fleetca

Documentation

Overview

Package fleetca is the control-plane certificate authority for fleet agents (#408). It verifies a certificate signing request an agent generates locally (the agent's private key never leaves the host) and issues a short-lived client certificate whose subject encodes the agent id and tenant. The SHA-256 fingerprint of the issued certificate is the agent's cryptographic identity used by mutual-TLS authentication. This is a control-plane issued intermediate, not an external PKI.

Index

• func FingerprintDER(der []byte) string
• func GenerateCA(commonName string, validity time.Duration, now time.Time) (certPEM, keyPEM []byte, err error)
• type CA
  • func New(certPEM, keyPEM []byte, ttl time.Duration) (*CA, error)
  • func (c *CA) Issue(csrPEM []byte, agentID, tenantID string, now time.Time) (certPEM []byte, fingerprint string, err error)

Functions

func FingerprintDER

func FingerprintDER(der []byte) string

FingerprintDER returns the certificate fingerprint. It delegates to the domain's single definition so the CA and the auth path can never compute it differently.

func GenerateCA

func GenerateCA(commonName string, validity time.Duration, now time.Time) (certPEM, keyPEM []byte, err error)

GenerateCA creates a fresh self-signed control-plane CA (ECDSA P-256) valid for validity. It is used to bootstrap a dev/test CA and to let operators mint one; the returned key PEM is secret.

Types

type CA

type CA struct {
	// contains filtered or unexported fields
}

CA issues client certificates from a control-plane signing certificate and key.

func New

func New(certPEM, keyPEM []byte, ttl time.Duration) (*CA, error)

New builds a CA from PEM-encoded certificate and private key and a certificate lifetime.

func (*CA) Issue

func (c *CA) Issue(csrPEM []byte, agentID, tenantID string, now time.Time) (certPEM []byte, fingerprint string, err error)

Issue verifies csrPEM and issues a client certificate bound to (agentID, tenantID). It returns the certificate PEM and its SHA-256 fingerprint. The CSR's signature is checked and its public key must meet the strength floor; the agent's private key is never seen.