tlsutil

Documentation

Overview

Copyright Confidential Containers Contributors SPDX-License-Identifier: Apache-2.0 This code is adapted from https://github.com/kubernetes/client-go/blob/kubernetes-1.22.17/transport/transport.go

Index

• func GetTLSConfigFor(t *TLSConfig) (*tls.Config, error)
• func NewClientCertificate(orgName string) (certPEM, keyPEM []byte, err error)
• type CAService
  • func NewCAService(orgName string) (CAService, error)
• type TLSConfig
  • func (t *TLSConfig) HasCA() bool
  • func (t *TLSConfig) HasCertAuth() bool

Functions

func GetTLSConfigFor

func GetTLSConfigFor(t *TLSConfig) (*tls.Config, error)

GetTLSConfigFor returns a tls.Config that will provide the transport level security defined by the provided Config. Will return nil if no transport level security is requested.

func NewClientCertificate

func NewClientCertificate(orgName string) (certPEM, keyPEM []byte, err error)

NewClientCertificate generates a self-signed client certificate for orgName and its private key

Types

type CAService

type CAService interface {
	RootCertificate() (certPEM []byte)
	Issue(serverName string) (certPEM, keyPEM []byte, err error)
}

func NewCAService

func NewCAService(orgName string) (CAService, error)

type TLSConfig

type TLSConfig struct {
	CAFile     string // Path of the PEM-encoded server trusted root certificates.
	CertFile   string // Path of the PEM-encoded client certificate.
	KeyFile    string // Path of the PEM-encoded client key.
	SkipVerify bool   // Server should be accessed without verifying the certificate. For testing only.

	CAData   []byte // Bytes of the PEM-encoded server trusted root certificates. Supercedes CAFile.
	CertData []byte // Bytes of the PEM-encoded client certificate. Supercedes CertFile.
	KeyData  []byte // Bytes of the PEM-encoded client key. Supercedes KeyFile.
}

TLSConfig holds the information needed to set up a TLS transport.

func (*TLSConfig) HasCA

func (t *TLSConfig) HasCA() bool

HasCA returns whether the configuration has a certificate authority or not.

func (*TLSConfig) HasCertAuth

func (t *TLSConfig) HasCertAuth() bool

HasCertAuth returns whether the configuration has certificate authentication or not.