Documentation
¶
Index ¶
- Variables
- func ExtractLeafAndIntermediates(certs []*x509.Certificate) (*x509.Certificate, *x509.CertPool, error)
- func GetSubjectKeyID(pubKey interface{}) ([]byte, error)
- func IsPem(data []byte) bool
- func LoadPKCS12CertPool(p12data []byte, password string) (*x509.CertPool, error)
- func NewCertPool(certs ...*x509.Certificate) *x509.CertPool
- func NewSerialNumber() (*big.Int, error)
- func ParseCaBundleFromFile(filePath string, password string, format string) (*x509.CertPool, error)
- func ParseRemoteBundle(remoteBundle RemoteBundle) (*x509.CertPool, error)
- func ReadCertificatesFromEndpoint(client HTTPClient, url *url.URL) ([]*x509.Certificate, error)
- func ReadCertificatesFromFile(filename string, format string, password string) ([]*x509.Certificate, error)
- type HTTPClient
- type RealHTTPClient
- type RemoteBundle
Constants ¶
This section is empty.
Variables ¶
var RootPrograms = map[string]RemoteBundle{
"mozilla": {Url: "https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites", Format: "pem", Parser: parseMozilla},
}
Microsoft has a *.cab file in a well-known location, but it only contains a list of thumbprints that doesn't entirely overlap with Mozilla's list. Chrome's list can be retrieved with a bit of HTML-stripping and parsing of a couple of files in chromium's source, but that is brittle. Apple provides an unhelpful list of CAs in a webpage. For now, we'll just support Mozilla. robstradling has already solved all of this. We can periodically reconstruct trust stores by using the public postgres db from crt.sh.
Functions ¶
func ExtractLeafAndIntermediates ¶
func ExtractLeafAndIntermediates(certs []*x509.Certificate) (*x509.Certificate, *x509.CertPool, error)
Given a certificate chain, separate into the leaf and the intermediates
func GetSubjectKeyID ¶
GetSubjectKeyID calculates a subject key identifier by doing a SHA-1 hash over the ASN.1 encoding of the public key.
func LoadPKCS12CertPool ¶
func NewCertPool ¶
func NewCertPool(certs ...*x509.Certificate) *x509.CertPool
func NewSerialNumber ¶
NewSerialNumber creates a random certificate serial number according to CA/Browser forum spec Section 7.1: "Effective September 30, 2016, CAs SHALL generate non-sequential Certificate serial numbers greater than zero (0) containing at least 64 bits of output from a CSPRNG"
func ParseCaBundleFromFile ¶
The main difference with ReadCertificatesFromFile is that this returns a CertPool, which gets passed into the verification function. It also handles Java KeyStores and PKCS#12 files.
func ParseRemoteBundle ¶
func ParseRemoteBundle(remoteBundle RemoteBundle) (*x509.CertPool, error)
Downloads a remote bundle to a temporary file and then calls ParseCaBundleFromFile
func ReadCertificatesFromEndpoint ¶
func ReadCertificatesFromEndpoint(client HTTPClient, url *url.URL) ([]*x509.Certificate, error)
Pulls the certificate chain from an HTTPs endpoint
func ReadCertificatesFromFile ¶
func ReadCertificatesFromFile(filename string, format string, password string) ([]*x509.Certificate, error)
Reads a certificate chain from a file
Types ¶
type HTTPClient ¶
type HTTPClient interface {
GetPeerCertificates(url *url.URL) ([]*x509.Certificate, error)
}
type RealHTTPClient ¶
func (*RealHTTPClient) GetPeerCertificates ¶
func (c *RealHTTPClient) GetPeerCertificates(url *url.URL) ([]*x509.Certificate, error)
Source Files