feat(certificate): set distinguishable issuer name with peer id (#1296)

libp2p/transports/tls/certificate.nim

@@ -28,6 +28,7 @@ import mbedtls/error
 import nimcrypto/utils
 import ../../crypto/crypto
 import ../../errors
+import ../../../libp2p/peerid
 
 logScope:
   topics = "libp2p tls certificate"
@@ -75,6 +76,12 @@ var
   ctrDrbg: mbedtls_ctr_drbg_context
   drbgInitialized = false
 
+func publicKey*(cert: P2pCertificate): PublicKey =
+  return PublicKey.init(cert.extension.publicKey).get()
+
+func peerId*(cert: P2pCertificate): PeerId =
+  return PeerId.init(cert.publicKey()).tryGet()
+
 proc initializeDRBG() {.raises: [KeyGenerationError].} =
   ## Function to initialize entropy and DRBG context if not already initialized.
   if not drbgInitialized:
@@ -182,6 +189,15 @@ func makeSignatureMessage(pubKey: seq[byte]): seq[byte] {.inline.} =
 
   return msg
 
+func makeIssuerDN(identityKeyPair: KeyPair): string {.inline.} =
+  let issuerDN =
+    try:
+      "CN=" & $(PeerId.init(identityKeyPair.pubkey).tryGet())
+    except LPError:
+      raiseAssert "pubkey must be set"
+
+  return issuerDN
+
 func parseCertificatePublicKey(
     pk: mbedtls_pk_context
 ): seq[byte] {.raises: [CertificateParsingError].} =
@@ -332,11 +348,12 @@ proc generate*(
   let libp2pExtension = makeLibp2pExtension(identityKeyPair, certKey)
 
   # Set the Subject and Issuer Name (self-signed)
-  ret = mbedtls_x509write_crt_set_subject_name(addr crt, "CN=libp2p.io")
+  let issuerDN = makeIssuerDN(identityKeyPair)
+  ret = mbedtls_x509write_crt_set_subject_name(addr crt, issuerDN)
   if ret != 0:
     raise newException(CertificateCreationError, "Failed to set subject name")
 
-  ret = mbedtls_x509write_crt_set_issuer_name(addr crt, "CN=libp2p.io")
+  ret = mbedtls_x509write_crt_set_issuer_name(addr crt, issuerDN)
   if ret != 0:
     raise newException(CertificateCreationError, "Failed to set issuer name")
 

tests/transports/tls/testcertificate.nim

@@ -4,12 +4,6 @@ import ../../../libp2p/transports/tls/certificate
 import ../../../libp2p/crypto/crypto
 import ../../../libp2p/peerid
 
-func publicKey*(cert: P2pCertificate): PublicKey =
-  return PublicKey.init(cert.extension.publicKey).get()
-
-func peerId*(cert: P2pCertificate): PeerId =
-  return PeerId.init(cert.publicKey()).tryGet()
-
 suite "Certificate roundtrip tests":
   test "generate then parse with DER ecoding":
     let schemes = @[Ed25519, Secp256k1, ECDSA]