Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

tlspolicy

package

Go to main page

Versions in this module

v0

v0.46.0

Aug 29, 2026

v0.45.0

Aug 21, 2026

v0.44.0

Aug 20, 2026

v0.43.0

Aug 20, 2026

v0.42.0

Aug 20, 2026

v0.41.0

Aug 20, 2026

v0.40.0

Aug 14, 2026

v0.39.0

Aug 13, 2026

v0.38.0

Aug 12, 2026

v0.37.0

Aug 9, 2026

v0.36.0

Jul 28, 2026

Changes in this version

+ var ErrMissingServerIdentity = errors.New("tlspolicy: missing remote server identity")

+ var ErrNoVerifiedChains = errors.New("tlspolicy: normal TLS verification produced no certificate chain")

+ var ErrPinMismatch = errors.New("tlspolicy: peer certificate pin mismatch")

+ var ErrServerIdentityMismatch = errors.New("tlspolicy: server certificate does not match the policy identity")

+ var ErrUnauthorizedChain = errors.New("tlspolicy: no verified certificate chain is authorized by policy")

+ type Authority struct

+ func AuthorityFromCertificate(cert *x509.Certificate) (Authority, error)

+ func ParseAuthoritiesPEM(pemData []byte) ([]Authority, error)

+ func ParseAuthorityDER(der []byte) (Authority, error)

+ func (a *Authority) UnmarshalBinary(data []byte) error

+ func (a Authority) Certificate() (*x509.Certificate, error)

+ func (a Authority) DER() []byte

+ func (a Authority) Equal(other Authority) bool

+ func (a Authority) Fingerprint() Fingerprint

+ func (a Authority) MarshalBinary() ([]byte, error)

+ func (a Authority) SPKIFingerprint() Fingerprint

+ func (a Authority) Valid() bool

+ type AuthorityCandidate struct

+ DER []byte

+ Source AuthoritySource

+ type AuthorityCatalog struct

+ func FetchAuthorityCatalog(ctx context.Context, fetcher AuthorityFetcher) (*AuthorityCatalog, error)

+ func NewAuthorityCatalog(candidates []AuthorityCandidate) (*AuthorityCatalog, error)

+ func (c *AuthorityCatalog) Len() int

+ func (c *AuthorityCatalog) Lookup(id Fingerprint) (AuthorityRecord, bool)

+ func (c *AuthorityCatalog) Records() []AuthorityRecord

+ func (c *AuthorityCatalog) Select(ids []Fingerprint) ([]Authority, error)

+ type AuthorityConstraint struct

+ Authority Authority

+ Match AuthorityMatch

+ Scope Scope

+ type AuthorityFetcher interface

+ FetchAuthorities func(ctx context.Context) ([]AuthorityCandidate, error)

+ type AuthorityFetcherFunc func(context.Context) ([]AuthorityCandidate, error)

+ func (f AuthorityFetcherFunc) FetchAuthorities(ctx context.Context) ([]AuthorityCandidate, error)

+ type AuthorityMatch uint8

+ const MatchCertificate

+ const MatchSPKI

+ func (m AuthorityMatch) String() string

+ type AuthorityRecord struct

+ Authority Authority

+ CertificateFingerprint Fingerprint

+ IsCA bool

+ Issuer string

+ NotAfter time.Time

+ NotBefore time.Time

+ PublicKeyAlgorithm x509.PublicKeyAlgorithm

+ SPKIFingerprint Fingerprint

+ SerialNumber string

+ SignatureAlgorithm x509.SignatureAlgorithm

+ Sources []AuthoritySource

+ Subject string

+ type AuthoritySource struct

+ Metadata map[string]string

+ Name string

+ Trust TrustHint

+ type ClientAuthMode uint8

+ const ClientAuthNone

+ const ClientAuthRequireAndVerify

+ const ClientAuthVerifyIfGiven

+ func (m ClientAuthMode) String() string

+ type ClientConnectionVerifier interface

+ VerifyClient func(connection ClientVerification) error

+ type ClientConnectionVerifierFunc func(ClientVerification) error

+ func (f ClientConnectionVerifierFunc) VerifyClient(connection ClientVerification) error

+ type ClientPolicy struct

+ func CompileClientPolicy(spec ClientPolicySpec) (*ClientPolicy, error)

+ func (p *ClientPolicy) PinCount() int

+ func (p *ClientPolicy) ServerTLSConfig(options ServerTLSOptions) (*tls.Config, error)

+ func (p *ClientPolicy) TrustAnchorCount() int

+ func (p *ClientPolicy) VerifyClient(state tls.ConnectionState) (ClientVerification, error)

+ type ClientPolicySpec struct

+ Pins []Pin

+ TrustAnchors []Authority

+ type ClientTLSOptions struct

+ Certificates []tls.Certificate

+ CipherSuites []uint16

+ CurvePreferences []tls.CurveID

+ GetClientCertificate func(*tls.CertificateRequestInfo) (*tls.Certificate, error)

+ MaxVersion uint16

+ MinVersion uint16

+ NextProtos []string

+ SessionCacheSize int

+ Time func() time.Time

+ Verifiers []ServerConnectionVerifier

+ type ClientVerification struct

+ AuthorizedChains [][]*x509.Certificate

+ ConnectionState tls.ConnectionState

+ type DNSRule struct

+ Domain string

+ IncludeSubdomains bool

+ type Fingerprint [sha256.Size]byte

+ func ParseFingerprint(value string) (Fingerprint, error)

+ func (f *Fingerprint) UnmarshalText(text []byte) error

+ func (f Fingerprint) MarshalText() ([]byte, error)

+ func (f Fingerprint) String() string

+ type IdentityKind uint8

+ const IdentityDNS

+ const IdentityIP

+ const IdentityInvalid

+ func (k IdentityKind) String() string

+ type Pin struct

+ func NewCertificatePin(certificateDER []byte) (Pin, error)

+ func NewPin(kind PinKind, digest Fingerprint) (Pin, error)

+ func NewSPKIPin(certificateDER []byte) (Pin, error)

+ func (p *Pin) UnmarshalText(text []byte) error

+ func (p Pin) Digest() Fingerprint

+ func (p Pin) Kind() PinKind

+ func (p Pin) MarshalText() ([]byte, error)

+ func (p Pin) Matches(cert *x509.Certificate) bool

+ func (p Pin) String() string

+ func (p Pin) Valid() bool

+ type PinKind uint8

+ const PinInvalid

+ const PinLeafCertificate

+ const PinLeafSPKI

+ func (k PinKind) String() string

+ type Scope struct

+ Any bool

+ DNS []DNSRule

+ IPPrefixes []netip.Prefix

+ func AnyServerScope() Scope

+ func NewDNSDomainScope(domain string, includeSubdomains bool) (Scope, error)

+ func NewExactServerScope(identity string) (Scope, error)

+ func NewIPPrefixScope(prefix netip.Prefix) (Scope, error)

+ func (s Scope) Allows(identity ServerIdentity) (bool, error)

+ func (s Scope) Validate() error

+ type ScopedAuthority struct

+ Authority Authority

+ Scope Scope

+ type ScopedPin struct

+ Pin Pin

+ Scope Scope

+ type ServerConnectionVerifier interface

+ VerifyServer func(connection ServerVerification) error

+ type ServerConnectionVerifierFunc func(ServerVerification) error

+ func (f ServerConnectionVerifierFunc) VerifyServer(connection ServerVerification) error

+ type ServerIdentity struct

+ func ParseServerIdentity(value string) (ServerIdentity, error)

+ func (id *ServerIdentity) UnmarshalText(text []byte) error

+ func (id ServerIdentity) DNSName() (string, bool)

+ func (id ServerIdentity) IP() (netip.Addr, bool)

+ func (id ServerIdentity) Kind() IdentityKind

+ func (id ServerIdentity) MarshalText() ([]byte, error)

+ func (id ServerIdentity) String() string

+ func (id ServerIdentity) Valid() bool

+ type ServerPolicy struct

+ func CompileServerPolicy(spec ServerPolicySpec) (*ServerPolicy, error)

+ func (p *ServerPolicy) PinCount() int

+ func (p *ServerPolicy) TLSClientConfig(options ClientTLSOptions) (*tls.Config, error)

+ func (p *ServerPolicy) TLSClientConfigForServer(serverName string, options ClientTLSOptions) (*tls.Config, error)

+ func (p *ServerPolicy) TrustAnchorCount() int

+ func (p *ServerPolicy) VerifyServer(identity ServerIdentity, state tls.ConnectionState) (ServerVerification, error)

+ type ServerPolicySpec struct

+ Constraints []AuthorityConstraint

+ Pins []ScopedPin

+ TrustAnchors []ScopedAuthority

+ type ServerTLSOptions struct

+ Certificates []tls.Certificate

+ CipherSuites []uint16

+ ClientAuth ClientAuthMode

+ CurvePreferences []tls.CurveID

+ GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)

+ MaxVersion uint16

+ MinVersion uint16

+ NextProtos []string

+ SessionTicketsDisabled bool

+ Time func() time.Time

+ Verifiers []ClientConnectionVerifier

+ type ServerVerification struct

+ AuthorizedChains [][]*x509.Certificate

+ ConnectionState tls.ConnectionState

+ Identity ServerIdentity

+ type TrustHint uint8

+ const TrustHintAnchor

+ const TrustHintDistrusted

+ const TrustHintRestricted

+ const TrustHintUnknown

+ func (h TrustHint) String() string