certificate

Documentation

Index

• type Certifier
  • func NewCertifier(core *api.Core, resolver resolver, options CertifierOptions) *Certifier
  • func (c *Certifier) Get(url string, bundle bool) (*Resource, error)
  • func (c *Certifier) GetOCSP(bundle []byte) ([]byte, *ocsp.Response, error)
  • func (c *Certifier) Obtain(request ObtainRequest) (*Resource, error)
  • func (c *Certifier) ObtainForCSR(request ObtainForCSRRequest) (*Resource, error)
  • func (c *Certifier) Renew(certRes Resource, bundle, mustStaple bool, preferredChain string) (*Resource, error)
  • func (c *Certifier) Revoke(cert []byte) error
  • func (c *Certifier) RevokeWithReason(cert []byte, reason *uint) error
• type CertifierOptions
• type ObtainForCSRRequest
• type ObtainRequest
• type Resource

Types

type Certifier

type Certifier struct {
	// contains filtered or unexported fields
}

Certifier A service to obtain/renew/revoke certificates.

func NewCertifier

func NewCertifier(core *api.Core, resolver resolver, options CertifierOptions) *Certifier

NewCertifier creates a Certifier.

func (*Certifier) Get

func (c *Certifier) Get(url string, bundle bool) (*Resource, error)

Get attempts to fetch the certificate at the supplied URL. The URL is the same as what would normally be supplied at the Resource's CertURL.

The returned Resource will not have the PrivateKey and CSR fields populated as these will not be available.

If bundle is true, the Certificate field in the returned Resource includes the issuer certificate.

func (*Certifier) GetOCSP

func (c *Certifier) GetOCSP(bundle []byte) ([]byte, *ocsp.Response, error)

GetOCSP takes a PEM encoded cert or cert bundle returning the raw OCSP response, the parsed response, and an error, if any.

The returned []byte can be passed directly into the OCSPStaple property of a tls.Certificate. If the bundle only contains the issued certificate, this function will try to get the issuer certificate from the IssuingCertificateURL in the certificate.

If the []byte and/or ocsp.Response return values are nil, the OCSP status may be assumed OCSPUnknown.

func (*Certifier) Obtain

func (c *Certifier) Obtain(request ObtainRequest) (*Resource, error)

Obtain tries to obtain a single certificate using all domains passed into it.

This function will never return a partial certificate. If one domain in the list fails, the whole certificate will fail.

func (*Certifier) ObtainForCSR

func (c *Certifier) ObtainForCSR(request ObtainForCSRRequest) (*Resource, error)

ObtainForCSR tries to obtain a certificate matching the CSR passed into it.

The domains are inferred from the CommonName and SubjectAltNames, if any. The private key for this CSR is not required.

If bundle is true, the []byte contains both the issuer certificate and your issued certificate as a bundle.

This function will never return a partial certificate. If one domain in the list fails, the whole certificate will fail.

func (*Certifier) Renew

func (c *Certifier) Renew(certRes Resource, bundle, mustStaple bool, preferredChain string) (*Resource, error)

Renew takes a Resource and tries to renew the certificate.

If the renewal process succeeds, the new certificate will be returned in a new CertResource. Please be aware that this function will return a new certificate in ANY case that is not an error. If the server does not provide us with a new cert on a GET request to the CertURL this function will start a new-cert flow where a new certificate gets generated.

If bundle is true, the []byte contains both the issuer certificate and your issued certificate as a bundle.

For private key reuse the PrivateKey property of the passed in Resource should be non-nil.

func (*Certifier) Revoke

func (c *Certifier) Revoke(cert []byte) error

Revoke takes a PEM encoded certificate or bundle and tries to revoke it at the CA.

func (*Certifier) RevokeWithReason

func (c *Certifier) RevokeWithReason(cert []byte, reason *uint) error

RevokeWithReason takes a PEM encoded certificate or bundle and tries to revoke it at the CA.

type CertifierOptions

type CertifierOptions struct {
	KeyType certcrypto.KeyType
	Timeout time.Duration
}

type ObtainForCSRRequest

type ObtainForCSRRequest struct {
	CSR                            *x509.CertificateRequest
	Bundle                         bool
	PreferredChain                 string
	AlwaysDeactivateAuthorizations bool
}

ObtainForCSRRequest The request to obtain a certificate matching the CSR passed into it.

If `Bundle` is true, the `[]byte` contains both the issuer certificate and your issued certificate as a bundle.

If `AlwaysDeactivateAuthorizations` is true, the authorizations are also relinquished if the obtain request was successful. See https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.2.

type ObtainRequest

type ObtainRequest struct {
	Domains                        []string
	Bundle                         bool
	PrivateKey                     crypto.PrivateKey
	MustStaple                     bool
	PreferredChain                 string
	AlwaysDeactivateAuthorizations bool
}

ObtainRequest The request to obtain certificate.

The first domain in domains is used for the CommonName field of the certificate, all other domains are added using the Subject Alternate Names extension.

A new private key is generated for every invocation of the function Obtain. If you do not want that you can supply your own private key in the privateKey parameter. If this parameter is non-nil it will be used instead of generating a new one.

If `Bundle` is true, the `[]byte` contains both the issuer certificate and your issued certificate as a bundle.

If `AlwaysDeactivateAuthorizations` is true, the authorizations are also relinquished if the obtain request was successful. See https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.2.

type Resource

type Resource struct {
	Domain            string `json:"domain"`
	CertURL           string `json:"certUrl"`
	CertStableURL     string `json:"certStableUrl"`
	PrivateKey        []byte `json:"-"`
	Certificate       []byte `json:"-"`
	IssuerCertificate []byte `json:"-"`
	CSR               []byte `json:"-"`
}

Resource represents a CA issued certificate. PrivateKey, Certificate and IssuerCertificate are all already PEM encoded and can be directly written to disk. Certificate may be a certificate bundle, depending on the options supplied to create it.