localtls

package module

Go to main page

Versions in this module

v0

v0.3.0

Nov 9, 2026

Changes in this version

+ var ErrKeyPolicyMismatch = errors.New("persisted CNG key DACL does not match its Local-TLS key policy")

+ var ErrPrivilegeRequired = errors.New(...)

+ func MigrateMachineKeyPolicies() error

v0.2.0

Oct 31, 2026

Changes in this version

+ var ErrCandidateMismatch = errors.New("pending server certificate candidate does not match the candidate reference")

+ var ErrCandidateNotFound = errors.New("pending server certificate candidate not found")

+ var ErrCandidatePromoted = errors.New("candidate has already been promoted")

+ var ErrCandidateStale = errors.New(...)

+ var ErrCertificateNotValidNow = errors.New("certificate is expired or not yet valid")

+ var ErrInconsistentMachineState = errors.New("inconsistent Local-TLS machine state")

+ var ErrKeyDeletionUnconfirmed = errors.New("key deletion unconfirmed")

+ var ErrLeafOutlivesCA = errors.New("server certificate validity extends beyond the CA certificate")

+ var ErrNoCandidate = errors.New("candidate reference does not describe a staged candidate")

+ var ErrPromotionUnconfirmed = errors.New("server certificate promotion outcome unconfirmed")

+ var ErrRenewalDue = errors.New("server certificate renewal is due; stage it with StageServerRenewal")

+ var ErrTrustNotHealthy = errors.New("CA trust anchor is not healthy")

+ func AbandonServingCandidate(ref CandidateRef) error

+ func ConfirmServingCandidate(ref CandidateRef) error

+ type CandidateRef struct

+ BaseSHA256 [32]byte

+ CASHA256 [32]byte

+ CandidateSHA256 [32]byte

+ Outcome RenewalOutcome

+ func StageServerRenewal() (CandidateRef, error)

type Material

+ func LoadServingCandidate(ref CandidateRef) (Material, error)

+ type RenewalOutcome int

+ const RenewalCandidateStaged

+ const RenewalNotDue

+ func (o RenewalOutcome) String() string

v0.1.2

Sep 16, 2026

v0.1.1

Sep 15, 2026

v0.1.0

Sep 11, 2026

Changes in this version

+ const RenewalThreshold

+ const SmokeCAKeyName — windows/amd64

+ const SmokeServerKeyName — windows/amd64

+ var ErrKeyNotFound = errors.New("persisted CNG key not found")

+ var ErrTrustAnchorNotFound = errors.New("trust anchor certificate not found in LocalMachine\\Root")

+ func CleanupMachine() error

+ func CleanupMachineBySHA256(fp [32]byte) error

+ func CleanupSmoke(rootDir string, caCertDER []byte) error — windows/amd64

+ func CleanupSmokeAnchorBySHA256(hexFP string) error — windows/amd64

+ func ComputeSHA256Fingerprint(der []byte) [32]byte

+ func MachineAgentPath() (string, error)

+ func MachineTLSPath() (string, error)

+ func ParseSHA256Fingerprint(hexFP string) ([32]byte, error)

+ func TestCreateKey(name string) (crypto.Signer, error) — windows/amd64

+ func TestDeleteKey(name string) error — windows/amd64

+ func TestOpenKey(name string) (crypto.Signer, error) — windows/amd64

+ func TestSignAndVerify(signer crypto.Signer) error — windows/amd64

+ type MachineKeyDeleter interface

+ DeleteCAKey func() error

+ DeleteServerKey func() error

+ func PlatformKeyDeleter() (MachineKeyDeleter, error)

+ type MachineKeyStore interface

+ LoadOrCreateCAKey func() (crypto.Signer, error)

+ LoadOrCreateServerKey func() (crypto.Signer, error)

+ func PlatformKeyStore() (MachineKeyStore, error)

+ type Material struct

+ CACertificate *x509.Certificate

+ CAFingerprintSHA256 [32]byte

+ Certificate tls.Certificate

+ ServerCertificate *x509.Certificate

+ func LoadServingMaterial() (Material, error)

+ func Provision(dataDir string, protector Protector, trustStore TrustStore, ...) (Material, error)

+ func ProvisionMachine() (Material, error)

+ func ProvisionSmoke(rootDir string) (Material, error)

+ func ProvisionWithKeyStore(dataDir string, keyStore MachineKeyStore, trustStore TrustStore, ...) (Material, error)

+ func ReloadMachine() (Material, error)

+ func (m *Material) Close() error

+ type Protector interface

+ Protect func(plaintext []byte) ([]byte, error)

+ Unprotect func(ciphertext []byte) ([]byte, error)

+ func PlatformProtector() (Protector, error)

+ type TrustProvisioner interface

+ InstallTrust func(certificateDER []byte) error

+ RemoveTrust func(certificateDER []byte) error

+ RemoveTrustBySHA256 func(fp [32]byte) error

+ type TrustState int

+ const TrustAbsent

+ const TrustConflict

+ const TrustError

+ const TrustHealthy

+ func VerifySmokeTrust(caCertDER []byte) (TrustState, error)

+ func (s TrustState) String() string

+ type TrustStore interface

+ EnsureTrusted func(certificateDER []byte) error

+ func PlatformTrustStore() (TrustStore, error)

+ type TrustVerifier interface

+ IsTrustedSHA256 func(fingerprint [32]byte) (bool, error)

+ VerifyTrust func(certificateDER []byte) (TrustState, error)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL