Documentation
¶
Overview ¶
Package ca is the signing boundary for workload credentials. It defines the Authority interface that enrollment and renewal sign through, and the two rules every implementation shares: a certificate signing request contributes only its public key, and identity is granted by the control plane, never requested by the enrollee (ADR-0016). Certificates carry identity only: one URI SAN with a control-plane-assigned UUID. Mutable attributes never enter a certificate.
The file-backed implementation lives in the fileca subpackage. Nothing outside that subpackage depends on how it stores its key.
Index ¶
Constants ¶
const BackdateNotBefore = 5 * time.Minute
BackdateNotBefore is how far into the past an issued certificate's validity starts. Hosts with a slightly slow clock would otherwise reject a freshly issued credential as not yet valid.
Variables ¶
var ErrBadCSR = errors.New("ca: invalid certificate signing request")
ErrBadCSR is wrapped by every CSR rejection so callers can map it to a client error without inspecting the message.
Functions ¶
func EncodeCertificatePEM ¶
EncodeCertificatePEM encodes DER certificate bytes as PEM.
func LeafTemplate ¶
func LeafTemplate(id identity.WorkloadID, now time.Time, ttl time.Duration) (*x509.Certificate, error)
LeafTemplate builds the certificate template for a workload credential. The template is constructed entirely from server-side values: the identity goes in exactly one URI SAN, the common name mirrors it for human readers and is never read for authorization, and no DNS, IP, or email SANs and no extra extensions are present. Implementations sign this template with the public key from PublicKeyFromCSR and change nothing else.
func NewSerial ¶
NewSerial is exported for implementations that build templates other than workload leaves (a server certificate for the listener, for example).
func PublicKeyFromCSR ¶
PublicKeyFromCSR parses a PEM-encoded PKCS#10 request and returns its public key and nothing else. The signature is checked so the enrollee has proven possession of the private key; the subject, requested SANs, and requested extensions are deliberately not returned. This function is the only way an Authority implementation should read a CSR: what it does not return cannot leak into a certificate.
Types ¶
type Authority ¶
type Authority interface {
// Sign issues a client certificate binding id to the public key in the
// CSR. Implementations MUST use only the CSR's public key: any subject,
// SANs, or extensions requested in the CSR are ignored. Identity is
// granted by the control plane, never requested by the enrollee.
Sign(ctx context.Context, csrPEM []byte, id identity.WorkloadID, ttl time.Duration) (certPEM []byte, err error)
// Bundle returns the PEM trust chain for verifying issued credentials.
Bundle(ctx context.Context) ([]byte, error)
}
Authority is the signing boundary for workload credentials. Enrollment and renewal are written against this interface so that a backend holding its key elsewhere (a secrets manager, a hardware module, a hosted signing service) replaces the file-backed default without touching enrollment logic (ADR-0016).
Source Files
Directories