func (c *defaultCA) SignCSR(csrPem []byte, subject string, identity *identity.Bundle, ttl time.Duration, isCA bool) (*SignedCertificate, error) {
	c.issuerLock.RLock()
	defer c.issuerLock.RUnlock()
	certLifetime := ttl
	if certLifetime.Seconds() < 0 {
		certLifetime = c.config.WorkloadCertTTL
	}
	certLifetime += c.config.AllowedClockSkew
	signingCert := c.bundle.issuerCreds.Certificate
	signingKey := c.bundle.issuerCreds.PrivateKey
	cert, err := certs.ParsePemCSR(csrPem)
	if err != nil {
		return nil, errors.Wrap(err, "error parsing csr pem")
	}
	crtb, err := csr.GenerateCSRCertificate(cert, subject, identity, signingCert, cert.PublicKey, signingKey.Key, certLifetime, c.config.AllowedClockSkew, isCA)
	if err != nil {
		return nil, errors.Wrap(err, "error signing csr")
	}
	csrCert, err := x509.ParseCertificate(crtb)
	if err != nil {
		return nil, errors.Wrap(err, "error parsing cert")
	}
	certPem := pem.EncodeToMemory(&pem.Block{
		Type:  certs.Certificate,
		Bytes: crtb,
	})
	return &SignedCertificate{
		Certificate: csrCert,
		CertPEM:     certPem,
	}, nil
}
SignCSR signs a request with a PEM encoded CSR cert and duration.
If isCA is set to true, a CA cert will be issued. If isCA is set to false, a workload
Certificate will be issued instead.
package ca
import (
	"crypto/rand"
	"crypto/x509"
	"encoding/pem"
	"os"
	"sync"
	"time"
	"github.com/pkg/errors"
	"github.com/dapr/kit/logger"
	"github.com/dapr/dapr/pkg/credentials"
	"github.com/dapr/dapr/pkg/sentry/certs"
	"github.com/dapr/dapr/pkg/sentry/config"
	"github.com/dapr/dapr/pkg/sentry/csr"
	"github.com/dapr/dapr/pkg/sentry/identity"
)
const (
	caOrg                      = "dapr.io/sentry"
	caCommonName               = "cluster.local"
	selfSignedRootCertLifetime = time.Hour * 8760
	certLoadTimeout            = time.Second * 30
	certDetectInterval         = time.Second * 1
)
var log = logger.NewLogger("dapr.sentry.ca")
type CertificateAuthority interface {
	LoadOrStoreTrustBundle() error
	GetCACertBundle() TrustRootBundler
	SignCSR(csrPem []byte, subject string, identity *identity.Bundle, ttl time.Duration, isCA bool) (*SignedCertificate, error)
	ValidateCSR(csr *x509.CertificateRequest) error
}
func NewCertificateAuthority(config config.SentryConfig) (CertificateAuthority, error) {
	switch config.CAStore {
	default:
		return &defaultCA{
			config:     config,
			issuerLock: &sync.RWMutex{},
		}, nil
	}
}
type defaultCA struct {
	bundle     *trustRootBundle
	config     config.SentryConfig
	issuerLock *sync.RWMutex
}
type SignedCertificate struct {
	Certificate *x509.Certificate
	CertPEM     []byte
}
func (c *defaultCA) LoadOrStoreTrustBundle() error {
	bundle, err := c.validateAndBuildTrustBundle()
	if err != nil {
		return err
	}
	c.bundle = bundle
	return nil
}
func (c *defaultCA) GetCACertBundle() TrustRootBundler {
	return c.bundle
}