// FillTemplate is a utility function that tries to load as much of
// the certificate template as possible from the profiles and current
// template. It fills in the key uses, expiration, revocation URLs
// and SKI.
FillTemplate is a utility function that tries to load as much of
the certificate template as possible from the profiles and current
template. It fills in the key uses, expiration, revocation URLs
and SKI.
// FillTemplate is a utility function that tries to load as much of // the certificate template as possible from the profiles and current // template . It fills in the key uses expiration revocation URLs // and SKI .
func FillTemplate(template *x509.Certificate, defaultProfile, profile *config.SigningProfile, notBefore time.Time, notAfter time.Time) error {
	ski, err := ComputeSKI(template)
	if err != nil {
		return err
	}
	var (
		eku             []x509.ExtKeyUsage
		ku              x509.KeyUsage
		backdate        time.Duration
		expiry          time.Duration
		crlURL, ocspURL string
		issuerURL       = profile.IssuerURL
	)
	ku, eku, _ = profile.Usages()
	if profile.IssuerURL == nil {
		issuerURL = defaultProfile.IssuerURL
	}
	if ku == 0 && len(eku) == 0 {
		return cferr.New(cferr.PolicyError, cferr.NoKeyUsages)
	}
	if expiry = profile.Expiry; expiry == 0 {
		expiry = defaultProfile.Expiry
	}
	if crlURL = profile.CRL; crlURL == "" {
		crlURL = defaultProfile.CRL
	}
	if ocspURL = profile.OCSP; ocspURL == "" {
		ocspURL = defaultProfile.OCSP
	}
	if notBefore.IsZero() {
		if !profile.NotBefore.IsZero() {
			notBefore = profile.NotBefore
		} else {
			if backdate = profile.Backdate; backdate == 0 {
				backdate = -5 * time.Minute
			} else {
				backdate = -1 * profile.Backdate
			}
			notBefore = time.Now().Round(time.Minute).Add(backdate)
		}
	}
	notBefore = notBefore.UTC()
	if notAfter.IsZero() {
		if !profile.NotAfter.IsZero() {
			notAfter = profile.NotAfter
		} else {
			notAfter = notBefore.Add(expiry)
		}
	}
	notAfter = notAfter.UTC()
	template.NotBefore = notBefore
	template.NotAfter = notAfter
	template.KeyUsage = ku
	template.ExtKeyUsage = eku
	template.BasicConstraintsValid = true
	template.IsCA = profile.CAConstraint.IsCA
	if template.IsCA {
		template.MaxPathLen = profile.CAConstraint.MaxPathLen
		if template.MaxPathLen == 0 {
			template.MaxPathLenZero = profile.CAConstraint.MaxPathLenZero
		}
		template.DNSNames = nil
		template.EmailAddresses = nil
		template.URIs = nil
	}
	template.SubjectKeyId = ski
	if ocspURL != "" {
		template.OCSPServer = []string{ocspURL}
	}
	if crlURL != "" {
		template.CRLDistributionPoints = []string{crlURL}
	}
	if len(issuerURL) != 0 {
		template.IssuingCertificateURL = issuerURL
	}
	if len(profile.Policies) != 0 {
		err = addPolicies(template, profile.Policies)
		if err != nil {
			return cferr.Wrap(cferr.PolicyError, cferr.InvalidPolicy, err)
		}
	}
	if profile.OCSPNoCheck {
		ocspNoCheckExtension := pkix.Extension{
			Id:       asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 48, 1, 5},
			Critical: false,
			Value:    []byte{0x05, 0x00},
		}
		template.ExtraExtensions = append(template.ExtraExtensions, ocspNoCheckExtension)
	}
	return nil
}
func FillTemplate ( template * x509 . Certificate , defaultProfile , profile * config . SigningProfile , notBefore time . Time , notAfter time . Time ) error { ski , err := ComputeSKI ( template ) if err != nil { return err } var ( eku [ ] x509 . ExtKeyUsage ku x509 . KeyUsage backdate time . Duration expiry time . Duration crlURL , ocspURL string issuerURL = profile . IssuerURL ) ku , eku , _ = profile . Usages ( ) if profile . IssuerURL == nil { issuerURL = defaultProfile . IssuerURL } if ku == 0 && len ( eku ) == 0 { return cferr . New ( cferr . PolicyError , cferr . NoKeyUsages ) } if expiry = profile . Expiry ; expiry == 0 { expiry = defaultProfile . Expiry } if crlURL = profile . CRL ; crlURL == " " { crlURL = defaultProfile . CRL } if ocspURL = profile . OCSP ; ocspURL == " " { ocspURL = defaultProfile . OCSP } if notBefore . IsZero ( ) { if ! profile . NotBefore . IsZero ( ) { notBefore = profile . NotBefore } else { if backdate = profile . Backdate ; backdate == 0 { backdate = - 5 * time . Minute } else { backdate = - 1 * profile . Backdate } notBefore = time . Now ( ) . Round ( time . Minute ) . Add ( backdate ) } } notBefore = notBefore . UTC ( ) if notAfter . IsZero ( ) { if ! profile . NotAfter . IsZero ( ) { notAfter = profile . NotAfter } else { notAfter = notBefore . Add ( expiry ) } } notAfter = notAfter . UTC ( ) template . NotBefore = notBefore template . NotAfter = notAfter template . KeyUsage = ku template . ExtKeyUsage = eku template . BasicConstraintsValid = true template . IsCA = profile . CAConstraint . IsCA if template . IsCA { template . MaxPathLen = profile . CAConstraint . MaxPathLen if template . MaxPathLen == 0 { template . MaxPathLenZero = profile . CAConstraint . MaxPathLenZero } template . DNSNames = nil template . EmailAddresses = nil template . URIs = nil } template . SubjectKeyId = ski if ocspURL != " " { template . OCSPServer = [ ] string { ocspURL } } if crlURL != " " { template . CRLDistributionPoints = [ ] string { crlURL } } if len ( issuerURL ) != 0 { template . IssuingCertificateURL = issuerURL } if len ( profile . Policies ) != 0 { err = addPolicies ( template , profile . Policies ) if err != nil { return cferr . Wrap ( cferr . PolicyError , cferr . InvalidPolicy , err ) } } if profile . OCSPNoCheck { ocspNoCheckExtension := pkix . Extension { Id : asn1 . ObjectIdentifier { 1 , 3 , 6 , 1 , 5 , 5 , 7 , 48 , 1 , 5 } , Critical : false , Value : [ ] byte { 0x05 , 0x00 } , } template . ExtraExtensions = append ( template . ExtraExtensions , ocspNoCheckExtension ) } return nil }
FillTemplate is a utility function that tries to load as much of
the certificate template as possible from the profiles and current
template.
FillTemplate is a utility function that tries to load as much of the certificate template as possible from the profiles and current template .
// The third value returned from Usages is a list of unknown key usages. // This should be used when validating the profile at load, and isn't used // here.