{"name":"selfsigned_cert.nu","source":"// selfsigned_cert.nu — mint a self-signed HTTPS certificate in pure NURL.\n//\n// No OpenSSL, no shelling out: the P-256 keypair, the X.509 v3 DER\n// structure, the RFC 6979 ECDSA-SHA256 self-signature and the PEM wrapping\n// all come from the standard library (std/x509_gen.nu + the same crypto\n// that powers the pure TLS stack). Run it and you get a certificate +\n// private key you could hand straight to the pure TLS server — `curl\n// --cacert` accepts the pair, and so does `openssl verify`.\n//\n// As a finale the program eats its own cooking: it re-parses the PEM with\n// the stdlib's X.509 *parser* (std/x509.nu, the one the TLS client uses to\n// verify real websites) and checks the self-signature with\n// ecdsa_p256_verify.\n\n$ `stdlib/core/io.nu`\n$ `stdlib/core/string.nu`\n$ `stdlib/core/vec.nu`\n$ `stdlib/std/bytes.nu`\n$ `stdlib/std/hash_sha256.nu`\n$ `stdlib/std/x509_gen.nu`\n$ `stdlib/std/x509.nu`\n$ `stdlib/std/pkey.nu`\n\n@ main → i {\n    ( nurl_print `── self-signed certificate, minted in pure NURL ──\\n\\n` )\n\n    // CN + SAN \"localhost\", valid for one year.\n    : X509SelfSigned c ( x509_selfsigned_p256 `localhost` 365 )\n\n    ( nurl_print ( string_data . c cert_pem ) )\n    ( nurl_print `\\n` )\n    ( nurl_print ( string_data . c key_pem ) )\n\n    // ── self-check: parse it back and verify the signature ──────────\n    : ~ i rc 1\n    : !( Vec u ) ParseErr dr ( pem_to_der ( string_data . c cert_pem ) )\n    ?? dr {\n        T der → {\n            : X509 x ( x509_parse der )\n            ? . x ok {\n                ( nurl_print `\\nparsed back with the stdlib X.509 parser:\\n` )\n                : ~ i si 0\n                ~ < si ( vec_len [String] . x sans ) {\n                    ?? ( vec_get [String] . x sans si ) {\n                        T san → {\n                            ( nurl_print `  subjectAltName: DNS:` )\n                            ( nurl_print ( string_data san ) )\n                            ( nurl_print `\\n` )\n                        }\n                        F → {}\n                    }\n                    = si + si 1\n                }\n                ( nurl_print ? . x is_ca `  basicConstraints: CA:TRUE\\n` `  basicConstraints: leaf\\n` )\n\n                : ( Vec u ) h ( sha256_pure . x tbs )\n                : ( Vec u ) rs ( x509_ecdsa_sig_rs . x sig )\n                ? == ( vec_len [u] rs ) 64 {\n                    : ( Vec u ) r ( bytes_slice rs 0 32 )\n                    : ( Vec u ) s ( bytes_slice rs 32 64 )\n                    ? ( ecdsa_p256_verify . x ec_point r s h )\n                    { ( nurl_print `  ECDSA-P256/SHA-256 self-signature: verifies\\n` ) = rc 0 }\n                    { ( nurl_print `  self-signature: FAILED\\n` ) }\n                } { ( nurl_print `  signature DER: malformed\\n` ) }\n            } { ( nurl_print `parse FAILED\\n` ) }\n        }\n        F _ → { ( nurl_print `pem decode FAILED\\n` ) }\n    }\n    ^ rc\n}\n","bytes":2926}