{"id":13562325,"url":"https://github.com/Shyp/generate-tls-cert","last_synced_at":"2025-04-03T18:33:21.015Z","repository":{"id":57485153,"uuid":"119917155","full_name":"Shyp/generate-tls-cert","owner":"Shyp","description":"Generating self signed certificates","archived":false,"fork":false,"pushed_at":"2018-11-17T22:49:10.000Z","size":14,"stargazers_count":151,"open_issues_count":3,"forks_count":28,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-11-04T14:44:51.089Z","etag":null,"topics":["curl","golang","javascript","self-signed-certificate"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Shyp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-02-02T01:52:23.000Z","updated_at":"2024-10-16T16:40:59.000Z","dependencies_parsed_at":"2022-08-26T13:40:11.572Z","dependency_job_id":null,"html_url":"https://github.com/Shyp/generate-tls-cert","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Shyp%2Fgenerate-tls-cert","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Shyp%2Fgenerate-tls-cert/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Shyp%2Fgenerate-tls-cert/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Shyp%2Fgenerate-tls-cert/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Shyp","download_url":"https://codeload.github.com/Shyp/generate-tls-cert/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247057009,"owners_count":20876495,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["curl","golang","javascript","self-signed-certificate"],"created_at":"2024-08-01T13:01:07.227Z","updated_at":"2025-04-03T18:33:16.002Z","avatar_url":"https://github.com/Shyp.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Better self-signed certificates\n\nHere's a script that helps you generate self signed certificates. It will\ngenerate both a root certificate and a leaf.\n\n(The TLS certificates generated by `crypto/tls/generate_cert.go` act both as a\nCA and as a leaf certificate. Some TLS clients have a problem with that scheme.)\n\nThis script modifies `crypto/tls/generate_cert.go` slightly:\n\n- A leaf certificate and a root certificate are generated.\n\n- the only supported key type is ecdsa P256.\n\n- Better usage instructions are generated.\n\nCredit comes from [Adam Langley](https://www.imperialviolet.org/), who provided\nthe initial version of this script on a golang-nuts message thread.\n\n## Installation\n\n```bash\ngo get github.com/Shyp/generate-tls-cert\n```\n\n## Usage\n\nRunning `generate-tls-cert` will give you nine files. Three of them are the\nmost important:\n\n- `root.pem`: The public key of the root CA. Add this as a CA in clients to\nconnect to your self-signed server (see \"Client\" below).\n\n- `leaf.key` and `leaf.pem` - The public and private key for terminating TLS\n  with your self signed certificate.\n\n```\n$ generate-tls-cert --host=localhost,127.0.0.1\nSuccessfully generated certificates! Here's what you generated.\n\n# Root CA\n\nroot.key\n\tThe private key for the root Certificate Authority. Keep this private.\n\nroot.pem\n\tThe public key for the root Certificate Authority. Clients should load the\n\tcertificate in this file to connect to the server.\n\nroot.debug.crt\n\tDebug information about the generated certificate.\n\n# Leaf Certificate - Use these to serve TLS traffic.\n\nleaf.key\n\tPrivate key (PEM-encoded) for terminating TLS traffic on the server.\n\nleaf.pem\n\tPublic key for terminating TLS traffic on the server.\n\nleaf.debug.crt\n\tDebug information about the generated certificate\n\n# Client Certificate - You probably don't need these.\n\nclient.key: Secret key for TLS client authentication\nclient.pem: Public key for TLS client authentication\n```\n\nAdd the following instructions to your Makefile, and all your users will have to\ndo to get started is run `make generate_cert` to download the binary and load\nTLS certificates.\n\n```make\nGENERATE_TLS_CERT = $(GOPATH)/bin/generate-tls-cert\n\n$(GENERATE_TLS_CERT):\n\tgo get -u github.com/Shyp/generate-tls-cert\n\ncerts/leaf.pem: | $(GENERATE_TLS_CERT)\n\tmkdir -p certs\n\tcd certs \u0026\u0026 $(GENERATE_TLS_CERT) --host=localhost,127.0.0.1\n\n# Generate TLS certificates for local development.\ngenerate_cert: certs/leaf.pem | $(GENERATE_TLS_CERT)\n```\n\n## Client Side\n\nHere's how to make requests that validate, using your new TLS certificates.\n\n### Go\n\n```go\nrootPEM, err := ioutil.ReadFile(\"path/to/root.pem\")\nif err != nil {\n\tlog.Fatal(err)\n}\nroots := x509.NewCertPool()\nok := roots.AppendCertsFromPEM(rootPEM)\nif !ok {\n\tpanic(\"failed to parse root certificate\")\n}\n\n// Use the tls.Config here in http.Transport.TLSClientConfig\nconn, err := tls.Dial(\"tcp\", \"yourhost:yourport\", \u0026tls.Config{\n    RootCAs: roots,\n})\nif err != nil {\n    panic(\"failed to connect: \" + err.Error())\n}\nconn.Close()\n```\n\n### Javascript\n\n```javascript\nvar fs = require('fs');\nvar https = require('https');\n\nvar get = https.request({\n  path: '/', hostname: 'yourhost', port: yourport,\n  ca: fs.readFileSync('path/to/root.pem'),\n  agent: false,\n  rejectUnauthorized: true,\n}, function(response) {\n  response.on('data', (d) =\u003e {\n    process.stdout.write(d);\n  });\n});\n\nget.on('error', function(e) {\n  console.error(e)\n  console.error(\"error\", e)\n  console.error(\"error\", JSON.stringify(e))\n});\n\nget.end();\n```\n\n### Curl\n\n```bash\ncurl --cacert path/to/root.pem https://yourhost:yourport\n```\n\n### Python Requests\n\n```python\nimport requests\n\nr = requests.get(\"https://yourhost:yourport\", verify='root.pem')\nprint(r.status_code)\n```\n\n### OpenSSL\n\n```bash\nopenssl s_client -showcerts -servername localhost -CAfile path/to/root.pem -connect yourhost:yourport\n```\n\n## Server Side\n\nHere's how to integrate the generated certificates into different server\narchitectures.\n\n### Go\n\nStart the Go server with the leaf public and private keys.\n\n```go\nhttp.ListenAndServeTLS(\":7252\", \"leaf.pem\", \"leaf.key\", nil)\n```\n\n### Node.js\n\nStart a Node server with the leaf public and private keys.\n\n```javascript\nconst https = require('https');\nconst fs = require('fs');\n\nconst options = {\n  key: fs.readFileSync('leaf.key'),\n  cert: fs.readFileSync('leaf.pem'),\n};\n\nhttps.createServer(options, (req, res) =\u003e {\n  res.writeHead(200);\n  res.end('hello world\\n');\n}).listen(8000);\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FShyp%2Fgenerate-tls-cert","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FShyp%2Fgenerate-tls-cert","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FShyp%2Fgenerate-tls-cert/lists"}