Documentation
¶
Index ¶
- Constants
- func GenCA() (*x509.Certificate, crypto.Signer, error)
- func IsStatic(secret *v1.Secret) bool
- func LoadCA(caPem, caKey []byte) (*x509.Certificate, crypto.Signer, error)
- func LoadCAChain(caPem, caKey []byte) ([]*x509.Certificate, crypto.Signer, error)
- func LoadCerts(certFile, keyFile string) (*x509.Certificate, crypto.Signer, error)deprecated
- func LoadCertsChain(certFile, keyFile string) ([]*x509.Certificate, crypto.Signer, error)
- func LoadOrGenCA() (*x509.Certificate, crypto.Signer, error)deprecated
- func LoadOrGenCAChain() ([]*x509.Certificate, crypto.Signer, error)
- func Marshal(x509Cert *x509.Certificate, privateKey crypto.Signer) (certBytes, keyBytes []byte, err error)
- func MarshalChain(privateKey crypto.Signer, certs ...*x509.Certificate) (keyBytes, certChainBytes []byte, err error)
- func NeedsUpdate(maxSANs int, secret *v1.Secret, cn ...string) bool
- func NewPrivateKey() (crypto.Signer, error)
- func NewSelfSignedCACert(key crypto.Signer, cn string, org ...string) (*x509.Certificate, error)
- func NewSignedCert(signer crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, cn string, ...) (*x509.Certificate, error)
- func NewSignedClientCert(signer crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, cn string) (*x509.Certificate, error)
- func ParseCertPEM(pemCerts []byte) (*x509.Certificate, error)
- type TLS
- func (t *TLS) AddCN(secret *v1.Secret, cn ...string) (*v1.Secret, bool, error)
- func (t *TLS) Filter(cn ...string) []string
- func (t *TLS) IsExpired(secret *v1.Secret) bool
- func (t *TLS) Merge(target, additional *v1.Secret) (*v1.Secret, bool, error)
- func (t *TLS) Regenerate(secret *v1.Secret) (*v1.Secret, error)
- func (t *TLS) Renew(secret *v1.Secret) (*v1.Secret, error)
- func (t *TLS) Verify(secret *v1.Secret) error
Constants ¶
const (
CertificateBlockType = "CERTIFICATE"
)
const (
Static = "listener.cattle.io/static"
)
Variables ¶
This section is empty.
Functions ¶
func IsStatic ¶ added in v0.2.1
IsStatic returns true if the Secret has an attribute indicating that it contains a static (aka user-provided) certificate, which should not be modified.
func LoadCAChain ¶ added in v0.3.6
func LoadCertsChain ¶ added in v0.3.6
func LoadOrGenCA
deprecated
func LoadOrGenCA() (*x509.Certificate, crypto.Signer, error)
Deprecated: Use LoadOrGenCAChain instead as it supports intermediate CAs
func LoadOrGenCAChain ¶ added in v0.3.6
func LoadOrGenCAChain() ([]*x509.Certificate, crypto.Signer, error)
func Marshal ¶
func Marshal(x509Cert *x509.Certificate, privateKey crypto.Signer) (certBytes, keyBytes []byte, err error)
Marshal returns the given cert and key as byte slices.
func MarshalChain ¶ added in v0.3.3
func MarshalChain(privateKey crypto.Signer, certs ...*x509.Certificate) (keyBytes, certChainBytes []byte, err error)
MarshalChain returns given key and certificates as byte slices.
func NeedsUpdate ¶
NeedsUpdate returns true if any of the CNs are not currently present on the secret's Certificate, as recorded in the cnPrefix annotations. It will return false if all requested CNs are already present, or if maxSANs is non-zero and has been exceeded.
func NewPrivateKey ¶
NewPrivateKey returnes a new ECDSA key
func NewSelfSignedCACert ¶
func NewSignedCert ¶
func NewSignedClientCert ¶ added in v0.2.1
func NewSignedClientCert(signer crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer, cn string) (*x509.Certificate, error)
func ParseCertPEM ¶
func ParseCertPEM(pemCerts []byte) (*x509.Certificate, error)
Types ¶
type TLS ¶
type TLS struct {
CACert []*x509.Certificate
CAKey crypto.Signer
CN string
Organization []string
FilterCN func(...string) []string
ExpirationDaysCheck int
}
func (*TLS) AddCN ¶
AddCN attempts to add a list of CN strings to a given Secret, returning the potentially-modified Secret along with a bool indicating whether or not it has been updated. The Secret will not be changed if it has an attribute indicating that it is static (aka user-provided), or if no new CNs were added.
func (*TLS) Filter ¶ added in v0.2.1
Filter ensures that the CNs are all valid accorting to both internal logic, and any filter callbacks. The returned list will contain only approved CN entries.
func (*TLS) Merge ¶
Merge combines the SAN lists from the target and additional Secrets, and returns a potentially modified Secret, along with a bool indicating if the returned Secret is not the same as the target Secret. Secrets with expired certificates will never be returned.
If the merge would not add any CNs to the additional Secret, the additional Secret is returned, to allow for certificate rotation/regeneration.
If the merge would not add any CNs to the target Secret, the target Secret is returned; no merging is necessary.
If neither certificate is acceptable as-is, a new certificate containing the union of the two lists is generated, using the private key from the first Secret. The returned Secret will contain the updated cert.
Source Files