-
-
Notifications
You must be signed in to change notification settings - Fork 2.5k
/
main.go
393 lines (348 loc) · 10.7 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
// Copyright 2018 The mkcert Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// Command mkcert is a simple zero-config tool to make development certificates.
package main
import (
"crypto"
"crypto/x509"
"flag"
"fmt"
"log"
"net"
"net/mail"
"net/url"
"os"
"os/exec"
"os/user"
"path/filepath"
"regexp"
"runtime"
"runtime/debug"
"strings"
"sync"
"golang.org/x/net/idna"
)
const shortUsage = `Usage of mkcert:
$ mkcert -install
Install the local CA in the system trust store.
$ mkcert example.org
Generate "example.org.pem" and "example.org-key.pem".
$ mkcert example.com myapp.dev localhost 127.0.0.1 ::1
Generate "example.com+4.pem" and "example.com+4-key.pem".
$ mkcert "*.example.it"
Generate "_wildcard.example.it.pem" and "_wildcard.example.it-key.pem".
$ mkcert -uninstall
Uninstall the local CA (but do not delete it).
`
const advancedUsage = `Advanced options:
-cert-file FILE, -key-file FILE, -p12-file FILE
Customize the output paths.
-client
Generate a certificate for client authentication.
-ecdsa
Generate a certificate with an ECDSA key.
-pkcs12
Generate a ".p12" PKCS #12 file, also know as a ".pfx" file,
containing certificate and key for legacy applications.
-csr CSR
Generate a certificate based on the supplied CSR. Conflicts with
all other flags and arguments except -install and -cert-file.
-CAROOT
Print the CA certificate and key storage location.
$CAROOT (environment variable)
Set the CA certificate and key storage location. (This allows
maintaining multiple local CAs in parallel.)
$TRUST_STORES (environment variable)
A comma-separated list of trust stores to install the local
root CA into. Options are: "system", "java" and "nss" (includes
Firefox). Autodetected by default.
`
// Version can be set at link time to override debug.BuildInfo.Main.Version,
// which is "(devel)" when building from within the module. See
// golang.org/issue/29814 and golang.org/issue/29228.
var Version string
func main() {
if len(os.Args) == 1 {
fmt.Print(shortUsage)
return
}
log.SetFlags(0)
var (
installFlag = flag.Bool("install", false, "")
uninstallFlag = flag.Bool("uninstall", false, "")
pkcs12Flag = flag.Bool("pkcs12", false, "")
ecdsaFlag = flag.Bool("ecdsa", false, "")
clientFlag = flag.Bool("client", false, "")
helpFlag = flag.Bool("help", false, "")
carootFlag = flag.Bool("CAROOT", false, "")
csrFlag = flag.String("csr", "", "")
certFileFlag = flag.String("cert-file", "", "")
keyFileFlag = flag.String("key-file", "", "")
p12FileFlag = flag.String("p12-file", "", "")
versionFlag = flag.Bool("version", false, "")
)
flag.Usage = func() {
fmt.Fprint(flag.CommandLine.Output(), shortUsage)
fmt.Fprintln(flag.CommandLine.Output(), `For more options, run "mkcert -help".`)
}
flag.Parse()
if *helpFlag {
fmt.Print(shortUsage)
fmt.Print(advancedUsage)
return
}
if *versionFlag {
if Version != "" {
fmt.Println(Version)
return
}
if buildInfo, ok := debug.ReadBuildInfo(); ok {
fmt.Println(buildInfo.Main.Version)
return
}
fmt.Println("(unknown)")
return
}
if *carootFlag {
if *installFlag || *uninstallFlag {
log.Fatalln("ERROR: you can't set -[un]install and -CAROOT at the same time")
}
fmt.Println(getCAROOT())
return
}
if *installFlag && *uninstallFlag {
log.Fatalln("ERROR: you can't set -install and -uninstall at the same time")
}
if *csrFlag != "" && (*pkcs12Flag || *ecdsaFlag || *clientFlag) {
log.Fatalln("ERROR: can only combine -csr with -install and -cert-file")
}
if *csrFlag != "" && flag.NArg() != 0 {
log.Fatalln("ERROR: can't specify extra arguments when using -csr")
}
(&mkcert{
installMode: *installFlag, uninstallMode: *uninstallFlag, csrPath: *csrFlag,
pkcs12: *pkcs12Flag, ecdsa: *ecdsaFlag, client: *clientFlag,
certFile: *certFileFlag, keyFile: *keyFileFlag, p12File: *p12FileFlag,
}).Run(flag.Args())
}
const rootName = "rootCA.pem"
const rootKeyName = "rootCA-key.pem"
type mkcert struct {
installMode, uninstallMode bool
pkcs12, ecdsa, client bool
keyFile, certFile, p12File string
csrPath string
CAROOT string
caCert *x509.Certificate
caKey crypto.PrivateKey
// The system cert pool is only loaded once. After installing the root, checks
// will keep failing until the next execution. TODO: maybe execve?
// https://github.com/golang/go/issues/24540 (thanks, myself)
ignoreCheckFailure bool
}
func (m *mkcert) Run(args []string) {
m.CAROOT = getCAROOT()
if m.CAROOT == "" {
log.Fatalln("ERROR: failed to find the default CA location, set one as the CAROOT env var")
}
fatalIfErr(os.MkdirAll(m.CAROOT, 0755), "failed to create the CAROOT")
m.loadCA()
if m.installMode {
m.install()
if len(args) == 0 {
return
}
} else if m.uninstallMode {
m.uninstall()
return
} else {
var warning bool
if storeEnabled("system") && !m.checkPlatform() {
warning = true
log.Println("Note: the local CA is not installed in the system trust store.")
}
if storeEnabled("nss") && hasNSS && CertutilInstallHelp != "" && !m.checkNSS() {
warning = true
log.Printf("Note: the local CA is not installed in the %s trust store.", NSSBrowsers)
}
if storeEnabled("java") && hasJava && !m.checkJava() {
warning = true
log.Println("Note: the local CA is not installed in the Java trust store.")
}
if warning {
log.Println("Run \"mkcert -install\" for certificates to be trusted automatically ⚠️")
}
}
if m.csrPath != "" {
m.makeCertFromCSR()
return
}
if len(args) == 0 {
flag.Usage()
return
}
hostnameRegexp := regexp.MustCompile(`(?i)^(\*\.)?[0-9a-z_-]([0-9a-z._-]*[0-9a-z_-])?$`)
for i, name := range args {
if ip := net.ParseIP(name); ip != nil {
continue
}
if email, err := mail.ParseAddress(name); err == nil && email.Address == name {
continue
}
if uriName, err := url.Parse(name); err == nil && uriName.Scheme != "" && uriName.Host != "" {
continue
}
punycode, err := idna.ToASCII(name)
if err != nil {
log.Fatalf("ERROR: %q is not a valid hostname, IP, URL or email: %s", name, err)
}
args[i] = punycode
if !hostnameRegexp.MatchString(punycode) {
log.Fatalf("ERROR: %q is not a valid hostname, IP, URL or email", name)
}
}
m.makeCert(args)
}
func getCAROOT() string {
if env := os.Getenv("CAROOT"); env != "" {
return env
}
var dir string
switch {
case runtime.GOOS == "windows":
dir = os.Getenv("LocalAppData")
case os.Getenv("XDG_DATA_HOME") != "":
dir = os.Getenv("XDG_DATA_HOME")
case runtime.GOOS == "darwin":
dir = os.Getenv("HOME")
if dir == "" {
return ""
}
dir = filepath.Join(dir, "Library", "Application Support")
default: // Unix
dir = os.Getenv("HOME")
if dir == "" {
return ""
}
dir = filepath.Join(dir, ".local", "share")
}
return filepath.Join(dir, "mkcert")
}
func (m *mkcert) install() {
if storeEnabled("system") {
if m.checkPlatform() {
log.Print("The local CA is already installed in the system trust store! 👍")
} else {
if m.installPlatform() {
log.Print("The local CA is now installed in the system trust store! ⚡️")
}
m.ignoreCheckFailure = true // TODO: replace with a check for a successful install
}
}
if storeEnabled("nss") && hasNSS {
if m.checkNSS() {
log.Printf("The local CA is already installed in the %s trust store! 👍", NSSBrowsers)
} else {
if hasCertutil && m.installNSS() {
log.Printf("The local CA is now installed in the %s trust store (requires browser restart)! 🦊", NSSBrowsers)
} else if CertutilInstallHelp == "" {
log.Printf(`Note: %s support is not available on your platform. ℹ️`, NSSBrowsers)
} else if !hasCertutil {
log.Printf(`Warning: "certutil" is not available, so the CA can't be automatically installed in %s! ⚠️`, NSSBrowsers)
log.Printf(`Install "certutil" with "%s" and re-run "mkcert -install" 👈`, CertutilInstallHelp)
}
}
}
if storeEnabled("java") && hasJava {
if m.checkJava() {
log.Println("The local CA is already installed in Java's trust store! 👍")
} else {
if hasKeytool {
m.installJava()
log.Println("The local CA is now installed in Java's trust store! ☕️")
} else {
log.Println(`Warning: "keytool" is not available, so the CA can't be automatically installed in Java's trust store! ⚠️`)
}
}
}
log.Print("")
}
func (m *mkcert) uninstall() {
if storeEnabled("nss") && hasNSS {
if hasCertutil {
m.uninstallNSS()
} else if CertutilInstallHelp != "" {
log.Print("")
log.Printf(`Warning: "certutil" is not available, so the CA can't be automatically uninstalled from %s (if it was ever installed)! ⚠️`, NSSBrowsers)
log.Printf(`You can install "certutil" with "%s" and re-run "mkcert -uninstall" 👈`, CertutilInstallHelp)
log.Print("")
}
}
if storeEnabled("java") && hasJava {
if hasKeytool {
m.uninstallJava()
} else {
log.Print("")
log.Println(`Warning: "keytool" is not available, so the CA can't be automatically uninstalled from Java's trust store (if it was ever installed)! ⚠️`)
log.Print("")
}
}
if storeEnabled("system") && m.uninstallPlatform() {
log.Print("The local CA is now uninstalled from the system trust store(s)! 👋")
log.Print("")
} else if storeEnabled("nss") && hasCertutil {
log.Printf("The local CA is now uninstalled from the %s trust store(s)! 👋", NSSBrowsers)
log.Print("")
}
}
func (m *mkcert) checkPlatform() bool {
if m.ignoreCheckFailure {
return true
}
_, err := m.caCert.Verify(x509.VerifyOptions{})
return err == nil
}
func storeEnabled(name string) bool {
stores := os.Getenv("TRUST_STORES")
if stores == "" {
return true
}
for _, store := range strings.Split(stores, ",") {
if store == name {
return true
}
}
return false
}
func fatalIfErr(err error, msg string) {
if err != nil {
log.Fatalf("ERROR: %s: %s", msg, err)
}
}
func fatalIfCmdErr(err error, cmd string, out []byte) {
if err != nil {
log.Fatalf("ERROR: failed to execute \"%s\": %s\n\n%s\n", cmd, err, out)
}
}
func pathExists(path string) bool {
_, err := os.Stat(path)
return err == nil
}
func binaryExists(name string) bool {
_, err := exec.LookPath(name)
return err == nil
}
var sudoWarningOnce sync.Once
func commandWithSudo(cmd ...string) *exec.Cmd {
if u, err := user.Current(); err == nil && u.Uid == "0" {
return exec.Command(cmd[0], cmd[1:]...)
}
if !binaryExists("sudo") {
sudoWarningOnce.Do(func() {
log.Println(`Warning: "sudo" is not available, and mkcert is not running as root. The (un)install operation might fail. ⚠️`)
})
return exec.Command(cmd[0], cmd[1:]...)
}
return exec.Command("sudo", append([]string{"--prompt=Sudo password:", "--"}, cmd...)...)
}