmailAddresses, cert.URIs),
|
|
AttributeOrganization: cert.Subject.Organization[0],
|
|
AttributeOrganizationUnit: cert.Subject.OrganizationalUnit[0],
|
|
AttributeCountry: cert.Subject.Country[0],
|
|
AttributeState: cert.Subject.Province[0],
|
|
AttributeLocality: cert.Subject.Locality[0],
|
|
AttributeStreet: cert.Subject.StreetAddress[0],
|
|
AttributeEmail: "",
|
|
AttributeAddress: "",
|
|
AttributePostalCode: cert.Subject.PostalCode[0],
|
|
AttributeNotBefore: cert.NotBefore,
|
|
AttributeNotAfter: cert.NotAfter,
|
|
Type: req.Type,
|
|
Status: models.CertificateStatusActive,
|
|
CertificateAuthorityID: req.CertificateAuthorityID,
|
|
RequestID: &req.CSRID,
|
|
FileID: certFileID,
|
|
PrivateKeyID: privateKeyFileID,
|
|
Generated: true,
|
|
GeneratedAt: &time.Time{},
|
|
}
|
|
|
|
// Set generated time
|
|
now := time.Now()
|
|
certModel.GeneratedAt = &now
|
|
|
|
// Save to database
|
|
if err := s.certRepo.Create(*certModel); err != nil {
|
|
// Clean up files if database save fails
|
|
s.cleanupFiles(certFileID, privateKeyFileID)
|
|
return nil, fmt.Errorf("failed to save certificate to database: %w", err)
|
|
}
|
|
|
|
return certModel, nil
|
|
}
|
|
|
|
// GetCertificate retrieves a certificate by ID
|
|
func (s *CertificateService) GetCertificate(id string) (*models.Certificate, error) {
|
|
cert, err := s.certRepo.GetByID(id)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
return &cert, nil
|
|
}
|
|
|
|
// GetAllCertificates retrieves all certificates
|
|
func (s *CertificateService) GetAllCertificates() ([]models.Certificate, error) {
|
|
certs, err := s.certRepo.GetAll()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
|
|
}
|
|
return certs, nil
|
|
}
|
|
|
|
// GetCertificatesByType retrieves certificates by type
|
|
func (s *CertificateService) GetCertificatesByType(certType models.CertificateType) ([]models.Certificate, error) {
|
|
certs, err := s.certRepo.GetAll()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
|
|
}
|
|
|
|
var filteredCerts []models.Certificate
|
|
for _, cert := range certs {
|
|
if cert.Type == certType {
|
|
filteredCerts = append(filteredCerts, cert)
|
|
}
|
|
}
|
|
|
|
return filteredCerts, nil
|
|
}
|
|
|
|
// GetCertificatesByCA retrieves certificates issued by a specific CA
|
|
func (s *CertificateService) GetCertificatesByCA(caID string) ([]models.Certificate, error) {
|
|
certs, err := s.certRepo.GetAll()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to retrieve certificates: %w", err)
|
|
}
|
|
|
|
var filteredCerts []models.Certificate
|
|
for _, cert := range certs {
|
|
if cert.CertificateAuthorityID.String() == caID {
|
|
filteredCerts = append(filteredCerts, cert)
|
|
}
|
|
}
|
|
|
|
return filteredCerts, nil
|
|
}
|
|
|
|
// GetCertificateFile retrieves the certificate file
|
|
func (s *CertificateService) GetCertificateFile(certID string) (*x509.Certificate, error) {
|
|
cert, err := s.certRepo.GetByID(certID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
|
|
certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", cert.FileID))
|
|
certPEM, err := os.ReadFile(certPath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read certificate file: %w", err)
|
|
}
|
|
|
|
block, _ := pem.Decode(certPEM)
|
|
if block == nil {
|
|
return nil, fmt.Errorf("failed to decode certificate PEM")
|
|
}
|
|
|
|
certParsed, err := x509.ParseCertificate(block.Bytes)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse certificate: %w", err)
|
|
}
|
|
|
|
return certParsed, nil
|
|
}
|
|
|
|
// GetPrivateKeyFile retrieves the private key file
|
|
func (s *CertificateService) GetPrivateKeyFile(certID string) (interface{}, error) {
|
|
cert, err := s.certRepo.GetByID(certID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
|
|
keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", cert.PrivateKeyID))
|
|
keyPEM, err := os.ReadFile(keyPath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to read private key file: %w", err)
|
|
}
|
|
|
|
block, _ := pem.Decode(keyPEM)
|
|
if block == nil {
|
|
return nil, fmt.Errorf("failed to decode private key PEM")
|
|
}
|
|
|
|
var privateKey interface{}
|
|
switch block.Type {
|
|
case "RSA PRIVATE KEY":
|
|
privateKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
|
|
case "EC PRIVATE KEY":
|
|
privateKey, err = x509.ParseECPrivateKey(block.Bytes)
|
|
default:
|
|
return nil, fmt.Errorf("unsupported private key type: %s", block.Type)
|
|
}
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse private key: %w", err)
|
|
}
|
|
|
|
return privateKey, nil
|
|
}
|
|
|
|
// UpdateCertificate updates a certificate
|
|
func (s *CertificateService) UpdateCertificate(cert *models.Certificate) error {
|
|
return s.certRepo.Update(*cert)
|
|
}
|
|
|
|
// RevokeCertificate revokes a certificate
|
|
func (s *CertificateService) RevokeCertificate(certID string, reason string) error {
|
|
cert, err := s.certRepo.GetByID(certID)
|
|
if err != nil {
|
|
return fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
|
|
// Update certificate with revocation information
|
|
cert.Status = models.CertificateStatusRevoked
|
|
cert.RevocationReason = reason
|
|
now := time.Now()
|
|
cert.RevokedAt = &now
|
|
|
|
if err := s.certRepo.Update(cert); err != nil {
|
|
return fmt.Errorf("failed to revoke certificate: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// DeleteCertificate deletes a certificate
|
|
func (s *CertificateService) DeleteCertificate(certID string) error {
|
|
cert, err := s.certRepo.GetByID(certID)
|
|
if err != nil {
|
|
return fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
|
|
// Delete from database
|
|
if err := s.certRepo.Delete(certID); err != nil {
|
|
return fmt.Errorf("failed to delete certificate from database: %w", err)
|
|
}
|
|
|
|
// Clean up files
|
|
s.cleanupFiles(cert.FileID, cert.PrivateKeyID)
|
|
|
|
return nil
|
|
}
|
|
|
|
// ValidateCertificate validates a certificate
|
|
func (s *CertificateService) ValidateCertificate(certID string) error {
|
|
cert, err := s.certRepo.GetByID(certID)
|
|
if err != nil {
|
|
return fmt.Errorf("certificate not found: %w", err)
|
|
}
|
|
|
|
// Load certificate
|
|
certParsed, err := s.GetCertificateFile(certID)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to load certificate: %w", err)
|
|
}
|
|
|
|
// Check validity period
|
|
now := time.Now()
|
|
if now.Before(certParsed.NotBefore) {
|
|
return fmt.Errorf("certificate is not yet valid")
|
|
}
|
|
if now.After(certParsed.NotAfter) {
|
|
return fmt.Errorf("certificate has expired")
|
|
}
|
|
|
|
// Check status
|
|
if cert.Status == models.CertificateStatusRevoked {
|
|
return fmt.Errorf("certificate has been revoked: %s", cert.RevocationReason)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ExportCertificate exports a certificate in various formats
|
|
func (s *CertificateService) ExportCertificate(certID string, format string) ([]byte, error) {
|
|
certParsed, err := s.GetCertificateFile(certID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to load certificate: %w", err)
|
|
}
|
|
|
|
exporter := utils.NewCertificateExporter()
|
|
|
|
switch format {
|
|
case "pem":
|
|
return exporter.ExportCertificateToPEM(certParsed)
|
|
case "der":
|
|
return exporter.ExportCertificateToDER(certParsed), nil
|
|
default:
|
|
return nil, fmt.Errorf("unsupported export format: %s", format)
|
|
}
|
|
}
|
|
|
|
// ExportPrivateKey exports a private key in various formats
|
|
func (s *CertificateService) ExportPrivateKey(certID string, format string) ([]byte, error) {
|
|
privateKey, err := s.GetPrivateKeyFile(certID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to load private key: %w", err)
|
|
}
|
|
|
|
exporter := utils.NewCertificateExporter()
|
|
|
|
switch format {
|
|
case "pem":
|
|
return exporter.ExportPrivateKeyToPEM(privateKey)
|
|
case "der":
|
|
return exporter.ExportPrivateKeyToDER(privateKey)
|
|
default:
|
|
return nil, fmt.Errorf("unsupported export format: %s", format)
|
|
}
|
|
}
|
|
|
|
// Helper methods
|
|
|
|
// createCertificateConfig creates a certificate configuration from a request
|
|
func (s *CertificateService) createCertificateConfig(req *CreateCertificateRequest) *utils.CertificateConfig {
|
|
config := utils.DefaultCertificateConfig(req.Type)
|
|
|
|
// Set basic information
|
|
config.CommonName = req.CommonName
|
|
config.Organization = req.Organization
|
|
config.OrganizationalUnit = req.OrganizationalUnit
|
|
config.Country = req.Country
|
|
config.State = req.State
|
|
config.Locality = req.Locality
|
|
config.Street = req.Street
|
|
config.PostalCode = req.PostalCode
|
|
config.Email = req.Email
|
|
|
|
// Set validity period
|
|
if req.NotBefore != nil {
|
|
config.NotBefore = *req.NotBefore
|
|
}
|
|
if req.NotAfter != nil {
|
|
config.NotAfter = *req.NotAfter
|
|
}
|
|
if req.ValidityYears > 0 {
|
|
config.ValidityYears = req.ValidityYears
|
|
config.NotAfter = config.NotBefore.AddDate(req.ValidityYears, 0, 0)
|
|
}
|
|
|
|
// Set SANs
|
|
config.DNSNames = req.DNSNames
|
|
config.IPAddresses = req.IPAddresses
|
|
config.EmailAddresses = req.EmailAddresses
|
|
config.URIs = req.URIs
|
|
|
|
// Set key configuration
|
|
if req.KeyType != "" {
|
|
config.KeyType = utils.KeyType(req.KeyType)
|
|
}
|
|
if req.KeySize != 0 {
|
|
config.KeySize = utils.KeySize(req.KeySize)
|
|
}
|
|
if req.Curve != "" {
|
|
config.Curve = utils.Curve(req.Curve)
|
|
}
|
|
|
|
// Set custom key usage and extended key usage
|
|
if req.KeyUsage != nil {
|
|
config.DigitalSignature = req.KeyUsage.DigitalSignature
|
|
config.ContentCommitment = req.KeyUsage.ContentCommitment
|
|
config.KeyEncipherment = req.KeyUsage.KeyEncipherment
|
|
config.DataEncipherment = req.KeyUsage.DataEncipherment
|
|
config.KeyAgreement = req.KeyUsage.KeyAgreement
|
|
config.KeyCertSign = req.KeyUsage.KeyCertSign
|
|
config.CRLSign = req.KeyUsage.CRLSign
|
|
config.EncipherOnly = req.KeyUsage.EncipherOnly
|
|
config.DecipherOnly = req.KeyUsage.DecipherOnly
|
|
}
|
|
|
|
if req.ExtendedKeyUsage != nil {
|
|
config.ServerAuth = req.ExtendedKeyUsage.ServerAuth
|
|
config.ClientAuth = req.ExtendedKeyUsage.ClientAuth
|
|
config.CodeSigning = req.ExtendedKeyUsage.CodeSigning
|
|
config.EmailProtection = req.ExtendedKeyUsage.EmailProtection
|
|
config.TimeStamping = req.ExtendedKeyUsage.TimeStamping
|
|
config.OCSPSigning = req.ExtendedKeyUsage.OCSPSigning
|
|
}
|
|
|
|
return config
|
|
}
|
|
|
|
// createCertificateConfigFromCSR creates a certificate configuration from a CSR
|
|
func (s *CertificateService) createCertificateConfigFromCSR(req *CreateCertificateFromCSRRequest, csr *x509.CertificateRequest) *utils.CertificateConfig {
|
|
config := utils.DefaultCertificateConfig(req.Type)
|
|
|
|
// Set basic information from CSR
|
|
config.CommonName = csr.Subject.CommonName
|
|
if len(csr.Subject.Organization) > 0 {
|
|
config.Organization = csr.Subject.Organization[0]
|
|
}
|
|
if len(csr.Subject.OrganizationalUnit) > 0 {
|
|
config.OrganizationalUnit = csr.Subject.OrganizationalUnit[0]
|
|
}
|
|
if len(csr.Subject.Country) > 0 {
|
|
config.Country = csr.Subject.Country[0]
|
|
}
|
|
if len(csr.Subject.Province) > 0 {
|
|
config.State = csr.Subject.Province[0]
|
|
}
|
|
if len(csr.Subject.Locality) > 0 {
|
|
config.Locality = csr.Subject.Locality[0]
|
|
}
|
|
if len(csr.Subject.StreetAddress) > 0 {
|
|
config.Street = csr.Subject.StreetAddress[0]
|
|
}
|
|
if len(csr.Subject.PostalCode) > 0 {
|
|
config.PostalCode = csr.Subject.PostalCode[0]
|
|
}
|
|
|
|
// Set validity period
|
|
if req.NotBefore != nil {
|
|
config.NotBefore = *req.NotBefore
|
|
}
|
|
if req.NotAfter != nil {
|
|
config.NotAfter = *req.NotAfter
|
|
}
|
|
if req.ValidityYears > 0 {
|
|
config.ValidityYears = req.ValidityYears
|
|
config.NotAfter = config.NotBefore.AddDate(req.ValidityYears, 0, 0)
|
|
}
|
|
|
|
// Set SANs from CSR
|
|
config.DNSNames = csr.DNSNames
|
|
config.IPAddresses = csr.IPAddresses
|
|
config.EmailAddresses = csr.EmailAddresses
|
|
config.URIs = s.parseURIsFromCSR(csr.URIs)
|
|
|
|
// Set key configuration
|
|
if req.KeyType != "" {
|
|
config.KeyType = utils.KeyType(req.KeyType)
|
|
}
|
|
if req.KeySize != 0 {
|
|
config.KeySize = utils.KeySize(req.KeySize)
|
|
}
|
|
if req.Curve != "" {
|
|
config.Curve = utils.Curve(req.Curve)
|
|
}
|
|
|
|
// Set custom key usage and extended key usage
|
|
if req.KeyUsage != nil {
|
|
config.DigitalSignature = req.KeyUsage.DigitalSignature
|
|
config.ContentCommitment = req.KeyUsage.ContentCommitment
|
|
config.KeyEncipherment = req.KeyUsage.KeyEncipherment
|
|
config.DataEncipherment = req.KeyUsage.DataEncipherment
|
|
config.KeyAgreement = req.KeyUsage.KeyAgreement
|
|
config.KeyCertSign = req.KeyUsage.KeyCertSign
|
|
config.CRLSign = req.KeyUsage.CRLSign
|
|
config.EncipherOnly = req.KeyUsage.EncipherOnly
|
|
config.DecipherOnly = req.KeyUsage.DecipherOnly
|
|
}
|
|
|
|
if req.ExtendedKeyUsage != nil {
|
|
config.ServerAuth = req.ExtendedKeyUsage.ServerAuth
|
|
config.ClientAuth = req.ExtendedKeyUsage.ClientAuth
|
|
config.CodeSigning = req.ExtendedKeyUsage.CodeSigning
|
|
config.EmailProtection = req.ExtendedKeyUsage.EmailProtection
|
|
config.TimeStamping = req.ExtendedKeyUsage.TimeStamping
|
|
config.OCSPSigning = req.ExtendedKeyUsage.OCSPSigning
|
|
}
|
|
|
|
return config
|
|
}
|
|
|
|
// formatSANs formats SANs for storage
|
|
func (s *CertificateService) formatSANs(dnsNames []string, ipAddresses []net.IP, emailAddresses []string, uris []*url.URL) string {
|
|
var sans []string
|
|
|
|
for _, dns := range dnsNames {
|
|
sans = append(sans, dns)
|
|
}
|
|
|
|
for _, ip := range ipAddresses {
|
|
sans = append(sans, ip.String())
|
|
}
|
|
|
|
for _, email := range emailAddresses {
|
|
sans = append(sans, email)
|
|
}
|
|
|
|
for _, uri := range uris {
|
|
sans = append(sans, uri.String())
|
|
}
|
|
|
|
return strings.Join(sans, ",")
|
|
}
|
|
|
|
// parseURIsFromCSR parses URIs from CSR
|
|
func (s *CertificateService) parseURIsFromCSR(uris []*url.URL) []string {
|
|
var uriStrings []string
|
|
for _, uri := range uris {
|
|
uriStrings = append(uriStrings, uri.String())
|
|
}
|
|
return uriStrings
|
|
}
|
|
|
|
// saveCertificate saves a certificate to a file and returns the file ID
|
|
func (s *CertificateService) saveCertificate(cert *x509.Certificate, certType models.CertificateType) (string, error) {
|
|
// Create certificate directory if it doesn't exist
|
|
if err := os.MkdirAll(s.certDir, 0755); err != nil {
|
|
return "", fmt.Errorf("failed to create certificate directory: %w", err)
|
|
}
|
|
|
|
// Generate file ID
|
|
fileID := fmt.Sprintf("%s-%s", certType, uuid.New().String())
|
|
|
|
// Export certificate to PEM
|
|
exporter := utils.NewCertificateExporter()
|
|
certPEM, err := exporter.ExportCertificateToPEM(cert)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to export certificate to PEM: %w", err)
|
|
}
|
|
|
|
// Save to file
|
|
certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", fileID))
|
|
if err := os.WriteFile(certPath, certPEM, 0644); err != nil {
|
|
return "", fmt.Errorf("failed to write certificate file: %w", err)
|
|
}
|
|
|
|
return fileID, nil
|
|
}
|
|
|
|
// savePrivateKey saves a private key to a file and returns the file ID
|
|
func (s *CertificateService) savePrivateKey(privateKey interface{}, certType models.CertificateType) (string, error) {
|
|
// Create private key directory if it doesn't exist
|
|
if err := os.MkdirAll(s.privateDir, 0700); err != nil {
|
|
return "", fmt.Errorf("failed to create private key directory: %w", err)
|
|
}
|
|
|
|
// Generate file ID
|
|
fileID := fmt.Sprintf("%s-%s", certType, uuid.New().String())
|
|
|
|
// Export private key to PEM
|
|
exporter := utils.NewCertificateExporter()
|
|
keyPEM, err := exporter.ExportPrivateKeyToPEM(privateKey)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to export private key to PEM: %w", err)
|
|
}
|
|
|
|
// Save to file
|
|
keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", fileID))
|
|
if err := os.WriteFile(keyPath, keyPEM, 0600); err != nil {
|
|
return "", fmt.Errorf("failed to write private key file: %w", err)
|
|
}
|
|
|
|
return fileID, nil
|
|
}
|
|
|
|
// cleanupFiles removes certificate and private key files
|
|
func (s *CertificateService) cleanupFiles(certFileID, privateKeyFileID string) {
|
|
if certFileID != "" {
|
|
certPath := filepath.Join(s.certDir, fmt.Sprintf("%s.crt", certFileID))
|
|
os.Remove(certPath)
|
|
}
|
|
|
|
if privateKeyFileID != "" {
|
|
keyPath := filepath.Join(s.privateDir, fmt.Sprintf("%s.key", privateKeyFileID))
|
|
os.Remove(keyPath)
|
|
}
|
|
}
|
|
|
|
// validateCreateCertificateRequest validates a certificate creation request
|
|
func (s *CertificateService) validateCreateCertificateRequest(req *CreateCertificateRequest) error {
|
|
if req.Name == "" {
|
|
return fmt.Errorf("name is required")
|
|
}
|
|
if req.CommonName == "" {
|
|
return fmt.Errorf("common name is required")
|
|
}
|
|
if req.Organization == "" {
|
|
return fmt.Errorf("organization is required")
|
|
}
|
|
if req.Country == "" {
|
|
return fmt.Errorf("country is required")
|
|
}
|
|
if req.CertificateAuthorityID == uuid.Nil {
|
|
return fmt.Errorf("certificate authority ID is required")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// validateCreateCertificateFromCSRRequest validates a certificate creation from CSR request
|
|
func (s *CertificateService) validateCreateCertificateFromCSRRequest(req *CreateCertificateFromCSRRequest) error {
|
|
if req.Name == "" {
|
|
return fmt.Errorf("name is required")
|
|
}
|
|
if req.CSRID == uuid.Nil {
|
|
return fmt.Errorf("CSR ID is required")
|
|
}
|
|
if req.CertificateAuthorityID == uuid.Nil {
|
|
return fmt.Errorf("certificate authority ID is required")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Request structures
|
|
|
|
// CreateCertificateRequest represents a request to create a certificate
|
|
type CreateCertificateRequest struct {
|
|
Name string
|
|
Description string
|
|
CommonName string
|
|
Organization string
|
|
OrganizationalUnit string
|
|
Country string
|
|
State string
|
|
Locality string
|
|
Street string
|
|
Address string
|
|
PostalCode string
|
|
Email string
|
|
Type models.CertificateType
|
|
CertificateAuthorityID uuid.UUID
|
|
RequestID *uuid.UUID
|
|
|
|
// Validity period
|
|
NotBefore *time.Time
|
|
NotAfter *time.Time
|
|
ValidityYears int // Custom validity period in years (overrides NotAfter if set)
|
|
|
|
// Subject Alternative Names
|
|
DNSNames []string
|
|
IPAddresses []net.IP
|
|
EmailAddresses []string
|
|
URIs []string
|
|
|
|
// Key configuration
|
|
KeyType string // "rsa" or "ecdsa"
|
|
KeySize int // RSA key size (2048, 3072, 4096)
|
|
Curve string // ECDSA curve ("P-256", "P-384", "P-521")
|
|
|
|
// Custom key usage
|
|
KeyUsage *KeyUsageConfig
|
|
|
|
// Custom extended key usage
|
|
ExtendedKeyUsage *ExtendedKeyUsageConfig
|
|
}
|
|
|
|
// CreateCertificateFromCSRRequest represents a request to create a certificate from a CSR
|
|
type CreateCertificateFromCSRRequest struct {
|
|
Name string
|
|
Description string
|
|
Type models.CertificateType
|
|
CSRID uuid.UUID
|
|
CertificateAuthorityID uuid.UUID
|
|
|
|
// Validity period
|
|
NotBefore *time.Time
|
|
NotAfter *time.Time
|
|
ValidityYears int // Custom validity period in years (overrides NotAfter if set)
|
|
|
|
// Key configuration
|
|
KeyType string // "rsa" or "ecdsa"
|
|
KeySize int // RSA key size (2048, 3072, 4096)
|
|
Curve string // ECDSA curve ("P-256", "P-384", "P-521")
|
|
|
|
// Custom key usage
|
|
KeyUsage *KeyUsageConfig
|
|
|
|
// Custom extended key usage
|
|
ExtendedKeyUsage *ExtendedKeyUsageConfig
|
|
}
|
|
|
|
// KeyUsageConfig represents key usage configuration
|
|
type KeyUsageConfig struct {
|
|
DigitalSignature bool
|
|
ContentCommitment bool
|
|
KeyEncipherment bool
|
|
DataEncipherment bool
|
|
KeyAgreement bool
|
|
KeyCertSign bool
|
|
CRLSign bool
|
|
EncipherOnly bool
|
|
DecipherOnly bool
|
|
}
|
|
|
|
// ExtendedKeyUsageConfig represents extended key usage configuration
|
|
type ExtendedKeyUsageConfig struct {
|
|
ServerAuth bool
|
|
ClientAuth bool
|
|
CodeSigning bool
|
|
EmailProtection bool
|
|
TimeStamping bool
|
|
OCSPSigning bool
|
|
}
|