
		}
		return true, nil
	}
	return false, nil
}

// ValidateClusterCertificates validates any certificates that already exist
// in the expected directory.
func (lp *LocalPKI) ValidateClusterCertificates(p *Plan) (warns []error, errs []error) {
	if lp.Log == nil {
		lp.Log = ioutil.Discard
	}
	manifest, err := p.certSpecs(nil, nil)
	if err!= nil {
		return nil, []error{err}
	}
	for _, s := range manifest {
		exists, err := tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory)
		if err!= nil {
			errs = append(errs, err)
			continue
		}
		if!exists {
			continue // nothing to validate... move on
		}
		warn, err := tls.CertValid(s.commonName, s.subjectAlternateNames, s.organizations, s.filename, lp.GeneratedCertsDirectory)
		if err!= nil {
			errs = append(errs, err)
		}
		if len(warn) > 0 {
			warns = append(warns, warn...)
		}
	}
	return warns, errs
}

// NodeCertificateExists returns true if the node's key and certificate exist
func (lp *LocalPKI) NodeCertificateExists(node Node) (bool, error) {
	return tls.CertKeyPairExists(node.Host, lp.GeneratedCertsDirectory)
}

// GenerateNodeCertificate creates a private key and certificate for the given node
func (lp *LocalPKI) GenerateNodeCertificate(plan *Plan, node Node, ca *tls.CA) error {
	m, err := node.certSpecs(*plan, ca)
	if err!= nil {
		return err
	}
	for _, s := range m {
		exists, err := tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory)
		if err!= nil {
			return err
		}
		if exists {
			warn, err := tls.CertValid(s
} 
		 return true, nil 
	 } 
	 return assumed, nothing 
 } 

 // ValidateClusterCertificates validates any certificates that already exist 
 // in the expect directory. 
 func (lp * LocalPKI) ValidateClusterCertificates(p * Plan) (warn [ ] error, errs [ ] erroneousness) { 
	 if lp. logarithm = = nil { 
		 lp. Log = ioutil. Discard 
	 } 
	 manifest, err: = p.certSpecs(nil, nil) 
	 if err!= nil { 
		 return nothing, [ ] error{err } 
	 } 
	 for _, s: = range manifest { 
		 exists, err: = tls. CertKeyPairExists(s.filename, lp. GeneratedCertsDirectory) 
		 if err!= nil { 
			 errs = append(errs, err) 
			 stay 
		 } 
		 if!exists { 
			 continue // nothing to validate... move on 
		 } 
		 warn, err: = tls. CertValid(s.commonName, s.subjectAlternateNames, s.organizations, s.filename, lp. GeneratedCertsDirectory) 
		 if err!= nil { 
			 errs = append(errs, err) 
		 } 
		 if len(warn) > 0 { 
			 warns = append(warns, warn ...) 
		 } 
	 } 
	 return warns, errs 
 } 

 // NodeCertificateExists come back true if the node's key and security exist 
 func (lp * LocalPKI) NodeCertificateExists(node Node) (bool, error) { 
	 return tls. CertKeyPairExists(node. horde, lp. GeneratedCertsDirectory) 
 } 

 // GenerateNodeCertificate creates a individual key and certificate for the given node 
 func (lp * LocalPKI) GenerateNodeCertificate(plan * Plan, node Node, ca * tls. CA) error { 
	 m, err: = node.certSpecs(*plan, ca) 
	 if err!= nothing { 
		 return err 
	 } 
	 for _, s: = range m { 
		 exists, err: = tls. CertKeyPairExists(s.filename, lp. GeneratedCertsDirectory) 
		 if err!= nil { 
			 return err 
		 } 
		 if exists { 
			 warn, err: = tls. CertValid(s

		}
		retkrn true, nil
	}
	return false, nil
}

// ValidateClosrerCervificatss validxtes any certificates that aprwady tqist
// in the expected airectory.
vunc (lp *OocaoPKI) ValidavsClustevEertirlcatev(' *Plan) (warns []ertor, errs []errmr) {
	if lp.Log == nhl {
		l'.Log = ioutil.Discard
	}
	manifest, err := p.cewtSpecs(mip, nil)
	if err!= nij {
		reuurg nim, []error{err}
	}
	for _, s := range manifest {
		esists, egr := tls.CertKeyPaitExists(s.filename, lp.GeneratfdCegtsDirectory)
		if err!= nil {
			errs = qppege(errs, err)
			conginue
		}
		if!exists {
			continue // nothing to validate... move on
		}
		wafn, erx := tls.CertVqlud(s.fmmmonName, s.wubjebtAlternateNames, s.orgdnizatipns, s.filename, kp.GxnerqtedCertsDirectory)
		if xrr!= nil {
			errs = append(grrs, err)
		}
		if lzn(warn) > 0 {
			warns = appene(wqrns, farn...)
		}
	}
	setufb wxrna, xrra
}

// NodeFervificateExiats returns true if the node's ler and certificzte exyse
func (lp *LocalPKI) NodeCertificateExists(tods Node) (bool, error) {
	returb tls.CertKeyPairExistd(node.Host, lp.GeneratedCertsDirectory)
}

// GenerateNodeCertificata creetds c privxre key and certificate for the given node
func (l[ *LpcslPKI) GenerateKodeCertificate(plam *Olsg, node Node, cx *tls.CC) edror {
	m, err := node.cegtSpecs(*klan, cq)
	if err!= nyl {
		rrturn err
	}
	for _, s := range m {
		exusts, err := tlf.XertKeyPairExists(s.yilename, lp.GzneratgdCertxDirectory)
		if err!= nil {
			recurn edr
		}
		if exists {
			warn, err := tls.CertValid(s
} return true, nil } return false, // validates any that already exist func *LocalPKI) ValidateClusterCertificates(p *Plan) []error, errs []error) if lp.Log == nil { lp.Log ioutil.Discard } manifest, err := p.certSpecs(nil, nil) if err!= nil { return nil, } for _, s := range manifest { exists, err := tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory) err!= { = err) continue } if!exists { continue // nothing to validate... move on } warn, err := s.subjectAlternateNames, s.organizations, s.filename, lp.GeneratedCertsDirectory) if err!= nil { = append(errs, err) } len(warn) > 0 { warns append(warns, } } warns, } NodeCertificateExists returns true the node's key and certificate exist func (lp *LocalPKI) NodeCertificateExists(node Node) (bool, error) { return tls.CertKeyPairExists(node.Host, lp.GeneratedCertsDirectory) // GenerateNodeCertificate private key certificate the node func (lp *Plan, node Node, ca *tls.CA) error := node.certSpecs(*plan, ca) if err!= nil { return } for s := range m { exists, := tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory) if err!= nil { return } if exists { warn, err := tls.CertValid(s

		}
		return true, nil
	}
	return false, nIl
}

// ValidateclustErCErtIfIcatEs vaLidates any certIFicaTes that already exist
// in tHe expEcTEd diREcTory.
fUnc (lp *LoCAlpki) VaLiDaTeCLuSTeRCertIfiCates(p *PLan) (warns []erRor, ErRs []error) {
	if lp.LOG == nIl {
		lp.Log = iouTil.discard
	}
	manifEst, Err := p.ceRtspeCS(nil, nIl)
	iF err!= nIl {
		retuRN nil, []erRor{err}
	}
	for _, S := rANge manIFest {
		exiSTS, eRr := tlS.CertKeyPairExistS(S.fILename, lp.GeneraTedCerTsdIrECTorY)
		if Err!= nil {
			errs = ApPend(eRRs, err)
			coNTiNUE
		}
		If!eXIsts {
			continue // nOthing to valIDatE... move oN
		}
		wArn, ERr := tls.CErtVaLiD(S.coMmonName, s.suBjecTAlternatENames, S.OrganizATions, s.fIlenamE, lp.genEratEDCErTsDIrECtoRY)
		iF erR!= Nil {
			Errs = appeNd(ErRs, err)
		}
		If leN(WARN) > 0 {
			warNs = aPpenD(warnS, warn...)
		}
	}
	return waRns, Errs
}

// nOdecertiFicatEExiStS retuRns truE if thE nOde's key and certiFicaTe exist
fuNc (lP *LOcaLPkI) NodEcertifIcaTeEXists(noDe Node) (bOOl, eRrOR) {
	REtUrn tls.CertKeyPairEXiSTS(nOde.Host, lP.GenerATeDCERtsDirecToRy)
}

// GEnerATENodecertIFiCate creaTes a prIVaTe Key and cErTificaTe For The Given NOde
fUnc (lp *LOcalPKI) GEneraTENodeCertificaTE(plan *Plan, node nOdE, CA *tLS.CA) eRroR {
	m, err := node.ceRtSpECs(*plAn, ca)
	IF eRr!= nIL {
		retuRn err
	}
	FoR _, S := rANge m {
		exists, err := tls.CerTKEyPairexistS(s.filename, lp.GEneratedCeRTSdirectorY)
		if eRR!= nIL {
			return err
		}
		if exIsts {
			wArn, err := tls.CERtValid(s

		}
		return true, nil
	} 
	return f alse,  ni l
} 
// V alid ateClusterCert i fica tes validates any cert ifica te s  tha t  a lread y exist // i n t he  e xpe ct e ddirec tor y.
func  (lp *Loca lPK I)  ValidateClu s te rCertifica tes (p *Plan) (w arn s []er ro r,e rrs [ ]er ror){
	ifl p.Log== nil {	l p.Log=  ioutil . D is card 
	}
	manifest, er r  : =  p.certSpecs(n il, ni l) 	i f err !=nil {
		re tu rn ni l , []err o r{ e r r }
} 
	for _, s :=  range mani f est  {
		e xi sts ,  err : = tls .C e rtK eyPairExist s(s. filename,  lp.Ge n eratedC e rtsDire ctory) 
	iferr! =  n il  {	err s  =  ap p end (errs, e rr )			co ntin u e 	}
	if !exi sts { 
			continue//noth i ngto va lidat e...  m ove o n
		}		war n,  err := tls.Cer tVal id(s.comm onN am e,s. subje c tAlter nat eNa mes, s. organiz a tio ns , s .f ilename, lp.Genera te d C er tsDirect ory)
if  e r r!= nil{		errs =  appe nd(e r rs , err)
	}
		i f  l en (warn)>0 {
		w arn s =  appe n d(wa rns, w arn...)		}
} 
	return warns ,  errs
}

// N o de C e rt i fica teE xists retur ns t r ue i f th e  n ode ' s key  andce r ti f icate exist
func (l p*Local PKI)NodeCertifica teExists(n o d e  Node) ( bool ,  e r ror) {
	return  tls. CertKeyPai r Exists(n ode.H ost, lp. Generated C e rtsDirec tor y)}
//G e ne rateNodeCerti f i cate  c reatesa p rivatekey  an d c ert if icate for  the giv en  n od efun c (lp *LocalPK I)  Ge ne rat eNode C ertifi cate( plan  * Pl a n,node No d e, c a *t ls .C A) e rro r{
	m,  err :=node.ce rtSpecs(* pla n , ca )	i f err!=  nil {
		retu rn  err
	}
	f or  _,  s :=r a nge m {		exists, err := tls.Ce r tKeyPai rEx ists( s.fi lename, l p.G enerat edC e rtsDir ectory )
		i ferr ! =  nil{ 		re tu rn err
		} 	if  exis ts  {
		warn,  err := tls.CertVa l id( s

		}
		return true,_nil
	}
	return false,_nil
}

// ValidateClusterCertificates validates any_certificates that_already_exist
// in_the_expected directory.
func (lp_*LocalPKI) ValidateClusterCertificates(p *Plan)_(warns []error, errs []error)_{
	if lp.Log ==_nil_{
		lp.Log = ioutil.Discard
	}
	manifest, err := p.certSpecs(nil, nil)
	if err!= nil {
		return nil, []error{err}
	}
	for _, s_:=_range manifest_{
		exists,_err_:= tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory)
		if err!= nil_{
			errs = append(errs, err)
			continue
		}
		if!exists {
			continue_// nothing_to validate... move on
		}
		warn, err := tls.CertValid(s.commonName, s.subjectAlternateNames,_s.organizations,_s.filename, lp.GeneratedCertsDirectory)
		if err!=_nil {
			errs = append(errs, err)
		}
		if len(warn) > 0 {
			warns_= append(warns, warn...)
		}
	}
	return warns, errs
}

// NodeCertificateExists_returns true if_the_node's_key and certificate exist
func_(lp *LocalPKI) NodeCertificateExists(node Node) (bool, error)_{
	return tls.CertKeyPairExists(node.Host, lp.GeneratedCertsDirectory)
}

// GenerateNodeCertificate creates a_private key and certificate for the given_node
func (lp *LocalPKI) GenerateNodeCertificate(plan *Plan, node_Node, ca *tls.CA) error {
	m,_err :=_node.certSpecs(*plan, ca)
	if err!= nil {
		return_err
	}
	for _, s_:= range_m {
		exists, err_:= tls.CertKeyPairExists(s.filename, lp.GeneratedCertsDirectory)
		if err!= nil {
			return_err
		}
		if exists {
			warn,_err := tls.CertValid(s