issuance

package

v0.12.0 Latest Latest Go to latest Published: Nov 10, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Details

Package issuance creates identities and bounded CA transition certificates.

This section is empty.

This section is empty.

This section is empty.

type Authority struct {
	// contains filtered or unexported fields
}

func NewAuthority(name string, now time.Time, lifetime time.Duration) (*Authority, error)

func ParseAuthority(pair KeyPair) (*Authority, error)

ParseAuthority allows expired CAs so callers can recover their persisted state.

func (a *Authority) CheckIdentity(pair KeyPair, name string, usage x509.ExtKeyUsage) (time.Time, error)

CheckIdentity verifies persisted identity material even after its expiry.

func (a *Authority) CheckTransition(pair KeyPair, previousCA []byte, until time.Time) error

func (a *Authority) CrossSign(next *Authority, now, until time.Time) ([]byte, error)

CrossSign bridges old trust to the next CA only until the supplied deadline.

func (a *Authority) ExpiresAt() time.Time

func (a *Authority) Issue(dnsName string, usage x509.ExtKeyUsage, now time.Time, lifetime time.Duration) (KeyPair, error)

func (a *Authority) KeyPair() (KeyPair, error)

type KeyPair struct {
	Certificate []byte
	PrivateKey  []byte
}

KeyPair contains PEM data. Neither field belongs in logs or diagnostics.