// tlsChallengeCert creates a temporary certificate for TLS-SNI challenges
// with the given SANs and auto-generated public/private key pair.
// To create a cert with a custom key pair, specify WithKey option.
tlsChallengeCert creates a temporary certificate for TLS-SNI challenges
with the given SANs and auto-generated public/private key pair.
To create a cert with a custom key pair, specify WithKey option.
// tlsChallengeCert creates a temporary certificate for TLS - SNI challenges // with the given SANs and auto - generated public / private key pair . // To create a cert with a custom key pair specify WithKey option .
func tlsChallengeCert(san []string, opt []CertOption) (tls.Certificate, error) {
	var (
		key  crypto.Signer
		tmpl *x509.Certificate
	)
	for _, o := range opt {
		switch o := o.(type) {
		case *certOptKey:
			if key != nil {
				return tls.Certificate{}, errors.New("acme: duplicate key option")
			}
			key = o.key
		case *certOptTemplate:
			var t = *(*x509.Certificate)(o) 
			tmpl = &t
		default:
			panic(fmt.Sprintf("unsupported option type %T", o))
		}
	}
	if key == nil {
		var err error
		if key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader); err != nil {
			return tls.Certificate{}, err
		}
	}
	if tmpl == nil {
		tmpl = &x509.Certificate{
			SerialNumber:          big.NewInt(1),
			NotBefore:             time.Now(),
			NotAfter:              time.Now().Add(24 * time.Hour),
			BasicConstraintsValid: true,
			KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		}
	}
	tmpl.DNSNames = san
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, key.Public(), key)
	if err != nil {
		return tls.Certificate{}, err
	}
	return tls.Certificate{
		Certificate: [][]byte{der},
		PrivateKey:  key,
	}, nil
}
func tlsChallengeCert ( san [ ] string , opt [ ] CertOption ) ( tls . Certificate , error ) { var ( key crypto . Signer tmpl * x509 . Certificate ) for _ , o := range opt { switch o := o . ( type ) { case * certOptKey : if key != nil { return tls . Certificate { } , errors . New ( " " ) } key = o . key case * certOptTemplate : var t = * ( * x509 . Certificate ) ( o ) tmpl = & t default : panic ( fmt . Sprintf ( " " , o ) ) } } if key == nil { var err error if key , err = ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader ) ; err != nil { return tls . Certificate { } , err } } if tmpl == nil { tmpl = & x509 . Certificate { SerialNumber : big . NewInt ( 1 ) , NotBefore : time . Now ( ) , NotAfter : time . Now ( ) . Add ( 24 * time . Hour ) , BasicConstraintsValid : true , KeyUsage : x509 . KeyUsageKeyEncipherment | x509 . KeyUsageDigitalSignature , ExtKeyUsage : [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth } , } } tmpl . DNSNames = san der , err := x509 . CreateCertificate ( rand . Reader , tmpl , tmpl , key . Public ( ) , key ) if err != nil { return tls . Certificate { } , err } return tls . Certificate { Certificate : [ ] [ ] byte { der } , PrivateKey : key , } , nil }
tlsChallengeCert creates a temporary certificate for TLS-SNI challenges
with the given SANs and auto-generated public/private key pair.
tlsChallengeCert creates a temporary certificate for TLS - SNI challenges with the given SANs and auto - generated public / private key pair .
// shallow copy is ok // package's fault, if we let this happen: