ca

func Client ¶

func Client(dir, id string) error

Client signs a client certificate for a SPIFFE ID with the CA in dir and writes it, with a new key, to dir/clients/<role>/<name>.crt and .key.

func ClientFiles ¶

func ClientFiles(dir string, role Role, name string) (crt, key string)

ClientFiles is where Client writes id's certificate and key.

func ID ¶

func ID(trustDomain string, role Role, name string) string

Identity is a SPIFFE ID in the certificate's only URI SAN, never the CN. The trust domain is the tunnel name, so a certificate for one edge is worth nothing at another that shares its CA. The name identifies one node, operator, or shipper in the edge's log.

spiffe://tunnel.example.com/node/node1
spiffe://tunnel.example.com/ops/alice
spiffe://tunnel.example.com/logs/filebeat

func Init ¶

func Init(dir string, serverNames []string) error

Init writes a self-signed CA (ca.key/ca.crt) into dir. With serverNames it also issues a server cert (server.key/server.crt), for tests.

func LoadPool ¶

func LoadPool(caPath string) (*x509.CertPool, error)

LoadPool reads a PEM CA bundle into a pool.

func NewCA ¶

func NewCA() (certPEM, keyPEM []byte, err error)

NewCA generates a self-signed client CA in memory. It runs on the operator's workstation (fortressctl); the edge never holds a CA key.

func ParseCA ¶

func ParseCA(certPEM, keyPEM []byte) (*x509.Certificate, *ecdsa.PrivateKey, error)

ParseCA decodes a CA cert+key PEM pair.

func ParseCAPEM ¶

func ParseCAPEM(pemBytes []byte) (*x509.Certificate, error)

ParseCAPEM parses exactly one PEM certificate, which must be a CA's. Anything after it is refused: a trust anchor that holds a second certificate would trust that one too, and a reader of the file might see only the first.

func ParseCertPEM ¶

func ParseCertPEM(pemBytes []byte) (*x509.Certificate, error)

ParseCertPEM returns the first certificate in pemBytes.

func SignClient ¶

func SignClient(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, id string, pub any) ([]byte, error)

SignClient signs pub — the caller's public key, so private keys never cross the wire — as a client cert carrying id (a SPIFFE ID) in its URI SAN. The CN repeats the ID for openssl readability; nothing consults it.

func SignServer ¶

func SignServer(caCert *x509.Certificate, caKey *ecdsa.PrivateKey, names []string) (certPEM, keyPEM []byte, err error)

SignServer generates a server key and signs it for names: a test's stand-in for an edge, whose own certificates come from ACME.