code

Documentation

Overview

Package code contains the go-openssl certificate generation logic used by the CLI and by other Go code that needs to create plain or encrypted PEM assets programmatically. Artifact writes use same-filesystem staging and atomic replacement. New encrypted envelopes use Argon2id with AES-256-GCM; legacy version-1 envelopes remain readable for migration.

Index

• func DecryptPEM(content []byte, secret string) ([]byte, error)
• func ReadCertificateFile(path string, secret string) (*x509.Certificate, error)
• func ReadPEMFile(path string, secret string) ([]byte, error)
• func ReadPrivateKeyFile(path string, secret string) (any, error)
• func ReadPublicKeyFile(path string, secret string) (any, error)
• type App
  • func NewApp() *App
  • func (app *App) Execute() error
• type Command
• type Generator
  • func NewGenerator() *Generator
  • func (generator *Generator) Generate(options Options) (Result, error)
  • func (generator *Generator) UpdateEncryptionSecret(options UpdateEncryptionSecretOptions) (UpdateEncryptionSecretResult, error)
• type IOStreams
• type Options
• type Result
  • func GenerateCertificates(options Options) (Result, error)
• type UpdateEncryptionSecretOptions
• type UpdateEncryptionSecretResult
  • func UpdateEncryptionSecret(options UpdateEncryptionSecretOptions) (UpdateEncryptionSecretResult, error)

Functions

func DecryptPEM

func DecryptPEM(content []byte, secret string) ([]byte, error)

DecryptPEM returns plain PEM content. It reads the current and legacy GoForge encrypted envelope versions. Unencrypted PEM content is returned as-is.

func ReadCertificateFile

func ReadCertificateFile(path string, secret string) (*x509.Certificate, error)

ReadCertificateFile reads a plain or encrypted certificate PEM file.

func ReadPEMFile

func ReadPEMFile(path string, secret string) ([]byte, error)

ReadPEMFile reads a PEM file and decrypts it when it contains a GoForge encrypted PEM envelope.

func ReadPrivateKeyFile

func ReadPrivateKeyFile(path string, secret string) (any, error)

ReadPrivateKeyFile reads a plain or encrypted private key PEM file.

func ReadPublicKeyFile

func ReadPublicKeyFile(path string, secret string) (any, error)

ReadPublicKeyFile reads a plain or encrypted public key PEM file.

Types

type App

type App struct {
	// contains filtered or unexported fields
}

App wires the go-openssl CLI, its command tree, and the certificate generator.

func NewApp

func NewApp() *App

NewApp creates the default go-openssl application ready to execute from main.

func (*App) Execute

func (app *App) Execute() error

Execute runs the root go-openssl command tree.

type Command

type Command interface {
	Cobra() *cobra.Command
}

Command defines an executable CLI command that can be converted into a Cobra command.

type Generator

type Generator struct {
	// contains filtered or unexported fields
}

Generator coordinates filesystem writes and cryptographic generation helpers.

func NewGenerator

func NewGenerator() *Generator

NewGenerator creates the default certificate generator.

func (*Generator) Generate

func (generator *Generator) Generate(options Options) (Result, error)

Generate creates a certificate together with matching private and public keys.

func (*Generator) UpdateEncryptionSecret

func (generator *Generator) UpdateEncryptionSecret(options UpdateEncryptionSecretOptions) (UpdateEncryptionSecretResult, error)

UpdateEncryptionSecret atomically updates existing encrypted certificate, private key, and public key files using the current envelope format.

type IOStreams

type IOStreams struct {
	In  io.Reader
	Out io.Writer
	Err io.Writer
}

IOStreams groups the standard input, output, and error streams used by the CLI.

type Options

type Options struct {
	// Algorithm selects the key algorithm used to generate the certificate.
	Algorithm string
	// OutputDir is the directory where the PEM files are written.
	OutputDir string
	// CommonName is the subject common name included in the certificate.
	CommonName string
	// DNSNames lists the DNS subject alternative names included in the certificate.
	DNSNames []string
	// IPAddresses lists the IP subject alternative names included in the certificate.
	IPAddresses []string
	// Organization is the subject organization included in the certificate.
	Organization string
	// ValidForDays controls the certificate validity period in days.
	ValidForDays int
	// RSAKeySize is the RSA key size in bits when Algorithm is rsa.
	RSAKeySize int
	// ECCCurve selects the elliptic curve when Algorithm is ecc.
	ECCCurve string
	// Salt mixes additional data into the random source used for generation.
	Salt string
	// CertFileName is the certificate PEM file name written inside OutputDir.
	CertFileName string
	// KeyFileName is the private key PEM file name written inside OutputDir.
	KeyFileName string
	// PublicKeyFileName is the public key PEM file name written inside OutputDir.
	PublicKeyFileName string
	// SignedBy is the CA certificate PEM path used to sign the generated certificate.
	SignedBy string
	// CAKeyFile is the CA private key PEM path used to sign the generated certificate.
	CAKeyFile string
	// IsCA marks the generated certificate as a certificate authority.
	IsCA bool
	// EncryptSecret encrypts generated PEM files when set. It must be at least 32 bytes.
	EncryptSecret string
	// SignedBySecret decrypts an encrypted SignedBy certificate when set.
	SignedBySecret string
	// CAKeySecret decrypts an encrypted CAKeyFile private key when set.
	CAKeySecret string
}

Options configures the generated certificate, keys, output paths, and algorithm-specific settings.

type Result

type Result struct {
	// Algorithm is the normalized algorithm used for generation.
	Algorithm string
	// OutputDir is the normalized output directory used for the generated files.
	OutputDir string
	// CertificatePath is the path to the generated certificate PEM file.
	CertificatePath string
	// PrivateKeyPath is the path to the generated private key PEM file.
	PrivateKeyPath string
	// PublicKeyPath is the path to the generated public key PEM file.
	PublicKeyPath string
	// Encrypted reports whether the generated PEM files were encrypted.
	Encrypted bool
}

Result describes the generated PEM artifacts and the effective generation parameters.

func GenerateCertificates

func GenerateCertificates(options Options) (Result, error)

GenerateCertificates generates PEM certificate assets using the default generator.

type UpdateEncryptionSecretOptions

type UpdateEncryptionSecretOptions struct {
	// CertificatePath is the encrypted certificate PEM path to update.
	CertificatePath string
	// PrivateKeyPath is the encrypted private key PEM path to update.
	PrivateKeyPath string
	// PublicKeyPath is the encrypted public key PEM path to update.
	PublicKeyPath string
	// EncryptSecretOld is the current secret used to decrypt the PEM files.
	EncryptSecretOld string
	// EncryptSecretNew is the new secret used to re-encrypt the PEM files.
	EncryptSecretNew string
}

UpdateEncryptionSecretOptions configures re-encryption of existing encrypted PEM files.

type UpdateEncryptionSecretResult

type UpdateEncryptionSecretResult struct {
	// CertificatePath is the re-encrypted certificate PEM path.
	CertificatePath string
	// PrivateKeyPath is the re-encrypted private key PEM path.
	PrivateKeyPath string
	// PublicKeyPath is the re-encrypted public key PEM path.
	PublicKeyPath string
}

UpdateEncryptionSecretResult describes the PEM files updated with a new encryption secret.

func UpdateEncryptionSecret

func UpdateEncryptionSecret(options UpdateEncryptionSecretOptions) (UpdateEncryptionSecretResult, error)

UpdateEncryptionSecret re-encrypts existing encrypted PEM files using a new secret and upgrades legacy envelopes to the current format.