[leninmehedy]

Summary

First PR in the stacked series for epic #1164 — Consensus Node Key & Secret Management.

Adds pkg/consensus/keys, the pure-Go cryptographic core that the consensus node keys command family builds on. No CLI surface yet — this is the foundation (#1165); generate/import/export/verify/init land in the stacked PRs above it.

What's in it

• GenerateGossipKey — RSA-3072, self-signed X.509 with SHA384WithRSA, CN=<machine-UUID> and an optional human --identity label in OU/SAN. This is the node's long-lived gossip identity (roster gossip_ca_certificate), deliberately decoupled from the node-id so it can be generated before the network assigns one during a DAB join. The EC agreement key is auto-derived by the platform at boot and is not produced here.
• GenerateGrpcKey(GrpcOptions) — self-signed TLS cert, CN=localhost by default. GrpcOptions optionally sets the subject CN and O (free text, up to 64 characters, no control characters), adds DNS/IP SANs on top of the always-present localhost, 127.0.0.1, and ::1, and sets the lifetime in days (1-36500; default 100 years). The gossip cert lifetime stays fixed at 100 years. HAProxy terminates client TLS with its own cert and re-encrypts to the node with ssl verify none, so this cert is never hostname/CA-validated; only its SHA-384 hash matters. CertHashSHA384 exposes the roster grpc_certificate_hash: a SHA-384 over the certificate in PEM form (UTF-8 bytes), as node_create requires, not over the DER. It equals openssl dgst -sha384 over the .crt file. CertPEMHashSHA384(cert) is exported so other packages hash a parsed certificate the same way.
• PEM helpers (ParsePrivateKeyPEM, PKCS#8 for the RSA keys, and ParseCertificatePEM) and a host MachineUUID() resolver, for the upcoming import/verify verbs.
• No admin key generation. The node admin key is created in an external wallet; only its public key is provided to the provisioner (see the import PR).
• All randomness via crypto/rand — never a deterministic RNG (the hiero reference generator uses one for tests; that must not be copied).

Dependencies

None added. Generation uses only the Go standard library.

Testing

go test -race -cover ./pkg/consensus/keys/ — passes, 82% statement coverage. Behavioral contracts covered: key formats & sizes, CN rules, cert hash (PEM, not DER), PEM round-trip for the RSA keys, non-determinism (distinct keys across calls), wrong-block-type rejection, and host machine-id resolution. The uncovered remainder is unreachable error branches (rand/marshal failures).

Files

File	Purpose
pkg/consensus/keys/keys.go	Types, constants, self-signed cert builder, PEM/PKCS#8 + SHA-384 helpers
pkg/consensus/keys/gossip.go	GenerateGossipKey
pkg/consensus/keys/grpc.go	GenerateGrpcKey and GrpcOptions
pkg/consensus/keys/machineid.go	Host MachineUUID() resolver
pkg/consensus/keys/pem.go	ParsePrivateKeyPEM / ParseCertificatePEM
pkg/consensus/keys/keys_test.go	Unit tests

Closes #1165.

[swirlds-automation]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.