summaryrefslogtreecommitdiffstats
path: root/vendor/github.com/miekg/dns/dane.go
blob: 8c4a14ef190688aedf9db933bfafaa29db9e397e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
package dns

import (
	"crypto/sha256"
	"crypto/sha512"
	"crypto/x509"
	"encoding/hex"
	"errors"
)

// CertificateToDANE converts a certificate to a hex string as used in the TLSA or SMIMEA records.
func CertificateToDANE(selector, matchingType uint8, cert *x509.Certificate) (string, error) {
	switch matchingType {
	case 0:
		switch selector {
		case 0:
			return hex.EncodeToString(cert.Raw), nil
		case 1:
			return hex.EncodeToString(cert.RawSubjectPublicKeyInfo), nil
		}
	case 1:
		h := sha256.New()
		switch selector {
		case 0:
			h.Write(cert.Raw)
			return hex.EncodeToString(h.Sum(nil)), nil
		case 1:
			h.Write(cert.RawSubjectPublicKeyInfo)
			return hex.EncodeToString(h.Sum(nil)), nil
		}
	case 2:
		h := sha512.New()
		switch selector {
		case 0:
			h.Write(cert.Raw)
			return hex.EncodeToString(h.Sum(nil)), nil
		case 1:
			h.Write(cert.RawSubjectPublicKeyInfo)
			return hex.EncodeToString(h.Sum(nil)), nil
		}
	}
	return "", errors.New("dns: bad MatchingType or Selector")
}