Documentation
¶
Index ¶
Examples ¶
Constants ¶
const MaxMessageBytes = 16 * 1024 * 1024
MaxMessageBytes is the gRPC message-size limit these services use in place of grpc-go's 4 MiB default, on both ends of every connection.
Credential Issuer Metadata is the payload that outgrew the default: it carries one entry per configured scope, and each entry now inlines that type's display metadata - logos included - so an issuer offering a handful of types can publish several MiB. It is signed by the issuer over gRPC (SignMetadata), so the transport limit is what decides whether an issuer can sign its own metadata at all.
Application-level guards stay below this deliberately, so an oversized payload gets a specific error from the service rather than a generic transport failure - see the issuer's maxMetadataJSONBytes.
Variables ¶
This section is empty.
Functions ¶
func CertDN ¶
func CertDN(cert *x509.Certificate) string
CertDN returns the Subject Distinguished Name of a certificate as a human-readable string. Uses the standard Go x509 String() format. For comparison purposes, use certCanonicalDN instead.
func CertFingerprint ¶
func CertFingerprint(cert *x509.Certificate) string
CertFingerprint calculates the SHA256 fingerprint of a certificate. Returns the fingerprint as a lowercase hex string.
func FormatFingerprint ¶
FormatFingerprint formats a fingerprint with colons for display (e.g., "aa:bb:cc:dd...")
Example ¶
package main
import (
"fmt"
"github.com/SUNET/vc/pkg/grpchelpers"
)
func main() {
// A short hex string for demonstration
fp := "aabbccdd"
formatted := grpchelpers.FormatFingerprint(fp)
fmt.Println(formatted)
}
Output: SHA256:aa:bb:cc:dd
Example (Full) ¶
package main
import (
"fmt"
"github.com/SUNET/vc/pkg/grpchelpers"
)
func main() {
// A full SHA-256 fingerprint (64 hex characters)
fp := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
formatted := grpchelpers.FormatFingerprint(fp)
fmt.Println(formatted)
}
Output: SHA256:e3:b0:c4:42:98:fc:1c:14:9a:fb:f4:c8:99:6f:b9:24:27:ae:41:e4:64:9b:93:4c:a4:95:99:1b:78:52:b8:55
func NewClientConn ¶
func NewClientConn(cfg model.GRPCClientTLS) (*grpc.ClientConn, error)
NewClientConn creates a gRPC client connection with optional mTLS support. If TLS is disabled, returns an insecure connection. If TLS is enabled without client certs, uses server-only TLS. If TLS is enabled with client certs, uses mutual TLS (mTLS).
No automatic retry policy is configured because several services exposed over these connections are non-idempotent (e.g. MakeSDJWT, MakeMDoc, TokenStatusListAddStatus). Retrying UNAVAILABLE after the server has already processed a request would risk duplicating credentials or status list entries. Callers that need retries for specific idempotent RPCs should implement them at the application level.
func NewServerOptions ¶
func NewServerOptions(cfg model.GRPCServer) ([]grpc.ServerOption, error)
NewServerOptions returns gRPC server options with optional TLS/mTLS support. The message-size options (MaxMessageBytes) are always included, TLS or not. If TLS is enabled without client CA, uses server-only TLS. If TLS is enabled with client CA, uses mutual TLS (mTLS) requiring client certificates. If AllowedClientFingerprints or AllowedClientDNs is set, adds an interceptor to verify client certs.
Types ¶
This section is empty.
Source Files