cert/cert.go

@@ -66,14 +66,9 @@ type AltNames struct {
 	IPs      []net.IP
 }
 
-// NewRSAPrivateKey creates an RSA private key
-func NewRSAPrivateKey() (*rsa.PrivateKey, error) {
-	return rsa.GenerateKey(cryptorand.Reader, rsaKeySize)
-}
-
 // NewPrivateKey creates an RSA private key
-func NewPrivateKey() (*ecdsa.PrivateKey, error) {
-	return ecdsa.GenerateKey(elliptic.P256Sm2(), cryptorand.Reader)
+func NewPrivateKey() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(cryptorand.Reader, rsaKeySize)
 }
 
 // NewSelfSignedCACert creates a CA certificate
@@ -158,7 +153,7 @@ func NewSignedCert(cfg Config, key crypto.Signer, caCert *x509.Certificate, caKe
 
 // MakeEllipticPrivateKeyPEM creates an ECDSA private key
 func MakeEllipticPrivateKeyPEM() ([]byte, error) {
-	privateKey, err := ecdsa.GenerateKey(elliptic.P256Sm2(), cryptorand.Reader)
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), cryptorand.Reader)
 	if err != nil {
 		return nil, err
 	}
@@ -209,7 +204,7 @@ func GenerateSelfSignedCertKeyWithFixtures(host string, alternateIPs []net.IP, a
 		maxAge = 100 * time.Hour * 24 * 365 // 100 years fixtures
 	}
 
-	caKey, err := NewPrivateKey()
+	caKey, err := rsa.GenerateKey(cryptorand.Reader, 2048)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -237,7 +232,7 @@ func GenerateSelfSignedCertKeyWithFixtures(host string, alternateIPs []net.IP, a
 		return nil, nil, err
 	}
 
-	priv, err := NewPrivateKey()
+	priv, err := rsa.GenerateKey(cryptorand.Reader, 2048)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -280,12 +275,7 @@ func GenerateSelfSignedCertKeyWithFixtures(host string, alternateIPs []net.IP, a
 
 	// Generate key
 	keyBuffer := bytes.Buffer{}
-	privBuf, err := x509.MarshalECPrivateKey(priv)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if err := pem.Encode(&keyBuffer, &pem.Block{Type: ECPrivateKeyBlockType, Bytes: privBuf}); err != nil {
+	if err := pem.Encode(&keyBuffer, &pem.Block{Type: RSAPrivateKeyBlockType, Bytes: x509.MarshalPKCS1PrivateKey(priv)}); err != nil {
 		return nil, nil, err
 	}
 

cert/cert_test.go

@@ -1,39 +0,0 @@
-package cert
-
-import (
-	"crypto/ecdsa"
-	"fmt"
-	"os"
-	"testing"
-)
-
-func TestCreateAndReadCert(t *testing.T) {
-	kFile := "service.key"
-	defer os.Remove(kFile)
-	key, err := NewPrivateKey()
-	if err != nil {
-		t.Errorf("failed to create private key: %v", err)
-	}
-
-	if err := WriteKey(kFile, EncodePrivateKeyPEM(key)); err != nil {
-		t.Errorf("failed to encode private key to pem: %v", err)
-	}
-
-	keyR, err := PrivateKeyFromFile(kFile)
-	if err != nil {
-		t.Errorf("failed to load private key from file: %v", err)
-	}
-
-	switch k := keyR.(type) {
-	case *ecdsa.PrivateKey:
-		fmt.Println("loaded back ecdsa private key")
-	default:
-		t.Errorf("load back a wrong private key %v", k)
-	}
-
-	buf := EncodePrivateKeyPEM(key)
-	_, err = ParsePrivateKeyPEM(buf)
-	if err != nil {
-		t.Errorf("failed to parse private key from pem: %v", err)
-	}
-}

cert/csr.go

@@ -17,7 +17,6 @@ limitations under the License.
 package cert
 
 import (
-	"crypto/ecdsa"
 	cryptorand "crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -61,11 +60,8 @@ func MakeCSRFromTemplate(privateKey interface{}, template *x509.CertificateReque
 
 func sigType(privateKey interface{}) x509.SignatureAlgorithm {
 	// Customize the signature for RSA keys, depending on the key size
-	switch privK := privateKey.(type) {
-	case *ecdsa.PrivateKey:
-		return x509.ECDSAWithSHA256
-	case *rsa.PrivateKey:
-		keySize := privK.N.BitLen()
+	if privateKey, ok := privateKey.(*rsa.PrivateKey); ok {
+		keySize := privateKey.N.BitLen()
 		switch {
 		case keySize >= 4096:
 			return x509.SHA512WithRSA

cert/pem.go

@@ -41,7 +41,7 @@ const (
 )
 
 // EncodePublicKeyPEM returns PEM-encoded public data
-func EncodePublicKeyPEM(key interface{}) ([]byte, error) {
+func EncodePublicKeyPEM(key *rsa.PublicKey) ([]byte, error) {
 	der, err := x509.MarshalPKIXPublicKey(key)
 	if err != nil {
 		return []byte{}, err
@@ -54,25 +54,12 @@ func EncodePublicKeyPEM(key interface{}) ([]byte, error) {
 }
 
 // EncodePrivateKeyPEM returns PEM-encoded private key data
-func EncodePrivateKeyPEM(key interface{}) []byte {
-	var block *pem.Block
-	switch privKey := key.(type) {
-	case *ecdsa.PrivateKey:
-		derBytes, _ := x509.MarshalECPrivateKey(privKey)
-		block = &pem.Block{
-			Type:  ECPrivateKeyBlockType,
-			Bytes: derBytes,
-		}
-	case *rsa.PrivateKey:
-		block = &pem.Block{
-			Type:  RSAPrivateKeyBlockType,
-			Bytes: x509.MarshalPKCS1PrivateKey(privKey),
-		}
+func EncodePrivateKeyPEM(key *rsa.PrivateKey) []byte {
+	block := pem.Block{
+		Type:  RSAPrivateKeyBlockType,
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
 	}
-	if block != nil {
-		return pem.EncodeToMemory(block)
-	}
-	return []byte{}
+	return pem.EncodeToMemory(&block)
 }
 
 // EncodeCertPEM returns PEM-endcoded certificate data