go/libkb/ca.go - master - githubmirror/client

go/libkb/ca.go
193 строки10 KB
Mike Maxim
update api ca
31 дек 2023, 22:07
31 дек 2023, 22:07fbebbc9
// Copyright 2015 Keybase, Inc. All rights reserved. Use of
// this source code is governed by the included BSD license.

package libkb

import "strings"

var apiCAOverrideForTest = ""

// GetBundledCAsFromHost returns in root CA in []byte for given host, or nil if
// no matching CA is found for host.
func GetBundledCAsFromHost(host string) (rootCA []byte, ok bool) {
	host = strings.TrimSpace(strings.ToLower(host))
	realAPICA := APICA
	if len(apiCAOverrideForTest) > 0 {
		realAPICA = apiCAOverrideForTest
	}
	switch {
	case (host == "api.keybase.io" || host == "api-0.core.keybaseapi.com" || host == "api-1.core.keybaseapi.com"):
		return []byte(realAPICA), true

	// Staging CA.
	case strings.HasSuffix(host, "dev.keybase.io"),
		strings.HasSuffix(host, "dev.keybaseapi.com"):
		return []byte(KBFSDevCA), true

	// Prod CA.
	case strings.HasSuffix(host, "kbfs.keybase.io"),
		strings.HasSuffix(host, "kbfs.keybaseapi.com"):
		return []byte(KBFSProdCA), true

	// We have services using both CAs on this domain, so need to bundle both.
	case strings.HasSuffix(host, "core.keybase.io"),
		strings.HasSuffix(host, "core.keybaseapi.com"):
		return []byte(realAPICA + KBFSProdCA), true

	default:
		return nil, false
	}
}

const APICA = `
-----BEGIN CERTIFICATE-----
MIIGIzCCBAugAwIBAgIJAPzhpcIBaOeNMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCTlkxETAPBgNVBAcTCE5ldyBZb3JrMRQwEgYDVQQK
EwtLZXliYXNlIExMQzEXMBUGA1UECxMOQ2VydCBBdXRob3JpdHkxLjAsBgNVBAMM
JWtleWJhc2UuaW8vZW1haWxBZGRyZXNzPWNhQGtleWJhc2UuaW8wIBcNMjMxMjMx
MTkwMzE5WhgPNjAyMzEyMzExOTAzMTlaMIGMMQswCQYDVQQGEwJVUzELMAkGA1UE
CBMCTlkxETAPBgNVBAcTCE5ldyBZb3JrMRQwEgYDVQQKEwtLZXliYXNlIExMQzEX
MBUGA1UECxMOQ2VydCBBdXRob3JpdHkxLjAsBgNVBAMMJWtleWJhc2UuaW8vZW1h
aWxBZGRyZXNzPWNhQGtleWJhc2UuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
ggIKAoICAQDewsDpkby46+aUW8UtUg5RGZxCtnIwUptW739N4OJ6aWzfDf8nNVN2
4P7sqJSL1HtBwJb9XVmlF5N+6ebut8AKInV+kiSNJCuCy8oMuCEjPEhLkUwjy616
3mnpC24mFoDCaZefzFfTkW+pY1utxdF2kviCgV2KA+wUrbGFNSJZq0syy16hKEjv
7OauCTHvkt4swPRsva45/zsmM7NtjzHaxQhksbA+gBPIbxZLfx7LoqQnFGMCEben
45NgSNhKuwC1ADoiZt4Ol9Ico4HwcXedWn/8RvgcSISxbAFFtBe8BaHcNgsa6QVb
TCI7QdUKhZj5scv8yprQ11EY6UuxsvhnikuuGoqBINTy6Zf1i41FFoHQ/mdOTPJT
prEerOr33QZ6n8jrZuOwF1hin4ONI8rjeZdGt9YmXY1NyXzEoDJ+w5b72FD2/ArS
2lKJw3F9i5RmzQGF+NJn9NzpnURF2BRhGJdO2iGX5JEDYiBkyWgcKWVUw2MSNeGC
68eAsA6ty7KFUG6mJRAZQdC+QyyvVTPxU80MU4l53C5xFTYBpHzzVuSedJt2z37M
0uy9QVX4ErtB2e39aQWlgvvysbBjjuayL06h13Hp8/J6DeqQkYzpzCf9ujLD2VB6
V5gOryTIl2LEgDG0CyQ3NE8nicO7aLNN8HJCgzx6nABZuhz+A0U5swIDAQABo4GD
MIGAMA4GA1UdDwEB/wQEAwIChDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
AwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQURqpATOw1gVVrzlqqFKbkfaKX
vwowHwYDVR0jBBgwFoAURqpATOw1gVVrzlqqFKbkfaKXvwowDQYJKoZIhvcNAQEL
BQADggIBALjuBecPwt0XJ6rpygOt9r1O6Oyj6WshzD2OvsK/RoHCJLjI32V8xYt3
YubUdFucy5m6dUEeTo6LwDd/7UpX+7NImQdRssHk6GynJJ7Sd2Jqvzlh6t+xFJHG
WqRt/u48T9Bm7pw1Z79QAXXi1L9DnPz8nMzu6gVTS2dzG4FAjXwzKsYV6mLoQW0L
adLKQELboM5hCauSILncD9ujWBZduFr7o4eHrRaZ4FiZ/46nGn/lqDhFTtgvSL53
+thrAiQCVv7sGkg8Niu3WTuJtIDlXzjGFuGli/l9KI9Dnr+RBe1kileQ99VZmayA
PgVFzkicAEd5ZzGnADGWAW0nSA8tOxAyo3qnnJ6Z1e2mNflmGv6+cryIkksfDu7A
oQuFQW0E3wEDmBXFHAGWgNKZQ05nxPY6zDm3FQCzS3v6CZuyJ8iwpDTKZYp4azPb
WLef0IJCGB62/+6YwD3bUunFq6jUR/vCgc5WRrLQd4LAbrrrP8SaLNPIlapZkYIU
Ba88Cg+nfTa7s0ETEJDNV+UyEoZbAMhcjCbua+aMx66WA+iinmZ++ilXxlBPNyFM
XNpVqc8i9YuN5ASXKwR0nna/vFyr2sFYhV/Q+QIBUh6bwZEFF9f3qtgxi908ZSEC
ip88muP7dUJ5jR/XrBLdYqrnMFym5dyHN7AjBdTwjSkTtFKHjAxb
-----END CERTIFICATE-----
`

const KBFSProdCA = `
-----BEGIN CERTIFICATE-----
MIIFkjCCA3qgAwIBAgIRALpii0WkmMIt0pcl7fLxvogwDQYJKoZIhvcNAQELBQAw
UTESMBAGCgmSJomT8ixkARkWAmlvMRwwGgYKCZImiZPyLGQBGRYMa2Jmcy5rZXli
YXNlMR0wGwYDVQQDDBRLZXliYXNlIEtCRlMgQ0EgcHJvZDAgFw0xNzA5MjYxNzA3
NDJaGA83MDE0MDYwMjE3MDc0MlowUTESMBAGCgmSJomT8ixkARkWAmlvMRwwGgYK
CZImiZPyLGQBGRYMa2Jmcy5rZXliYXNlMR0wGwYDVQQDDBRLZXliYXNlIEtCRlMg
Q0EgcHJvZDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALtjrV8B+9ly
JjyMBX3m+9O8UbotvW9OQrPbQwVUY4LG8UJEeFETjtrZlYH4MZM7QhltBgxhnPlt
elCFxquCZTo8TScDzc6GdWZrvewDWjQTWRvxmNX++3dq5U9mbY8NqONoMoA9V4ZF
HL2xKrOITum0dSYjAzxfx5ofvdlmZ9MXTSDRu04lB0b0i2k3MnOfGQW7fxUA11lS
O5b3QrTvae20Pzhb5psjKUiaHDGMzulVO+Lz1gdsotahgxe/NCWiGjdS3OcjRbAV
BqNu7K/4xbxb580P1MOE+HSrziF3RDUSuryCzP8YMMqRXIf4rjaFYFrpazKbMoqG
pFZ//935i1lUopmIuaAkQjz/8Y11hYkdvSqVTHH0kyX7/kbEm+yIkLzn3VzoSJ5X
EL07XmHNY46LXBeDtIs3+Fdg0ISSMeHuSVYsm/TFK1VOrsToj8mbA0mF96laNMP6
d8OPWIVCbMN48MuZCT22gZCyAeHO57vXdd0Lg456WCcYcm3rQAHP0xoiHDLGxpoF
Yawl4dpj3qEdV1XJH0LQE450FVSrwfwL2FcH2+/6GVBhPEeJQgCECVbOwCbp/BPW
85Q7GntStVQQH89CqJnZEa1hglMwhaWCxVGfFDsPpM8GCh+BfXuSpQTlvOojo518
VRHxlMduI42VZMhnmHw7G4WorhhRC6inAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMB
Af8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRQmQ3lv6fySPlfpNjyUKG3wzh9
5jAfBgNVHSMEGDAWgBRQmQ3lv6fySPlfpNjyUKG3wzh95jANBgkqhkiG9w0BAQsF
AAOCAgEAEoOPz2/LQJZQId69QR5nedpoWZ7d7ob0tkM0/+S5fIgQCCsC31417pRD
QxFuPPnYh5XaEcdzWq3ECGMZZfSsDmfgJSgPwCOwtK6rXshKK+W66PK2/OGQD3Jx
QuBzBN1ZGT6saXg1pjhY1gdYCXuYiszXoYjpJZnp+sKegRB5BujEn9a1dnBCjVM3
BzXBB9PI34yc1+OJ6RusZtMa9fNgNAKJdMSTkCzVEU9qh3MhkqD/xEneUsZmdSDk
skv6/B1fpes0ctZM/JV99FrKDqq7eWnAlsF0e6GdnWL5MNOW0UupPK8edcDjr9op
cULw/+/2Hp60r50L1WWIcYEjrVmGIMpybrX1eqNilpJSjgrhX0ZqtiHh03+DcxXw
kZHxDQZf1bn+WwMxy0nb6YNBwcBXZEePb4S5KKy4V0T10YEDv7oOMrF6wIy/MxtU
wXHjIp+cd+lZkMngsGYZQExt9dq2BVmAncUiXj4ZAGQjpgSjaEuFkKDxEnRU908n
s+ljmQv1mMwPJqVyR+VIcwmAzhDSK1bwRpKgPjhkB10fBbiqPVllPuU40lSWCGEA
JB1KvwsOTY92T/h43MIeXWD2q1yzLtNmXp434uTUiZZwu2rFUYJTwagGp+z7d8TO
Zdjxkm8d4rsrfgqIWXdOQejJwYm8+LpRiOcUNpA47JR5l+HQAMQ=
-----END CERTIFICATE-----
` /* ^ created on 9/26/2017; expires on 06/02/7014 */ + `
-----BEGIN CERTIFICATE-----
MIIDkDCCAnigAwIBAgIRAL1MQ3C37AuGO8gFqfhqb9EwDQYJKoZIhvcNAQELBQAw
UTESMBAGCgmSJomT8ixkARkWAmlvMRwwGgYKCZImiZPyLGQBGRYMa2Jmcy5rZXli
YXNlMR0wGwYDVQQDDBRLZXliYXNlIEtCRlMgQ0EgcHJvZDAeFw0xNTExMDgyMzM3
MDFaFw0xNzExMDcyMzM3MDFaMFExEjAQBgoJkiaJk/IsZAEZFgJpbzEcMBoGCgmS
JomT8ixkARkWDGtiZnMua2V5YmFzZTEdMBsGA1UEAwwUS2V5YmFzZSBLQkZTIENB
IHByb2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCr9ttTzL093jPt
WstzWR19qvLprd778ALqShZYZughuXPULgOck4AQW27vlp1nY8+7sBnWgstzL6Gv
dTQU61e34yOeAFYyKoWPFHyeo/g1y+LANgLdLbeOatOlWyM2sb/f0K3SKpusp/9J
0ylpDyko97MAI28spwX1d7L/qlDV6ryce4GrzElp3J8j3TZ3cju5rEldn8BSnLYw
i/2/Sc93GwhkjI03MZvuWaJQXQjTMALVzx5gFzshUymV4yrJfQbmBTwODf1yucsQ
NrWDiKWcFXe5dR8BWBZG7lslZeGYaHQ6lc3TgGwaPobpaZpzVEt3Crb9HAuTVl8/
Ynlw2XvzAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
MB0GA1UdDgQWBBSg9AYko8IqCwg2awZOZO6TW+ITsjAfBgNVHSMEGDAWgBSg9AYk
o8IqCwg2awZOZO6TW+ITsjANBgkqhkiG9w0BAQsFAAOCAQEAAJ2oOlY+DCDWr73m
TrR3Kfx+bDzvU1IZviKKooGGPjG+apcz5rWoKhjkO593ORCrygAvITnAI4v2Eaic
h2zYfWkOnCI2YYvVChR0TSJfa2+gxZFUqxRb68zMgcTxGZTZUonEX4nCJjkrSx3M
ATZkFWJDPPVci6o87VbpnKOc3mep3i1s3Cvw0GMHP+yVgw8Y0BpXII5hGbCODmoh
d2mdg2gjlOVBCfTEAe7cgUx9/lraQwUurUjDO3g54NZo/pcoc9koIW+Ai+saF5gA
UnFkqAOuEw0y4Fxzr9pw9naKF3KMlEJf6CiDJ4xspNzPZFupuepKitRrlrzofYuW
OXgZAw==
-----END CERTIFICATE-----
` /* ^ expires on 11/7/2017 */

const KBFSDevCA = `
-----BEGIN CERTIFICATE-----
MIIFjTCCA3WgAwIBAgIQFpAR2yGFjPGpRawSbyV+JzANBgkqhkiG9w0BAQsFADBP
MRIwEAYKCZImiZPyLGQBGRYCaW8xGzAZBgoJkiaJk/IsZAEZFgtkZXYua2V5YmFz
ZTEcMBoGA1UEAwwTS2V5YmFzZSBLQkZTIENBIGRldjAgFw0xNzA5MjYxNzA3MDZa
GA83MDE0MDYwMjE3MDcwNlowTzESMBAGCgmSJomT8ixkARkWAmlvMRswGQYKCZIm
iZPyLGQBGRYLZGV2LmtleWJhc2UxHDAaBgNVBAMME0tleWJhc2UgS0JGUyBDQSBk
ZXYwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfzXIB3edtDpdpyOrS
8rSBL6STOIucCQUf8737uk1FyA8kg84YCyDUtGFe242tCncQMJ3i/3Fo4542txKf
UQ6C7XCIUKP76ZvnG6N+KJkb0Tnr3N6pOYj0xQE6dldcXHNOgOC14m84mDABH0L9
0ZSpsVKmS7svn+Nr5y8hO9J2gg8/HBGl6MupJci4VGaTFgzT22D7IvjsBEcr4Pwd
qX6VafdeXlRONrVvPTHWJilpwpDkOo2EV6Un+61bVxTejFVsDpSRlwxE/R4zUJjm
sscE0GOpyZRyzmdAPlzEVhTqlMTjpFyODukQnXUq8CvkoZzzc+aCCFQbRw33T3eF
Je+pjqJS38pzQeaxCWs35WG53+xqiAuGVuXTcc5R31gVK2E92UmrGL96V9gRSTfg
YEoT4wVHzFscMIQUpKqQ2uoJm1asiOcJG6rPFSrkTTMSiCu1ITXeL62dj7Id+6gT
wdUv/r2W8tt4cCv24mfZPKI1cHjXUjZFslHJtFXn1kG19ka+JLj7kIAeglCona22
xTwdsla5nsAX2xOhtiteYlmmOkhIj3CJLDm86PYcTcsTByiDqNdgUdFGk4uvnSph
1yW/NulAuY4BX7yIRGqwGLgQQvnsbdsvcH+kYxu3I2nNz8dsaoAsX6cMSLQ9tH/I
6Cu/3jaXanvem7yFnfuFuO3abQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4G
A1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUknKQ73ecH+pEfJicSJdhi7Ud4ekwHwYD
VR0jBBgwFoAUknKQ73ecH+pEfJicSJdhi7Ud4ekwDQYJKoZIhvcNAQELBQADggIB
AI8dK0HiAvXtdvU3sMdK1K18JKroirK7yJL2MPKAy5Fr8IT30g/9zsoWY22zTRbD
iTcvjAoK/9DlcTSdxjYqh5s8D5jALBOxWi9e6TFWK71m6eec103TJJIOtwS2jC6u
R3hk1W56XL7cbdptAtrUfcEf3iohbnORdd50iAsGOAl/Iv4FduQeGZNJXIBpINYc
Mjo8CLA5Iw94XlyCcc8OJPYEk33Af2MiYCnccndWlophZq8fpLTaEcPGtlIYv2sA
sJhGWAdvEtZ9RoI5Rp66NuP7ZuD8GSjBwglC4PsKQS+7VdLOtt2HrzX3ZXp9DT9T
zjt/PriziUbyadK8PaYaJzTkGgJe4J0nA0UlNbRl8peEpepomPG2SyJSuNpkWh0d
zHeusngGowrBMqn54hmBwGaAGPA+b4faIq9sHnZm1TRlg0f7GeQegeJhjigAsv7q
iq2keQ2AXXnb1SUU2NbQ6GcdNEdi1eaatiWCkmp+pZLOAAJq7FsQiOF0oqo6OicX
gRQVL8BaIiQ6OQYO+XpLP0Efji0aK11X0yh02oUjdTWGBfQyBAFtccwUUDZZEaRV
FWG2uwh+ewaxA+3q+goIbIpzwbV8HMUcBAvEGajprdkv0Qmv3PY/ZVW+Y1SaSlIN
We3c57PSYN4UV4034Wr8gAZY5nzlYb0irQnl/Kw5oyNP
-----END CERTIFICATE-----
` /* ^ created on 9/26/2017; expires on 06/02/7014 */ + `
-----BEGIN CERTIFICATE-----
MIIDjDCCAnSgAwIBAgIRANRMeoRz3Xg5c8kT2f5k9wMwDQYJKoZIhvcNAQELBQAw
TzESMBAGCgmSJomT8ixkARkWAmlvMRswGQYKCZImiZPyLGQBGRYLZGV2LmtleWJh
c2UxHDAaBgNVBAMME0tleWJhc2UgS0JGUyBDQSBkZXYwHhcNMTUwOTIzMTk0NzM3
WhcNMTcwOTIyMTk0NzM3WjBPMRIwEAYKCZImiZPyLGQBGRYCaW8xGzAZBgoJkiaJ
k/IsZAEZFgtkZXYua2V5YmFzZTEcMBoGA1UEAwwTS2V5YmFzZSBLQkZTIENBIGRl
djCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALWCTpo8NNeGM6nIkNW+
4qiM8ocuFjDw2Er6XJhncgj7xjTGf/9yZqnXeGHyHGT66AtKl5bc8son4+npWmvs
47OXORF7YGi89d9KBlIC4NCetZLBSVWiSG+XXSKrmIffi6D0UojpZc2blnzgejEO
ii1uCDSaj6TRLcC8z/eXKq+DtPcfNnPL0pu5CiUNrH1cA9PS+jO1OonCGPG5yVjW
bBw0nQfThhapm9IohtdbYzlQiSbE1+3ctNwCPLas3mmUWkcrrVbn1Fa54LnfNR2u
pnZRNZ7czfB/vtymUJ6/y8dLYTmnzMFFYy416FOmvr4NqLBkaMWg9xp+KeR30044
AicCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYD
VR0OBBYEFBdb6+h+Qq5vXUWo99QbatQTX6u+MB8GA1UdIwQYMBaAFBdb6+h+Qq5v
XUWo99QbatQTX6u+MA0GCSqGSIb3DQEBCwUAA4IBAQArhp0KXfJHEhVcUXqYYjdn
pZQjq3+0aKjMjgnVWekxwwBARh4ycy2e7066ru1eDZr6myGYK+/vjXituWtq7/c/
Fifezgje6o9lB1TPamgQeE8slqqAgc3OxTqbAAf+rxJelcI6aOm7tqX04k8Aiuhm
dr64cM/NsZTKUbrCHCVNHPNj8wWkrb9pbXH/q0+Gt/gw4MiL6p1YuSr4SIENqDpP
VFiOCcbOSiw5OHPe/VwLts/g3e3NSXqd53nQW1/CgpSBdT73oWw+SBfv21KuJN5K
745S8d9JfbLItWgM73o94MSLOpUEl2F7qqXj2eOBEYWIMbRjMMZ7Vzmuo5wo3M8i
-----END CERTIFICATE-----
` /* ^ expired on 9/22/2017 */