transportsecurity

package

v0.8.1 Latest Latest Go to latest Published: Oct 29, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Package transportsecurity provides reloadable mutual TLS for HTTP connections.

This section is empty.

This section is empty.

This section is empty.

type Source struct {
	// contains filtered or unexported fields
}

Source reads tls.crt, tls.key, and ca.crt from one directory revision.

func NewSource(directory, peerName string) (*Source, error)

NewSource validates the initial revision. peerName is the required peer DNS SAN.

func (s *Source) ServerConfig() *tls.Config

ServerConfig permits anonymous probes; authenticated handlers must call VerifyClient.

func (s *Source) VerifyClient(state *tls.ConnectionState) error

VerifyClient checks current trust and identity even on an existing connection.

type Transport struct {
	// contains filtered or unexported fields
}

Transport replaces connection pools when identity or active trust changes.

func NewTransport(source *Source, base *http.Transport) *Transport

NewTransport copies base; callers retain ownership of the original transport.

func (t *Transport) CloseIdleConnections()

CloseIdleConnections closes the active pool without changing trust.

func (t *Transport) RoundTrip(request *http.Request) (*http.Response, error)

Path	Synopsis
issuance Package issuance creates identities and bounded CA transition certificates.	Package issuance creates identities and bounded CA transition certificates.
tlstest Package tlstest creates temporary certificate revisions for transport tests.	Package tlstest creates temporary certificate revisions for transport tests.