tls

package
v1.0.7 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 14, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CipherSuiteName

func CipherSuiteName(id uint16) string

CipherSuiteName returns the name of a cipher suite

func CreateCertPool

func CreateCertPool(certFiles ...string) (*x509.CertPool, error)

CreateCertPool creates a certificate pool from PEM files

func DefaultmTLSClientConfig

func DefaultmTLSClientConfig() *mTLSClientConfig

DefaultmTLSClientConfig returns a default client configuration

func DefaultmTLSConfig

func DefaultmTLSConfig() *mTLSConfig

DefaultmTLSConfig returns a default mTLS configuration

func ExtractCertificateInfo

func ExtractCertificateInfo(certPEM []byte) (map[string]interface{}, error)

ExtractCertificateInfo extracts information from a certificate

func GenerateSelfSignedCertificate

func GenerateSelfSignedCertificate(cn string, validityDays int) error

GenerateSelfSignedCertificate generates a self-signed certificate

func GetDefaultTLSConfig

func GetDefaultTLSConfig() *tls.Config

GetDefaultTLSConfig returns a secure default TLS configuration

func GetFIPSTLSConfig

func GetFIPSTLSConfig() *tls.Config

GetFIPSTLSConfig returns a FIPS-compliant TLS configuration

func NewmTLSClient

func NewmTLSClient(cfg *mTLSClientConfig) (*mTLSClient, error)

NewmTLSClient creates a new mTLS client for connecting to services

func NewmTLSContext

func NewmTLSContext(cfg *mTLSConfig) (*mTLSContext, error)

NewmTLSContext creates a new mTLS server context for validating client certificates

func ValidateConfig

func ValidateConfig(cfg *tls.Config) error

ValidateConfig validates TLS configuration for FIPS compliance

func VerifyCertificate

func VerifyCertificate(certPEM []byte, caPool *x509.CertPool) error

VerifyCertificate verifies a raw certificate against a CA pool

Types

type CAConfig

type CAConfig struct {
	CertDir      string
	OrgName      string
	CacheTTL     time.Duration
	AutoGenerate bool
}

CAConfig holds Certificate Authority configuration

type CertificateAuthority

type CertificateAuthority struct {
	// contains filtered or unexported fields
}

CertificateAuthority manages CA certificate for MITM intercept

func NewCertificateAuthority

func NewCertificateAuthority(cfg *CAConfig) (*CertificateAuthority, error)

NewCertificateAuthority creates a new CA for MITM certificate generation

func (*CertificateAuthority) CacheSize

func (ca *CertificateAuthority) CacheSize() int

CacheSize returns the number of cached certificates

func (*CertificateAuthority) ClearCache

func (ca *CertificateAuthority) ClearCache()

ClearCache clears the certificate cache

func (*CertificateAuthority) GetCACertInfo

func (ca *CertificateAuthority) GetCACertInfo() (map[string]interface{}, error)

GetCACertInfo returns information about the CA certificate

func (*CertificateAuthority) GetCACertificate

func (ca *CertificateAuthority) GetCACertificate() []byte

GetCACertificate returns the CA certificate in DER format

func (*CertificateAuthority) GetCACertificatePEM

func (ca *CertificateAuthority) GetCACertificatePEM() []byte

GetCACertificatePEM returns the CA certificate in PEM format

func (*CertificateAuthority) GetCAKeyPEM

func (ca *CertificateAuthority) GetCAKeyPEM() []byte

GetCAKeyPEM returns the CA key in PEM format (for export)

func (*CertificateAuthority) GetCertificate

func (ca *CertificateAuthority) GetCertificate(domain string) (*tls.Certificate, error)

GetCertificate generates or retrieves a certificate for a domain

func (*CertificateAuthority) GetConfigForClient

func (ca *CertificateAuthority) GetConfigForClient() *tls.Config

GetConfigForClient returns a TLS config that generates certificates on-the-fly

type Config

type Config struct {
	CertDir      string
	CertFile     string
	KeyFile      string
	AutoGenerate bool
	MinVersion   uint16
}

Config contains TLS manager configuration

type FIPSConfig

type FIPSConfig struct {
	// Minimum TLS version (default: TLS 1.2)
	MinVersion uint16

	// Maximum TLS version
	MaxVersion uint16

	// List of cipher suites to use (nil = use FIPS defaults)
	CipherSuites []uint16

	// Prefer server cipher suites
	PreferServerCipherSuites bool

	// Enable FIPS mode
	FIPSMode bool
}

FIPSConfig represents FIPS-compliant TLS configuration

func DefaultFIPSTLSConfig

func DefaultFIPSTLSConfig() *FIPSConfig

DefaultFIPSTLSConfig returns a FIPS-compliant TLS configuration

func (*FIPSConfig) ToStandardTLSConfig

func (c *FIPSConfig) ToStandardTLSConfig() *tls.Config

ToStandardTLSConfig converts to standard tls.Config

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles TLS certificates and configuration

func NewManager

func NewManager(cfg *Config) (*Manager, error)

NewManager creates a new TLS certificate manager

func (*Manager) GetCertificateInfo

func (m *Manager) GetCertificateInfo() (map[string]interface{}, error)

GetCertificateInfo returns information about the loaded certificate

func (*Manager) GetCertificatePaths

func (m *Manager) GetCertificatePaths() (certFile, keyFile string)

GetCertificatePaths returns the paths to certificate files

func (*Manager) GetConfig

func (m *Manager) GetConfig() *TLSConfig

GetConfig returns the TLS configuration

func (*Manager) GetTLSConfig

func (m *Manager) GetTLSConfig() *tls.Config

GetTLSConfig returns the TLS configuration

func (*Manager) Initialize

func (m *Manager) Initialize() error

Initialize ensures certificates are available

func (*Manager) IsAutoGenerated

func (m *Manager) IsAutoGenerated() bool

IsAutoGenerated returns true if using auto-generated certificates

type Options

type Options struct {
	CertFile string
	KeyFile  string
	Address  string
	Port     int
}

Options contains TLS server configuration

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server implements TLS termination

func NewServer

func NewServer(opts *Options) (*Server, error)

NewServer creates a new TLS server

func (*Server) Start

func (s *Server) Start() error

Start starts the TLS server

func (*Server) Stop

func (s *Server) Stop() error

Stop stops the TLS server

type TLSConfig

type TLSConfig struct {
	Enabled      bool   `json:"enabled"`
	CertFile     string `json:"cert_file"`
	KeyFile      string `json:"key_file"`
	AutoGenerate bool   `json:"auto_generate"`
	MinVersion   string `json:"min_version"`
}

TLSConfig represents TLS configuration for gRPC service

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL