README
¶
certdb usage
Using a database enables additional functionality for existing commands when a db config is provided:
signandgencertadd a certificate to the certdb after signing itserveenables database functionality for the sign and revoke endpoints
A database is required for the following:
revokemarks certificates revoked in the database with an optional reasonocsprefreshrefreshes the table of cached OCSP responsesocspdumpoutputs cached OCSP responses in a concatenated base64-encoded format
Setup/Migration
This directory stores goose db migration scripts for various DB backends. Currently supported:
- MySQL in mysql
- PostgreSQL in pg
- SQLite in sqlite
Get goose
go get bitbucket.org/liamstask/goose/cmd/goose
Use goose to start and terminate a MySQL DB
To start a MySQL using goose:
goose -path certdb/mysql up
To tear down a MySQL DB using goose
goose -path certdb/mysql down
Note: the administration of MySQL DB is not included. We assume the databases being connected to are already created and access control is properly handled.
Use goose to start and terminate a PostgreSQL DB
To start a PostgreSQL using goose:
goose -path certdb/pg up
To tear down a PostgreSQL DB using goose
goose -path certdb/pg down
Note: the administration of PostgreSQL DB is not included. We assume the databases being connected to are already created and access control is properly handled.
Use goose to start and terminate a SQLite DB
To start a SQLite DB using goose:
goose -path certdb/sqlite up
To tear down a SQLite DB using goose
goose -path certdb/sqlite down
CFSSL Configuration
Several cfssl commands take a -db-config flag. Create a file with a JSON dictionary:
{"driver":"sqlite3","data_source":"certs.db"}
or
{"driver":"postgres","data_source":"postgres://user:password@host/db"}
or
{"driver":"mysql","data_source":"user:password@tcp(hostname:3306)/db?parseTime=true"}
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Accessor ¶
type Accessor interface {
InsertCertificate(cr CertificateRecord) error
GetCertificate(serial, aki string) ([]CertificateRecord, error)
GetUnexpiredCertificates() ([]CertificateRecord, error)
GetRevokedAndUnexpiredCertificates() ([]CertificateRecord, error)
GetUnexpiredCertificatesByLabel(labels []string) (crs []CertificateRecord, err error)
GetRevokedAndUnexpiredCertificatesByLabel(label string) ([]CertificateRecord, error)
GetRevokedAndUnexpiredCertificatesByLabelSelectColumns(label string) ([]CertificateRecord, error)
RevokeCertificate(serial, aki string, reasonCode int) error
InsertOCSP(rr OCSPRecord) error
GetOCSP(serial, aki string) ([]OCSPRecord, error)
GetUnexpiredOCSPs() ([]OCSPRecord, error)
UpdateOCSP(serial, aki, body string, expiry time.Time) error
UpsertOCSP(serial, aki, body string, expiry time.Time) error
}
Accessor abstracts the CRUD of certdb objects from a DB.
type CertificateRecord ¶
type CertificateRecord struct {
Serial string `db:"serial_number"`
AKI string `db:"authority_key_identifier"`
CALabel string `db:"ca_label"`
Status string `db:"status"`
Reason int `db:"reason"`
Expiry time.Time `db:"expiry"`
RevokedAt time.Time `db:"revoked_at"`
PEM string `db:"pem"`
// the following fields will be empty for data inserted before migrate 002 has been run.
IssuedAt *time.Time `db:"issued_at"`
NotBefore *time.Time `db:"not_before"`
MetadataJSON types.JSONText `db:"metadata"`
SANsJSON types.JSONText `db:"sans"`
CommonName sql.NullString `db:"common_name"`
}
CertificateRecord encodes a certificate and its metadata that will be recorded in a database.
func (*CertificateRecord) GetMetadata ¶ added in v1.5.0
func (c *CertificateRecord) GetMetadata() (map[string]interface{}, error)
GetMetadata returns the json metadata
func (*CertificateRecord) GetSANs ¶ added in v1.5.0
func (c *CertificateRecord) GetSANs() ([]string, error)
GetSANs returns the json SANs
func (*CertificateRecord) SetMetadata ¶ added in v1.5.0
func (c *CertificateRecord) SetMetadata(meta map[string]interface{}) error
SetMetadata sets the metadata json
func (*CertificateRecord) SetSANs ¶ added in v1.5.0
func (c *CertificateRecord) SetSANs(meta []string) error
SetSANs sets the list of sans
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ocspstapling implements OCSP stapling of Signed Certificate Timestamps (SCTs) into OCSP responses in a database.
|
Package ocspstapling implements OCSP stapling of Signed Certificate Timestamps (SCTs) into OCSP responses in a database. |