Documentation
¶
Overview ¶
Package ca is the signing boundary for workload credentials. It defines the Authority interface that enrollment and renewal sign through, and the two rules every implementation shares: a certificate signing request contributes only its public key, and identity is granted by the control plane, never requested by the enrollee (ADR-0016). Certificates carry identity only: one URI SAN with a control-plane-assigned UUID. Mutable attributes never enter a certificate.
The package also defines ServerIssuer, the separate contract for the agent gateway's own TLS server certificate. Authority is not extended to cover it: a server certificate names hosts, not a workload, and reissuing one for a new host list from the same root leaves every enrolled agent trusting the gateway.
The file-backed implementation lives in the fileca subpackage. Nothing outside that subpackage depends on how it stores its key.
Index ¶
Constants ¶
const BackdateNotBefore = 5 * time.Minute
BackdateNotBefore is how far into the past an issued certificate's validity starts. Hosts with a slightly slow clock would otherwise reject a freshly issued credential as not yet valid.
Variables ¶
var ErrBadCSR = errors.New("ca: invalid certificate signing request")
ErrBadCSR is wrapped by every CSR rejection so callers can map it to a client error without inspecting the message.
Functions ¶
func EncodeCertificatePEM ¶
EncodeCertificatePEM encodes DER certificate bytes as PEM.
func LeafTemplate ¶
func LeafTemplate(id identity.WorkloadID, now time.Time, ttl time.Duration) (*x509.Certificate, error)
LeafTemplate builds the certificate template for a workload credential. The template is constructed entirely from server-side values: the identity goes in exactly one URI SAN, the common name mirrors it for human readers and is never read for authorization, and no DNS, IP, or email SANs and no extra extensions are present. Implementations sign this template with the public key from PublicKeyFromCSR and change nothing else.
func NewSerial ¶
NewSerial is exported for implementations that build templates other than workload leaves (a server certificate for the listener, for example).
func PublicKeyFromCSR ¶
PublicKeyFromCSR parses a PEM-encoded PKCS#10 request and returns its public key and nothing else. The signature is checked so the enrollee has proven possession of the private key; the subject, requested SANs, and requested extensions are deliberately not returned. This function is the only way an Authority implementation should read a CSR: what it does not return cannot leak into a certificate.
Types ¶
type Authority ¶
type Authority interface {
// Sign issues a client certificate binding id to the public key in the
// CSR. Implementations MUST use only the CSR's public key: any subject,
// SANs, or extensions requested in the CSR are ignored. Identity is
// granted by the control plane, never requested by the enrollee.
Sign(ctx context.Context, csrPEM []byte, id identity.WorkloadID, ttl time.Duration) (certPEM []byte, err error)
// Bundle returns the PEM trust chain for verifying issued credentials.
Bundle(ctx context.Context) ([]byte, error)
}
Authority is the signing boundary for workload credentials. Enrollment and renewal are written against this interface so that a backend holding its key elsewhere (a secrets manager, a hardware module, a hosted signing service) replaces the file-backed default without touching enrollment logic (ADR-0016).
type ServerIssuer ¶ added in v0.5.0
type ServerIssuer interface {
// IssueServerCertificate returns a certificate for hosts (DNS names or
// IP addresses, each a SAN) valid for ttl, and its fresh private key,
// both PEM-encoded. The authority's own key is never reused for it.
IssueServerCertificate(ctx context.Context, hosts []string, ttl time.Duration) (certPEM, keyPEM []byte, err error)
}
ServerIssuer issues the TLS server certificate the agent gateway presents. It is separate from Authority, whose contract is enrollee credentials alone: a server certificate names hosts, not a workload, and is never issued through enrollment or renewal. The certificate is signed by the same root that Bundle returns, so agents verify the gateway with the bundle they already hold; issuing a new one for another host list leaves every enrolled agent trusting it.
Source Files
Directories