tls_certs.go

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"math/big"
	"os"
	"time"
)

func getTlsCert() (*tls.Certificate, error) {
	_, certExists := os.Stat("tlskeys/auth-test-osucyber-club-selfsigned-cert.pem")
	_, keyExists := os.Stat("tlskeys/auth-test-osucyber-club-selfsigned-key.pem")

	if certExists == nil && keyExists == nil {
		cert, err := tls.LoadX509KeyPair("tlskeys/auth-test-osucyber-club-selfsigned-cert.pem", "tlskeys/auth-test-osucyber-club-selfsigned-key.pem")
		if err != nil {
			return nil, err
		}

		return &cert, nil
	}

	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, err
	}

	serialNumber, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 64))

	now := time.Now()
	certTemplate := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			CommonName:         "auth-test.osucyber.club",
			Country:            []string{"US"},
			Organization:       []string{"Cyber Security Club @ The Ohio State University"},
			Locality:           []string{"Columbus"},
			Province:           []string{"OH"},
			OrganizationalUnit: []string{"auth-autogenerated"},
		},
		NotBefore:      now,
		NotAfter:       now.AddDate(1, 0, 0), // Valid for 1 year
		DNSNames:       []string{"auth-test.osucyber.club"},
		EmailAddresses: []string{"info@osucyber.club"},

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	certBytes, err := x509.CreateCertificate(rand.Reader, &certTemplate, &certTemplate, &privateKey.PublicKey, privateKey)
	if err != nil {
		return nil, err
	}

	privateKeyPEM := pem.EncodeToMemory(&pem.Block{
		Type:  "PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
	})

	_ = os.MkdirAll("tlskeys", 0700)

	if err := os.WriteFile("tlskeys/auth-test-osucyber-club-selfsigned-key.pem", privateKeyPEM, 0600); err != nil {
		return nil, err
	}

	certificatePEM := pem.EncodeToMemory(&pem.Block{
		Type:  "CERTIFICATE",
		Bytes: certBytes,
	})

	if err := os.WriteFile("tlskeys/auth-test-osucyber-club-selfsigned-cert.pem", certificatePEM, 0644); err != nil {
		return nil, err
	}

	tlsCert, err := tls.X509KeyPair(certificatePEM, privateKeyPEM)
	if err != nil {
		return nil, err
	}

	return &tlsCert, nil
}