Help us shape the future of Go! Take the 2026 Go Developer Survey

Why Go
- Case Studies
  
  Common problems companies solve with Go
- Use Cases
  
  Stories about how and why companies use Go
- Security
  
  How Go can help keep you secure by default
Learn
Docs
- Effective Go
  
  Tips for writing clear, performant, and idiomatic Go code
- Go User Manual
  
  A complete introduction to building software with Go
- Standard library
  
  Reference documentation for Go's standard library
- Release Notes
  
  Learn what's new in each Go release
- API
  
  Reference documentation for the pkg.go.dev API
Packages
Community
- Recorded Talks
  
  Videos from prior events
- Meetups
  
  Meet other local Go developers
- Conferences
  
  Learn and network with Go developers from around the world
- Go blog
  
  The Go project's official blog.
- Go project
  
  Get help and stay informed from Go
- Get connected

identity

package module

Go to main page

Versions in this module

v1

v1.0.129

Jul 30, 2026

v1.0.126

Jul 23, 2026

Changes in this version

+ const ConfigFieldAltServerCerts

+ const ConfigFieldCa

+ const ConfigFieldCert

+ const ConfigFieldKey

+ const ConfigFieldServerCert

+ const ConfigFieldServerKey

+ const StorageFile

+ const StoragePem

+ var ErrInvalidAddressForIdentity = errors.New("identity is not valid for provided host")

+ func AssembleServerChains(certs []*x509.Certificate, cas []*x509.Certificate) ([][]*x509.Certificate, error)

+ func ChainsToTlsCerts(chains [][]*x509.Certificate, key crypto.PrivateKey) []*tls.Certificate

+ func IsFile(configValue string) (string, bool)

+ func IsRootCa(cert *x509.Certificate) bool

+ func LoadCert(certAddr string) ([]*x509.Certificate, error)

+ func LoadKey(keyAddr string) (crypto.PrivateKey, error)

+ func ValidFor(id Identity, hostnameOrIp string) error

+ type AddressError struct

+ BaseErr error

+ Host string

+ ValidFor []string

+ func (e *AddressError) Error() string

+ func (e *AddressError) Unwrap() error

+ type CaPool struct

+ func NewCaPool(certs []*x509.Certificate) *CaPool

+ func (self *CaPool) AddCa(cert *x509.Certificate) error

+ func (self *CaPool) Clone() *CaPool

+ func (self *CaPool) GetChain(cert *x509.Certificate, additionalCerts ...*x509.Certificate) []*x509.Certificate

+ func (self *CaPool) GetChainMinusRoot(cert *x509.Certificate, additionalCerts ...*x509.Certificate) []*x509.Certificate

+ func (self *CaPool) Intermediates() []*x509.Certificate

+ func (self *CaPool) IntermediatesAsStdPool() *x509.CertPool

+ func (self *CaPool) Roots() []*x509.Certificate

+ func (self *CaPool) RootsAsStdPool() *x509.CertPool

+ func (self *CaPool) VerifyToRoot(cert *x509.Certificate) ([][]*x509.Certificate, error)

+ type Config struct

+ AltServerCerts []ServerPair

+ CA string

+ Cert string

+ Key string

+ ServerCert string

+ ServerKey string

+ func NewConfigFromMap(identityMap map[interface{}]interface{}) (*Config, error)

+ func NewConfigFromMapWithPathContext(identityMap map[interface{}]interface{}, pathContext string) (*Config, error)

+ func (config *Config) Validate() error

+ func (config *Config) ValidateForClient() error

+ func (config *Config) ValidateForClientWithPathContext(pathContext string) error

+ func (config *Config) ValidateForServer() error

+ func (config *Config) ValidateForServerWithPathContext(pathContext string) error

+ func (config *Config) ValidateWithPathContext(pathContext string) error

+ type ID struct

+ func (id *ID) CA() *x509.CertPool

+ func (id *ID) CaPool() *CaPool

+ func (id *ID) Cert() *tls.Certificate

+ func (id *ID) CheckServerCertSansForConflicts() []SanHostConflictError

+ func (id *ID) ClientTLSConfig() *tls.Config

+ func (id *ID) GetCaPool() *CaPool

+ func (id *ID) GetClientCertificate(config *tls.Config, _ *tls.CertificateRequestInfo) (*tls.Certificate, error)

+ func (id *ID) GetConfig() *Config

+ func (id *ID) GetConfigForClient(config *tls.Config, _ *tls.ClientHelloInfo) (*tls.Config, error)

+ func (id *ID) GetServerCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

+ func (id *ID) GetX509ActiveClientCertChain() []*x509.Certificate

+ func (id *ID) GetX509ActiveServerCertChains() [][]*x509.Certificate

+ func (id *ID) GetX509CaPool() *CaPool

+ func (id *ID) GetX509IdentityAltCertCertChains() [][]*x509.Certificate

+ func (id *ID) GetX509IdentityServerCertChain() []*x509.Certificate

+ func (id *ID) IsCertSettable() error

+ func (id *ID) IsServerCertSettable() error

+ func (id *ID) Reload() error

+ func (id *ID) ServerCert() []*tls.Certificate

+ func (id *ID) ServerTLSConfig() *tls.Config

+ func (id *ID) SetCert(pemStr string) error

+ func (id *ID) SetServerCert(pem string) error

+ func (id *ID) StopWatchingFiles()

+ func (id *ID) ValidFor(hostnameOrIp string) error

+ func (id *ID) WatchFiles() error

+ type Identity interface

+ CA func() *x509.CertPool

+ CaPool func() *CaPool

+ Cert func() *tls.Certificate

+ CheckServerCertSansForConflicts func() []SanHostConflictError

+ ClientTLSConfig func() *tls.Config

+ GetCaPool func() *CaPool

+ GetConfig func() *Config

+ GetX509ActiveClientCertChain func() []*x509.Certificate

+ GetX509ActiveServerCertChains func() [][]*x509.Certificate

+ GetX509IdentityAltCertCertChains func() [][]*x509.Certificate

+ GetX509IdentityServerCertChain func() []*x509.Certificate

+ IsCertSettable func() error

+ IsServerCertSettable func() error

+ Reload func() error

+ ServerCert func() []*tls.Certificate

+ ServerTLSConfig func() *tls.Config

+ SetCert func(pem string) error

+ SetServerCert func(pem string) error

+ StopWatchingFiles func()

+ ValidFor func(hostnameOrIp string) error

+ WatchFiles func() error

+ func LoadIdentity(cfg Config) (Identity, error)

+ type LazyIdentity struct

+ func (self *LazyIdentity) CA() *x509.CertPool

+ func (self *LazyIdentity) CaPool() *CaPool

+ func (self *LazyIdentity) Cert() *tls.Certificate

+ func (self *LazyIdentity) ClientTLSConfig() *tls.Config

+ func (self *LazyIdentity) GetConfig() *Config

+ func (self *LazyIdentity) Reload() error

+ func (self *LazyIdentity) ServerCert() []*tls.Certificate

+ func (self *LazyIdentity) ServerTLSConfig() *tls.Config

+ func (self *LazyIdentity) SetCert(pem string) error

+ func (self *LazyIdentity) SetServerCert(pem string) error

+ func (self *LazyIdentity) StopWatchingFiles()

+ func (self *LazyIdentity) WatchFiles() error

+ type SanHostConflictError struct

+ Certificates []*x509.Certificate

+ HostOrIp string

+ func (s SanHostConflictError) Error() string

+ type ServerPair struct

+ ServerCert string

+ ServerKey string

+ type TokenId struct

+ Data map[uint32][]byte

+ Token string

+ func LoadClientIdentity(certPath, keyPath, caCertPath string) (*TokenId, error)

+ func LoadServerIdentity(clientCertPath, serverCertPath, keyPath, caCertPath string) (*TokenId, error)

+ func NewClientTokenIdentity(clientCerts []*x509.Certificate, privateKey crypto.PrivateKey, ...) *TokenId

+ func NewClientTokenIdentityWithPool(clientCerts []*x509.Certificate, privateKey crypto.PrivateKey, ...) *TokenId

+ func NewIdentity(id Identity) *TokenId

+ func (i *TokenId) ClientTLSConfig() *tls.Config

+ func (i *TokenId) ServerTLSConfig() *tls.Config

+ func (i *TokenId) ShallowCloneWithNewToken(token string) *TokenId

+ func (id *TokenId) ValidFor(hostnameOrIp string) error