* validateCertificates(): split the function's code

control.go

@@ -1078,24 +1078,15 @@ func handleTLSConfigure(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-/* Process certificate data and its private key.
-CertificateChain, PrivateKey parameters are optional.
-On error, return partially set object
- with 'WarningValidation' field containing error description.
-*/
-func validateCertificates(CertificateChain, PrivateKey, ServerName string) tlsConfigStatus {
-	var err error
-	var data tlsConfigStatus
-
-	// check only public certificate separately from the key
-	if CertificateChain != "" {
-		log.Tracef("got certificate: %s", CertificateChain)
+// Return 0 on success
+func verifyCertChain(data *tlsConfigStatus, certChain string, serverName string) int {
+	log.Tracef("got certificate: %s", certChain)
 
 	// now do a more extended validation
 	var certs []*pem.Block    // PEM-encoded certificates
 	var skippedBytes []string // skipped bytes
 
-		pemblock := []byte(CertificateChain)
+	pemblock := []byte(certChain)
 	for {
 		var decoded *pem.Block
 		decoded, pemblock = pem.Decode(pemblock)
@@ -1115,14 +1106,14 @@ func validateCertificates(CertificateChain, PrivateKey, ServerName string) tlsCo
 		parsed, err := x509.ParseCertificate(cert.Bytes)
 		if err != nil {
 			data.WarningValidation = fmt.Sprintf("Failed to parse certificate: %s", err)
-				return data
+			return 1
 		}
 		parsedCerts = append(parsedCerts, parsed)
 	}
 
 	if len(parsedCerts) == 0 {
 		data.WarningValidation = fmt.Sprintf("You have specified an empty certificate")
-			return data
+		return 1
 	}
 
 	data.ValidCert = true
@@ -1130,7 +1121,7 @@ func validateCertificates(CertificateChain, PrivateKey, ServerName string) tlsCo
 	// spew.Dump(parsedCerts)
 
 	opts := x509.VerifyOptions{
-			DNSName: ServerName,
+		DNSName: serverName,
 	}
 
 	log.Printf("number of certs - %d", len(parsedCerts))
@@ -1164,16 +1155,18 @@ func validateCertificates(CertificateChain, PrivateKey, ServerName string) tlsCo
 		data.NotBefore = mainCert.NotBefore
 		data.DNSNames = mainCert.DNSNames
 	}
-	}
 
-	// validate private key (right now the only validation possible is just parsing it)
-	if PrivateKey != "" {
+	return 0
+}
+
+// Return 0 on success
+func validatePkey(data *tlsConfigStatus, pkey string) int {
 	// now do a more extended validation
 	var key *pem.Block        // PEM-encoded certificates
 	var skippedBytes []string // skipped bytes
 
 	// go through all pem blocks, but take first valid pem block and drop the rest
-		pemblock := []byte(PrivateKey)
+	pemblock := []byte(pkey)
 	for {
 		var decoded *pem.Block
 		decoded, pemblock = pem.Decode(pemblock)
@@ -1190,23 +1183,46 @@ func validateCertificates(CertificateChain, PrivateKey, ServerName string) tlsCo
 
 	if key == nil {
 		data.WarningValidation = "No valid keys were found"
-			return data
+		return 1
 	}
 
 	// parse the decoded key
 	_, keytype, err := parsePrivateKey(key.Bytes)
 	if err != nil {
 		data.WarningValidation = fmt.Sprintf("Failed to parse private key: %s", err)
-			return data
+		return 1
 	}
 
 	data.ValidKey = true
 	data.KeyType = keytype
+	return 0
+}
+
+/* Process certificate data and its private key.
+All parameters are optional.
+On error, return partially set object
+ with 'WarningValidation' field containing error description.
+*/
+func validateCertificates(certChain, pkey, serverName string) tlsConfigStatus {
+	var data tlsConfigStatus
+
+	// check only public certificate separately from the key
+	if certChain != "" {
+		if verifyCertChain(&data, certChain, serverName) != 0 {
+			return data
+		}
+	}
+
+	// validate private key (right now the only validation possible is just parsing it)
+	if pkey != "" {
+		if validatePkey(&data, pkey) != 0 {
+			return data
+		}
 	}
 
 	// if both are set, validate both in unison
-	if PrivateKey != "" && CertificateChain != "" {
-		_, err = tls.X509KeyPair([]byte(CertificateChain), []byte(PrivateKey))
+	if pkey != "" && certChain != "" {
+		_, err := tls.X509KeyPair([]byte(certChain), []byte(pkey))
 		if err != nil {
 			data.WarningValidation = fmt.Sprintf("Invalid certificate or key: %s", err)
 			return data