Fix headers in generated PKCS#8 CA certificates

Previously we set PKCS#1 headers on PKCS#8 data, which worked in some
cases because of some flexible APIs, but really shouldn't. This sets the
right headers so this should work correctly.

Author: pimterry

src/util/tls.ts

@@ -202,7 +202,7 @@ export async function generateCACertificate(options: {
     });
 
     const privateKeyBuffer = await crypto.subtle.exportKey("pkcs8", keyPair.privateKey as CryptoKey);
-    const privateKeyPem = arrayBufferToPem(privateKeyBuffer, "RSA PRIVATE KEY");
+    const privateKeyPem = arrayBufferToPem(privateKeyBuffer, "PRIVATE KEY");
     const certificatePem = certificate.toString("pem");
 
     return {
@@ -383,7 +383,7 @@ export class CA {
         const generatedCertificate = {
             key: arrayBufferToPem(
                 await crypto.subtle.exportKey("pkcs8", leafKeyPair.privateKey as CryptoKey),
-                "RSA PRIVATE KEY"
+                "PRIVATE KEY"
             ),
             cert: certificate.toString("pem"),
             ca: this.caCert.toString("pem")

test/ca.spec.ts

@@ -161,7 +161,7 @@ nodeOnly(() => {
             expect(caCertificate.cert.length).to.be.greaterThan(1000);
             expect(caCertificate.cert.split('\n')[0]).to.equal('-----BEGIN CERTIFICATE-----');
             expect(caCertificate.key.length).to.be.greaterThan(1000);
-            expect(caCertificate.key.split('\n')[0]).to.equal('-----BEGIN RSA PRIVATE KEY-----');
+            expect(caCertificate.key.split('\n')[0]).to.equal('-----BEGIN PRIVATE KEY-----');
         });
 
         it("should generate a CA certificate that can be used to create domain certificates", async () => {
@@ -173,7 +173,7 @@ nodeOnly(() => {
             expect(cert.length).to.be.greaterThan(1000);
             expect(cert.split('\n')[0]).to.equal('-----BEGIN CERTIFICATE-----');
             expect(key.length).to.be.greaterThan(1000);
-            expect(key.split('\n')[0]).to.equal('-----BEGIN RSA PRIVATE KEY-----');
+            expect(key.split('\n')[0]).to.equal('-----BEGIN PRIVATE KEY-----');
         });
 
         it("should be able to generate a CA certificate that passes lintcert checks", async function () {