testca

Documentation

Overview

Package testca mints ephemeral CA and leaf certificates for tests.

Index

• func Chain(certs ...*Cert) [][]byte
• func ClientTLS(leaf *Cert, cas ...*Cert) tls.Certificate
• func Expired(c *x509.Certificate)
• func RequireLoopback(t *testing.T)
• type Cert
  • func NewCA(t *testing.T, cn string) *Cert
  • func (ca *Cert) Issue(t *testing.T, cn string, opts ...func(*x509.Certificate)) *Cert
  • func (c *Cert) WritePEM(t *testing.T, path string)

Functions

func Chain

func Chain(certs ...*Cert) [][]byte

Chain returns the raw DER chain (leaf first) for the given certs.

func ClientTLS

func ClientTLS(leaf *Cert, cas ...*Cert) tls.Certificate

ClientTLS builds a tls.Certificate presenting leaf then the given CAs, for use as an http client certificate (so the server sees the full chain).

func Expired

func Expired(c *x509.Certificate)

Expired is an Issue mutator that produces an already-expired certificate.

func RequireLoopback

func RequireLoopback(t *testing.T)

RequireLoopback skips the test if the environment cannot bind a loopback socket (e.g. a sandbox that blocks listening), so httptest-based tests do not panic where networking is unavailable.

Types

type Cert

type Cert struct {
	Cert *x509.Certificate
	Key  *ecdsa.PrivateKey
	DER  []byte
	PEM  []byte
	TLS  tls.Certificate
}

Cert bundles a certificate with its key and common encodings.

func NewCA

func NewCA(t *testing.T, cn string) *Cert

NewCA returns a self-signed CA certificate.

func (*Cert) Issue

func (ca *Cert) Issue(t *testing.T, cn string, opts ...func(*x509.Certificate)) *Cert

Issue signs a client leaf certificate with clientAuth EKU. Optional mutators can adjust the template (e.g. to make it expired).

func (*Cert) WritePEM

func (c *Cert) WritePEM(t *testing.T, path string)

WritePEM writes the certificate PEM to path.