pki

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 7, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	EnrollmentStatusPending  = "pending"
	EnrollmentStatusSigned   = "signed"
	EnrollmentStatusRejected = "rejected"
)
View Source 
const (
	DefaultCATTL                = 43800 * time.Hour
	DefaultLeafTTL              = 720 * time.Hour
	DefaultEnrollmentTimeout    = 2 * time.Minute
	DefaultPollInterval         = 500 * time.Millisecond
	DefaultRotationInterval     = 1 * time.Minute
	DefaultTrustRefreshInterval = 5 * time.Minute
)

Variables

This section is empty.

Functions

func CSRMac 

func CSRMac(macKey, csrDER []byte) []byte

CSRMac returns HMAC-SHA256(csr-mac-key, csrDER).

func CertPool 

func CertPool(caPEM []byte) (*x509.CertPool, []*x509.Certificate, error)

func GenerateCA 

func GenerateCA(now time.Time, ttl time.Duration) (certPEM, keyPEM []byte, cert *x509.Certificate, err error)

GenerateCA creates a self-signed Caesium internal CA certificate and key.

func NewCAGeneration 

func NewCAGeneration(generation int, kek []byte, now time.Time, ttl time.Duration) (*models.InternalCAGeneration, *x509.Certificate, error)

NewCAGeneration creates a sealed catalog CA generation row.

func OpenCAKey 

func OpenCAKey(kek, ciphertext, nonce []byte) ([]byte, error)

OpenCAKey decrypts a PEM-encoded CA private key sealed by SealCAKey.

func ParseCSRPEM 

func ParseCSRPEM(data []byte) (*x509.CertificateRequest, error)

ParseCSRPEM parses a single PEM-encoded certificate request.

func ParseCertificatesPEM 

func ParseCertificatesPEM(data []byte) ([]*x509.Certificate, error)

ParseCertificatesPEM parses one or more PEM certificates.

func ParsePrivateKeyPEM 

func ParsePrivateKeyPEM(data []byte) (crypto.Signer, error)

ParsePrivateKeyPEM parses an ECDSA or PKCS#8 private key PEM.

func SealCAKey 

func SealCAKey(kek, plaintext []byte) (ciphertext, nonce []byte, err error)

SealCAKey encrypts a PEM-encoded CA private key under kek using AES-256-GCM.

func ShouldRenewLeaf 

func ShouldRenewLeaf(cert *x509.Certificate, now time.Time, renewBefore time.Duration) bool

func ShouldRollCA 

func ShouldRollCA(gen *models.InternalCAGeneration, now time.Time, renewBefore time.Duration) bool

func SignCSR 

func SignCSR(csrPEM []byte, nodeID string, caCert *x509.Certificate, caKey crypto.Signer, now time.Time, ttl time.Duration) ([]byte, *x509.Certificate, error)

SignCSR verifies csrPEM and signs a constrained non-CA leaf for nodeID. The resulting certificate uses only the CSR public key and the validated node identity; CSR-requested extensions are intentionally ignored.

func TLSCertificate 

func TLSCertificate(certPEM, keyPEM []byte) (tls.Certificate, error)

func TrustPoolFromGenerations 

func TrustPoolFromGenerations(gens []models.InternalCAGeneration, now time.Time) (*x509.CertPool, []*x509.Certificate, error)

TrustPoolFromGenerations builds the union trust pool from every non-expired CA generation.

func VerifyCSRMac 

func VerifyCSRMac(macKey, csrDER, got []byte) bool

VerifyCSRMac checks a CSR HMAC using hmac.Equal.

Types

type Clock 

type Clock interface {
	Now() time.Time
}

Clock lets tests make renewal and roll decisions deterministic.

type Config 

type Config struct {
	Store                *Store
	NodeID               string
	Token                string
	CATTL                time.Duration
	LeafTTL              time.Duration
	LeafRenewBefore      time.Duration
	CARenewBefore        time.Duration
	EnrollmentTimeout    time.Duration
	PollInterval         time.Duration
	RotationInterval     time.Duration
	TrustRefreshInterval time.Duration
	SignBatchSize        int
	LeaderCheck          LeaderCheckFunc
	Clock                Clock
}

Config controls internal mTLS auto-provisioning.

type DerivedKeys 

type DerivedKeys struct {
	CAKEK  []byte
	CSRMac []byte
}

DerivedKeys are independent HKDF-SHA256 outputs derived from the operator's shared internal token. The raw token is never used for CA encryption or CSR authentication.

func DeriveKeys 

func DeriveKeys(token string) (DerivedKeys, error)

DeriveKeys expands token into the CA-key encryption key and CSR MAC key.

type LeaderCheckFunc 

type LeaderCheckFunc func(context.Context) (bool, error)

type LeafRequest 

type LeafRequest struct {
	CSRPEM []byte
	CSRDER []byte
	KeyPEM []byte
}

LeafRequest holds a locally generated private key and CSR. KeyPEM must never be written to the catalog.

func GenerateLeafRequest 

func GenerateLeafRequest(nodeID string) (LeafRequest, error)

GenerateLeafRequest creates a node-local leaf keypair and CSR.

type Material 

type Material struct {
	Certificate tls.Certificate
	Leaf        *x509.Certificate
	Pool        *x509.CertPool
	CACerts     []*x509.Certificate
}

Material is the currently usable node certificate and trust bundle.

type MaterialHolder 

type MaterialHolder struct {
	// contains filtered or unexported fields
}

MaterialHolder atomically publishes TLS material to server/client callbacks.

func NewMaterialHolder 

func NewMaterialHolder() *MaterialHolder

func NewStaticMaterialHolder 

func NewStaticMaterialHolder(caFile, certFile, keyFile string) (*MaterialHolder, error)

func (*MaterialHolder) CertPool 

func (h *MaterialHolder) CertPool() (*x509.CertPool, error)

func (*MaterialHolder) Certificate 

func (h *MaterialHolder) Certificate() (*tls.Certificate, error)

func (*MaterialHolder) Material 

func (h *MaterialHolder) Material() (*Material, bool)

func (*MaterialHolder) Set 

func (h *MaterialHolder) Set(cert tls.Certificate, pool *x509.CertPool, caCerts []*x509.Certificate)

func (*MaterialHolder) UpdateTrust 

func (h *MaterialHolder) UpdateTrust(pool *x509.CertPool, caCerts []*x509.Certificate) error

type Provisioner 

type Provisioner struct {
	// contains filtered or unexported fields
}

func NewProvisioner 

func NewProvisioner(cfg Config) (*Provisioner, error)

func (*Provisioner) Bootstrap 

func (p *Provisioner) Bootstrap(ctx context.Context) error

Bootstrap blocks until this node has a signed leaf and a non-empty trust pool. The caller should complete this before starting the internal mTLS listener or dispatch loop.

func (*Provisioner) Enroll 

func (p *Provisioner) Enroll(ctx context.Context) error

func (*Provisioner) Holder 

func (p *Provisioner) Holder() *MaterialHolder

func (*Provisioner) LeafRenewalDue 

func (p *Provisioner) LeafRenewalDue() bool

func (*Provisioner) PruneExpiredCAs 

func (p *Provisioner) PruneExpiredCAs(ctx context.Context) (int64, error)

func (*Provisioner) RefreshTrust 

func (p *Provisioner) RefreshTrust(ctx context.Context) error

func (*Provisioner) RollCAIfNeeded 

func (p *Provisioner) RollCAIfNeeded(ctx context.Context) error

func (*Provisioner) Run 

func (p *Provisioner) Run(ctx context.Context) error

Run starts the signer/rotation loop. It returns when ctx is cancelled or a non-recoverable PKI operation fails.

func (*Provisioner) SignPending 

func (p *Provisioner) SignPending(ctx context.Context, limit int) (int, error)

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store wraps catalog access for internal mTLS CA generations and enrollment rows.

func NewStore 

func NewStore(db *gorm.DB) *Store

func (*Store) ActiveCAGenerations 

func (s *Store) ActiveCAGenerations(ctx context.Context, now time.Time) ([]models.InternalCAGeneration, error)

func (*Store) CountCAGenerations 

func (s *Store) CountCAGenerations(ctx context.Context) (int64, error)

func (*Store) CreateCAGenerationIfAbsent 

func (s *Store) CreateCAGenerationIfAbsent(ctx context.Context, gen *models.InternalCAGeneration) (bool, error)

func (*Store) CreateEnrollment 

func (s *Store) CreateEnrollment(ctx context.Context, enrollment *models.InternalNodeEnrollment) error

func (*Store) DeleteEnrollment 

func (s *Store) DeleteEnrollment(ctx context.Context, id string) error

func (*Store) Enrollment 

func (s *Store) Enrollment(ctx context.Context, id string) (*models.InternalNodeEnrollment, error)

func (*Store) MarkEnrollmentRejected 

func (s *Store) MarkEnrollmentRejected(ctx context.Context, id string, signedAt time.Time) (bool, error)

func (*Store) MarkEnrollmentSigned 

func (s *Store) MarkEnrollmentSigned(ctx context.Context, id string, caGeneration int, certPEM string, signedAt time.Time) (bool, error)

func (*Store) MaxCAGeneration 

func (s *Store) MaxCAGeneration(ctx context.Context) (int, error)

func (*Store) NewestActiveCAGeneration 

func (s *Store) NewestActiveCAGeneration(ctx context.Context, now time.Time) (*models.InternalCAGeneration, error)

func (*Store) PendingEnrollments 

func (s *Store) PendingEnrollments(ctx context.Context, limit int) ([]models.InternalNodeEnrollment, error)

func (*Store) PruneExpiredCAGenerations 

func (s *Store) PruneExpiredCAGenerations(ctx context.Context, cutoff time.Time) (int64, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.