// CaCerts specifies the root certificates for HTTPS connections with the CredHub server.
//
// If the OAuthStrategy is used for Auth, the root certificates will also be used for HTTPS
// connections with the OAuth server.
511713
func CaCerts(certs ...string) Option {
	return func(c *CredHub) error {
		// TODO: remove else block once x509.SystemCertPool is supported on Windows
		// see: https://github.com/golang/go/issues/16736
		var pool *x509.CertPool
		if runtime.GOOS != "windows" {
			var err error
			pool, err = x509.SystemCertPool()
			if err != nil {
				return err
			}
		} else {
			pool = x509.NewCertPool()
		}
		c.caCerts = pool

		for _, cert := range certs {
			ok := c.caCerts.AppendCertsFromPEM([]byte(cert))
			if !ok {
				return errors.New("provided ca certs are invalid")
			}
		}

		return nil
	}
}
684698
func (s *ModifyListenerInput) SetCertificates(v []*Certificate) *ModifyListenerInput {
	s.Certificates = v
	return s
}
68315
func (a Arg) SetCACertPaths(caCertPaths string) Arg {
	a.CACertPaths = caCertPaths
	return a
}
255713
func generateCerts(tmpDir string, rootCA *ca.RootCA, nodeID, role, org string, writeKey bool) error {
	signer, err := rootCA.Signer()
	if err != nil {
		return err
	}
	certDir := filepath.Join(tmpDir, "certificates")
	if err := os.MkdirAll(certDir, 0700); err != nil {
		return err
	}
	certPaths := ca.NewConfigPaths(certDir)
	if err := ioutil.WriteFile(certPaths.RootCA.Cert, signer.Cert, 0644); err != nil {
		return err
	}
	if writeKey {
		if err := ioutil.WriteFile(certPaths.RootCA.Key, signer.Key, 0600); err != nil {
			return err
		}
	}
	_, _, err = rootCA.IssueAndSaveNewCertificates(
		ca.NewKeyReadWriter(certPaths.Node, nil, nil), nodeID, role, org)
	return err
}
106055
func (s *Cluster) SetCertificates(v *Certificates) *Cluster {
	s.Certificates = v
	return s
}
668402
func Creds(c credentials.TransportCredentials) ServerOption {
	return newFuncServerOption(func(o *serverOptions) {
		o.creds = c
	})
}
795563
func RunCreateSecretCaCert(f *util.Factory, out io.Writer, options *CreateSecretCaCertOptions) error {
	if options.CaCertPath == "" {
		return fmt.Errorf("error cert provided")
	}

	if options.CaPrivateKeyPath == "" {
		return fmt.Errorf("error no private key provided")
	}

	cluster, err := GetCluster(f, options.ClusterName)
	if err != nil {
		return fmt.Errorf("error getting cluster: %q: %v", options.ClusterName, err)
	}

	clientSet, err := f.Clientset()
	if err != nil {
		return fmt.Errorf("error getting clientset: %v", err)
	}

	keyStore, err := clientSet.KeyStore(cluster)
	if err != nil {
		return fmt.Errorf("error getting keystore: %v", err)
	}

	options.CaCertPath = utils.ExpandPath(options.CaCertPath)
	options.CaPrivateKeyPath = utils.ExpandPath(options.CaPrivateKeyPath)

	certBytes, err := ioutil.ReadFile(options.CaCertPath)
	if err != nil {
		return fmt.Errorf("error reading user provided cert %q: %v", options.CaCertPath, err)
	}
	privateKeyBytes, err := ioutil.ReadFile(options.CaPrivateKeyPath)
	if err != nil {
		return fmt.Errorf("error reading user provided private key %q: %v", options.CaPrivateKeyPath, err)
	}

	privateKey, err := pki.ParsePEMPrivateKey(privateKeyBytes)
	if err != nil {
		return fmt.Errorf("error loading private key %q: %v", privateKeyBytes, err)
	}
	cert, err := pki.ParsePEMCertificate(certBytes)
	if err != nil {
		return fmt.Errorf("error loading certificate %q: %v", options.CaCertPath, err)
	}

	err = keyStore.StoreKeypair(fi.CertificateId_CA, cert, privateKey)
	if err != nil {
		return fmt.Errorf("error storing user provided keys %q %q: %v", options.CaCertPath, options.CaPrivateKeyPath, err)
	}

	glog.Infof("using user provided cert: %v\n", options.CaCertPath)
	glog.Infof("using user provided private key: %v\n", options.CaPrivateKeyPath)

	return nil
}
417872
func (c *CertChecker) CheckCert(principal string, cert *ssh.Certificate) error {
	err := validate(cert)
	if err != nil {
		return trace.Wrap(err)
	}

	return c.CertChecker.CheckCert(principal, cert)
}
1028008
func (api *API) OriginCertificates(options OriginCACertificateListOptions) ([]OriginCACertificate, error) {
	v := url.Values{}
	if options.ZoneID != "" {
		v.Set("zone_id", options.ZoneID)
	}
	uri := "/certificates" + "?" + v.Encode()
	res, err := api.makeRequestWithAuthType(context.TODO(), "GET", uri, nil, AuthUserService)

	if err != nil {
		return nil, errors.Wrap(err, errMakeRequestError)
	}

	var originResponse *originCACertificateResponseList

	err = json.Unmarshal(res, &originResponse)

	if err != nil {
		return nil, errors.Wrap(err, errUnmarshalError)
	}

	if !originResponse.Success {
		return nil, errors.New(errRequestNotSuccessful)
	}

	return originResponse.Result, nil
}
1124336
func sslClientCertificates(tlsConf *tls.Config, o values) {
	sslkey := o.Get("sslkey")
	sslcert := o.Get("sslcert")

	var cinfo, kinfo os.FileInfo
	var err error

	if sslcert != "" && sslkey != "" {
		// Check that both files exist. Note that we don't do any more extensive
		// checks than this (such as checking that the paths aren't directories);
		// LoadX509KeyPair() will take care of the rest.
		cinfo, err = os.Stat(sslcert)
		if err != nil {
			panic(err)
		}

		kinfo, err = os.Stat(sslkey)
		if err != nil {
			panic(err)
		}
	} else {
		// Automatically find certificates from ~/.postgresql
		sslcert, sslkey, cinfo, kinfo = sslHomeCertificates()

		if cinfo == nil || kinfo == nil {
			// No certificates to load
			return
		}
	}

	// The files must also have the correct permissions
	sslCertificatePermissions(cinfo, kinfo)

	cert, err := tls.LoadX509KeyPair(sslcert, sslkey)
	if err != nil {
		panic(err)
	}
	tlsConf.Certificates = []tls.Certificate{cert}
}
677823
func (c *Config) ConfigureTLS(t *TLSConfig) error {
	if c.HttpClient == nil {
		c.HttpClient = DefaultConfig().HttpClient
	}
	clientTLSConfig := c.HttpClient.Transport.(*http.Transport).TLSClientConfig

	var clientCert tls.Certificate
	foundClientCert := false

	switch {
	case t.ClientCert != "" && t.ClientKey != "":
		var err error
		clientCert, err = tls.LoadX509KeyPair(t.ClientCert, t.ClientKey)
		if err != nil {
			return err
		}
		foundClientCert = true
	case t.ClientCert != "" || t.ClientKey != "":
		return fmt.Errorf("both client cert and client key must be provided")
	}

	if t.CACert != "" || t.CAPath != "" {
		rootConfig := &rootcerts.Config{
			CAFile: t.CACert,
			CAPath: t.CAPath,
		}
		if err := rootcerts.ConfigureTLS(clientTLSConfig, rootConfig); err != nil {
			return err
		}
	}

	if t.Insecure {
		clientTLSConfig.InsecureSkipVerify = true
	}

	if foundClientCert {
		// We use this function to ignore the server's preferential list of
		// CAs, otherwise any CA used for the cert auth backend must be in the
		// server's CA pool
		clientTLSConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
			return &clientCert, nil
		}
	}

	if t.TLSServerName != "" {
		clientTLSConfig.ServerName = t.TLSServerName
	}

	return nil
}
1066039
func configureTLS(caCertificatePath string) (*http.Transport, error) {
	tr := &http.Transport{}
	// if user provided CA cert we must use it, otherwise use InsecureSkipVerify: true for all HTTPS requests.
	if caCertificatePath != "" {
		caPool, err := loadCAPool(caCertificatePath)
		if err != nil {
			return tr, err
		}

		tr.TLSClientConfig = &tls.Config{
			RootCAs: caPool,
		}
	} else {
		tr.TLSClientConfig = &tls.Config{
			InsecureSkipVerify: true,
		}
	}
	return tr, nil
}
240208
func (s *BoshBase) InitializeCerts() (err error) {
	var cert, key, caCert string
	if caCert, cert, key, err = pluginutil.GenerateCert([]string{s.GetRoutableIP()}); err == nil {
		s.SSLCert = cert
		s.SSLKey = key
		s.CACert = caCert
	}
	return
}
558683
func (ch *CredHub) GenerateCertificate(name string, gen generate.Certificate, overwrite Mode) (credentials.Certificate, error) {
	var cred credentials.Certificate
	err := ch.generateCredential(name, "certificate", gen, overwrite, &cred)
	return cred, err
}
330859
func sslHomeCertificates() (cert, key string, cinfo, kinfo os.FileInfo) {
	user, err := user.Current()

	if err != nil {
		// user.Current() might fail when cross-compiling. We have to ignore the
		// error and continue without client certificates, since we wouldn't know
		// from where to load them.
		return
	}

	cert = filepath.Join(user.HomeDir, ".postgresql", "postgresql.crt")
	key = filepath.Join(user.HomeDir, ".postgresql", "postgresql.key")

	cinfo, err = os.Stat(cert)
	if err != nil {
		cinfo = nil
	}

	kinfo, err = os.Stat(key)
	if err != nil {
		kinfo = nil
	}

	return
}
97352
func (s *DescribeCertificatesOutput) SetCertificates(v []*Certificate) *DescribeCertificatesOutput {
	s.Certificates = v
	return s
}
1085150
func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage, certName string) (pool *x509.CertPool, trusted []*ParsedCert, trustedNonCAs []*ParsedCert) {
	pool = x509.NewCertPool()
	trusted = make([]*ParsedCert, 0)
	trustedNonCAs = make([]*ParsedCert, 0)
	names, err := storage.List(ctx, "cert/")
	if err != nil {
		b.Logger().Error("failed to list trusted certs", "error", err)
		return
	}
	for _, name := range names {
		// If we are trying to select a single CertEntry and this isn't it
		if certName != "" && name != certName {
			continue
		}
		entry, err := b.Cert(ctx, storage, strings.TrimPrefix(name, "cert/"))
		if err != nil {
			b.Logger().Error("failed to load trusted cert", "name", name, "error", err)
			continue
		}
		parsed := parsePEM([]byte(entry.Certificate))
		if len(parsed) == 0 {
			b.Logger().Error("failed to parse certificate", "name", name)
			continue
		}
		if !parsed[0].IsCA {
			trustedNonCAs = append(trustedNonCAs, &ParsedCert{
				Entry:        entry,
				Certificates: parsed,
			})
		} else {
			for _, p := range parsed {
				pool.AddCert(p)
			}

			// Create a ParsedCert entry
			trusted = append(trusted, &ParsedCert{
				Entry:        entry,
				Certificates: parsed,
			})
		}
	}
	return
}