tlsconfig

package
v1.13.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 23, 2026 License: MIT Imports: 18 Imported by: 7

Documentation

Index

Constants

View Source 
const (
	// CertMaxPermissions is the maximum permissions allowed for the certificate file.
	CertMaxPermissions = 0644

	// KeyMaxPermissions is the maximum permissions allowed for the key file.
	KeyMaxPermissions = 0600

	// DefaultExpirationWarnTime is the default advanced warning to give for expiring certificates.
	DefaultExpirationWarnTime = 5 * (24 * time.Hour)

	// DefaultCertificateCheckTime is the default duration between certificate checks.
	DefaultCertificateCheckTime = time.Hour
)
View Source 
const (
	DefaultTriggerDelay = 5 * time.Second
)

Variables

View Source 
var (
	ErrCertificateNil            = errors.New("TLS certificate is nil")
	ErrCertificateEmpty          = errors.New("TLS certificate is empty")
	ErrCertificateInvalid        = errors.New("TLS certificate is invalid")
	ErrCertificateNotServerAuth  = errors.New("TLS certificate does not permit server authentication")
	ErrCertificateRequestInfoNil = errors.New("CertificateRequestInfo is nil")
	ErrLoadedCertificateInvalid  = errors.New("LoadedCertificate is invalid")
	ErrNoCertificateMonitor      = errors.New("no certificate monitor")
	ErrPathEmpty                 = errors.New("empty path")
	ErrSingleRoleRequired        = errors.New("single role required (Server or Client)")
)
View Source 
var (
	// ErrConfigureDisabledManager is returned when an attempt is made to reconfigure
	// a disabled config manager.
	ErrConfigureDisabledManager = errors.New("cannot configure disabled TLS manager")

	// ErrClientListen is returned when attempt is made to have a client role manager
	// create a listener.
	ErrClientListen = errors.New("client TLS manager cannot Listen")

	// ErrNoCertLoader indicates that an operation requiring a TLSCertLoader did not have one available.
	// This can happen if the TLSConfigManager was created without a certificate for client-side use only.
	ErrNoCertLoader = errors.New("no TLSCertLoader available")

	// ErrNoRole indicates that a configuration manager or other object was not initialized
	// with a valid Role. It is generally due to a misuse of an internal API.
	ErrNoRole = errors.New("no role specified for TLS certificate")

	// ErrNoTLSConfig indicates that a TLS connection was attempted against a manager
	// that has no TLS configuration to serve it.
	ErrNoTLSConfig = errors.New("no TLS configuration available")

	// ErrCertificateNotClientAuth indicates a certificate a client would present does
	// not permit client authentication.
	ErrCertificateNotClientAuth = errors.New("TLS certificate does not permit client authentication")

	// ErrNotSupportedServer indicates that an operation is not supported by a server role
	// config manager.
	ErrNotSupportedServer = errors.New("operation not supported by server role TLS manager")

	// ErrServerDial is returned when attempt is made to have a server role manager
	// dial a connection.
	ErrServerDial = errors.New("server TLS manager cannot Dial / DialWithDialer")
)
View Source 
var ErrCATrustsNothing = errors.New("trusts no certificates: set paths or enable include-system")

ErrCATrustsNothing is returned by resolveCA when a configured CA pool would trust no certificates. Callers wrap it with root/client context.

Functions

This section is empty.

Types

type CAConfig added in v1.13.0 

type CAConfig struct {
	// Paths are the PEM files whose certificates are added to the pool.
	Paths []string `toml:"paths"`

	// IncludeSystem includes the host's system CA pool in addition to Paths.
	IncludeSystem bool `toml:"include-system"`
}

CAConfig configures a CA certificate pool: the PEM files to trust and whether to also include the host's system CA pool. It is used for both root CAs (verifying peer server certificates) and client CAs (verifying client certificates during client authentication).

It is designed to be embedded in configuration structs as a *CAConfig so that "not configured" is distinguishable from "configured": a nil pointer leaves the base TLS config's pool in place (for root CAs, that means Go's implicit system roots), while a non-nil value is used exactly as given. In particular, a non-nil config with Paths but without IncludeSystem trusts only those paths, because IncludeSystem's zero value is the correct default once the user has configured a pool.

type Config 

type Config struct {
	Ciphers    []string `toml:"ciphers"`
	MinVersion string   `toml:"min-version"`
	MaxVersion string   `toml:"max-version"`
}

func NewConfig 

func NewConfig() Config

func (Config) Parse 

func (c Config) Parse() (out *tls.Config, err error)

func (Config) Validate 

func (c Config) Validate() error

type LoadCertificateOpt added in v1.12.3 

type LoadCertificateOpt func(*loadCertificateConfig)

LoadCertificateOpt are functions to change the behavior of LoadCertificate.

func WithLoadCertificateIgnoreFilePermissions added in v1.12.3 

func WithLoadCertificateIgnoreFilePermissions(ignore bool) LoadCertificateOpt

WithLoadCertificateIgnoreFilePermissions instructs LoadCertificate to ignore file permissions if ignore is true.

type LoadedCertificate added in v1.12.3 

type LoadedCertificate struct {

	// CertPath is the path the certificate was loaded from.
	CertificatePath string

	// KeyPath is the path the private key was loaded from.
	KeyPath string

	// Certificate is the certificate that was loaded.
	Certificate *tls.Certificate

	// Leaf is the parsed x509 certificate of Certificate's leaf certificate.
	Leaf *x509.Certificate
	// contains filtered or unexported fields
}

LoadedCertificate encapsulates information about a loaded certificate.

func LoadCertificate added in v1.12.3 

func LoadCertificate(certPath, keyPath string, opts ...LoadCertificateOpt) (LoadedCertificate, error)

LoadCertificate loads a key pair from certPath and keyPath, performing several checks along the way. If any checks fail or an error occurs loading the files, then an error is returned. If keyPath is empty, then certPath is assumed to contain both the certificate and the private key. Only trusted input (standard configuration files) should be used for certPath and keyPath.

func (*LoadedCertificate) GetLeaf added in v1.13.0 

func (lc *LoadedCertificate) GetLeaf() (*X509Certificate, error)

GetLeaf returns the loaded leaf certificate, wrapped as a X509Certificate.

func (LoadedCertificate) IsEmpty added in v1.13.0 

func (lc LoadedCertificate) IsEmpty() bool

func (LoadedCertificate) IsValid added in v1.12.3 

func (lc LoadedCertificate) IsValid() bool

func (LoadedCertificate) Serial added in v1.13.0 

func (lc LoadedCertificate) Serial() string

func (LoadedCertificate) WithLogContext added in v1.13.0 

func (lc LoadedCertificate) WithLogContext(log *zap.Logger) *zap.Logger

WithLogContext adds context about lc to log and returns the new logger.

type Role added in v1.13.0 

type Role int

Role is an enum that specifies how a config manager or cert loader will be used. 

const (
	// InvalidRole is an invalid role. It is the zero value so IsValid can be used
	// to determine if a role was properly initialized.
	InvalidRole Role = iota

	// ServerOnlyRole specifies that a config manager or certificate is only for
	// server use through Listen.
	ServerOnlyRole

	// ClientOnlyRole specifies that a config manager or certificate is only for
	// client use through Dial.
	ClientOnlyRole

	// ServerAndClientRole specifies that a config manager or certificate is for
	// use for both a server (through Listen) and a client (through Dial).
	ServerAndClientRole
)

func (Role) IsClientRole added in v1.13.0 

func (r Role) IsClientRole() bool

IsClientRole returns true if role specifies a client role.

func (Role) IsServerRole added in v1.13.0 

func (r Role) IsServerRole() bool

IsServerRole returns true if role specifies a server role.

func (Role) IsSingleRole added in v1.13.0 

func (r Role) IsSingleRole() bool

IsSingleRole returns true if role specifies a single role, Server or Client. This is used to check for valid values in places where only a single role is accepted.

func (Role) IsValid added in v1.13.0 

func (r Role) IsValid() bool

IsValid returns true if r is valid. It can be used to determine if r was initialized properly.

type TLSCertLoader added in v1.12.3 

type TLSCertLoader struct {
	// contains filtered or unexported fields
}

TLSCertLoader handles loading TLS certificates, providing them to a tls.Config, and monitoring the certificate for expiration.

func NewTLSCertLoader added in v1.12.3 

func NewTLSCertLoader(role Role, monitor *TLSCertMonitor, opts ...TLSCertLoaderOpt) (rCertLoader *TLSCertLoader, rErr error)

NewTLSCertLoader creates a TLSCertLoader loaded with the certificate found in certPath and keyPath. Only trusted input (standard configuration files) should be used for certPath and keyPath. If the certificate cannot be loaded, an error is returned. On success, a monitor is setup to periodically check the certificate for expiration.

func (*TLSCertLoader) Certificate added in v1.12.3 

func (cl *TLSCertLoader) Certificate() *tls.Certificate

Certificate returns the currently loaded certificate, which may be nil.

func (*TLSCertLoader) Clear added in v1.13.0 

func (cl *TLSCertLoader) Clear()

Clear clears the loaded certificate.

func (*TLSCertLoader) Close added in v1.12.3 

func (cl *TLSCertLoader) Close() error

Close shuts down the goroutine monitoring certificate expiration. Even after the monitoring goroutine is shutdown, Load and GetCertificate will continue to work normally.

func (*TLSCertLoader) GetCertificate added in v1.12.3 

func (cl *TLSCertLoader) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate is for use with a tls.Config's GetCertificate member. This allows a tls.Config to dynamically update its certificate when Load changes the active certificate.

func (*TLSCertLoader) GetClientCertificate added in v1.12.3 

func (cl *TLSCertLoader) GetClientCertificate(cri *tls.CertificateRequestInfo) (*tls.Certificate, error)

GetClientCertificate is for use with a tls.Config's GetClientCertificate member. This allows a tls.Config to dynamically update its client certificates when Load changes the active certificate.

func (*TLSCertLoader) Leaf added in v1.12.3 

func (cl *TLSCertLoader) Leaf() *x509.Certificate

Leaf returns the parsed x509 certificate of the currently loaded certificate. If no certificate is loaded then nil is returned.

func (*TLSCertLoader) Load added in v1.12.3 

func (cl *TLSCertLoader) Load(certPath, keyPath string) error

Load loads the certificate at the given certificate path and private keyfile path. Only trusted input (standard configuration files) should be used for certPath and keyPath.

func (*TLSCertLoader) LoadedCertificate added in v1.13.0 

func (cl *TLSCertLoader) LoadedCertificate() LoadedCertificate

LoadedCertificate returns the currently loaded certificate, which may be invalid or empty.

func (*TLSCertLoader) Paths added in v1.12.3 

func (cl *TLSCertLoader) Paths() (certPath, keyPath string)

Paths returns the path of the currently loaded certificate and private key. The keyPath will be the file containing the private key, even if no keyPath was provided to NewTLSCertLoader / Load.

func (*TLSCertLoader) PrepareLoad added in v1.12.3 

func (cl *TLSCertLoader) PrepareLoad(opts ...TLSCertLoaderOpt) (func() error, error)

PrepareLoad verifies that the certificate at certPath and keyPath will load without error. If the certificate can be loaded, a function that will apply the certificate reload is returned. Otherwise, an error is returned.

func (*TLSCertLoader) SetupTLSConfig added in v1.12.3 

func (cl *TLSCertLoader) SetupTLSConfig(tlsConfig *tls.Config)

SetupTLSConfig modifies tlsConfig to use cl for server and client certificates. tlsConfig may be nil. If other fields like tlsConfig.Certificates or tlsConfig.NameToCertificate have been set, then cl's certificate may not be used as expected.

func (*TLSCertLoader) Usage added in v1.13.0 

func (cl *TLSCertLoader) Usage() string

Usage is the descriptive usage set using WithCertLoaderUsage.

type TLSCertLoaderOpt added in v1.12.3 

type TLSCertLoaderOpt func(*tlsCertLoaderConfig)

TLSCertLoaderOpt is a function to configure a TLSCertLoader.

func WithCertLoaderCertificate added in v1.13.0 

func WithCertLoaderCertificate(certPath string, keyPath string) TLSCertLoaderOpt

WithCertLoaderCertificate sets the certificate and key for the cert loader to load.

func WithCertLoaderIgnoreFilePermissions added in v1.12.3 

func WithCertLoaderIgnoreFilePermissions(ignore bool) TLSCertLoaderOpt

WithCertLoaderIgnoreFilePermissions skips file permission checking when loading certificates.

func WithCertLoaderIgnoreSanityChecks added in v1.13.0 

func WithCertLoaderIgnoreSanityChecks(ignore bool) TLSCertLoaderOpt

WithCertLoaderIgnoreSanityChecks logs failed certificate sanity checks and loads the certificate anyway, instead of failing the load. It is an escape hatch for a certificate this package judges unusable but a deployment relies on; it does not relax the checks that a certificate be present and parseable, which are faults rather than judgments.

func WithCertLoaderLogger added in v1.12.3 

func WithCertLoaderLogger(logger *zap.Logger) TLSCertLoaderOpt

WithCertLoaderLogger assigns a logger to use. It only takes effect when given to NewTLSCertLoader; a loader keeps its original logger through a PrepareLoad.

func WithCertLoaderUsage added in v1.13.0 

func WithCertLoaderUsage(usage string) TLSCertLoaderOpt

WithCertLoaderUsage assigns the descriptive usage of the cert loader.

type TLSCertMonitor added in v1.13.0 

type TLSCertMonitor struct {
	// contains filtered or unexported fields
}

TLSCertMonitor implements periodic certificate monitoring. 

It avoids logging about a single certificate / key pair

multiple times, as well as the number of goroutines required to monitor certificates. There should be a single TLSCertMonitor in an application that is shared amongst all TLSConfigManager objects.

func NewTLSCertMonitor added in v1.13.0 

func NewTLSCertMonitor(opts ...TLSCertMonitorOpt) *TLSCertMonitor

NewTLSCertMonitor creates a new TLSCertMonitor and starts its worker goroutine.

func (*TLSCertMonitor) Close added in v1.13.0 

func (m *TLSCertMonitor) Close() error

Close stops the certificate monitor background routine. After calling this, certificates will no longer be monitored. It is safe to call multiple times, but it will only stop the monitor goroutine once.

func (*TLSCertMonitor) Open added in v1.13.0 

func (m *TLSCertMonitor) Open() error

Open starts the certificate monitor background goroutine. The certificate monitor won't do anything until this is called. It is safe to call multiple times, but it will only start one monitor goroutine.

func (*TLSCertMonitor) QueueWarnIssues added in v1.13.0 

func (m *TLSCertMonitor) QueueWarnIssues(cl *TLSCertLoader)

QueueWarnIssues allows a TLSCertLoader to queue itself for issue warning. When the warn issues trigger occurs, all queued certificate loggers will have their issues logged. This also sets / resets the delayed trigger timer so that when a reload occurs issue warning won't occur until have certificates have been reloaded.

func (*TLSCertMonitor) SetCheckInterval added in v1.13.0 

func (m *TLSCertMonitor) SetCheckInterval(checkInterval time.Duration)

func (*TLSCertMonitor) SetExpirationAdvanced added in v1.13.0 

func (m *TLSCertMonitor) SetExpirationAdvanced(expirationAdvanced time.Duration)

func (*TLSCertMonitor) SetLogger added in v1.13.0 

func (m *TLSCertMonitor) SetLogger(log *zap.Logger)

func (*TLSCertMonitor) SetTriggerDelay added in v1.13.0 

func (m *TLSCertMonitor) SetTriggerDelay(d time.Duration)

SetTriggerDelay sets the trigger delay interval to d.

func (*TLSCertMonitor) WaitForMonitorStart added in v1.13.0 

func (m *TLSCertMonitor) WaitForMonitorStart()

WaitForMonitorStart will wait for the certificate monitor goroutine to start. This is mainly useful for tests to avoid race conditions.

func (*TLSCertMonitor) WaitForMonitorStop added in v1.13.0 

func (m *TLSCertMonitor) WaitForMonitorStop()

WaitForMonitorStop waits for the certificate monitor goroutine to stop. This is mainly useful for tests to avoid race conditions. This will block forever if Open is not called before Close.

type TLSCertMonitorOpt added in v1.13.0 

type TLSCertMonitorOpt func(*TLSCertMonitor)

TLSCertMonitorOpt is an option for NewTLSCertMonitor.

func WithMonitorCheckInterval added in v1.13.0 

func WithMonitorCheckInterval(d time.Duration) TLSCertMonitorOpt

WithMonitorCheckInterval sets the initial check interval for the monitor. It can be changed later with SetCheckInterval.

func WithMonitorExpirationAdvanced added in v1.13.0 

func WithMonitorExpirationAdvanced(d time.Duration) TLSCertMonitorOpt

WithMonitorExpirationWarn sets the initial expiration warn time for the monitor. It can be changed later with SetExpirationAdvanced.

func WithMonitorLogger added in v1.13.0 

func WithMonitorLogger(log *zap.Logger) TLSCertMonitorOpt

WithMonitorLogger sets the logger for the monitor. It can be changed later with SetLogger.

func WithMonitorTriggerDelay added in v1.13.0 

func WithMonitorTriggerDelay(d time.Duration) TLSCertMonitorOpt

WithMonitorTriggerDelay sets the initial trigger delay interval. This 

can be changed later with SetTriggerDelay.

type TLSConfigManager added in v1.12.3 

type TLSConfigManager struct {
	// contains filtered or unexported fields
}

TLSConfigManager will manage a TLS configuration and make sure that only one instance of its tls.Config exists. Different TLSConfigManager objects will have different configurations, even if they are instantiated in exactly the same way.

func NewClientServerTLSConfigManager added in v1.13.0 

func NewClientServerTLSConfigManager(monitor *TLSCertMonitor, opts ...TLSConfigManagerOpt) (*TLSConfigManager, error)

NewClientServerTLSConfigManager creates a config manager that can be used for both client and server operations. See NewServerTLSConfig for further information on options.

func NewClientTLSConfigManager added in v1.12.3 

func NewClientTLSConfigManager(monitor *TLSCertMonitor, opts ...TLSConfigManagerOpt) (*TLSConfigManager, error)

NewClientTLSConfigManager creates a TLSConfigManager that can only be used for clients. See NewTLSConfigManager for further information on options.

func NewDisabledTLSConfigManager added in v1.12.3 

func NewDisabledTLSConfigManager() *TLSConfigManager

NewDisabledTLSConfigManager creates a TLSConfigManager that has TLS disabled. A disabled config manager cannot be reconfigured to enable TLS later. It is primarily useful for tests that do not require TLS.

func NewServerTLSConfigManager added in v1.13.0 

func NewServerTLSConfigManager(monitor *TLSCertMonitor, opts ...TLSConfigManagerOpt) (*TLSConfigManager, error)

NewServerTLSConfigManager returns a TLSConfigManager for a given set options for server-only use.

Previously, many options were required parameters to this function. They are still required, but given using With*() parameters. This has the advantage of allowing a single function to convert a TOML configuration to a slice of With* parameters for both construction and reconfiguration. It does make missing an option a run-time error instead of a compile-time error.

If WithUseTLS(true) is given, then WithServerCertificate must also be given.

All options given as direct positional parameters are required and cannot be changed after construction.

The returned TLSConfigManager can be used for server operations (e.g. Listen), but not for client operations (e.g. Dial).

func (*TLSConfigManager) Close added in v1.12.3 

func (cm *TLSConfigManager) Close() error

Close closes the underlying TLSCertLoader, if present. This is safe to call multiple times.

func (*TLSConfigManager) Dial added in v1.12.3 

func (cm *TLSConfigManager) Dial(network, address string) (net.Conn, error)

Dial a remote for network and addressing using the current configuration.

func (*TLSConfigManager) DialContext added in v1.13.0 

func (cm *TLSConfigManager) DialContext(ctx context.Context, network, address string) (net.Conn, error)

DialContext dials a remote for network and address using the current configuration, honoring ctx for cancellation.

The configuration is resolved on each call, so a manager reconfigured through PrepareReconfigure takes effect on the next connection without the caller rebuilding anything. This makes it suitable for an http.Transport's DialTLSContext, where a *tls.Config handed over once would otherwise freeze the settings in place.

No dial timeout is imposed: ctx is the only bound, matching Dial. Callers that need one should pass a ctx carrying it. Note that an http.Client.Timeout is delivered as a cancellation of ctx rather than as a ctx deadline, and is honored either way.

func (*TLSConfigManager) DialWithDialer added in v1.12.3 

func (cm *TLSConfigManager) DialWithDialer(dialer *net.Dialer, network, address string) (net.Conn, error)

Dial a remote for network and addressing using the given dialer and current configuration.

func (*TLSConfigManager) Listen added in v1.12.3 

func (cm *TLSConfigManager) Listen(network, address string) (net.Listener, error)

Return a net.Listener for network and address based on current configuration.

When TLS is enabled the listener resolves its configuration on each connection, so a manager reconfigured through PrepareReconfigure takes effect on the next connection without the listener being rebound. Connections that are already established keep the configuration they handshook with. Whether the listener is TLS at all is fixed here, when the socket is bound, which is why PrepareReconfigure refuses to change useTLS for a server.

func (*TLSConfigManager) PrepareReconfigure added in v1.13.0 

func (cm *TLSConfigManager) PrepareReconfigure(opts ...TLSConfigManagerOpt) (func() error, error)

PrepareReconfigure creates an apply function for a new configuration of the configuration manager.

func (*TLSConfigManager) TLSConfig added in v1.12.3 

func (cm *TLSConfigManager) TLSConfig() *tls.Config

TLSConfig returns a tls.Config for use with dial and listen functions. When TLS is disabled the return is nil. The returned tls.Config is a clone and does not need to be cloned again.

func (*TLSConfigManager) UseTLS added in v1.12.3 

func (cm *TLSConfigManager) UseTLS() bool

UseTLS returns true if this TLSConfigManager is configured to use TLS. It is a convenience wrapper around TLSConfig.

type TLSConfigManagerOpt added in v1.12.3 

type TLSConfigManagerOpt func(*tlsConfigManagerConfig)

TLSConfigManagerOpt is an option for use with NewTLSConfigManager and related constructors.

func WithAllowInsecure added in v1.12.3 

func WithAllowInsecure(allowInsecure bool) TLSConfigManagerOpt

WithAllowInsecure sets if the config manager should allow insecure TLS.

func WithBaseConfig added in v1.12.3 

func WithBaseConfig(baseConfig *tls.Config) TLSConfigManagerOpt

WithBaseConfig sets the config manager's base *tls.Config.

func WithClientAuth added in v1.12.3 

func WithClientAuth(auth tls.ClientAuthType) TLSConfigManagerOpt

WithClientAuth specifies the type of TLS client authentication a server should perform. When used, it overrides the base config's ClientAuth with auth, even if auth is the zero value (tls.NoClientCert).

func WithClientAuthPtr added in v1.13.0 

func WithClientAuthPtr(clientAuthPtr *tls.ClientAuthType) TLSConfigManagerOpt

WithClientAuthPtr specifies the type of TLS client authentication a server should perform, allowing "not configured" to be distinguished from an explicit value. When clientAuthPtr is nil the base config's ClientAuth is left in place; when it is non-nil the base config's ClientAuth is overridden with *clientAuthPtr, even if that is the zero value (tls.NoClientCert).

func WithClientCA added in v1.13.0 

func WithClientCA(cc *CAConfig) TLSConfigManagerOpt

WithClientCA configures the CA pool used to verify client certificates during client authentication. A nil config leaves the base config's client pool in place; a non-nil config is validated and built into a pool whether or not client authentication is enabled via WithClientAuth, and one that trusts no certificates is an error at construction. The pool is only actually used to verify clients when client authentication is enabled.

func WithClientCertificate added in v1.13.0 

func WithClientCertificate(certPath, keyPath string) TLSConfigManagerOpt

WithClientCertificate sets the config manager's client certificate and private key path. If no client certificate is set, then the server certificate will be used as a fallback.

func WithIgnoreFilePermissions added in v1.12.3 

func WithIgnoreFilePermissions(ignore bool) TLSConfigManagerOpt

WithIgnoreFilePermissions ignores file permissions when loading certificates.

func WithIgnoreSanityChecks added in v1.13.0 

func WithIgnoreSanityChecks(ignore bool) TLSConfigManagerOpt

WithIgnoreSanityChecks logs failed certificate sanity checks and loads the certificate anyway, instead of failing. It is an escape hatch for a certificate this package judges unusable but a deployment relies on. It does not relax the requirement that a server have a present, parseable certificate, which is a fault rather than a judgment.

func WithLogger added in v1.12.3 

func WithLogger(logger *zap.Logger) TLSConfigManagerOpt

WithLogger assigns a logger for to use.

func WithRootCA added in v1.13.0 

func WithRootCA(cc *CAConfig) TLSConfigManagerOpt

WithRootCA configures the CA pool used to verify peer (server) certificates. A nil config leaves the base config's roots in place (Go's implicit system pool). A non-nil config is used as-is; one that trusts no certificates is an error at construction unless insecure connections are allowed.

func WithServerCertificate added in v1.13.0 

func WithServerCertificate(certPath, keyPath string) TLSConfigManagerOpt

WithServerCertificate sets the config manager's server certificate and private key path. These will also be used as fallbacks for a client if no client certificate is configured.

func WithUsage added in v1.13.0 

func WithUsage(usage string) TLSConfigManagerOpt

WithUsage sets the config manager descriptive usage.

func WithUseTLS added in v1.12.3 

func WithUseTLS(useTLS bool) TLSConfigManagerOpt

WithUseTLS sets if the config manager should use TLS.

type X509Certificate added in v1.13.0 

type X509Certificate struct {
	*x509.Certificate
}

X509Certificate is a wrapper around an x509.Certificate that adds some extra utility methods.

func (*X509Certificate) ExpiresSoon added in v1.13.0 

func (xc *X509Certificate) ExpiresSoon(expirationAdvanced time.Duration) (bool, time.Duration)

certExpiresSoon determines if an x509 cert is about to expire, based on expirationAdvanced. It also returns how long until the cert expires if we are within the expiration warn window.

func (*X509Certificate) IsExpired added in v1.13.0 

func (xc *X509Certificate) IsExpired() bool

IsExpired determines if an x509 cert is expired. Returns if true if certificate is expired, false otherwise.

func (*X509Certificate) IsPremature added in v1.13.0 

func (xc *X509Certificate) IsPremature() bool

IsPremature determines if an x509 cert is premature (not valid yet). Returns true if certificate is premature, false otherwise.

func (*X509Certificate) SupportsClientAuth added in v1.13.0 

func (xc *X509Certificate) SupportsClientAuth() bool

SupportsClientAuth reports whether xc may be presented by a TLS client for client authentication. It only matters against a peer that verifies the certificates clients present; below tls.VerifyClientCertIfGiven the usages are never examined.

func (*X509Certificate) SupportsServerAuth added in v1.13.0 

func (xc *X509Certificate) SupportsServerAuth() bool

SupportsServerAuth reports whether xc may be presented by a TLS server.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.