tlspin

Documentation

Overview

Package tlspin provides certificate-pinned HTTPS clients for Sable's local control plane. The operator API uses a self-signed certificate, so pinning the exact leaf certificate replaces public-CA validation without trusting an arbitrary process that happens to bind a loopback port.

Index

• Constants
• func LoadFingerprint(path string) ([]byte, error)
• func NewClient(expectedFingerprint []byte, timeout time.Duration) (*http.Client, error)
• func NewClientFromCert(certPath string, timeout time.Duration) (*http.Client, error)

Constants

const FingerprintSize = sha256.Size

Functions

func LoadFingerprint

func LoadFingerprint(path string) ([]byte, error)

LoadFingerprint reads a PEM certificate and returns the SHA-256 fingerprint of its first certificate.

func NewClient

func NewClient(expectedFingerprint []byte, timeout time.Duration) (*http.Client, error)

NewClient returns a TLS 1.3 HTTPS client that accepts only the expected leaf certificate fingerprint. Redirects are rejected so credentials and bearer tokens cannot be forwarded away from the pinned origin.

func NewClientFromCert

func NewClientFromCert(certPath string, timeout time.Duration) (*http.Client, error)

NewClientFromCert loads a certificate pin from certPath and constructs a pinned client.