mirror of
https://github.com/Noratrieb/terustform.git
synced 2026-01-14 16:35:11 +01:00
29 lines
1.3 KiB
Rust
29 lines
1.3 KiB
Rust
use eyre::{Context, Result};
|
|
use rcgen::{DistinguishedName, DnType, IsCa, KeyUsagePurpose};
|
|
use time::Duration;
|
|
|
|
pub fn generate_cert() -> Result<(tonic::transport::Identity, rcgen::Certificate)> {
|
|
// https://github.com/hashicorp/go-plugin/blob/8d2aaa458971cba97c3bfec1b0380322e024b514/mtls.go#L20
|
|
let keypair = rcgen::KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256)
|
|
.wrap_err("failed to generate keypair")?;
|
|
|
|
let mut params =
|
|
rcgen::CertificateParams::new(["localhost".to_owned()]).wrap_err("creating cert params")?;
|
|
params.key_usages = vec![
|
|
KeyUsagePurpose::DigitalSignature,
|
|
KeyUsagePurpose::KeyEncipherment,
|
|
KeyUsagePurpose::KeyAgreement,
|
|
KeyUsagePurpose::KeyCertSign,
|
|
];
|
|
params.is_ca = IsCa::Ca(rcgen::BasicConstraints::Unconstrained);
|
|
params.not_before = time::OffsetDateTime::now_utc().saturating_add(Duration::seconds(-30));
|
|
params.not_after = time::OffsetDateTime::now_utc().saturating_add(Duration::seconds(262980));
|
|
let mut dn = DistinguishedName::new();
|
|
dn.push(DnType::OrganizationName, "HashiCorp");
|
|
dn.push(DnType::CommonName, "localhost");
|
|
params.distinguished_name = dn;
|
|
|
|
let cert = params.self_signed(&keypair).wrap_err("signing cert")?;
|
|
|
|
Ok((tonic::transport::Identity::from_pem(cert.pem(), keypair.serialize_pem()), cert))
|
|
}
|