fix(certificates): fail politely in tresor's cert issuer
solves where tresor would continue to try and
create a certificate even when unable to decode PEM
had an error
@@ -81,6 +81,7 @@ func (cm *CertManager) IssueCertificate(cn certificate.CommonName, validityPerio
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrDecodingPEMCert)).
Msg("Error decoding Root Certificate's PEM")
+ return nil, errors.Wrap(err, errCreateCert.Error())
}
rsaKeyRoot, err := certificate.DecodePEMPrivateKey(cm.ca.GetPrivateKey())
@@ -88,6 +89,7 @@ func (cm *CertManager) IssueCertificate(cn certificate.CommonName, validityPerio
// TODO(#3962): metric might not be scraped before process restart resulting from this error
log.Error().Err(err).Str(errcode.Kind, errcode.GetErrCodeWithMetric(errcode.ErrDecodingPEMPrivateKey)).
Msg("Error decoding Root Certificate's Private Key PEM ")
+ return nil, errors.Wrap(err, errCreateCert.Error())
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, x509Root, &certPrivKey.PublicKey, rsaKeyRoot)
