tls

type CertChainEntry struct {
	Subject           string
	Issuer            string
	Serial            string
	NotBefore         string
	NotAfter          string
	Version           int
	DNSNames          []string
	IPAddresses       []string
	IsCA              bool
	SignatureAlgo     string
	PublicKeyAlgo     string
	SHA256Fingerprint string

	// Status holds Chrome-style CERT_ checks for this individual certificate.
	// ref: https://github.com/chromium/chromium/blob/main/net/cert/cert_status_flags.cc
	Status []string
}

type TLS struct{}

type TLSConfig struct {
	// ServerName overrides the SNI hostname sent in the ClientHello.
	// When empty, the target host is used.
	ServerName string

	// CertPEM is the PEM-encoded client certificate for mTLS.
	// When non-empty, the certificate is presented to the server
	// during the handshake. KeyPEM must also be set.
	CertPEM []byte

	// KeyPEM is the PEM-encoded private key for the client certificate.
	// When empty and CertPEM is non-empty, the key is expected to be
	// bundled in the same PEM block as CertPEM.
	KeyPEM []byte

	// CAPEM is the PEM-encoded CA certificate pool. When non-empty,
	// the pool is used as the root of trust (RootCAs) instead of
	// skipping verification entirely.
	CAPEM []byte

	// InsecureSkipVerify controls whether the server's certificate chain
	// and hostname are verified. Defaults to true.
	InsecureSkipVerify bool
}

type TLSResult struct {
	// CertChain contains all presented certificates sorted from leaf to root.
	// The leaf certificate is always CertChain[0].
	CertChain []CertChainEntry

	// Status is the final concluded chain status. It holds the statuses from
	// the first certificate (walking leaf→root) that has a non-OK check, or
	// ["OK"] if every certificate in the chain passes all checks.
	Status []string
}