2020-11-29 23:08:05 +00:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2020-12-05 18:46:15 +00:00
|
|
|
"crypto/rand"
|
2020-11-29 23:08:05 +00:00
|
|
|
"crypto/tls"
|
2020-12-11 21:05:27 +00:00
|
|
|
"crypto/x509"
|
|
|
|
"encoding/base64"
|
2020-11-29 23:08:05 +00:00
|
|
|
"encoding/json"
|
2020-12-11 21:05:27 +00:00
|
|
|
"encoding/pem"
|
2020-11-29 23:08:05 +00:00
|
|
|
"fmt"
|
2020-12-04 23:21:18 +00:00
|
|
|
"html/template"
|
2020-11-29 23:08:05 +00:00
|
|
|
"io/ioutil"
|
|
|
|
"net/http"
|
2020-12-05 18:46:15 +00:00
|
|
|
"os"
|
2020-11-29 23:08:05 +00:00
|
|
|
"os/exec"
|
2020-12-11 21:05:27 +00:00
|
|
|
"os/signal"
|
2020-12-04 23:21:18 +00:00
|
|
|
"strings"
|
2020-12-11 21:05:27 +00:00
|
|
|
"syscall"
|
2020-11-29 23:08:05 +00:00
|
|
|
"time"
|
2020-12-04 23:21:18 +00:00
|
|
|
|
|
|
|
"github.com/BurntSushi/toml"
|
2020-12-05 18:46:15 +00:00
|
|
|
"github.com/gorilla/csrf"
|
2020-12-04 23:21:18 +00:00
|
|
|
"github.com/nicksnyder/go-i18n/v2/i18n"
|
2020-12-05 18:46:15 +00:00
|
|
|
log "github.com/sirupsen/logrus"
|
2020-12-04 23:21:18 +00:00
|
|
|
"golang.org/x/text/language"
|
2020-11-29 23:08:05 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type signCertificate struct{}
|
|
|
|
|
|
|
|
type requestData struct {
|
|
|
|
Csr string `json:"csr"`
|
|
|
|
CommonName string `json:"commonName"`
|
|
|
|
}
|
|
|
|
|
|
|
|
type responseData struct {
|
2020-12-11 21:05:27 +00:00
|
|
|
Certificate string `json:"certificate"`
|
|
|
|
CAChain []string `json:"ca_chain"`
|
2020-11-29 23:08:05 +00:00
|
|
|
}
|
|
|
|
|
2020-12-11 21:05:27 +00:00
|
|
|
var caCertificates []*x509.Certificate
|
|
|
|
|
|
|
|
func (h *signCertificate) sign(csrPem string, commonName string) (certPem string, caChain []string, err error) {
|
2020-11-29 23:08:05 +00:00
|
|
|
log.Printf("received CSR for %s:\n\n%s", commonName, csrPem)
|
|
|
|
subjectDN := fmt.Sprintf("/CN=%s", commonName)
|
2020-12-05 18:46:15 +00:00
|
|
|
var csrFile *os.File
|
|
|
|
if csrFile, err = ioutil.TempFile("", "*.csr.pem"); err != nil {
|
|
|
|
log.Errorf("could not open temporary file: %s", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if _, err = csrFile.Write([]byte(csrPem)); err != nil {
|
|
|
|
log.Errorf("could not write CSR to file: %s", err)
|
2020-11-29 23:08:05 +00:00
|
|
|
return
|
|
|
|
}
|
2020-12-05 18:46:15 +00:00
|
|
|
if err = csrFile.Close(); err != nil {
|
|
|
|
log.Errorf("could not close CSR file: %s", err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
defer func(file *os.File) {
|
|
|
|
err = os.Remove(file.Name())
|
|
|
|
if err != nil {
|
|
|
|
log.Errorf("could not remove temporary file: %s", err)
|
|
|
|
}
|
|
|
|
}(csrFile)
|
|
|
|
|
2020-11-29 23:08:05 +00:00
|
|
|
opensslCommand := exec.Command(
|
2020-12-05 18:46:15 +00:00
|
|
|
"openssl", "ca", "-config", "ca.cnf",
|
2020-11-29 23:08:05 +00:00
|
|
|
"-policy", "policy_match", "-extensions", "client_ext",
|
|
|
|
"-batch", "-subj", subjectDN, "-utf8", "-rand_serial", "-in", "in.pem")
|
|
|
|
var out, cmdErr bytes.Buffer
|
|
|
|
opensslCommand.Stdout = &out
|
|
|
|
opensslCommand.Stderr = &cmdErr
|
|
|
|
err = opensslCommand.Run()
|
|
|
|
if err != nil {
|
|
|
|
log.Print(err)
|
|
|
|
log.Print(cmdErr.String())
|
|
|
|
return
|
|
|
|
}
|
2020-12-11 21:05:27 +00:00
|
|
|
|
|
|
|
var block *pem.Block
|
|
|
|
if block, _ = pem.Decode(out.Bytes()); block == nil {
|
|
|
|
err = fmt.Errorf("could not decode pem")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
var certificate *x509.Certificate
|
|
|
|
if certificate, err = x509.ParseCertificate(block.Bytes); err != nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
certPem = string(pem.EncodeToMemory(&pem.Block{
|
|
|
|
Type: "CERTIFICATE",
|
|
|
|
Bytes: certificate.Raw,
|
|
|
|
}))
|
|
|
|
|
|
|
|
caChain, err = h.getCAChain(certificate)
|
2020-11-29 23:08:05 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
func (h *signCertificate) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
|
|
if r.Method != "POST" {
|
|
|
|
http.Error(w, "Only POST requests support", http.StatusMethodNotAllowed)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if r.Header.Get("content-type") != "application/json" {
|
|
|
|
http.Error(w, "Only JSON content is accepted", http.StatusNotAcceptable)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
var err error
|
|
|
|
var requestBody requestData
|
2020-12-11 21:05:27 +00:00
|
|
|
|
|
|
|
var responseData responseData
|
2020-11-29 23:08:05 +00:00
|
|
|
|
|
|
|
if err = json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
|
|
|
|
log.Print(err)
|
|
|
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-12-11 21:05:27 +00:00
|
|
|
responseData.Certificate, responseData.CAChain, err = h.sign(requestBody.Csr, requestBody.CommonName)
|
2020-11-29 23:08:05 +00:00
|
|
|
if err != nil {
|
|
|
|
http.Error(w, "Could not sign certificate", http.StatusInternalServerError)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
var jsonBytes []byte
|
2020-12-11 21:05:27 +00:00
|
|
|
if jsonBytes, err = json.Marshal(&responseData); err != nil {
|
2020-11-29 23:08:05 +00:00
|
|
|
log.Print(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, err = w.Write(jsonBytes); err != nil {
|
|
|
|
log.Print(err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-11 21:05:27 +00:00
|
|
|
func (*signCertificate) getCAChain(certificate *x509.Certificate) ([]string, error) {
|
|
|
|
result := make([]string, 0)
|
|
|
|
|
|
|
|
appendCert := func(cert *x509.Certificate) {
|
|
|
|
result = append(
|
|
|
|
result,
|
|
|
|
string(pem.EncodeToMemory(&pem.Block{Bytes: cert.Raw, Type: "CERTIFICATE"})))
|
|
|
|
log.Debugf("added %s to cachain", result[len(result)-1])
|
|
|
|
}
|
|
|
|
|
|
|
|
var previous *x509.Certificate
|
|
|
|
for {
|
|
|
|
if len(caCertificates) == 0 {
|
|
|
|
return result, nil
|
|
|
|
}
|
|
|
|
for _, caCert := range caCertificates {
|
|
|
|
if previous == nil {
|
|
|
|
if bytes.Equal(caCert.RawSubject, certificate.RawIssuer) {
|
|
|
|
previous = caCert
|
|
|
|
appendCert(caCert)
|
|
|
|
}
|
|
|
|
} else if bytes.Equal(previous.RawSubject, previous.RawIssuer) {
|
|
|
|
return result, nil
|
|
|
|
} else if bytes.Equal(caCert.RawSubject, previous.RawIssuer) {
|
|
|
|
previous = caCert
|
|
|
|
appendCert(caCert)
|
|
|
|
} else {
|
|
|
|
log.Debugf("skipped certificate %s", caCert.Subject)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-04 23:21:18 +00:00
|
|
|
type indexHandler struct {
|
|
|
|
Bundle *i18n.Bundle
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *indexHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
|
|
localizer := i18n.NewLocalizer(i.Bundle, r.Header.Get("Accept-Language"))
|
|
|
|
csrGenTitle := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "CSRGenTitle",
|
|
|
|
Other: "CSR generation in browser",
|
|
|
|
}})
|
|
|
|
nameLabel := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "NameLabel",
|
|
|
|
Other: "Your name",
|
|
|
|
}})
|
|
|
|
nameHelpText := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "NameHelpText",
|
|
|
|
Other: "Please input your name as it should be added to your certificate",
|
|
|
|
}})
|
|
|
|
passwordLabel := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "PasswordLabel",
|
|
|
|
Other: "Password for your client certificate",
|
|
|
|
}})
|
|
|
|
rsaKeySizeLegend := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "RSAKeySizeLabel",
|
|
|
|
Other: "RSA Key Size",
|
|
|
|
}})
|
|
|
|
rsa3072Label := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "RSA3072Label",
|
|
|
|
Other: "3072 Bit",
|
|
|
|
}})
|
|
|
|
rsa2048Label := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "RSA2048Label",
|
|
|
|
Other: "2048 Bit (not recommended)",
|
|
|
|
}})
|
|
|
|
rsa4096Label := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "RSA4096Label",
|
|
|
|
Other: "4096 Bit",
|
|
|
|
}})
|
|
|
|
rsaHelpText := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "RSAHelpText",
|
|
|
|
Other: "An RSA key pair will be generated in your browser. Longer key" +
|
|
|
|
" sizes provide better security but take longer to generate.",
|
|
|
|
}})
|
|
|
|
csrButtonLabel := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "CSRButtonLabel",
|
|
|
|
Other: "Generate signing request",
|
|
|
|
}})
|
|
|
|
statusLoading := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "StatusLoading",
|
|
|
|
Other: "Loading ...",
|
|
|
|
}})
|
2020-12-11 21:05:27 +00:00
|
|
|
downloadLabel := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "DownloadLabel",
|
|
|
|
Other: "Download",
|
|
|
|
}})
|
|
|
|
downloadDescription := localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "DownloadDescription",
|
|
|
|
Other: "Your key material is ready for download. The downloadable file contains your private key and your" +
|
|
|
|
" certificate encrypted with your password. You can now use the file to install your certificate in your" +
|
|
|
|
" browser or other applications.",
|
2020-12-04 23:21:18 +00:00
|
|
|
}})
|
|
|
|
|
|
|
|
t := template.Must(template.ParseFiles("templates/index.html"))
|
|
|
|
err := t.Execute(w, map[string]interface{}{
|
2020-12-11 21:05:27 +00:00
|
|
|
"Title": csrGenTitle,
|
|
|
|
"NameLabel": nameLabel,
|
|
|
|
"NameHelpText": nameHelpText,
|
|
|
|
"PasswordLabel": passwordLabel,
|
|
|
|
"RSAKeySizeLegend": rsaKeySizeLegend,
|
|
|
|
"RSA3072Label": rsa3072Label,
|
|
|
|
"RSA2048Label": rsa2048Label,
|
|
|
|
"RSA4096Label": rsa4096Label,
|
|
|
|
"RSAHelpText": rsaHelpText,
|
|
|
|
"CSRButtonLabel": csrButtonLabel,
|
|
|
|
"StatusLoading": statusLoading,
|
|
|
|
"DownloadDescription": downloadDescription,
|
|
|
|
"DownloadLabel": downloadLabel,
|
|
|
|
csrf.TemplateTag: csrf.TemplateField(r),
|
2020-12-04 23:21:18 +00:00
|
|
|
})
|
|
|
|
if err != nil {
|
|
|
|
log.Panic(err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
type jsLocalesHandler struct {
|
|
|
|
Bundle *i18n.Bundle
|
|
|
|
}
|
|
|
|
|
|
|
|
func (j *jsLocalesHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
|
|
parts := strings.Split(r.URL.Path, "/")
|
|
|
|
if len(parts) != 4 {
|
|
|
|
http.Error(w, "Not found", http.StatusNotFound)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
lang := parts[2]
|
|
|
|
|
|
|
|
localizer := i18n.NewLocalizer(j.Bundle, lang)
|
|
|
|
|
|
|
|
type translationData struct {
|
|
|
|
Keygen struct {
|
|
|
|
Started string `json:"started"`
|
|
|
|
Running string `json:"running"`
|
|
|
|
Generated string `json:"generated"`
|
|
|
|
} `json:"keygen"`
|
|
|
|
}
|
|
|
|
|
|
|
|
translations := &translationData{}
|
|
|
|
translations.Keygen.Started = localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "JavaScript.KeyGen.Started",
|
|
|
|
Other: "started key generation",
|
|
|
|
}})
|
|
|
|
translations.Keygen.Running = localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "JavaScript.KeyGen.Running",
|
|
|
|
Other: "key generation running for __seconds__ seconds",
|
|
|
|
}})
|
|
|
|
translations.Keygen.Generated = localizer.MustLocalize(&i18n.LocalizeConfig{DefaultMessage: &i18n.Message{
|
|
|
|
ID: "JavaScript.KeyGen.Generated",
|
|
|
|
Other: "key generated in __seconds__ seconds",
|
|
|
|
}})
|
|
|
|
|
|
|
|
encoder := json.NewEncoder(w)
|
|
|
|
if err := encoder.Encode(translations); err != nil {
|
|
|
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-05 18:46:15 +00:00
|
|
|
func generateRandomBytes(count int) []byte {
|
|
|
|
randomBytes := make([]byte, count)
|
|
|
|
|
|
|
|
_, err := rand.Read(randomBytes)
|
|
|
|
if err != nil {
|
|
|
|
log.Fatalf("could not read random bytes: %v", err)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
return randomBytes
|
|
|
|
}
|
|
|
|
|
2020-12-11 21:05:27 +00:00
|
|
|
func init() {
|
|
|
|
var err error
|
|
|
|
caCertificates = make([]*x509.Certificate, 2)
|
|
|
|
for index, certFile := range []string{"example_ca/sub/ca.crt.pem", "example_ca/root/ca.crt.pem"} {
|
|
|
|
var certBytes []byte
|
|
|
|
if certBytes, err = ioutil.ReadFile(certFile); err != nil {
|
|
|
|
log.Panic(err)
|
|
|
|
}
|
|
|
|
var block *pem.Block
|
|
|
|
if block, _ = pem.Decode(certBytes); block == nil {
|
|
|
|
log.Panicf("no PEM data found in %s", certFile)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if caCertificates[index], err = x509.ParseCertificate(block.Bytes); err != nil {
|
|
|
|
log.Panic(err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
log.Infof("read %d CA certificates", len(caCertificates))
|
|
|
|
}
|
|
|
|
|
2020-11-29 23:08:05 +00:00
|
|
|
func main() {
|
|
|
|
tlsConfig := &tls.Config{
|
|
|
|
CipherSuites: []uint16{
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
|
|
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
|
|
},
|
|
|
|
NextProtos: []string{"h2"},
|
|
|
|
PreferServerCipherSuites: true,
|
|
|
|
MinVersion: tls.VersionTLS12,
|
|
|
|
}
|
2020-12-04 23:21:18 +00:00
|
|
|
|
|
|
|
bundle := i18n.NewBundle(language.English)
|
|
|
|
bundle.RegisterUnmarshalFunc("toml", toml.Unmarshal)
|
|
|
|
for _, lang := range []string{"en-US", "de-DE"} {
|
|
|
|
if _, err := bundle.LoadMessageFile(fmt.Sprintf("active.%s.toml", lang)); err != nil {
|
|
|
|
log.Panic(err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-29 23:08:05 +00:00
|
|
|
mux := http.NewServeMux()
|
2020-12-11 21:05:27 +00:00
|
|
|
|
|
|
|
var csrfKey []byte = nil
|
|
|
|
|
|
|
|
if csrfB64, exists := os.LookupEnv("CSRF_KEY"); exists {
|
|
|
|
csrfKey, _ = base64.RawStdEncoding.DecodeString(csrfB64)
|
|
|
|
log.Info("read CSRF key from environment variable")
|
|
|
|
}
|
|
|
|
if csrfKey == nil {
|
|
|
|
csrfKey = generateRandomBytes(32)
|
|
|
|
log.Infof(
|
|
|
|
"generated new random CSRF key, set environment variable CSRF_KEY to %s to "+
|
|
|
|
"keep the same key for new sessions",
|
|
|
|
base64.RawStdEncoding.EncodeToString(csrfKey))
|
|
|
|
}
|
|
|
|
|
2020-11-29 23:08:05 +00:00
|
|
|
mux.Handle("/sign/", &signCertificate{})
|
2020-12-04 23:21:18 +00:00
|
|
|
mux.Handle("/", &indexHandler{Bundle: bundle})
|
|
|
|
fileServer := http.FileServer(http.Dir("./public"))
|
|
|
|
mux.Handle("/css/", fileServer)
|
|
|
|
mux.Handle("/js/", fileServer)
|
|
|
|
mux.Handle("/locales/", &jsLocalesHandler{Bundle: bundle})
|
2020-11-29 23:08:05 +00:00
|
|
|
server := http.Server{
|
|
|
|
Addr: ":8000",
|
2020-12-05 18:46:15 +00:00
|
|
|
Handler: csrf.Protect(csrfKey, csrf.FieldName("csrfToken"), csrf.RequestHeader("X-CSRF-Token"))(mux),
|
2020-11-29 23:08:05 +00:00
|
|
|
TLSConfig: tlsConfig,
|
|
|
|
ReadTimeout: 20 * time.Second,
|
|
|
|
ReadHeaderTimeout: 5 * time.Second,
|
|
|
|
WriteTimeout: 30 * time.Second,
|
|
|
|
IdleTimeout: 30 * time.Second,
|
|
|
|
}
|
2020-12-11 21:05:27 +00:00
|
|
|
go func() {
|
|
|
|
err := server.ListenAndServeTLS("server.crt.pem", "server.key.pem")
|
|
|
|
if err != nil {
|
|
|
|
log.Fatal(err)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
var hostPort string
|
|
|
|
if strings.HasPrefix(server.Addr, ":") {
|
|
|
|
hostPort = fmt.Sprintf("localhost%s", server.Addr)
|
|
|
|
} else {
|
|
|
|
hostPort = server.Addr
|
2020-11-29 23:08:05 +00:00
|
|
|
}
|
2020-12-11 21:05:27 +00:00
|
|
|
log.Infof("started web server on https://%s/", hostPort)
|
|
|
|
c := make(chan os.Signal, 1)
|
|
|
|
signal.Notify(c, os.Interrupt, syscall.SIGTERM)
|
|
|
|
s := <-c
|
|
|
|
log.Infof("received %s, shutting down", s)
|
|
|
|
_ = server.Close()
|
2020-11-29 23:08:05 +00:00
|
|
|
}
|