@@ -38,14 +38,13 @@ import (
3838 "strings"
3939)
4040
41- // LoadKeyFile loads a SSL keyfile formatted for the arangod server.
42- func LoadKeyFile (keyFile string ) (tls.Certificate , error ) {
43- raw , err := ioutil .ReadFile (keyFile )
44- if err != nil {
45- return tls.Certificate {}, maskAny (err )
46- }
41+ // Keyfile contains 1 or more certificates and a private key.
42+ type Keyfile tls.Certificate
4743
48- result := tls.Certificate {}
44+ // NewKeyfile creates a keyfile from given content.
45+ func NewKeyfile (content string ) (Keyfile , error ) {
46+ raw := []byte (content )
47+ result := Keyfile {}
4948 for {
5049 var derBlock * pem.Block
5150 derBlock , raw = pem .Decode (raw )
@@ -56,22 +55,74 @@ func LoadKeyFile(keyFile string) (tls.Certificate, error) {
5655 result .Certificate = append (result .Certificate , derBlock .Bytes )
5756 } else if derBlock .Type == "PRIVATE KEY" || strings .HasSuffix (derBlock .Type , " PRIVATE KEY" ) {
5857 if result .PrivateKey == nil {
58+ var err error
5959 result .PrivateKey , err = parsePrivateKey (derBlock .Bytes )
6060 if err != nil {
61- return tls. Certificate {}, maskAny (err )
61+ return Keyfile {}, maskAny (err )
6262 }
6363 }
6464 }
6565 }
66+ return result , nil
67+ }
6668
67- if len (result .Certificate ) == 0 {
68- return tls.Certificate {}, maskAny (fmt .Errorf ("No certificates found in %s" , keyFile ))
69+ // Validate the contents of the keyfile
70+ func (kf Keyfile ) Validate () error {
71+ if len (kf .Certificate ) == 0 {
72+ return maskAny (fmt .Errorf ("No certificates found in keyfile" ))
6973 }
70- if result .PrivateKey == nil {
71- return tls. Certificate {}, maskAny (fmt .Errorf ("No private key found in %s" , keyFile ))
74+ if kf .PrivateKey == nil {
75+ return maskAny (fmt .Errorf ("No private key found in keyfile" ))
7276 }
7377
74- return result , nil
78+ return nil
79+ }
80+
81+ // EncodeCACertificates extracts the CA certificate(s) from the given keyfile (if any).
82+ func (kf Keyfile ) EncodeCACertificates () (string , error ) {
83+ buf := & bytes.Buffer {}
84+ for _ , derBytes := range kf .Certificate {
85+ c , err := x509 .ParseCertificate (derBytes )
86+ if err != nil {
87+ return "" , maskAny (err )
88+ }
89+ if c .IsCA {
90+ pem .Encode (buf , & pem.Block {Type : "CERTIFICATE" , Bytes : derBytes })
91+ }
92+ }
93+
94+ return buf .String (), nil
95+ }
96+
97+ // EncodeCertificates extracts all certificates from the given keyfile and encodes them as PEM blocks.
98+ func (kf Keyfile ) EncodeCertificates () string {
99+ buf := & bytes.Buffer {}
100+ for _ , derBytes := range kf .Certificate {
101+ pem .Encode (buf , & pem.Block {Type : "CERTIFICATE" , Bytes : derBytes })
102+ }
103+
104+ return buf .String ()
105+ }
106+
107+ // EncodePrivateKey extract the private key from the given keyfile and encodes is as PEM block.
108+ func (kf Keyfile ) EncodePrivateKey () string {
109+ buf := & bytes.Buffer {}
110+ pem .Encode (buf , pemBlockForKey (kf .PrivateKey ))
111+ return buf .String ()
112+ }
113+
114+ // LoadKeyFile loads a SSL keyfile formatted for the arangod server.
115+ func LoadKeyFile (keyFile string ) (tls.Certificate , error ) {
116+ raw , err := ioutil .ReadFile (keyFile )
117+ if err != nil {
118+ return tls.Certificate {}, maskAny (err )
119+ }
120+
121+ kf , err := NewKeyfile (string (raw ))
122+ if err != nil {
123+ return tls.Certificate {}, maskAny (err )
124+ }
125+ return tls .Certificate (kf ), nil
75126}
76127
77128// ExtractCACertificateFromKeyFile loads a SSL keyfile formatted for the arangod server and
0 commit comments