go - 使用更新的 CommonName 重新生成新的 x509 证书

Question

我有一个编码的 x509 证书，我想更新 CommonName(又名主题或主机名)。

这是我到目前为止的代码(简化):

import (
    "crypto/tls",   
    "crypto/x509"
)

...

// parses a public/private key pair from a pair of PEM encoded data
c, _ := tls.X509KeyPair(certPEMBlock, keyPEMBlock)

// parse into a x509 cert object
cert, _ := x509.ParseCertificate(c.Certificate[0])

// I want to modify the Subject here

// I want to encode it back to PEM encoded data of type []bytes

...

知道如何更新主题并将其编码回 []bytes 类型的 PEM 编码数据吗？

Answer 1

您可以创建一个新证书，其代码如下所示。为此，您需要 CA 私钥:

func GenerateCertificate(ca *x509.Certificate, caKey crypto.PrivateKey, req x509.CertificateRequest, durYear, durMonth int, keyUsage x509.KeyUsage, extKeyUsage []x509.ExtKeyUsage, rsaKeySize int) (certificate, key *pem.Block, err error) {

    cert := &x509.Certificate{
        Version:         req.Version,
        SerialNumber:    RandomBigInt(),
        Subject:         req.Subject,
        Extensions:      req.Extensions,
        ExtraExtensions: req.ExtraExtensions,
        DNSNames:        req.DNSNames,
        EmailAddresses:  req.EmailAddresses,
        IPAddresses:     req.IPAddresses,
        URIs:            req.URIs,
        NotBefore:       time.Now(),
        NotAfter:        time.Now().AddDate(durYear, durMonth, 0),
        ExtKeyUsage:     extKeyUsage,
        KeyUsage:        keyUsage,
    }
    priv, _ := rsa.GenerateKey(rand.Reader, rsaKeySize)
    pub := &priv.PublicKey

    var data []byte
    data, err = x509.CreateCertificate(rand.Reader, cert, ca, pub, caKey)
    if err != nil {
        return
    }
    // Public key
    certificate = &pem.Block{Type: "CERTIFICATE", Bytes: data}
    // Private key
    key = &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}
    return
}

将其用作:

    subject := pkix.Name{CommonName:"name"}
    cert, certKey, err := GenerateCertificate(caCert, key, x509.CertificateRequest{Subject: subject}, 1, 0, x509.KeyUsageDigitalSignature,
        []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth}, 2048)

您需要找出 key 用法、ext key 用法等或从旧证书中复制它们。您可以初始化从您拥有的旧证书传递到 GenerateCertificate 的证书请求。

如果你需要一个自签名证书，你可以使用类似下面的东西(我用它来生成一个自签名 CA)。您必须将旧证书中的信息复制到此证书中。

func GenerateCA(subject pkix.Name, duryear, durmonth int, rsaKeySize int) (certificate, key *pem.Block, err error) {
    ca := &x509.Certificate{
        SerialNumber:          RandomBigInt(),
        Subject:               subject,
        NotBefore:             time.Now(),
        NotAfter:              time.Now().AddDate(duryear, durmonth, 0),
        IsCA:                  false, // or true?
        ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
        KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
        BasicConstraintsValid: true,
    }

    priv, _ := rsa.GenerateKey(rand.Reader, rsaKeySize)
    pub := &priv.PublicKey
    var data []byte
    data, err = x509.CreateCertificate(rand.Reader, ca, ca, pub, priv)
    if err != nil {
        return
    }

    // Public key
    certificate = &pem.Block{Type: "CERTIFICATE", Bytes: data}
    // Private key
    key = &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}
    return
}