Documentation
¶
Overview ¶
Package tlsconf builds the control plane's TLS configurations, for the fiberd's mutual-TLS server and for the callers that dial it. It also names a caller from the certificate it presented.
The server re-reads its certificate, key and client CA when the files change, so a renewal cert-manager writes in place is served without a restart. The files are checked at most once per second. A renewal that fails to load keeps the previous pair and pool.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrPartialTLS is a server or client given some of its TLS files but // not all of them. ErrPartialTLS = errors.New("tlsconf: TLS needs a certificate, a key and a CA together") // ErrNoTransport is a server given neither TLS files nor an explicit // plaintext opt-in. ErrNoTransport = errors.New("tlsconf: TLS is required: set a certificate, key and client CA, or opt in to plaintext explicitly") // ErrPlaintextWithTLS is a server given TLS files and the plaintext // opt-in at once. ErrPlaintextWithTLS = errors.New("tlsconf: plaintext and TLS are mutually exclusive") )
Functions ¶
func Client ¶
Client returns a caller's TLS 1.3 configuration. It verifies fiberd against caFile and presents the caller's own certificate. With no files it returns nil, which tells the caller to dial in plaintext.
func Server ¶
Server returns fiberd's server configuration. It requires TLS 1.3 and a client certificate signed by clientCA on every connection. With plaintext set and no files it returns nil, which tells the caller to serve without TLS.
The certificate, key and client CA are re-read when their files change, checked at most once per second, so a renewal written in place is served without a restart. A renewal that fails to load keeps the previous pair and pool. The files must load once here.
func Thumbprint ¶
func Thumbprint(cert *x509.Certificate) (string, error)
Thumbprint is the RFC 7638 thumbprint of a certificate's public key, the base64url SHA-256 of the key's canonical JWK, which is the value of a grant's cnf jkt. A key without a canonical JWK form, a P-224 one for example, is an error.
func ThumbprintFile ¶
ThumbprintFile is Thumbprint of the first certificate in a PEM file.
Types ¶
type Caller ¶
type Caller struct {
// Thumbprint is the RFC 7638 thumbprint of the caller's public key,
// the value of a grant's cnf jkt, so a renewed certificate with the
// same key names the same caller.
Thumbprint string
// Cert is the DER certificate itself, the one a handoff fiber of a
// grant bound to this caller is told to accept.
Cert []byte
}
Caller is who is on the other end of a verified connection.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package tlsconftest issues throwaway certificates for tests that need TLS or mutual TLS, in the spirit of net/http/httptest.
|
Package tlsconftest issues throwaway certificates for tests that need TLS or mutual TLS, in the spirit of net/http/httptest. |