Documentation
¶
Overview ¶
Package tlsutil handles low-level X.509 certificates: generating the self-signed cert used as the internal pre-ACME fallback, reading certificate metadata for display, computing SHA-256 pins, and writing key pairs to disk.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CertPinSHA256 ¶
CertPinSHA256 returns the hex-encoded SHA-256 of the leaf certificate's DER bytes at path. Clients pin this via pinnedPeerCertSha256 to trust a specific (e.g. self-signed) cert without CA verification — the modern replacement for allowInsecure, and stricter (only this exact cert is accepted). Xray expects lowercase hex (NOT base64), matching `openssl x509 -fingerprint -sha256`.
func GenerateSelfSigned ¶
GenerateSelfSigned creates a self-signed certificate for host (an IP address or a DNS name), valid ~1 year, returning PEM cert+key. It's a fallback so the panel can still serve TLS when ACME is unavailable (e.g. rate-limited); the renew loop replaces it with a real cert once ACME succeeds.
func WriteKeyPair ¶
WriteKeyPair writes cert and key PEM to the given paths (0600 key). Both files are staged to <path>.new first, then renamed back-to-back, so the window in which a concurrent reader (e.g. an Xray reload) could see a new cert beside an old key shrinks to the gap between two rename syscalls instead of spanning a whole file write. (Truly atomic cross-file replacement isn't possible.)
Types ¶
type CertInfo ¶
type CertInfo struct {
Subject string `json:"subject"`
Issuer string `json:"issuer"`
NotBefore time.Time `json:"not_before"`
NotAfter time.Time `json:"not_after"`
DaysLeft int `json:"days_left"`
}
CertInfo is summary metadata about a certificate on disk.
func ReadCertInfo ¶
ReadCertInfo parses the leaf certificate at path for display.
Source Files