lab-ca/main.go

package main

import (
	"fmt"
	"os"

	"github.com/spf13/cobra"
)

var Version = "dev"
var configPath string

func main() {

	var overwrite bool
	var subject string
	var certType string
	var validity string
	var san []string
	var name string
	var fromFile string
	var dryRun bool
	var verbose bool
	var crlFile string
	var crlValidityDays int
	var revokeName string
	var revokeSerial string
	var revokeReasonStr string

	var rootCmd = &cobra.Command{
		Use:   "lab-ca",
		Short: "Certificate Authority Utility",
		Long:  "lab-ca - Certificate Authority Utility",
		Run: func(cmd *cobra.Command, args []string) {
			printMainHelp()
		},
	}

	var initCmd = &cobra.Command{
		Use:   "initca",
		Short: "Generate a new CA certificate and key",
		Run: func(cmd *cobra.Command, args []string) {
			InitCA(overwrite)
		},
	}

	initCmd.Flags().StringVar(&configPath, "config", "ca_config.hcl", "Path to CA configuration file")
	initCmd.Flags().BoolVar(&overwrite, "overwrite", false, "Allow overwriting existing files")

	var issueCmd = &cobra.Command{
		Use:   "issue",
		Short: "Issue a new certificate (client, server, server-only, code-signing, email)",
		Run: func(cmd *cobra.Command, args []string) {
			if err := LoadCA(); err != nil {
				fmt.Fprintf(os.Stderr, "ERROR: %v\n", err)
				os.Exit(1)
			}
			if err := IssueCertificate(configPath,
				subject,
				certType,
				validity,
				san,
				name,
				fromFile,
				overwrite,
				dryRun,
				verbose); err != nil {
				fmt.Fprintf(os.Stderr, "ERROR: %v\n", err)
				os.Exit(1)
			}
		},
	}

	issueCmd.Flags().StringVar(&configPath, "config", "ca_config.hcl", "Path to CA configuration file")
	issueCmd.Flags().StringVar(&subject, "subject", "", "Subject Common Name for the certificate (optional, defaults to --name)")
	issueCmd.Flags().StringVar(&certType, "type", "server", "Certificate type: client, server, server-only, code-signing, email")
	issueCmd.Flags().StringArrayVar(&san, "san", nil,
		"Subject Alternative Name (SAN). Use multiple times for multiple values.\n"+
			"Format: dns:example.com, ip:1.2.3.4, email:user@example.com")
	issueCmd.Flags().StringVar(&validity, "validity", "1y", "Certificate validity (e.g. 2y, 6m, 30d). Overrides config file for this certificate.")
	issueCmd.Flags().BoolVar(&overwrite, "overwrite", false, "Allow overwriting existing files")
	issueCmd.Flags().StringVar(&fromFile, "from-file", "", "Path to HCL file with multiple certificate definitions (batch mode)")
	issueCmd.Flags().BoolVar(&dryRun, "dry-run", false, "Validate and show what would be created, but do not write files (batch mode)")
	issueCmd.Flags().BoolVar(&verbose, "verbose", false, "Print detailed information about each processed certificate")
	// Only require --name in simple mode
	issueCmd.Flags().StringVar(&name, "name", "", "Name for the certificate and key files (used as subject if --subject is omitted)")
	issueCmd.PreRun = func(cmd *cobra.Command, args []string) {
		if fromFile == "" {
			cmd.MarkFlagRequired("name")
		}
	}

	var versionCmd = &cobra.Command{
		Use:   "version",
		Short: "Show version information",
		Run: func(cmd *cobra.Command, args []string) {
			fmt.Printf("lab-ca version: %s\n", Version)
		},
	}

	var crlCmd = &cobra.Command{
		Use:   "crl",
		Short: "Generate a Certificate Revocation List (CRL)",
		Run: func(cmd *cobra.Command, args []string) {
			if err := LoadCA(); err != nil {
				fmt.Printf("ERROR: %v\n", err)
				os.Exit(1)
			}
			if crlValidityDays <= 0 {
				crlValidityDays = 30 // default to 30 days
			}
			err := CAState.GenerateCRL(crlFile, crlValidityDays)
			if err != nil {
				fmt.Printf("ERROR generating CRL: %v\n", err)
				os.Exit(1)
			}
			fmt.Printf("CRL written to %s (valid for %d days)\n", crlFile, crlValidityDays)
		},
	}
	crlCmd.Flags().StringVar(&crlFile, "crl-file", "crl.pem", "Output path for CRL file (default: crl.pem)")
	crlCmd.Flags().IntVar(&crlValidityDays, "validity-days", 30, "CRL validity in days (default: 30)")

	var revokeCmd = &cobra.Command{
		Use:   "revoke",
		Short: "Revoke a certificate by name or serial number",
		Run: func(cmd *cobra.Command, args []string) {
			if err := LoadCA(); err != nil {
				fmt.Printf("ERROR: %v\n", err)
				os.Exit(1)
			}
			if (revokeName == "" && revokeSerial == "") || (revokeName != "" && revokeSerial != "") {
				fmt.Println("ERROR: You must specify either --name or --serial (but not both)")
				os.Exit(1)
			}
			serial := ""
			if revokeName != "" {
				found := false
				for _, rec := range CAState.Certificates {
					if rec.Name == revokeName {
						serial = rec.Serial
						found = true
						break
					}
				}
				if !found {
					fmt.Printf("ERROR: Certificate with name '%s' not found\n", revokeName)
					os.Exit(1)
				}
			} else {
				serial = revokeSerial
			}
			reasonMap := map[string]int{
				"unspecified":          0,
				"keyCompromise":        1,
				"caCompromise":         2,
				"affiliationChanged":   3,
				"superseded":           4,
				"cessationOfOperation": 5,
				"certificateHold":      6,
				"removeFromCRL":        8,
			}
			reasonCode, ok := reasonMap[revokeReasonStr]
			if !ok {
				fmt.Printf("ERROR: Unknown revocation reason '%s'. Valid reasons: ", revokeReasonStr)
				for k := range reasonMap {
					fmt.Printf("%s ", k)
				}
				fmt.Println()
				os.Exit(1)
			}
			if err := CAState.RevokeCertificate(serial, reasonCode); err != nil {
				fmt.Printf("ERROR: %v\n", err)
				os.Exit(1)
			}
			fmt.Printf("Certificate with serial %s revoked (reason: %s, code %d)\n", serial, revokeReasonStr, reasonCode)
		},
	}
	revokeCmd.Flags().StringVar(&revokeName, "name", "", "Certificate name to revoke (mutually exclusive with --serial)")
	revokeCmd.Flags().StringVar(&revokeSerial, "serial", "", "Certificate serial number to revoke (mutually exclusive with --name)")
	revokeCmd.Flags().StringVar(&revokeReasonStr, "reason", "cessationOfOperation", "Revocation reason (unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL)")

	rootCmd.AddCommand(initCmd)
	rootCmd.AddCommand(issueCmd)
	rootCmd.AddCommand(versionCmd)
	rootCmd.AddCommand(crlCmd)
	rootCmd.AddCommand(revokeCmd)

	if err := rootCmd.Execute(); err != nil {
		os.Exit(1)
	}
}

func printMainHelp() {
	fmt.Println("lab-ca - Certificate Authority Utility")
	fmt.Println()
	fmt.Println("Usage:")
	fmt.Println("  lab-ca <command> [options]")
	fmt.Println()
	fmt.Println("Available commands:")
	fmt.Println("  initca     Generate a new CA certificate and key")
	fmt.Println("  issue      Issue a new client/server certificate")
	fmt.Println("  version     Show version information")
	fmt.Println("  crl        Generate a Certificate Revocation List (CRL)")
	fmt.Println("  revoke      Revoke a certificate by name or serial number")
	fmt.Println()
	fmt.Println("Use 'lab-ca <command> --help' for more information about a command.")
}