ca

package

v0.4.0 Latest Latest Go to latest Published: Oct 30, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/DavidGodefroid/lockhttp

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ca is lockhttp's local certificate authority: one per installation (P-256, pathlen 0, 90 days), trusted only inside lea's containers, and the 24-hour leaf certificates the signer issues for the gate's MITM.

Index ¶

Constants
func Generate(name string, now time.Time) (certPEM, keyPEM []byte, err error)
func Init(dir, name string, force bool, now time.Time) error
func ParseCert(certPEM []byte) (*x509.Certificate, error)
type CA
- func Load(certPath, keyPath string) (*CA, error)
- func Parse(certPEM, keyPEM []byte) (*CA, error)
- func (c *CA) Issue(host string) (*tls.Certificate, error)

Constants ¶

View Source

const (
	CAValidity   = 90 * 24 * time.Hour
	LeafValidity = 24 * time.Hour
)

Lifetimes.

View Source

const (
	CertFile = "ca.pem"
	KeyFile  = "ca-key.pem"
)

File names in a CA directory.

Variables ¶

This section is empty.

Functions ¶

func Generate ¶

func Generate(name string, now time.Time) (certPEM, keyPEM []byte, err error)

Generate creates a CA named after the installation.

func Init ¶

func Init(dir, name string, force bool, now time.Time) error

Init writes a new CA into dir (0700): ca.pem (0644) and ca-key.pem (0600). It refuses to overwrite an existing CA unless force.

func ParseCert ¶

func ParseCert(certPEM []byte) (*x509.Certificate, error)

ParseCert reads a CA certificate from PEM.

Types ¶

type CA ¶

type CA struct {
	Cert *x509.Certificate
	Key  *ecdsa.PrivateKey
	// PEM is the certificate in PEM form.
	PEM []byte
	// contains filtered or unexported fields
}

CA is a loaded authority.

func Load ¶

func Load(certPath, keyPath string) (*CA, error)

Load reads a CA from its PEM files.

func Parse ¶

func Parse(certPEM, keyPEM []byte) (*CA, error)

Parse reads a CA from PEM.

func (*CA) Issue ¶

func (c *CA) Issue(host string) (*tls.Certificate, error)

Issue returns a leaf certificate (and its key) for host, cached until an hour before it expires.

Source Files ¶

View all Source files

ca.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL