enroll: 登记
register: 注册
登记签名人初始化逻辑
// Initialize the enrollment signer
err = ca.initEnrollmentSigner()
主要方法
ca.enrollSigner, err = util.BccspBackedSigner(c.CA.Certfile, c.CA.Keyfile, policy, ca.csp)
BccspBackedSigner方法
func BccspBackedSigner(caFile, keyFile string, policy *config.Signing, csp bccsp.BCCSP) (signer.Signer, error) {
_, cspSigner, parsedCa, err := GetSignerFromCertFile(caFile, csp)
if err != nil {
// Fallback: attempt to read out of keyFile and import
log.Debugf("No key found in BCCSP keystore, attempting fallback")
var key bccsp.Key
var signer crypto.Signer
key, err = ImportBCCSPKeyFromPEM(keyFile, csp, false)
if err != nil {
return nil, errors.WithMessage(err, fmt.Sprintf("Could not find the private key in BCCSP keystore nor in keyfile '%s'", keyFile))
}
signer, err = cspsigner.New(csp, key)
if err != nil {
return nil, errors.WithMessage(err, "Failed initializing CryptoSigner")
}
cspSigner = signer
}
signer, err := local.NewSigner(cspSigner, parsedCa, signer.DefaultSigAlgo(cspSigner), policy)
if err != nil {
return nil, errors.Wrap(err, "Failed to create new signer")
}
return signer, nil
}
(1) 将PEM证书文件转换为x509格式
_, cspSigner, parsedCa, err := GetSignerFromCertFile(caFile, csp)
...
certBytes, err := ioutil.ReadFile(certFile)
parsedCa, err := helpers.ParseCertificatePEM(certBytes)
(2) 从X509证书中获取签名人
// Get the signer from the cert
key, cspSigner, err := GetSignerFromCert(parsedCa, csp)
(3) 由加密服务签名人 转换为本地签名人, 和bccsp的那一部分相同,cspSigner 都转换为了 本地的signer
signer, err := local.NewSigner(cspSigner, parsedCa, signer.DefaultSigAlgo(cspSigner), policy)
总结一下:
获取签名人的要素: 证书文件, 加密服务提供者(bccsp)
证书文件(ca-cert.pem)-->解析为符合X509格式的结构体
---> 从X509中获取公钥 --> 由公钥及bccsp共同生成私钥---> 由私钥和bccsp共同生成bccspSigner ---> 由bccspSigner生成LocalSigner
--> 即为最后的EnrollmentSigner。