public CertPair createCert()

in dubbo-xds/src/main/java/org/apache/dubbo/registry/xds/istio/IstioCitadelCertificateSigner.java [118:215]
85 lines of code
8 McCabe index (conditional complexity)

    public CertPair createCert() throws IOException {
        PublicKey publicKey = null;
        PrivateKey privateKey = null;
        ContentSigner signer = null;

        if (istioEnv.isECCFirst()) {
            try {
                ECGenParameterSpec ecSpec = new ECGenParameterSpec("secp256r1");
                KeyPairGenerator g = KeyPairGenerator.getInstance("EC");
                g.initialize(ecSpec, new SecureRandom());
                KeyPair keypair = g.generateKeyPair();
                publicKey = keypair.getPublic();
                privateKey = keypair.getPrivate();
                signer = new JcaContentSignerBuilder("SHA256withECDSA").build(keypair.getPrivate());
            } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException | OperatorCreationException e) {
                logger.error(
                        REGISTRY_FAILED_GENERATE_KEY_ISTIO,
                        "",
                        "",
                        "Generate Key with secp256r1 algorithm failed. Please check if your system support. "
                                + "Will attempt to generate with RSA2048.",
                        e);
            }
        }

        if (publicKey == null) {
            try {
                KeyPairGenerator kpGenerator = KeyPairGenerator.getInstance("RSA");
                kpGenerator.initialize(istioEnv.getRasKeySize());
                KeyPair keypair = kpGenerator.generateKeyPair();
                publicKey = keypair.getPublic();
                privateKey = keypair.getPrivate();
                signer = new JcaContentSignerBuilder("SHA256WithRSA").build(keypair.getPrivate());
            } catch (NoSuchAlgorithmException | OperatorCreationException e) {
                logger.error(
                        REGISTRY_FAILED_GENERATE_KEY_ISTIO,
                        "",
                        "",
                        "Generate Key with SHA256WithRSA algorithm failed. Please check if your system support.",
                        e);
                throw new RpcException(e);
            }
        }

        String csr = generateCsr(publicKey, signer);
        String caCert = istioEnv.getCaCert();
        ManagedChannel channel;
        if (StringUtils.isNotEmpty(caCert)) {
            channel = NettyChannelBuilder.forTarget(istioEnv.getCaAddr())
                    .sslContext(GrpcSslContexts.forClient()
                            .trustManager(new ByteArrayInputStream(caCert.getBytes(StandardCharsets.UTF_8)))
                            .build())
                    .build();
        } else {
            channel = NettyChannelBuilder.forTarget(istioEnv.getCaAddr())
                    .sslContext(GrpcSslContexts.forClient()
                            .trustManager(InsecureTrustManagerFactory.INSTANCE)
                            .build())
                    .build();
        }

        Metadata header = new Metadata();
        Metadata.Key<String> key = Metadata.Key.of("authorization", Metadata.ASCII_STRING_MARSHALLER);
        header.put(key, "Bearer " + istioEnv.getServiceAccount());

        key = Metadata.Key.of("ClusterID", Metadata.ASCII_STRING_MARSHALLER);
        header.put(key, istioEnv.getIstioMetaClusterId());

        IstioCertificateServiceGrpc.IstioCertificateServiceStub stub = IstioCertificateServiceGrpc.newStub(channel);

        stub = stub.withInterceptors(MetadataUtils.newAttachHeadersInterceptor(header));

        CountDownLatch countDownLatch = new CountDownLatch(1);
        StringBuffer publicKeyBuilder = new StringBuffer();
        AtomicBoolean failed = new AtomicBoolean(false);
        stub.createCertificate(
                generateRequest(csr), generateResponseObserver(countDownLatch, publicKeyBuilder, failed));

        long expireTime =
                System.currentTimeMillis() + (long) (istioEnv.getSecretTTL() * istioEnv.getSecretGracePeriodRatio());

        try {
            countDownLatch.await();
        } catch (InterruptedException e) {
            throw new RpcException("Generate Cert Failed. Wait for cert failed.", e);
        }

        if (failed.get()) {
            throw new RpcException("Generate Cert Failed. Send csr request failed. Please check log above.");
        }

        String privateKeyPem = generatePrivatePemKey(privateKey);
        CertPair certPair =
                new CertPair(privateKeyPem, publicKeyBuilder.toString(), System.currentTimeMillis(), expireTime);

        channel.shutdown();
        return certPair;
    }