testca

type CA struct {
	Cert *x509.Certificate
	Key  crypto.Signer
	DER  []byte
	// contains filtered or unexported fields
}

type CRLOpts struct {
	Number     int64
	ThisUpdate time.Time
	NextUpdate time.Time
	Entries    []x509.RevocationListEntry
	Extra      []pkix.Extension // raw CRL extensions, such as the delta indicator or expiredCertsOnCRL
	SigAlg     x509.SignatureAlgorithm
}

type KeyKind int

type Leaf struct {
	Cert *x509.Certificate
	Key  crypto.Signer
	DER  []byte
	// contains filtered or unexported fields
}

type Opts struct {
	Key     KeyKind                 // the new certificate's key kind (default P-256)
	KeyWith crypto.Signer           // use this key instead of generating one
	Pub     crypto.PublicKey        // a leaf for this public key, whose private half the test does not hold (an HSM's); Leaf.Key is then nil
	Mutate  func(*x509.Certificate) // last word on the template, before signing
	SigAlg  x509.SignatureAlgorithm // the signature algorithm, when the default is not wanted
}

type RawCRLOpts struct {
	Number      *big.Int // nil omits the cRLNumber extension
	This, Next  time.Time
	OmitNext    bool
	OmitVersion bool       // a version 1 CRL (no version field)
	Serials     []*big.Int // revoked at This, no extensions
	Entries     []RawEntry // revoked entries with their own times and extensions
	Extensions  []pkix.Extension
	PadBytes    int // adds a non-critical unknown extension of about this many bytes
	// InnerAlg and OuterAlg override the signature algorithm identifiers in the TBSCertList and in
	// the CertificateList (the signature itself is still the CA key's). OuterParams is the full DER of
	// the outer identifier's parameters (for RSASSA-PSS).
	InnerAlg, OuterAlg asn1.ObjectIdentifier
	OuterParams        []byte
	// Indefinite re-encodes the outer SEQUENCE with an indefinite length (BER).
	Indefinite bool
	// NoAKI omits the authority key identifier extension.
	NoAKI bool
}

type RawEntry struct {
	Serial *big.Int
	Time   time.Time
	Exts   []pkix.Extension
}