# Credential generation

The credential generation module in `src/generate.rs` creates all the certificate and key material needed for a rustunnel session.

## Purpose

Generate a self-signed CA, server certificate, client certificate, and a random auth token. Write them to disk in a specified output directory.

## Key abstractions

| Type/Function | File | Description |
| ------------- | ---- | ----------- |
| `GeneratedMaterial` | `src/generate.rs` | Struct holding all generated PEM strings and the auth token |
| `generate` | `src/generate.rs` | Generate material and write 8 files to an output directory |
| `generate_material` | `src/generate.rs` | Generate material without writing to disk |
| `generate_ca` | `src/generate.rs` | Create a self-signed CA with rcgen |
| `generate_server_cert` | `src/generate.rs` | Create a server cert signed by the CA |
| `generate_client_cert` | `src/generate.rs` | Create a client cert signed by the CA |
| `generate_auth_token` | `src/generate.rs` | Generate a 32-byte random hex token |

## Certificate details

- **CA** — CN from `--ca-name`, org "rustunnel", serial 1, constrained CA basic constraints
- **Server cert** — CN from `--server-name`, org "rustunnel", serial 2, SANs: `localhost`, `rustunnel`, `127.0.0.1`, and optionally the bind IP if not `0.0.0.0` or `::`
- **Client cert** — CN from `--client-name`, org "rustunnel", serial 3
- **Auth token** — 64 hex characters (32 random bytes)

## Output files

| File | Content |
| ---- | ------- |
| `ca.pem` | CA certificate (PEM) |
| `ca.key` | CA private key (PEM) |
| `server.crt` | Server certificate (PEM) |
| `server.key` | Server private key (PEM) |
| `client.crt` | Client certificate (PEM) |
| `client.key` | Client private key (PEM) |
| `token.txt` | Auth token (plain text) |
| `config.json` | Paths and default addresses (JSON) |

## Key source files

| File | Purpose |
| ---- | ------- |
| `src/generate.rs` | Certificate generation, token generation, file writing |