Documentation
¶
Overview ¶
Package tlsutil parses PEM-encoded X.509 certificates and classifies their expiry state. It is used by `noema serve` to refuse startup on an already-expired cert, by `noema verify cortex` to surface upcoming expiry, and by the periodic cert monitor that runs alongside the HTTP MCP server.
No I/O beyond reading the cert file. No network calls. Time is injectable so tests don't need to backdate certs.
Index ¶
Constants ¶
const NearExpiryWindow = 7 * 24 * time.Hour
NearExpiryWindow is the threshold at which Classify flips from StatusOK to StatusNearExpiry. The cert monitor uses a finer-grained banded warning schedule (90/30/7/expired) but the startup gate only distinguishes "fine" from "warn loudly."
Variables ¶
This section is empty.
Functions ¶
func LoadLeaf ¶
func LoadLeaf(path string) (*x509.Certificate, error)
LoadLeaf reads the PEM file at path and returns the first CERTIFICATE block parsed as an *x509.Certificate. A file containing a chain returns the leaf (which by Go and most tooling conventions is the first block); intermediates and roots after it are ignored because the local server doesn't need to validate them — we only care about expiry of the cert it serves.
Types ¶
type Classification ¶
type Classification struct {
Status ExpiryStatus
NotAfter time.Time
// DaysRemaining is rounded down. Negative when the cert is already
// expired. Zero when StatusNotYetValid (the field is meaningful
// only against NotAfter).
DaysRemaining int
}
Classification is the result of Classify.
func Classify ¶
func Classify(cert *x509.Certificate, now time.Time) Classification
Classify buckets a cert against the reference time `now`. Pass time.Now() in production and a fixed value in tests.
type ExpiryStatus ¶
type ExpiryStatus int
ExpiryStatus is the classification bucket for a leaf certificate relative to a reference time.
const ( // StatusOK means the cert is currently valid and not within any // warning band. NotBefore <= now < NotAfter, with NotAfter strictly // more than 7 days away. StatusOK ExpiryStatus = iota // StatusNearExpiry means the cert is still valid but expires within // 7 days. Serve continues; a warning is logged. StatusNearExpiry // StatusExpired means now >= NotAfter. Serve refuses to start // unless the operator passes --insecure-allow-expired. StatusExpired // StatusNotYetValid means now < NotBefore. Treated as a hard failure // in the same bucket as expired: a client cannot use this cert. StatusNotYetValid )
func (ExpiryStatus) String ¶
func (s ExpiryStatus) String() string
String returns a short tag suitable for logs.
Source Files