Documentation
¶
Overview ¶
Package pinned holds the small trust primitives shared by every reverse-dialed client: CA fingerprint pinning and key plus CSR generation. It imports no Docker, exec or build code so a minimal client can link it alone.
Index ¶
- Variables
- func CheckCA(caPEM []byte, fingerprint string) error
- func EnrollTLSConfig(caFingerprint string) *tls.Config
- func Fingerprint(der []byte) string
- func FingerprintPEM(certPEM []byte) (string, error)
- func NewKeyAndCSR(commonName string) (keyPEM, csrDER []byte, err error)
- func Normalize(fp string) string
- func SessionTLSConfig(caPEM, certPEM, keyPEM []byte) (*tls.Config, error)
- func VerifyChain(chain []*x509.Certificate, caFingerprint string) error
Constants ¶
This section is empty.
Variables ¶
var ErrMismatch = errors.New("agent: control plane CA does not match the pinned fingerprint")
ErrMismatch means the control plane's CA does not match the pinned fingerprint.
Functions ¶
func EnrollTLSConfig ¶
EnrollTLSConfig builds the enrollment TLS config. Go's own verification is skipped because no root exists yet; with a pin, VerifyChain replaces it.
func Fingerprint ¶
Fingerprint returns the hex SHA-256 of a DER-encoded certificate.
func FingerprintPEM ¶
FingerprintPEM returns the fingerprint of the first certificate in certPEM.
func NewKeyAndCSR ¶
NewKeyAndCSR generates an ed25519 key and a CSR for it. The key stays with the caller.
func SessionTLSConfig ¶
SessionTLSConfig builds the long-lived session TLS config from the CA the agent received at enrollment and its own client certificate.
func VerifyChain ¶
func VerifyChain(chain []*x509.Certificate, caFingerprint string) error
VerifyChain accepts the connection only if the chain includes the pinned CA and the leaf is a valid server certificate signed by it.
Types ¶
This section is empty.
Source Files