Certificate with only 'Digital Signature' Key Usage not accepted

[bashtheshell]

This issue is related to #436 where I initially commented. I was asked to create a new issue instead.

I tried using the certificates from Let's Encrypt so that I can ship encrypted HEPs to Homer, but with hepgen.js (which is an incredible test tool by the way!), I keep getting the following error: Error: key usage does not include certificate signing. openssl s_client reported 32 (key usage does not include certificate signing). I've tried different permutations of cert.pem, chain.pem, and fullchain.pem. None of them worked as I have expected the latter to be the most appropriate choice.

I was going crazy for a moment as I read that some certs won't be supported in some server configurations until I was able to confirm the feasibility with the help of ChatGPT. I created a proof-of-concept using minimal Golang code to run a non-HTTP server, which make use of Let's Encrypt certs, that receives plaintext (the message would be encrypted while in motion, of course) from a client using TLS.

I simply do not understand why we must use a private CA or why we must succumb to disabling TLS verification on the client's side. Is it a typical configuration to use a private CA for heplify-server?

If I've overlooked a solution that's been under my nose, then please point me in the right direction (thanks in advance). I've been on this issue for weeks now, but I'm out of time trying to put together a quick solution, and I've to move on to my next tasks.

[womblep]

@lmangani @negbie
It would be useful for some cases to have the TLS configuration able to detect if the cert configured using TLSCertFolder has the keyCertSign bit set in the key usage extension.
If it does then the current process can be followed, if it doesn't then the certificate loaded is used as the certificate for TLS and no new one is generated.
This functionality would be contained probably in https://github.com/negbie/cert which does the TLS load and generate. I am not sure if that code is a part of Homer or separate.

[womblep]

I dont know golang at all so I cant provide a PR but I think this logic would work.
If the function CertificateAuthorityFromFile in cert.go did the check for the key usage and if it was not a CA cert, then:

1. store the cert in the CertificateAuthority against the defaultServerName()
2. store the cert in the CertiifcateAuthority against whatever is in the common name of the certificate

That way the code in GetCertificate would detect a previously stored cert and return it rather than generating a new one.