util

Documentation

Index

• func CheckInsecureFingerprint(certificate tls.Certificate) (bool, error)
• func DecryptJWE(jweString string, key []byte) (messages.Base, error)
• func GenerateTLSCert(serial *big.Int, subject *pkix.Name, dnsNames []string, ...) (*tls.Certificate, error)
• func GetJWT(agentID uuid.UUID, key []byte) (string, error)
• func GetTLSCertificates(certificate string, key string) (*tls.Certificate, error)
• func ValidateJWT(agentJWT string, key []byte) (uuid.UUID, error)

Functions

func CheckInsecureFingerprint

func CheckInsecureFingerprint(certificate tls.Certificate) (bool, error)

CheckInsecureFingerprint calculates the SHA256 hash of the passed in certificate and determines if it matches the publicly distributed key pair from the Merlin repository. Anyone could decrypt the TLS traffic

func DecryptJWE

func DecryptJWE(jweString string, key []byte) (messages.Base, error)

DecryptJWE takes provided JWE string and decrypts it using the per-agent key

func GenerateTLSCert

func GenerateTLSCert(serial *big.Int, subject *pkix.Name, dnsNames []string, notBefore, notAfter *time.Time, privKey crypto.PrivateKey, makeRsa bool) (*tls.Certificate, error)

GenerateTLSCert will generate a new certificate. Nil values in the parameters are replaced with random or blank values.

If makeRsa is set to true, the key generated is an RSA key (EC by default).

If a nil date is passed in for notBefore and notAfter, a random date is picked in the last year.

If a nil date is passed in for notAfter, the date is set to be 2 years after the date provided (or generated) in the notBefore parameter.

Please ensure privkey is a proper private key. The go implementation of this value is challenging, so no type assertion can be made in the function definition.

func GetJWT

func GetJWT(agentID uuid.UUID, key []byte) (string, error)

GetJWT returns a JSON Web Token for the provided agent using the interface JWT Key

func GetTLSCertificates

func GetTLSCertificates(certificate string, key string) (*tls.Certificate, error)

GetTLSCertificates parses PEM encoded input x.509 certificate and key file paths as a string and returns a tls object

func ValidateJWT

func ValidateJWT(agentJWT string, key []byte) (uuid.UUID, error)

ValidateJWT validates the provided JSON Web Token