Documentation
¶
Overview ¶
Package fileca is the file-backed signing authority: a private key and a self-signed root certificate on local disk. It is the single Authority implementation shipped in v1 and is suitable for development and for small deployments where the control-plane host is itself the trust boundary. Backends that keep the key elsewhere implement the same ca.Authority interface; nothing outside this package depends on the files it keeps.
Index ¶
Constants ¶
const ( // KeyFile is the name of the root private key within the CA directory. KeyFile = "ca.key" // CertFile is the name of the root certificate within the CA directory. CertFile = "ca.crt" // DefaultRootTTL is the lifetime of a generated root. The root is // long-lived because rotating it means re-enrolling every workload; // the credentials it issues are short-lived (ADR-0016). DefaultRootTTL = 10 * 365 * 24 * time.Hour )
Variables ¶
var ErrExists = errors.New("fileca: directory already contains a certificate authority")
ErrExists is returned by Init when the directory already holds a CA.
var ErrNotFound = errors.New("fileca: no certificate authority in directory")
ErrNotFound is returned by Open when the directory holds no CA.
Functions ¶
This section is empty.
Types ¶
type Authority ¶
type Authority struct {
// contains filtered or unexported fields
}
Authority signs with a key held on local disk.
func Init ¶
func Init(dir string, opts InitOptions) (*Authority, error)
Init generates a new root key and self-signed certificate in dir, creating the directory with mode 0700 if needed. The key file is written with mode 0600. It refuses to overwrite an existing CA.
func (*Authority) IssueServerCertificate ¶
func (a *Authority) IssueServerCertificate(hosts []string, ttl time.Duration) (certPEM, keyPEM []byte, err error)
IssueServerCertificate issues a TLS server certificate for the control plane's own listener, signed by this root, so agents can verify the server with the same bundle they use for everything else. Hosts may be DNS names or IP addresses. The returned key is a fresh PKCS#8 key; the root key is never reused for a leaf.
func (*Authority) Sign ¶
func (a *Authority) Sign(_ context.Context, csrPEM []byte, id identity.WorkloadID, ttl time.Duration) ([]byte, error)
Sign implements ca.Authority. The CSR contributes its public key and nothing else; the certificate's subject and SANs come from LeafTemplate, which is built from the server-granted identity alone.
type InitOptions ¶
type InitOptions struct {
// CommonName of the root; informational only.
CommonName string
// TTL of the root certificate; DefaultRootTTL if zero.
TTL time.Duration
}
InitOptions control root generation.
Source Files