clientcert

Documentation

Overview

Package clientcert generates and manages per-network client TLS certificates for SASL EXTERNAL.

Index

• func Fingerprint(certificatePEM string) (string, error)
• type Certificate
  • func Generate() (*Certificate, error)
• type Store
  • func New(dir string, public bool) *Store
  • func (s *Store) Get(uuid string) (*Certificate, error)
  • func (s *Store) Remove(uuid string)

Functions

func Fingerprint

func Fingerprint(certificatePEM string) (string, error)

Fingerprint returns the SHA-256 fingerprint of a PEM certificate in the compact uppercase hex form used by IRC services for CERTFP management. The fingerprint is safe to log and lets an operator compare the exact certificate Relay presents with NickServ's registered fingerprint.

Types

type Certificate

type Certificate struct {
	PrivateKey  string
	Certificate string
}

Certificate mirrors clientCertificate.ts's ClientCertificateType: the raw PEM text for both halves. Parsing this into a *tls.Certificate (via tls.X509KeyPair) is left to the caller (Network.BuildConnectOptions's clientCert parameter) - this package only owns generation/storage.

func Generate

func Generate() (*Certificate, error)

Generate mirrors clientCertificate.ts's generate(): a self-signed 2048- bit RSA certificate good for SASL EXTERNAL client authentication, valid from yesterday (to tolerate minor client/server clock skew) through 100 years out.

nsCertType:client (a legacy Netscape certificate-type extension the TS version sets alongside extKeyUsage:clientAuth) has no Go x509 builtin and no functional meaning to any client that would connect to an IRC server today - extKeyUsage alone conveys "this is a client authentication certificate" to anything that still checks. Omitted rather than hand-rolled as a raw ASN.1 extension for a field nothing reads.

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store mirrors clientCertificate.ts's module (a stateless pair of exported functions closing over Config), wrapped in a struct so callers supply the certificates directory and public-mode flag explicitly instead of reaching into a global Config, matching every other Stage 9/ 10 store in this codebase.

func New

func New(dir string, public bool) *Store

New mirrors get/remove's shared `Config.values.public` guard and `Config.getClientCertificatesPath()` dependency. dir is internal/config.Loaded.ClientCertificatesPath(); public is Config.values.public, read once here since callers construct a fresh Store whenever config could plausibly have changed (matching how other stores in this codebase take config values as constructor/call parameters rather than a live *config.Loaded).

func (*Store) Get

func (s *Store) Get(uuid string) (*Certificate, error)

Get mirrors clientCertificate.ts's get: returns nil in public mode (no error - mirrors the TS `return null`), reads an existing certificate pair off disk if present, or generates and persists a new one. A nil *Certificate with a nil error also covers the "read/generate/write failed, already logged" cases, matching get()'s own `return null` after logging.

func (*Store) Remove

func (s *Store) Remove(uuid string)

Remove mirrors clientCertificate.ts's remove.