pki

package

v1.0.0 Latest Latest Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 20 Imported by: 0

Details

Package pki is the private certificate authority of the central: server and edge certificates, and the fingerprint edges pin.

This section is empty.

This section is empty.

func CSR(key crypto.Signer) ([]byte, error)

CSR builds a certificate request for an existing key.

func CertPEM(der []byte) []byte

func EdgeID(cert *x509.Certificate) (uuid.UUID, error)

EdgeID reads the edge identity from a certificate.

func Fingerprint(cert *x509.Certificate) string

Fingerprint returns "sha256:<hex>" of the certificate public key.

func KeyPEM(key crypto.Signer) ([]byte, error)

func NewEdgeKey() (crypto.Signer, []byte, error)

NewEdgeKey generates an edge key and its CSR.

func ParseCertPEM(b []byte) (*x509.Certificate, error)

func ParseKeyPEM(b []byte) (crypto.Signer, error)

type CA struct {
	Cert *x509.Certificate
	Key  crypto.Signer
}

CA is the private authority that signs the central and every edge.

func LoadOrCreateCA(dir string) (*CA, error)

LoadOrCreateCA reads ca.crt and ca.key from dir, or creates them.

func (ca *CA) Fingerprint() string

Fingerprint is the value edges pin at enrollment.

func (ca *CA) IssueServer(hosts []string, validity time.Duration) (*x509.Certificate, crypto.Signer, error)

IssueServer signs a server certificate for hosts. The key stays in memory.

func (ca *CA) SignEdge(csrDER []byte, id uuid.UUID, name string, validity time.Duration) (*x509.Certificate, error)

SignEdge signs an edge certificate. Only the public key comes from the CSR.