tlscert

Documentation

Overview

Package tlscert manages a local CA and server certificate for the LAN HTTPS listener. The CA is generated once so a phone only has to trust it once; the server certificate is renewed whenever the machine's LAN addresses change or it approaches expiry.

Index

• func LANIPs() ([]net.IP, error)
• type Store
  • func NewStore(dir string) *Store
  • func (s *Store) CAPEMPath() string
  • func (s *Store) Certificate(ips []net.IP) (tls.Certificate, error)
  • func (s *Store) ServerCertificate() (tls.Certificate, error)

Functions

func LANIPs

func LANIPs() ([]net.IP, error)

LANIPs returns the machine's usable unicast LAN addresses, excluding loopback, link-local and multicast. The slice may be empty on a host with only loopback interfaces; the certificate then covers localhost only.

Types

type Store

type Store struct {
	// contains filtered or unexported fields
}

Store owns the CA and server certificate files in one directory.

func NewStore

func NewStore(dir string) *Store

func (*Store) CAPEMPath

func (s *Store) CAPEMPath() string

CAPEMPath returns the path of the CA certificate that devices need to install and trust.

func (*Store) Certificate

func (s *Store) Certificate(ips []net.IP) (tls.Certificate, error)

Certificate returns a server certificate covering the given IPs. It is exported for tests and for callers that already know the desired SANs.

func (*Store) ServerCertificate

func (s *Store) ServerCertificate() (tls.Certificate, error)

ServerCertificate returns the TLS certificate for the LAN HTTPS listener, generating or renewing the local CA and leaf certificate as needed.