HMC/shhh
11
2 Fork 0
Code Issues Pull Requests Actions Packages Releases 4 Wiki Activity

fix: Bug where the ca key was being persisted to disk instead of client/server

Browse Source 
Also fixes naming of some variables leftover from bad copy-paste.
This commit is contained in:
jmug committed 2026-10-24 00:25:35 -07:00
1 parent f6991cbe1d
commit 9bdbc79458
3 files changed
+22 -22
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/clis/hmpki/generate_ca.go
+2 -2
View File
@@ -64,13 +64,13 @@ var generateCACmd = &cobra.Command{
}) })
// Write ca to disk. // Write ca to disk.
cafn := path.Join(OutDir, Name+"_ca.crt") cafn := path.Join(OutDir, Name+".crt")
err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms) err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms)
if err != nil { if err != nil {
return err return err
} }
// Write private key to disk. // Write private key to disk.
keyfn := path.Join(OutDir, Name+"_ca.key") keyfn := path.Join(OutDir, Name+".key")
err = createFileWith(keyfn, pki.MarshalKeyToPEM(key), pki.PrivateKeyFilePerms) err = createFileWith(keyfn, pki.MarshalKeyToPEM(key), pki.PrivateKeyFilePerms)
if err != nil { if err != nil {
return err return err
internal/clis/hmpki/generate_client_cert.go
+9 -9
View File
@@ -56,7 +56,7 @@ var generateClientCertCmd = &cobra.Command{
} }
certKey := pki.NewKey() certKey := pki.NewKey()
caTmpl := &x509.Certificate{ clientCrtTmpl := &x509.Certificate{
SerialNumber: pki.NewCertSerialNumber(), SerialNumber: pki.NewCertSerialNumber(),
Subject: pkix.Name{ Subject: pkix.Name{
CommonName: CommonName, CommonName: CommonName,
@@ -64,7 +64,7 @@ var generateClientCertCmd = &cobra.Command{
// Leaf certs valid for 1 year. // Leaf certs valid for 1 year.
NotBefore: time.Now(), NotBefore: time.Now(),
NotAfter: time.Now().AddDate(1, 0, 0), NotAfter: time.Now().AddDate(1, 0, 0),
// This cert is a CA. // This cert is a leaf, and not a CA.
IsCA: false, IsCA: false,
// Disambiguate `IsCA` // Disambiguate `IsCA`
BasicConstraintsValid: true, BasicConstraintsValid: true,
@@ -72,9 +72,9 @@ var generateClientCertCmd = &cobra.Command{
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
} }
caBytes, err := x509.CreateCertificate( clientCrtBytes, err := x509.CreateCertificate(
rand.Reader, rand.Reader,
caTmpl, clientCrtTmpl,
// CA is the parent. // CA is the parent.
ca, ca,
// The cert embeds its own public key. // The cert embeds its own public key.
@@ -82,20 +82,20 @@ var generateClientCertCmd = &cobra.Command{
// The CA's private key is the one signing the leaf cert. // The CA's private key is the one signing the leaf cert.
caKey, caKey,
) )
caPEMBytes := pem.EncodeToMemory(&pem.Block{ clientCrtPEMBytes := pem.EncodeToMemory(&pem.Block{
Type: pki.PEMTypeCertificate, Type: pki.PEMTypeCertificate,
Bytes: caBytes, Bytes: clientCrtBytes,
}) })
// Write cert to disk. // Write cert to disk.
cafn := path.Join(OutDir, Name+".crt") crtfn := path.Join(OutDir, Name+".crt")
err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms) err = createFileWith(crtfn, clientCrtPEMBytes, pki.CertFilePerms)
if err != nil { if err != nil {
return err return err
} }
// Write cert private key to disk. // Write cert private key to disk.
keyfn := path.Join(OutDir, Name+".key") keyfn := path.Join(OutDir, Name+".key")
err = createFileWith(keyfn, pki.MarshalKeyToPEM(caKey), pki.PrivateKeyFilePerms) err = createFileWith(keyfn, pki.MarshalKeyToPEM(certKey), pki.PrivateKeyFilePerms)
if err != nil { if err != nil {
return err return err
} }
internal/clis/hmpki/generate_server_cert.go
+11 -11
View File
@@ -84,8 +84,8 @@ var generateServerCertCmd = &cobra.Command{
ips = append(ips, ip) ips = append(ips, ip)
} }
certKey := pki.NewKey() crtKey := pki.NewKey()
caTmpl := &x509.Certificate{ serverCrtTmpl := &x509.Certificate{
SerialNumber: pki.NewCertSerialNumber(), SerialNumber: pki.NewCertSerialNumber(),
Subject: pkix.Name{ Subject: pkix.Name{
CommonName: CommonName, CommonName: CommonName,
@@ -95,7 +95,7 @@ var generateServerCertCmd = &cobra.Command{
// Leaf certs valid for 1 year. // Leaf certs valid for 1 year.
NotBefore: time.Now(), NotBefore: time.Now(),
NotAfter: time.Now().AddDate(1, 0, 0), NotAfter: time.Now().AddDate(1, 0, 0),
// This cert is a CA. // This cert is a leaf, and not a CA.
IsCA: false, IsCA: false,
// Disambiguate `IsCA` // Disambiguate `IsCA`
BasicConstraintsValid: true, BasicConstraintsValid: true,
@@ -103,30 +103,30 @@ var generateServerCertCmd = &cobra.Command{
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
} }
caBytes, err := x509.CreateCertificate( serverCrtBytes, err := x509.CreateCertificate(
rand.Reader, rand.Reader,
caTmpl, serverCrtTmpl,
// CA is the parent. // CA is the parent.
ca, ca,
// The cert embeds its own public key. // The cert embeds its own public key.
&certKey.PublicKey, &crtKey.PublicKey,
// The CA's private key is the one signing the leaf cert. // The CA's private key is the one signing the leaf cert.
caKey, caKey,
) )
caPEMBytes := pem.EncodeToMemory(&pem.Block{ serverCrtPEMBytes := pem.EncodeToMemory(&pem.Block{
Type: pki.PEMTypeCertificate, Type: pki.PEMTypeCertificate,
Bytes: caBytes, Bytes: serverCrtBytes,
}) })
// Write cert to disk. // Write cert to disk.
cafn := path.Join(OutDir, Name+".crt") crtfn := path.Join(OutDir, Name+".crt")
err = createFileWith(cafn, caPEMBytes, pki.CertFilePerms) err = createFileWith(crtfn, serverCrtPEMBytes, pki.CertFilePerms)
if err != nil { if err != nil {
return err return err
} }
// Write cert private key to disk. // Write cert private key to disk.
keyfn := path.Join(OutDir, Name+".key") keyfn := path.Join(OutDir, Name+".key")
err = createFileWith(keyfn, pki.MarshalKeyToPEM(caKey), pki.PrivateKeyFilePerms) err = createFileWith(keyfn, pki.MarshalKeyToPEM(crtKey), pki.PrivateKeyFilePerms)
if err != nil { if err != nil {
return err return err
} }