ca

package
v0.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 7, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package ca is lockhttp's local certificate authority: one per installation (P-256, pathlen 0, 90 days), trusted only inside lea's containers, and the 24-hour leaf certificates the signer issues for the gate's MITM.

Index

Constants

View Source 
const (
	CAValidity   = 90 * 24 * time.Hour
	LeafValidity = 24 * time.Hour
)

Lifetimes.

View Source 
const (
	CertFile = "ca.pem"
	KeyFile  = "ca-key.pem"
)

File names in a CA directory.

Variables

This section is empty.

Functions

func Generate 

func Generate(name string, now time.Time) (certPEM, keyPEM []byte, err error)

Generate creates a CA named after the installation.

func Init 

func Init(dir, name string, force bool, now time.Time) error

Init writes a new CA into dir (0700): ca.pem (0644) and ca-key.pem (0600). It refuses to overwrite an existing CA unless force.

func ParseCert 

func ParseCert(certPEM []byte) (*x509.Certificate, error)

ParseCert reads a CA certificate from PEM.

Types

type CA 

type CA struct {
	Cert *x509.Certificate
	Key  *ecdsa.PrivateKey
	// PEM is the certificate in PEM form.
	PEM []byte
	// contains filtered or unexported fields
}

CA is a loaded authority.

func Load 

func Load(certPath, keyPath string) (*CA, error)

Load reads a CA from its PEM files.

func Parse 

func Parse(certPEM, keyPEM []byte) (*CA, error)

Parse reads a CA from PEM.

func (*CA) Issue 

func (c *CA) Issue(host string) (*tls.Certificate, error)

Issue returns a leaf certificate (and its key) for host, cached until an hour before it expires.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.