// CreateSignRequest is a helper function that given an x509 OTT returns a
// simple but secure sign request as well as the private key used.
CreateSignRequest is a helper function that given an x509 OTT returns a
simple but secure sign request as well as the private key used.
// CreateSignRequest is a helper function that given an x509 OTT returns a // simple but secure sign request as well as the private key used .
func CreateSignRequest(ott string) (*api.SignRequest, crypto.PrivateKey, error) {
	token, err := jwt.ParseSigned(ott)
	if err != nil {
		return nil, nil, errors.Wrap(err, "error parsing ott")
	}
	var claims authority.Claims
	if err := token.UnsafeClaimsWithoutVerification(&claims); err != nil {
		return nil, nil, errors.Wrap(err, "error parsing ott")
	}
	pk, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, nil, errors.Wrap(err, "error generating key")
	}
	dnsNames, ips, emails, uris := x509util.SplitSANs(claims.SANs)
	if claims.Email != "" {
		emails = append(emails, claims.Email)
	}
	template := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: claims.Subject,
		},
		SignatureAlgorithm: x509.ECDSAWithSHA256,
		DNSNames:           dnsNames,
		IPAddresses:        ips,
		EmailAddresses:     emails,
		URIs:               uris,
	}
	csr, err := x509.CreateCertificateRequest(rand.Reader, template, pk)
	if err != nil {
		return nil, nil, errors.Wrap(err, "error creating certificate request")
	}
	cr, err := x509.ParseCertificateRequest(csr)
	if err != nil {
		return nil, nil, errors.Wrap(err, "error parsing certificate request")
	}
	if err := cr.CheckSignature(); err != nil {
		return nil, nil, errors.Wrap(err, "error signing certificate request")
	}
	return &api.SignRequest{
		CsrPEM: api.CertificateRequest{CertificateRequest: cr},
		OTT:    ott,
	}, pk, nil
}
func CreateSignRequest ( ott string ) ( * api . SignRequest , crypto . PrivateKey , error ) { token , err := jwt . ParseSigned ( ott ) if err != nil { return nil , nil , errors . Wrap ( err , " " ) } var claims authority . Claims if err := token . UnsafeClaimsWithoutVerification ( & claims ) ; err != nil { return nil , nil , errors . Wrap ( err , " " ) } pk , err := ecdsa . GenerateKey ( elliptic . P256 ( ) , rand . Reader ) if err != nil { return nil , nil , errors . Wrap ( err , " " ) } dnsNames , ips , emails , uris := x509util . SplitSANs ( claims . SANs ) if claims . Email != " " { emails = append ( emails , claims . Email ) } template := & x509 . CertificateRequest { Subject : pkix . Name { CommonName : claims . Subject , } , SignatureAlgorithm : x509 . ECDSAWithSHA256 , DNSNames : dnsNames , IPAddresses : ips , EmailAddresses : emails , URIs : uris , } csr , err := x509 . CreateCertificateRequest ( rand . Reader , template , pk ) if err != nil { return nil , nil , errors . Wrap ( err , " " ) } cr , err := x509 . ParseCertificateRequest ( csr ) if err != nil { return nil , nil , errors . Wrap ( err , " " ) } if err := cr . CheckSignature ( ) ; err != nil { return nil , nil , errors . Wrap ( err , " " ) } return & api . SignRequest { CsrPEM : api . CertificateRequest { CertificateRequest : cr } , OTT : ott , } , pk , nil }
CreateSignRequest is a helper function that given an x509 OTT returns a
simple but secure sign request as well as the private key used.
CreateSignRequest is a helper function that given an x509 OTT returns a simple but secure sign request as well as the private key used .