Documentation
¶
Overview ¶
Package pki provides certificate authority and certificate management utilities for the simplified Ploy server/node mTLS architecture.
Index ¶
Constants ¶
const ( // CAValidity is the default validity period for the CA certificate. CAValidity = 10 * 365 * 24 * time.Hour // 10 years // NodeCertValidity is the default validity period for node certificates. NodeCertValidity = 365 * 24 * time.Hour // 1 year // ServerCertValidity is the default validity period for server certificates. ServerCertValidity = 365 * 24 * time.Hour // 1 year )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CABundle ¶
type CABundle struct {
CertPEM string
KeyPEM string
Cert *x509.Certificate
Key *ecdsa.PrivateKey
}
CABundle represents a certificate authority bundle with both certificate and private key.
func GenerateCA ¶
GenerateCA creates a new certificate authority.
type IssuedCert ¶
type IssuedCert struct {
CertPEM string
KeyPEM string
Serial string
Fingerprint string
NotBefore time.Time
NotAfter time.Time
Cert *x509.Certificate
Key *ecdsa.PrivateKey
}
IssuedCert represents an issued certificate with metadata.
func GenerateNodeCSR ¶
func GenerateNodeCSR(nodeID, nodeIP string) (*IssuedCert, []byte, error)
GenerateNodeCSR generates a private key and CSR for a node. The nodeID is used in the certificate CN as "node:<nodeID>". The nodeIP is included in SANs along with the DNS name.
func IssueServerCert ¶
IssueServerCert issues a server certificate signed by the CA. It sets the subject CN to "ployd" and includes a "ployd.ploy" DNS SAN. The provided serverIP is also added to IP SANs for direct addressing.
func SignNodeCSR ¶
SignNodeCSR signs a node certificate signing request using the cluster CA. Returns the signed certificate with metadata for persistence.
Source Files