From 5f961cd492ac9d43fc33a8ef646bae79d113fd97 Mon Sep 17 00:00:00 2001 From: Alex Vaghin Date: Wed, 10 Aug 2016 16:35:40 +0200 Subject: [PATCH] acme: simplify TLS-SNI challenge cert There's no need to PEM-encode key/cert pair to create a tls.Certificate. All tls.X509KeyPair does is decode back to DER and verify that the key corresponds to the cert. But we already know it does. Change-Id: Icccdaf7fd86317147476fb03cbc71ee7b4a06edb Reviewed-on: https://go-review.googlesource.com/26694 Reviewed-by: Brad Fitzpatrick --- acme/internal/acme/acme.go | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/acme/internal/acme/acme.go b/acme/internal/acme/acme.go index 5e44dfb..86398e3 100644 --- a/acme/internal/acme/acme.go +++ b/acme/internal/acme/acme.go @@ -615,12 +615,10 @@ func tlsChallengeCert(san ...string) (tls.Certificate, error) { DNSNames: san, } der, err := x509.CreateCertificate(rand.Reader, &t, &t, &key.PublicKey, key) - if err != nil { - return tls.Certificate{}, err - } - cert := encodePEM("CERTIFICATE", der) - keyp := encodePEM("RSA PRIVATE KEY", x509.MarshalPKCS1PrivateKey(key)) - return tls.X509KeyPair(cert, keyp) + return tls.Certificate{ + Certificate: [][]byte{der}, + PrivateKey: key, + }, nil } // encodePEM returns b encoded as PEM with block of type typ.