ca

type Depot interface {
	Put(ctx context.Context, cert *x509.Certificate) error
	// Get returns the certificate with the serial or ErrNotFound.
	Get(ctx context.Context, serial *big.Int) (*x509.Certificate, error)
}

type KeyKind string

type Local struct {
	// contains filtered or unexported fields
}

type MemoryDepot struct {
	// contains filtered or unexported fields
}

type Option func(*Local)

type OtherName struct {
	ID    asn1.ObjectIdentifier
	Value []byte // the DER of the value, already encoded
}

type Policy struct {
	// Validity of issued certificates; default one year.
	Validity time.Duration
	// NotAfter caps the expiry absolutely, whatever Validity says. A
	// deadline is a moment, not a duration: a caller that turned one into a
	// duration would have the certificate outlive it by however long
	// issuing took, which is the kind of margin that goes unnoticed until
	// it matters. Zero means Validity alone decides.
	NotAfter time.Time
	// Backdate NotBefore by this much to absorb clock skew; default 5 minutes.
	Backdate time.Duration
	// KeyUsage default: digital signature (plus key encipherment for RSA).
	KeyUsage x509.KeyUsage
	// ExtKeyUsage default: client authentication.
	ExtKeyUsage []x509.ExtKeyUsage
	// AllowSANs permits subject alternative names from the CSR. Off by
	// default: an MDM identity is named by its subject only.
	AllowSANs bool
	// MinRSABits rejects small RSA keys; default 2048.
	MinRSABits int
	// Subject replaces the certificate request's subject when set. An ACME
	// server uses this because Apple's documentation says the server may
	// override the Subject the profile asked for: the subject is the server's
	// statement about the device, not the device's claim about itself.
	Subject *pkix.Name
	// OtherNames are subjectAltName otherName entries added to the issued
	// certificate. They come from the server, not from the request, so they
	// are not subject to AllowSANs.
	OtherNames []OtherName
	// AllowedKeys restricts the key types the CA will certify. Empty means
	// the existing behaviour: any RSA key of at least MinRSABits, and any
	// ECDSA key.
	AllowedKeys []KeyKind
}

type SANs struct {
	OtherNames     []OtherName
	DNSNames       []string
	EmailAddresses []string
	IPAddresses    []net.IP
	URIs           []*url.URL
}

type SelfSignedOptions struct {
	Subject  pkix.Name
	Validity time.Duration // default 10 years
	// RSABits default 2048. SCEP requires an RSA CA because devices
	// encrypt the PKCS #7 envelope to it.
	RSABits int
	// Random defaults to crypto/rand.
	Random io.Reader
}

type Signer interface {
	// Sign validates the CSR against the policy and returns the issued
	// certificate.
	Sign(ctx context.Context, csr *x509.CertificateRequest, p Policy) (*x509.Certificate, error)
	// Certificate returns the CA (or RA) certificate that signs.
	Certificate() *x509.Certificate
	// Chain returns the certificate followed by any intermediates up to but
	// not including the root, for clients that need the full chain.
	Chain() []*x509.Certificate
}