tlsutil

Documentation

Index

• Variables
• func SanitizeHost(host string) (string, error)
• func WithRenewBefore(b time.Duration) func(r *Renewer) error
• func WithRenewJitter(j time.Duration) func(r *Renewer) error
• type RenewFunc
• type Renewer
  • func NewRenewer(cert *tls.Certificate, config *tls.Config, fn RenewFunc, ...) (*Renewer, error)
  • func (r *Renewer) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
  • func (r *Renewer) GetClientCertificate(hello *tls.CertificateRequestInfo) (*tls.Certificate, error)
  • func (r *Renewer) GetConfig() *tls.Config
  • func (r *Renewer) GetConfigForClient(hello *tls.ClientHelloInfo) (*tls.Config, error)
  • func (r *Renewer) Run()
  • func (r *Renewer) RunContext(ctx context.Context)
  • func (r *Renewer) Stop() bool
• type ServerCredentials
  • func NewServerCredentials(fn ServerRenewFunc) (*ServerCredentials, error)
  • func NewServerCredentialsFromFile(certFile, keyFile string) (*ServerCredentials, error)
  • func (c *ServerCredentials) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
  • func (c *ServerCredentials) GetConfigForClient(hello *tls.ClientHelloInfo) (*tls.Config, error)
  • func (c *ServerCredentials) TLSConfig() *tls.Config
• type ServerRenewFunc

Variables

var MinCertDuration = time.Minute

MinCertDuration is the minimum validity of a certificate.

var SanitizeName = x509util.SanitizeName

SanitizeName converts the given domain to its ASCII form.

Functions

func SanitizeHost

func SanitizeHost(host string) (string, error)

SanitizeHost returns the ASCII form of the host part in a host:port address.

func WithRenewBefore

func WithRenewBefore(b time.Duration) func(r *Renewer) error

WithRenewBefore modifies a tls renewer by setting the renewBefore attribute.

func WithRenewJitter

func WithRenewJitter(j time.Duration) func(r *Renewer) error

WithRenewJitter modifies a tls renewer by setting the renewJitter attribute.

Types

type RenewFunc

type RenewFunc func() (*tls.Certificate, *tls.Config, error)

RenewFunc defines the type of the functions used to get a new tls certificate.

type Renewer

type Renewer struct {
	sync.RWMutex
	RenewFunc RenewFunc
	// contains filtered or unexported fields
}

Renewer automatically renews a tls certificate using a RenewFunc.

func NewRenewer

func NewRenewer(cert *tls.Certificate, config *tls.Config, fn RenewFunc, opts ...renewerOptions) (*Renewer, error)

NewRenewer creates a TLS renewer for the given cert. It will use the given RenewFunc to get a new certificate when required.

func (*Renewer) GetCertificate

func (r *Renewer) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate returns the current server certificate.

This method is set in the tls.Config GetCertificate property.

func (*Renewer) GetClientCertificate

func (r *Renewer) GetClientCertificate(hello *tls.CertificateRequestInfo) (*tls.Certificate, error)

GetClientCertificate returns the current client certificate.

This method is set in the tls.Config GetClientCertificate property.

func (*Renewer) GetConfig

func (r *Renewer) GetConfig() *tls.Config

GetConfig returns the current tls.Config.

func (*Renewer) GetConfigForClient

func (r *Renewer) GetConfigForClient(hello *tls.ClientHelloInfo) (*tls.Config, error)

GetConfigForClient returns the tls.Config used per request.

This method is set in the tls.Config GetConfigForClient property.

func (*Renewer) Run

func (r *Renewer) Run()

Run starts the certificate renewer for the given certificate.

func (*Renewer) RunContext

func (r *Renewer) RunContext(ctx context.Context)

RunContext starts the certificate renewer for the given certificate.

func (*Renewer) Stop

func (r *Renewer) Stop() bool

Stop prevents the renew timer from firing.

type ServerCredentials

type ServerCredentials struct {
	RenewFunc ServerRenewFunc
	// contains filtered or unexported fields
}

ServerCredentials is a type that manages the credentials of a server.

func NewServerCredentials

func NewServerCredentials(fn ServerRenewFunc) (*ServerCredentials, error)

NewServerCredentials returns a new ServerCredentials that will get certificates from the given function.

func NewServerCredentialsFromFile

func NewServerCredentialsFromFile(certFile, keyFile string) (*ServerCredentials, error)

NewServerCredentialsFromFile returns a ServerCredentials that renews the certificate from a file on disk.

func (*ServerCredentials) GetCertificate

func (c *ServerCredentials) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate returns the certificate for the SNI in the hello message.

func (*ServerCredentials) GetConfigForClient

func (c *ServerCredentials) GetConfigForClient(hello *tls.ClientHelloInfo) (*tls.Config, error)

GetConfigForClient returns the tls.Config used per request.

func (*ServerCredentials) TLSConfig

func (c *ServerCredentials) TLSConfig() *tls.Config

TLSConfig returns a *tls.Config with GetCertificate and GetConfigForClient set.

type ServerRenewFunc

type ServerRenewFunc func(hello *tls.ClientHelloInfo) (*tls.Certificate, *tls.Config, error)

ServerRenewFunc defines the type of the functions used to get a new tls certificate.