ca

Documentation

Index

• Constants
• func CreateServerCATemplate(csrDER []byte, trustDomain string, notBefore, notAfter time.Time, ...) (*x509.Certificate, error)
• func CreateX509SVIDTemplate(csrDER []byte, trustDomain string, notBefore, notAfter time.Time, ...) (*x509.Certificate, error)
• func GenerateServerCACSR(signer crypto.Signer, trustDomain string, subject pkix.Name) ([]byte, error)
• func NewManager(c *ManagerConfig) *manager
• func SelfSignServerCACertificate(signer crypto.Signer, trustDomain string, subject pkix.Name, ...) (*x509.Certificate, error)
• func UpstreamSignServerCACertificate(ctx context.Context, upstreamCA upstreamca.UpstreamCA, signer crypto.Signer, ...) (*x509.Certificate, []*x509.Certificate, error)
• type Manager
• type ManagerConfig
• type ServerCA

Constants

const (
	DefaultSVIDTTL = time.Hour
	DefaultCATTL   = 24 * time.Hour
)

const (
	DefaultJWTSVIDTTL = time.Minute * 5
)

Functions

func CreateServerCATemplate

func CreateServerCATemplate(csrDER []byte, trustDomain string, notBefore, notAfter time.Time, serialNumber *big.Int) (*x509.Certificate, error)

func CreateX509SVIDTemplate

func CreateX509SVIDTemplate(csrDER []byte, trustDomain string, notBefore, notAfter time.Time, serialNumber *big.Int) (*x509.Certificate, error)

func GenerateServerCACSR

func GenerateServerCACSR(signer crypto.Signer, trustDomain string, subject pkix.Name) ([]byte, error)

func NewManager

func NewManager(c *ManagerConfig) *manager

func SelfSignServerCACertificate

func SelfSignServerCACertificate(signer crypto.Signer, trustDomain string, subject pkix.Name, notBefore, notAfter time.Time) (*x509.Certificate, error)

func UpstreamSignServerCACertificate

func UpstreamSignServerCACertificate(ctx context.Context, upstreamCA upstreamca.UpstreamCA, signer crypto.Signer, trustDomain string, subject pkix.Name) (*x509.Certificate, []*x509.Certificate, error)

Types

type Manager

type Manager interface {
	// Initializes the CA manager. Must be called before a call to Run().
	Initialize(ctx context.Context) error

	// Run runs the CA manager. It blocks until a failure or the context is
	// canceled.
	Run(ctx context.Context) error

	// Returns the CA being managed
	CA() ServerCA
}

type ManagerConfig

type ManagerConfig struct {
	Catalog        catalog.Catalog
	TrustDomain    url.URL
	UpstreamBundle bool
	SVIDTTL        time.Duration
	CATTL          time.Duration
	CASubject      pkix.Name
	CertsPath      string
	Log            logrus.FieldLogger
	Metrics        telemetry.Metrics
}

type ServerCA

type ServerCA interface {
	SignX509SVID(ctx context.Context, csrDER []byte, ttl time.Duration) ([]*x509.Certificate, error)
	SignJWTSVID(ctx context.Context, jsr *node.JSR) (string, error)
}