server: Implement auto-init handshake to negotiate CA certs between n…

…odes

This PR implements the init protocol phase of the cert-free setup
described in #51991. A lot of the code is pulled out of Aaron's
reference implementation of this protocol:
https://github.com/aaron-crl/toy-secure-init-handshake/tree/n-way-join

One part of #60632.

Release note: None.

pkg/cli/connect.go

@@ -10,7 +10,12 @@
 
 package cli
 
-import "github.com/spf13/cobra"
+import (
+	"context"
+
+	"github.com/cockroachdb/cockroach/pkg/server"
+	"github.com/spf13/cobra"
+)
 
 // connectCmd triggers a TLS initialization handshake and writes
 // certificates in the specified certs-dir for use with start.
@@ -28,7 +33,9 @@ secure inter-node connections.
 // runConnect connects to other nodes and negotiates an initialization bundle
 // for use with secure inter-node connections.
 func runConnect(cmd *cobra.Command, args []string) error {
-	// TODO(bilal): Implement TLS init handshake.
-	// https://github.com/cockroachdb/cockroach/issues/60632
-	return nil
+	peers := []string(serverCfg.JoinList)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	return server.InitHandshake(ctx, baseCfg, baseCfg.InitToken, peers, baseCfg.SSLCertsDir, startCtx.serverListenAddr, serverListenPort)
 }

pkg/security/auto_tls_init.go

@@ -114,31 +114,31 @@ func CreateServiceCertAndKey(lifespan time.Duration, service, hostname string, c
 	// Create random serial number for CA.
 	serialNumber, err := createCertificateSerialNumber()
 	if err != nil {
-		return
+		return nil, nil, err
 	}
 
 	caCertBlock, _ := pem.Decode(caCertPEM)
 	if caCertBlock == nil {
 		err = errors.New("failed to parse valid PEM from CaCertificate blob")
-		return
+		return nil, nil, err
 	}
 
 	caCert, err := x509.ParseCertificate(caCertBlock.Bytes)
 	if err != nil {
 		err = errors.New("failed to parse valid Certificate from PEM blob")
-		return
+		return nil, nil, err
 	}
 
 	caKeyBlock, _ := pem.Decode(caKeyPEM)
 	if caKeyBlock == nil {
 		err = errors.New("failed to parse valid PEM from CaKey blob")
-		return
+		return nil, nil, err
 	}
 
-	caKey, err := x509.ParsePKCS8PrivateKey(caKeyBlock.Bytes)
+	caKey, err := x509.ParsePKCS1PrivateKey(caKeyBlock.Bytes)
 	if err != nil {
 		err = errors.New("failed to parse valid Certificate from PEM blob")
-		return
+		return nil, nil, err
 	}
 
 	// Bulid service certificate template; template will be used for all
@@ -170,12 +170,12 @@ func CreateServiceCertAndKey(lifespan time.Duration, service, hostname string, c
 
 	servicePrivKey, err := rsa.GenerateKey(rand.Reader, defaultKeySize)
 	if err != nil {
-		return
+		return nil, nil, err
 	}
 
 	serviceCertBytes, err := x509.CreateCertificate(rand.Reader, serviceCert, caCert, &servicePrivKey.PublicKey, caKey)
 	if err != nil {
-		return
+		return nil, nil, err
 	}
 
 	serviceCertBlock := new(bytes.Buffer)
@@ -190,5 +190,5 @@ func CreateServiceCertAndKey(lifespan time.Duration, service, hostname string, c
 		Bytes: x509.MarshalPKCS1PrivateKey(servicePrivKey),
 	})
 
-	return
+	return serviceCertBlock.Bytes(), certPrivKeyPEM.Bytes(), nil
 }