tlsgen

type CA interface {
	// CertBytes returns the certificate of the CA in PEM encoding
	CertBytes() []byte

	NewIntermediateCA() (CA, error)

	// newCertKeyPair returns a certificate and private key pair and nil,
	// or nil, error in case of failure
	// The certificate is signed by the CA and is used for TLS client authentication
	NewClientCertKeyPair() (*CertKeyPair, error)

	// NewServerCertKeyPair returns a CertKeyPair and nil,
	// with a given custom SAN.
	// The certificate is signed by the CA.
	// Returns nil, error in case of failure
	NewServerCertKeyPair(hosts ...string) (*CertKeyPair, error)

	// Signer returns a crypto.Signer that signs with the CA's private key.
	Signer() crypto.Signer
}

type CertKeyPair struct {
	// Cert is the certificate, PEM encoded
	Cert []byte
	// Key is the key corresponding to the certificate, PEM encoded
	Key []byte

	crypto.Signer
	TLSCert *x509.Certificate
}