From 9bdbc7945896c9ffc7fa4d499221b16f9e89e852 Mon Sep 17 00:00:00 2001
From: jmug <u.g.a.mariano@gmail.com>
Date: Sat, 24 Oct 2026 00:25:35 -0700
Subject: [PATCH] fix: Bug where the ca key was being persisted to disk instead
 of client/server

Also fixes naming of some variables leftover from bad copy-paste.
---
 internal/clis/hmpki/generate_ca.go          |  4 ++--
 internal/clis/hmpki/generate_client_cert.go | 18 ++++++++---------
 internal/clis/hmpki/generate_server_cert.go | 22 ++++++++++-----------
 3 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/internal/clis/hmpki/generate_ca.go b/internal/clis/hmpki/generate_ca.go
index 4d8192f..40db723 100644
--- a/internal/clis/hmpki/generate_ca.go
+++ b/internal/clis/hmpki/generate_ca.go
@@ -64,13 +64,13 @@ var generateCACmd = &cobra.Command{
 		})
 
 		// Write ca to disk.
-		cafn := path.Join(OutDir, Name+"_ca.crt")
+		cafn := path.Join(OutDir, Name+".crt")
 		err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms)
 		if err != nil {
 			return err
 		}
 		// Write private key to disk.
-		keyfn := path.Join(OutDir, Name+"_ca.key")
+		keyfn := path.Join(OutDir, Name+".key")
 		err = createFileWith(keyfn, pki.MarshalKeyToPEM(key), pki.PrivateKeyFilePerms)
 		if err != nil {
 			return err
diff --git a/internal/clis/hmpki/generate_client_cert.go b/internal/clis/hmpki/generate_client_cert.go
index 51436ec..08c8294 100644
--- a/internal/clis/hmpki/generate_client_cert.go
+++ b/internal/clis/hmpki/generate_client_cert.go
@@ -56,7 +56,7 @@ var generateClientCertCmd = &cobra.Command{
 		}
 
 		certKey := pki.NewKey()
-		caTmpl := &x509.Certificate{
+		clientCrtTmpl := &x509.Certificate{
 			SerialNumber: pki.NewCertSerialNumber(),
 			Subject: pkix.Name{
 				CommonName: CommonName,
@@ -64,7 +64,7 @@ var generateClientCertCmd = &cobra.Command{
 			// Leaf certs valid for 1 year.
 			NotBefore: time.Now(),
 			NotAfter:  time.Now().AddDate(1, 0, 0),
-			// This cert is a CA.
+			// This cert is a leaf, and not a CA.
 			IsCA: false,
 			// Disambiguate `IsCA`
 			BasicConstraintsValid: true,
@@ -72,9 +72,9 @@ var generateClientCertCmd = &cobra.Command{
 			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 		}
 
-		caBytes, err := x509.CreateCertificate(
+		clientCrtBytes, err := x509.CreateCertificate(
 			rand.Reader,
-			caTmpl,
+			clientCrtTmpl,
 			// CA is the parent.
 			ca,
 			// The cert embeds its own public key.
@@ -82,20 +82,20 @@ var generateClientCertCmd = &cobra.Command{
 			// The CA's private key is the one signing the leaf cert.
 			caKey,
 		)
-		caPEMBytes := pem.EncodeToMemory(&pem.Block{
+		clientCrtPEMBytes := pem.EncodeToMemory(&pem.Block{
 			Type:  pki.PEMTypeCertificate,
-			Bytes: caBytes,
+			Bytes: clientCrtBytes,
 		})
 
 		// Write cert to disk.
-		cafn := path.Join(OutDir, Name+".crt")
-		err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms)
+		crtfn := path.Join(OutDir, Name+".crt")
+		err = createFileWith(crtfn, clientCrtPEMBytes, pki.CertFilePerms)
 		if err != nil {
 			return err
 		}
 		// Write cert private key to disk.
 		keyfn := path.Join(OutDir, Name+".key")
-		err = createFileWith(keyfn, pki.MarshalKeyToPEM(caKey), pki.PrivateKeyFilePerms)
+		err = createFileWith(keyfn, pki.MarshalKeyToPEM(certKey), pki.PrivateKeyFilePerms)
 		if err != nil {
 			return err
 		}
diff --git a/internal/clis/hmpki/generate_server_cert.go b/internal/clis/hmpki/generate_server_cert.go
index d1e2338..901105f 100644
--- a/internal/clis/hmpki/generate_server_cert.go
+++ b/internal/clis/hmpki/generate_server_cert.go
@@ -84,8 +84,8 @@ var generateServerCertCmd = &cobra.Command{
 			ips = append(ips, ip)
 		}
 
-		certKey := pki.NewKey()
-		caTmpl := &x509.Certificate{
+		crtKey := pki.NewKey()
+		serverCrtTmpl := &x509.Certificate{
 			SerialNumber: pki.NewCertSerialNumber(),
 			Subject: pkix.Name{
 				CommonName: CommonName,
@@ -95,7 +95,7 @@ var generateServerCertCmd = &cobra.Command{
 			// Leaf certs valid for 1 year.
 			NotBefore: time.Now(),
 			NotAfter:  time.Now().AddDate(1, 0, 0),
-			// This cert is a CA.
+			// This cert is a leaf, and not a CA.
 			IsCA: false,
 			// Disambiguate `IsCA`
 			BasicConstraintsValid: true,
@@ -103,30 +103,30 @@ var generateServerCertCmd = &cobra.Command{
 			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 		}
 
-		caBytes, err := x509.CreateCertificate(
+		serverCrtBytes, err := x509.CreateCertificate(
 			rand.Reader,
-			caTmpl,
+			serverCrtTmpl,
 			// CA is the parent.
 			ca,
 			// The cert embeds its own public key.
-			&certKey.PublicKey,
+			&crtKey.PublicKey,
 			// The CA's private key is the one signing the leaf cert.
 			caKey,
 		)
-		caPEMBytes := pem.EncodeToMemory(&pem.Block{
+		serverCrtPEMBytes := pem.EncodeToMemory(&pem.Block{
 			Type:  pki.PEMTypeCertificate,
-			Bytes: caBytes,
+			Bytes: serverCrtBytes,
 		})
 
 		// Write cert to disk.
-		cafn := path.Join(OutDir, Name+".crt")
-		err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms)
+		crtfn := path.Join(OutDir, Name+".crt")
+		err = createFileWith(crtfn, serverCrtPEMBytes, pki.CertFilePerms)
 		if err != nil {
 			return err
 		}
 		// Write cert private key to disk.
 		keyfn := path.Join(OutDir, Name+".key")
-		err = createFileWith(keyfn, pki.MarshalKeyToPEM(caKey), pki.PrivateKeyFilePerms)
+		err = createFileWith(keyfn, pki.MarshalKeyToPEM(crtKey), pki.PrivateKeyFilePerms)
 		if err != nil {
 			return err
 		}