How to create a self-signed EC P-256 certificate with SANs in Rust

1[dependencies]
2rcgen = "=0.14.10"
3time = "=0.3.55" # OffsetDateTime for the validity period

1use rcgen::{
2    CertificateParams, DistinguishedName, DnType, ExtendedKeyUsagePurpose, IsCa, KeyPair, KeyUsagePurpose,
3    PKCS_ECDSA_P256_SHA256,
4};
5use time::{Duration, OffsetDateTime};
6 
7fn main() -> Result<(), Box<dyn std::error::Error>> {
8    let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)?;
9 
10    // Strings that parse as IP addresses become IP SANs, the rest DNS SANs
11    let mut params = CertificateParams::new(vec!["localhost".to_owned(), "127.0.0.1".to_owned()])?;
12    let mut subject = DistinguishedName::new();
13    subject.push(DnType::CommonName, "localhost");
14    params.distinguished_name = subject;
15 
16    // The defaults are a 1975-to-4096 validity and no basicConstraints: set both
17    let now = OffsetDateTime::now_utc();
18    params.not_before = now;
19    params.not_after = now + Duration::days(365);
20    params.is_ca = IsCa::ExplicitNoCa; // writes CA:FALSE
21    params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
22    params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
23 
24    let cert = params.self_signed(&key)?;
25    std::fs::write("cert.pem", cert.pem())?;
26    std::fs::write("key.pem", key.serialize_pem())?;
27    Ok(())
28}