Documentation
¶
Overview ¶
Package devtls provides a shared, in-memory self-signed TLS certificate generator for gopherstack's opt-in/mandatory dev HTTPS listeners.
It is lifted out of cli.go's original generateSelfSignedCert (used by the main port's opt-in TLS mode) so that services/azurearm -- which must serve its ARM/AAD-discovery listener over HTTPS unconditionally, see AZURE.md section 10.8 -- can share the exact same cert-generation logic instead of duplicating it. cli.go now calls GenerateSelfSignedCert instead of defining its own copy.
Index ¶
Constants ¶
const DefaultValidity = 365 * 24 * time.Hour
DefaultValidity is the validity window of a generated certificate.
Variables ¶
var ErrInvalidCAPEM = errors.New("devtls: invalid CA PEM")
ErrInvalidCAPEM is returned when a persisted CA cannot be decoded.
Functions ¶
func GenerateSelfSignedCert ¶
func GenerateSelfSignedCert(hosts ...string) (tls.Certificate, error)
GenerateSelfSignedCert creates an in-memory self-signed certificate valid for localhost/127.0.0.1/::1, plus any extra DNS names or IP addresses passed in hosts (each entry is tried as an IP first, falling back to a DNS name). Suitable for an opt-in or mandatory dev HTTPS listener -- never for production use.
func GenerateSelfSignedCertPEM ¶
GenerateSelfSignedCertPEM is the PEM-returning variant of GenerateSelfSignedCert, used by callers (e.g. the terraform test harness) that need to write the certificate to disk for a child process (such as `tofu`/`terraform`) to trust via SSL_CERT_FILE.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is an in-memory certificate authority that signs short-lived leaf certificates.
func LoadOrCreateCA ¶
LoadOrCreateCA returns the CA persisted in dir, creating and saving one when absent, so clients can trust it once across restarts.
func NewCA ¶
NewCA creates a self-signed CA certificate valid for DefaultValidity.
Source Files