certificates

package
v0.0.0-...-cf30d46 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 25, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Overview

Package certificates provides certificate generation utilities for the Wazuh operator. Domain-specific types are defined in subpackages (common, opensearch, wazuh). This file re-exports them for backward compatibility.

Package certificates provides certificate generation utilities

Index

Constants

View Source 
const (
	DefaultKeySize                 = certcommon.DefaultKeySize
	DefaultOrganization            = certcommon.DefaultOrganization
	DefaultOrganizationalUnit      = certcommon.DefaultOrganizationalUnit
	DefaultCountry                 = certcommon.DefaultCountry
	DefaultState                   = certcommon.DefaultState
	DefaultLocality                = certcommon.DefaultLocality
	DefaultAdminCommonName         = certcommon.DefaultAdminCommonName
	KeyAlgorithmRSA                = certcommon.KeyAlgorithmRSA
	KeyAlgorithmECDSA              = certcommon.KeyAlgorithmECDSA
	ECDSACurveP256                 = certcommon.ECDSACurveP256
	ECDSACurveP384                 = certcommon.ECDSACurveP384
	ECDSACurveP521                 = certcommon.ECDSACurveP521
	DefaultCAValidityStr           = certcommon.DefaultCAValidityStr
	DefaultNodeValidityStr         = certcommon.DefaultNodeValidityStr
	DefaultCARenewalThresholdStr   = certcommon.DefaultCARenewalThresholdStr
	DefaultNodeRenewalThresholdStr = certcommon.DefaultNodeRenewalThresholdStr
)
View Source 
const (
	DefaultDashboardCommonName = opensearchcerts.DefaultDashboardCommonName
)
View Source 
const (
	DefaultFilebeatCommonName = wazuhcerts.DefaultFilebeatCommonName
)

Variables

View Source 
var ErrInvalidCertificatePEM = certcommon.ErrInvalidCertificatePEM

ErrInvalidCertificatePEM is returned when the certificate PEM data is invalid.

Functions

func AdminDN 

func AdminDN(opts DNOptions) string

AdminDN returns the admin Distinguished Name using the given options

func CertificateDomainMismatch 

func CertificateDomainMismatch(cert *x509.Certificate) bool

CertificateDomainMismatch checks if a certificate's SANs match the configured cluster domain

func DaysFromDuration 

func DaysFromDuration(d time.Duration) int

DaysFromDuration converts a time.Duration to days (rounded down)

func DefaultAdminDN 

func DefaultAdminDN() string

DefaultAdminDN returns the default Distinguished Name for admin certificates

func DefaultNodesDN 

func DefaultNodesDN() string

DefaultNodesDN returns the default Distinguished Name pattern for node certificates

func DurationFromDays 

func DurationFromDays(days int) time.Duration

DurationFromDays converts days to time.Duration

func DurationFromHours 

func DurationFromHours(hours int) time.Duration

DurationFromHours converts hours to time.Duration

func DurationFromMinutes 

func DurationFromMinutes(minutes int) time.Duration

DurationFromMinutes converts minutes to time.Duration

func ExtractDomainFromSAN 

func ExtractDomainFromSAN(san string) (string, bool)

ExtractDomainFromSAN extracts the cluster domain from a Kubernetes FQDN SAN

func FormatCertDuration 

func FormatCertDuration(d time.Duration) string

FormatCertDuration formats a time.Duration as a human-readable string

func FormatDN 

func FormatDN(commonName, ou, org, locality, state, country string) string

FormatDN formats a Distinguished Name string from the given components

func GenerateDashboardSANs 

func GenerateDashboardSANs(clusterName, namespace string) []string

GenerateDashboardSANs generates Subject Alternative Names for dashboard

func GenerateFilebeatSANs 

func GenerateFilebeatSANs(clusterName, namespace string, workerReplicas int32) []string

GenerateFilebeatSANs generates Subject Alternative Names for filebeat

func GenerateIndexerNodeSANs 

func GenerateIndexerNodeSANs(clusterName, namespace string, replicas int32) []string

GenerateIndexerNodeSANs generates Subject Alternative Names for indexer nodes

func GenerateManagerNodeSANs 

func GenerateManagerNodeSANs(clusterName, namespace string, workerReplicas int32) []string

GenerateManagerNodeSANs generates Subject Alternative Names for manager nodes

func GenerateSerialNumber 

func GenerateSerialNumber() (*big.Int, error)

GenerateSerialNumber generates a random serial number for certificates

func GetCertificateExpiry 

func GetCertificateExpiry(certPEM []byte) (time.Time, error)

GetCertificateExpiry extracts the expiry time from a PEM-encoded certificate

func HoursFromDuration 

func HoursFromDuration(d time.Duration) int

HoursFromDuration converts a time.Duration to hours (rounded down)

func MinutesFromDuration 

func MinutesFromDuration(d time.Duration) int

MinutesFromDuration converts a time.Duration to minutes (rounded down)

func MustParseCertDuration 

func MustParseCertDuration(s string) time.Duration

MustParseCertDuration parses a duration string and panics on error

func NodesDN 

func NodesDN(opts DNOptions) string

NodesDN returns the nodes Distinguished Name pattern using the given options

func ParseCertDuration 

func ParseCertDuration(s string) (time.Duration, error)

ParseCertDuration parses a duration string like "365d", "24h", "30m"

func ParseCertificateFromPEM 

func ParseCertificateFromPEM(certPEM []byte) (*x509.Certificate, error)

ParseCertificateFromPEM parses a PEM-encoded certificate

func RequiresDomainRegeneration 

func RequiresDomainRegeneration(cert *x509.Certificate, secretName, namespace string, log logr.Logger) bool

RequiresDomainRegeneration checks if a certificate needs regeneration due to domain mismatch

Types

type AdminCertConfig 

type AdminCertConfig = opensearchcerts.AdminCertConfig

AdminCertConfig holds configuration for admin certificate generation

func DefaultAdminCertConfig 

func DefaultAdminCertConfig() *AdminCertConfig

DefaultAdminCertConfig returns an AdminCertConfig with default values

type AdminCertResult 

type AdminCertResult = opensearchcerts.AdminCertResult

AdminCertResult contains the generated admin certificate and private key

func GenerateAdminCert 

func GenerateAdminCert(config *AdminCertConfig, ca *CAResult) (*AdminCertResult, error)

GenerateAdminCert generates an admin certificate signed by the CA

func ParseAdminCert 

func ParseAdminCert(certPEM, keyPEM []byte) (*AdminCertResult, error)

ParseAdminCert parses an admin certificate and private key from PEM data

type CAConfig 

type CAConfig = certcommon.CAConfig

CAConfig holds configuration for CA certificate generation

func DefaultCAConfig 

func DefaultCAConfig(commonName string) *CAConfig

DefaultCAConfig returns a CAConfig with default values

type CAResult 

type CAResult = certcommon.CAResult

CAResult contains the generated CA certificate and private key

func GenerateCA 

func GenerateCA(config *CAConfig) (*CAResult, error)

GenerateCA generates a new CA certificate and private key

func ParseCA 

func ParseCA(certPEM, keyPEM []byte) (*CAResult, error)

ParseCA parses a CA certificate and private key from PEM data

type CertificateOptions 

type CertificateOptions struct {
	// CAValidity is the validity period for CA certificates
	// Default: 3650 days (10 years)
	CAValidity time.Duration

	// CARenewalThreshold is the duration before CA expiry to trigger renewal
	// Default: 60 days
	CARenewalThreshold time.Duration

	// NodeValidity is the validity period for node certificates (indexer)
	// Default: 365 days (1 year)
	NodeValidity time.Duration

	// RenewalThreshold is the duration before expiry to trigger renewal for node certs
	// Default: 30 days
	RenewalThreshold time.Duration

	// AdminValidity is the validity period for admin certificates
	// Admin certs are used for OpenSearch security API authentication
	// Default: 365 days (1 year)
	AdminValidity time.Duration

	// AdminRenewalThreshold is the duration before expiry to trigger renewal for admin certs
	// Default: 30 days
	AdminRenewalThreshold time.Duration

	// DashboardValidity is the validity period for dashboard certificates
	// Dashboard certs are used for HTTPS on the Wazuh Dashboard
	// Renewal requires dashboard pod restart
	// Default: 365 days (1 year)
	DashboardValidity time.Duration

	// DashboardRenewalThreshold is the duration before expiry to trigger renewal for dashboard certs
	// Default: 30 days
	DashboardRenewalThreshold time.Duration

	// FilebeatValidity is the validity period for filebeat certificates
	// Filebeat certs are used for TLS between managers and indexer
	// Renewal requires manager pod restart
	// Default: 365 days (1 year)
	FilebeatValidity time.Duration

	// FilebeatRenewalThreshold is the duration before expiry to trigger renewal for filebeat certs
	// Default: 30 days
	FilebeatRenewalThreshold time.Duration

	// Country is the country code for certificate subject (e.g., "US", "FR")
	// Default: "US"
	Country string

	// State is the state/province for certificate subject
	// Default: "California"
	State string

	// Locality is the city/locality for certificate subject
	// Default: "San Francisco"
	Locality string

	// Organization is the organization name for certificate subject
	// Default: "Wazuh"
	Organization string

	// OrganizationalUnit is the organizational unit for certificate subject
	// Default: "Security"
	OrganizationalUnit string

	// CommonName is the common name for certificates (may be overridden per cert)
	// Default: derived from cluster name
	CommonName string

	// KeyAlgorithm specifies the key algorithm to use (RSA or ECDSA)
	// Default: RSA
	KeyAlgorithm KeyAlgorithm

	// ECDSACurve specifies the ECDSA curve to use when KeyAlgorithm is ECDSA
	// Default: P256
	ECDSACurve ECDSACurve
}

CertificateOptions holds the certificate generation options from the CRD These options are used to configure certificate validity, renewal thresholds, and subject fields

func DefaultCertificateOptions 

func DefaultCertificateOptions() *CertificateOptions

DefaultCertificateOptions returns the default certificate options

func (*CertificateOptions) GetAdminRenewalThreshold 

func (o *CertificateOptions) GetAdminRenewalThreshold() time.Duration

GetAdminRenewalThreshold returns the admin cert renewal threshold

func (*CertificateOptions) GetAdminValidity 

func (o *CertificateOptions) GetAdminValidity() time.Duration

GetAdminValidity returns the admin certificate validity period

func (*CertificateOptions) GetCARenewalThreshold 

func (o *CertificateOptions) GetCARenewalThreshold() time.Duration

GetCARenewalThreshold returns the CA renewal threshold

func (*CertificateOptions) GetCAValidity 

func (o *CertificateOptions) GetCAValidity() time.Duration

GetCAValidity returns the CA validity period

func (*CertificateOptions) GetDashboardRenewalThreshold 

func (o *CertificateOptions) GetDashboardRenewalThreshold() time.Duration

GetDashboardRenewalThreshold returns the dashboard cert renewal threshold

func (*CertificateOptions) GetDashboardValidity 

func (o *CertificateOptions) GetDashboardValidity() time.Duration

GetDashboardValidity returns the dashboard certificate validity period

func (*CertificateOptions) GetFilebeatRenewalThreshold 

func (o *CertificateOptions) GetFilebeatRenewalThreshold() time.Duration

GetFilebeatRenewalThreshold returns the filebeat cert renewal threshold

func (*CertificateOptions) GetFilebeatValidity 

func (o *CertificateOptions) GetFilebeatValidity() time.Duration

GetFilebeatValidity returns the filebeat certificate validity period

func (*CertificateOptions) GetNodeValidity 

func (o *CertificateOptions) GetNodeValidity() time.Duration

GetNodeValidity returns the node certificate validity period

func (*CertificateOptions) GetRenewalThreshold 

func (o *CertificateOptions) GetRenewalThreshold() time.Duration

GetRenewalThreshold returns the node cert renewal threshold

func (*CertificateOptions) ShouldRenewAdmin 

func (o *CertificateOptions) ShouldRenewAdmin(cert *AdminCertResult) bool

ShouldRenewAdmin checks if an admin certificate should be renewed based on options

func (*CertificateOptions) ShouldRenewCA 

func (o *CertificateOptions) ShouldRenewCA(ca *CAResult) bool

ShouldRenewCA checks if a CA certificate should be renewed based on options

func (*CertificateOptions) ShouldRenewDashboard 

func (o *CertificateOptions) ShouldRenewDashboard(cert *DashboardCertResult) bool

ShouldRenewDashboard checks if a dashboard certificate should be renewed based on options

func (*CertificateOptions) ShouldRenewFilebeat 

func (o *CertificateOptions) ShouldRenewFilebeat(cert *FilebeatCertResult) bool

ShouldRenewFilebeat checks if a filebeat certificate should be renewed based on options

func (*CertificateOptions) ShouldRenewNode 

func (o *CertificateOptions) ShouldRenewNode(cert *NodeCertResult) bool

ShouldRenewNode checks if a node certificate should be renewed based on options

type CertificateResult 

type CertificateResult = certcommon.CertificateResult

CertificateResult is the common interface for all certificate results

type DNOptions 

type DNOptions = certcommon.DNOptions

DNOptions holds the options for generating Distinguished Names

func DefaultDNOptions 

func DefaultDNOptions() DNOptions

DefaultDNOptions returns the default DN options

type DashboardCertConfig 

type DashboardCertConfig = opensearchcerts.DashboardCertConfig

DashboardCertConfig holds configuration for dashboard certificate generation

func DefaultDashboardCertConfig 

func DefaultDashboardCertConfig() *DashboardCertConfig

DefaultDashboardCertConfig returns a DashboardCertConfig with default values

type DashboardCertResult 

type DashboardCertResult = opensearchcerts.DashboardCertResult

DashboardCertResult contains the generated dashboard certificate and private key

func GenerateDashboardCert 

func GenerateDashboardCert(config *DashboardCertConfig, ca *CAResult) (*DashboardCertResult, error)

GenerateDashboardCert generates a dashboard certificate signed by the CA

func ParseDashboardCert 

func ParseDashboardCert(certPEM, keyPEM []byte) (*DashboardCertResult, error)

ParseDashboardCert parses a dashboard certificate and private key from PEM data

type DomainValidationResult 

type DomainValidationResult = certcommon.DomainValidationResult

DomainValidationResult contains the result of a certificate domain validation

func ValidateCertificateDomain 

func ValidateCertificateDomain(cert *x509.Certificate) DomainValidationResult

ValidateCertificateDomain performs a detailed validation of certificate SANs

type ECDSACurve 

type ECDSACurve = certcommon.ECDSACurve

ECDSACurve represents the elliptic curve used for ECDSA

type FilebeatCertConfig 

type FilebeatCertConfig = wazuhcerts.FilebeatCertConfig

FilebeatCertConfig holds configuration for filebeat certificate generation

func DefaultFilebeatCertConfig 

func DefaultFilebeatCertConfig() *FilebeatCertConfig

DefaultFilebeatCertConfig returns a FilebeatCertConfig with default values

type FilebeatCertResult 

type FilebeatCertResult = wazuhcerts.FilebeatCertResult

FilebeatCertResult contains the generated filebeat certificate and private key

func GenerateFilebeatCert 

func GenerateFilebeatCert(config *FilebeatCertConfig, ca *CAResult) (*FilebeatCertResult, error)

GenerateFilebeatCert generates a filebeat certificate signed by the CA

func ParseFilebeatCert 

func ParseFilebeatCert(certPEM, keyPEM []byte) (*FilebeatCertResult, error)

ParseFilebeatCert parses a filebeat certificate and private key from PEM data

type KeyAlgorithm 

type KeyAlgorithm = certcommon.KeyAlgorithm

KeyAlgorithm represents the algorithm used for key generation

type NodeCertConfig 

type NodeCertConfig = opensearchcerts.NodeCertConfig

NodeCertConfig holds configuration for node certificate generation

func DefaultNodeCertConfig 

func DefaultNodeCertConfig(commonName string) *NodeCertConfig

DefaultNodeCertConfig returns a NodeCertConfig with default values

type NodeCertResult 

type NodeCertResult = opensearchcerts.NodeCertResult

NodeCertResult contains the generated node certificate and private key

func GenerateNodeCert 

func GenerateNodeCert(config *NodeCertConfig, ca *CAResult) (*NodeCertResult, error)

GenerateNodeCert generates a node certificate signed by the CA

func ParseNodeCert 

func ParseNodeCert(certPEM, keyPEM []byte) (*NodeCertResult, error)

ParseNodeCert parses a node certificate and private key from PEM data

Source Files

View all Source files

Directories

Path Synopsis
Package reconciler provides helper reconcilers for Wazuh components
 Package reconciler provides helper reconcilers for Wazuh components

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.