func GetOrCreateCaCert() (*x509.Certificate, *rsa.PrivateKey, error) {
	var tlsCACertPath, tlsCAKeyPath string
	if os.Getenv("CI") == "true" {
		// When in CI we create the cert dir in the root directory instead.
		tlsCACertPath = path.Join("/ca", "ca.crt")
		tlsCAKeyPath = path.Join("/ca", "ca.key")
	} else {
		wd, err := os.Getwd()
		if err != nil {
			return nil, nil, err
		}
		tlsCACertPath = path.Join(wd, "ca", "ca.crt")
		tlsCAKeyPath = path.Join(wd, "ca", "ca.key")
		if _, err := os.Stat(path.Join(wd, "ca")); os.IsNotExist(err) {
			err = os.Mkdir(path.Join(wd, "ca"), 0770)
			if err != nil {
				return nil, nil, err
			}
		}
	}
	if _, err := os.Stat(tlsCACertPath); err == nil {
		if _, err := os.Stat(tlsCAKeyPath); err == nil {
			// We already created a CA cert, let's use that.
			dat, err := ioutil.ReadFile(tlsCACertPath)
			if err != nil {
				return nil, nil, err
			}
			block, _ := pem.Decode([]byte(dat))
			if block == nil || block.Type != "CERTIFICATE" {
				return nil, nil, errors.New("ca.crt is not a valid pem encoded x509 cert")
			}
			caCerts, err := x509.ParseCertificates(block.Bytes)
			if err != nil {
				return nil, nil, err
			}
			if len(caCerts) != 1 {
				return nil, nil, errors.New("ca.crt contains none or more than one cert")
			}
			caCert := caCerts[0]
			dat, err = ioutil.ReadFile(tlsCAKeyPath)
			if err != nil {
				return nil, nil, err
			}
			block, _ = pem.Decode([]byte(dat))
			if block == nil || block.Type != "RSA PRIVATE KEY" {
				return nil, nil, errors.New("ca.key is not a valid pem encoded rsa private key")
			}
			priv, err := x509.ParsePKCS1PrivateKey(block.Bytes)
			if err != nil {
				return nil, nil, err
			}
			return caCert, priv, nil
		}
	}

	// valid for 10 years
	certificateDuration := time.Hour * 24 * 365 * 10
	priv, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, nil, err
	}
	notBefore := time.Now()
	notAfter := notBefore.Add(certificateDuration)
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, err
	}
	caCert := x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature | x509.KeyUsageCRLSign,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		Subject: pkix.Name{
			Organization:  []string{"matrix.org"},
			Country:       []string{"GB"},
			Province:      []string{"London"},
			Locality:      []string{"London"},
			StreetAddress: []string{"123 Street"},
			PostalCode:    []string{"12345"},
		},
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, &caCert, &caCert, &priv.PublicKey, priv)
	if err != nil {
		return nil, nil, err
	}
	certOut, err := os.Create(tlsCACertPath)
	if err != nil {
		return nil, nil, err
	}

	defer certOut.Close() // nolint: errcheck
	if err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
		return nil, nil, err
	}

	keyOut, err := os.OpenFile(tlsCAKeyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		return nil, nil, err
	}
	defer keyOut.Close() // nolint: errcheck
	err = pem.Encode(keyOut, &pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(priv),
	})
	if err != nil {
		return nil, nil, err
	}
	return &caCert, priv, nil
}
// GetOrCreateCaCert is used to create the federation TLS cert.
// In addition, it is passed to homeserver containers to create TLS certs
// for the homeservers.
// This basically acts as a test only valid PKI.
GetOrCreateCaCert is used to create the federation TLS cert.
In addition, it is passed to homeserver containers to create TLS certs
for the homeservers.
This basically acts as a test only valid PKI.
// GetOrCreateCaCert is used to create the federation TLS cert . // In addition it is passed to homeserver containers to create TLS certs // for the homeservers . // This basically acts as a test only valid PKI .
func GetOrCreateCaCert() (*x509.Certificate, *rsa.PrivateKey, error) {
	var tlsCACertPath, tlsCAKeyPath string
	if os.Getenv("CI") == "true" {
		tlsCACertPath = path.Join("/ca", "ca.crt")
		tlsCAKeyPath = path.Join("/ca", "ca.key")
	} else {
		wd, err := os.Getwd()
		if err != nil {
			return nil, nil, err
		}
		tlsCACertPath = path.Join(wd, "ca", "ca.crt")
		tlsCAKeyPath = path.Join(wd, "ca", "ca.key")
		if _, err := os.Stat(path.Join(wd, "ca")); os.IsNotExist(err) {
			err = os.Mkdir(path.Join(wd, "ca"), 0770)
			if err != nil {
				return nil, nil, err
			}
		}
	}
	if _, err := os.Stat(tlsCACertPath); err == nil {
		if _, err := os.Stat(tlsCAKeyPath); err == nil {
			dat, err := ioutil.ReadFile(tlsCACertPath)
			if err != nil {
				return nil, nil, err
			}
			block, _ := pem.Decode([]byte(dat))
			if block == nil || block.Type != "CERTIFICATE" {
				return nil, nil, errors.New("ca.crt is not a valid pem encoded x509 cert")
			}
			caCerts, err := x509.ParseCertificates(block.Bytes)
			if err != nil {
				return nil, nil, err
			}
			if len(caCerts) != 1 {
				return nil, nil, errors.New("ca.crt contains none or more than one cert")
			}
			caCert := caCerts[0]
			dat, err = ioutil.ReadFile(tlsCAKeyPath)
			if err != nil {
				return nil, nil, err
			}
			block, _ = pem.Decode([]byte(dat))
			if block == nil || block.Type != "RSA PRIVATE KEY" {
				return nil, nil, errors.New("ca.key is not a valid pem encoded rsa private key")
			}
			priv, err := x509.ParsePKCS1PrivateKey(block.Bytes)
			if err != nil {
				return nil, nil, err
			}
			return caCert, priv, nil
		}
	}
	certificateDuration := time.Hour * 24 * 365 * 10
	priv, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, nil, err
	}
	notBefore := time.Now()
	notAfter := notBefore.Add(certificateDuration)
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, err
	}
	caCert := x509.Certificate{
		SerialNumber:          serialNumber,
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature | x509.KeyUsageCRLSign,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		Subject: pkix.Name{
			Organization:  []string{"matrix.org"},
			Country:       []string{"GB"},
			Province:      []string{"London"},
			Locality:      []string{"London"},
			StreetAddress: []string{"123 Street"},
			PostalCode:    []string{"12345"},
		},
	}
	derBytes, err := x509.CreateCertificate(rand.Reader, &caCert, &caCert, &priv.PublicKey, priv)
	if err != nil {
		return nil, nil, err
	}
	certOut, err := os.Create(tlsCACertPath)
	if err != nil {
		return nil, nil, err
	}
	defer certOut.Close() 
	if err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}); err != nil {
		return nil, nil, err
	}
	keyOut, err := os.OpenFile(tlsCAKeyPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
	if err != nil {
		return nil, nil, err
	}
	defer keyOut.Close() 
	err = pem.Encode(keyOut, &pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(priv),
	})
	if err != nil {
		return nil, nil, err
	}
	return &caCert, priv, nil
}
func GetOrCreateCaCert ( ) ( * x509 . Certificate , * rsa . PrivateKey , error ) { var tlsCACertPath , tlsCAKeyPath string if os . Getenv ( " " ) == " " { tlsCACertPath = path . Join ( " " , " " ) tlsCAKeyPath = path . Join ( " " , " " ) } else { wd , err := os . Getwd ( ) if err != nil { return nil , nil , err } tlsCACertPath = path . Join ( wd , " " , " " ) tlsCAKeyPath = path . Join ( wd , " " , " " ) if _ , err := os . Stat ( path . Join ( wd , " " ) ) ; os . IsNotExist ( err ) { err = os . Mkdir ( path . Join ( wd , " " ) , 0770 ) if err != nil { return nil , nil , err } } } if _ , err := os . Stat ( tlsCACertPath ) ; err == nil { if _ , err := os . Stat ( tlsCAKeyPath ) ; err == nil { dat , err := ioutil . ReadFile ( tlsCACertPath ) if err != nil { return nil , nil , err } block , _ := pem . Decode ( [ ] byte ( dat ) ) if block == nil || block . Type != " " { return nil , nil , errors . New ( " " ) } caCerts , err := x509 . ParseCertificates ( block . Bytes ) if err != nil { return nil , nil , err } if len ( caCerts ) != 1 { return nil , nil , errors . New ( " " ) } caCert := caCerts [ 0 ] dat , err = ioutil . ReadFile ( tlsCAKeyPath ) if err != nil { return nil , nil , err } block , _ = pem . Decode ( [ ] byte ( dat ) ) if block == nil || block . Type != " " { return nil , nil , errors . New ( " " ) } priv , err := x509 . ParsePKCS1PrivateKey ( block . Bytes ) if err != nil { return nil , nil , err } return caCert , priv , nil } } certificateDuration := time . Hour * 24 * 365 * 10 priv , err := rsa . GenerateKey ( rand . Reader , 4096 ) if err != nil { return nil , nil , err } notBefore := time . Now ( ) notAfter := notBefore . Add ( certificateDuration ) serialNumberLimit := new ( big . Int ) . Lsh ( big . NewInt ( 1 ) , 128 ) serialNumber , err := rand . Int ( rand . Reader , serialNumberLimit ) if err != nil { return nil , nil , err } caCert := x509 . Certificate { SerialNumber : serialNumber , NotBefore : notBefore , NotAfter : notAfter , IsCA : true , KeyUsage : x509 . KeyUsageCertSign | x509 . KeyUsageDigitalSignature | x509 . KeyUsageCRLSign , ExtKeyUsage : [ ] x509 . ExtKeyUsage { x509 . ExtKeyUsageServerAuth } , BasicConstraintsValid : true , Subject : pkix . Name { Organization : [ ] string { " " } , Country : [ ] string { " " } , Province : [ ] string { " " } , Locality : [ ] string { " " } , StreetAddress : [ ] string { " " } , PostalCode : [ ] string { " " } , } , } derBytes , err := x509 . CreateCertificate ( rand . Reader , & caCert , & caCert , & priv . PublicKey , priv ) if err != nil { return nil , nil , err } certOut , err := os . Create ( tlsCACertPath ) if err != nil { return nil , nil , err } defer certOut . Close ( ) if err = pem . Encode ( certOut , & pem . Block { Type : " " , Bytes : derBytes } ) ; err != nil { return nil , nil , err } keyOut , err := os . OpenFile ( tlsCAKeyPath , os . O_WRONLY | os . O_CREATE | os . O_TRUNC , 0600 ) if err != nil { return nil , nil , err } defer keyOut . Close ( ) err = pem . Encode ( keyOut , & pem . Block { Type : " " , Bytes : x509 . MarshalPKCS1PrivateKey ( priv ) , } ) if err != nil { return nil , nil , err } return & caCert , priv , nil }
GetOrCreateCaCert is used to create the federation TLS cert.
GetOrCreateCaCert is used to create the federation TLS cert .
// When in CI we create the cert dir in the root directory instead. // We already created a CA cert, let's use that. // valid for 10 years // nolint: errcheck // nolint: errcheck