Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FingerprintSHA256FromCertificate ¶
func FingerprintSHA256FromCertificate(cert *x509.Certificate) string
FingerprintSHA256FromCertificate returns the SHA-256 fingerprint of the certificate's raw DER (uppercase hex, no separators).
func InstallCAToSystemTrustStore ¶
InstallCAToSystemTrustStore installs the CA certificate into the system trust store
func InstallCAToTrustStore ¶
func InstallCAToTrustStore(certPath string, mode TrustInstallMode) error
InstallCAToTrustStore installs the CA certificate into user/system trust store based on mode. mode: - auto: macOS prefers user trust store then system; Windows tries user then system; Linux is equivalent to system - user: install only to the current user's trust store (macOS/Windows) - system: install only to the system trust store (macOS/Linux/Windows; typically requires admin privileges)
func IsCATrusted ¶
IsCATrusted checks if the CA certificate is trusted by the system
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA represents the Certificate Authority
func LoadOrGenerateCA ¶
LoadOrGenerateCA loads or generates a CA certificate
func (*CA) DerivePlaceholderKey ¶ added in v0.1.4
DerivePlaceholderKey derives a symmetric key (32 bytes) for deterministic placeholder generation.
This key is used to generate stable placeholder tokens in "deterministic placeholders" mode. To avoid reusing the same key for other purposes (WAL/config encryption), this performs domain separation on top of DeriveStorageKey.
func (*CA) DeriveStorageKey ¶
DeriveStorageKey derives a symmetric key (32 bytes) for local "at-rest encryption".
Example uses: - session mapping WAL - encrypting sensitive pattern values (keywords) in the config file at rest
Note: - the key is derived from the CA private key; if the CA private key is regenerated/lost, old data can no longer be decrypted.
func (*CA) GetCertificate ¶
GetCertificate returns the CA certificate as PEM bytes
func (*CA) GetTLSCertificate ¶
func (ca *CA) GetTLSCertificate() (tls.Certificate, error)
GetTLSCertificate returns a tls.Certificate for the CA
type LeafCertManager ¶
type LeafCertManager struct {
// contains filtered or unexported fields
}
LeafCertManager manages per-host leaf certificate generation and caching
func NewLeafCertManager ¶
func NewLeafCertManager(ca *CA) *LeafCertManager
NewLeafCertManager creates a new leaf certificate manager
func (*LeafCertManager) ClearCache ¶
func (m *LeafCertManager) ClearCache()
ClearCache clears all cached leaf certificates
func (*LeafCertManager) GetCertificate ¶
func (m *LeafCertManager) GetCertificate(host string) (*tls.Certificate, error)
GetCertificate returns a TLS certificate for the given host
type TrustInstallMode ¶
type TrustInstallMode string
const ( TrustInstallModeAuto TrustInstallMode = "auto" TrustInstallModeUser TrustInstallMode = "user" TrustInstallModeSystem TrustInstallMode = "system" )
Source Files