Documentation
¶
Overview ¶
Package pki is the small certificate authority of the hub. It signs the client certificates of enrolled agents and the certificate the hub shows them, and gives the agents what they need to trust the hub without a public certificate: they pin the fingerprint of the CA.
Index ¶
- Constants
- func Fingerprint(der []byte) string
- func NewAgentKey() (*ecdsa.PrivateKey, []byte, error)
- func ParseFingerprint(s string) (string, error)
- func PinnedClientTLS(fingerprint string, cert *tls.Certificate) (*tls.Config, error)
- type CA
- func (ca *CA) CertDER() []byte
- func (ca *CA) Fingerprint() string
- func (ca *CA) ServerCertificate(now time.Time, hosts ...string) (tls.Certificate, error)
- func (ca *CA) ServerTLS(cert tls.Certificate) *tls.Config
- func (ca *CA) SignClient(csrDER []byte, agentID string, now time.Time) (certDER []byte, serialHex string, err error)
- type Identity
Constants ¶
const ( // ClientValidity is how long the certificate of an agent is valid. There is // no renewal yet, so it is long; revocation does not depend on it. ClientValidity = 5 * 365 * 24 * time.Hour )
Variables ¶
This section is empty.
Functions ¶
func Fingerprint ¶
Fingerprint returns "sha256:" and the hex SHA-256 of a DER certificate.
func NewAgentKey ¶
func NewAgentKey() (*ecdsa.PrivateKey, []byte, error)
NewAgentKey makes the key pair of an agent and the certificate request to send to the hub. The key stays on the agent.
func ParseFingerprint ¶
ParseFingerprint accepts a fingerprint written as "sha256:<hex>" or plain hex, with optional colons, in any case, and returns the canonical form.
func PinnedClientTLS ¶
PinnedClientTLS is the TLS configuration of an agent. It trusts a hub if the certificate it presents is signed by a CA with the given fingerprint, and ignores the host name: the pinned CA only signs the certificates of one hub, so the name adds nothing, and the hub may be reached by any address. cert may be nil, which is the case for enrollment.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is the hub's certificate authority.
func LoadOrCreate ¶
LoadOrCreate loads the CA stored in dir (ca.crt and ca.key), or creates it when neither file exists. The key is readable by the owner only.
func (*CA) Fingerprint ¶
Fingerprint is what an agent pins to trust this hub, as "sha256:" followed by 64 hex digits.
func (*CA) ServerCertificate ¶
ServerCertificate issues a fresh certificate for the hub's agent listener, valid for the given host names or addresses. It is not stored: a new one is made at every start. The chain includes the CA, so agents that only know the fingerprint can find what they pin.
func (*CA) ServerTLS ¶
func (ca *CA) ServerTLS(cert tls.Certificate) *tls.Config
ServerTLS is the TLS configuration of the agent listener. A client certificate is not required, because enrollment happens before an agent has one, but a certificate that is presented must be signed by this CA. The services decide which calls need an identity (see ClientIdentity).
func (*CA) SignClient ¶
func (ca *CA) SignClient(csrDER []byte, agentID string, now time.Time) (certDER []byte, serialHex string, err error)
SignClient issues the client certificate of an agent from a certificate request. The subject of the request is ignored; the certificate is made for agentID. It returns the certificate (DER) and its serial number in hex.
type Identity ¶
Identity is a verified client certificate.
func ClientIdentity ¶
func ClientIdentity(state tls.ConnectionState) (Identity, bool)
ClientIdentity returns the identity from the state of a TLS connection, or false if the client presented no verified certificate.
Source Files