pki

type CAInfo struct {
	IsCA           bool   `json:"is_ca"`
	IsIntermediate bool   `json:"is_intermediate"`
	Subject        string `json:"subject"`
	NotBefore      string `json:"not_before"`
	NotAfter       string `json:"not_after"`
	NextSerial     int64  `json:"next_serial"`
	CRLNumber      int64  `json:"crl_number"`
	CertCount      int    `json:"cert_count"`
}

type CAState struct {
	IsCA           bool   `json:"is_ca"`
	IsIntermediate bool   `json:"is_intermediate"`
	NextSerial     int64  `json:"next_serial"`
	Subject        string `json:"subject"`
	NotBefore      string `json:"not_before"`
	NotAfter       string `json:"not_after"`
	CRLNumber      int64  `json:"crl_number"`
}

type IssueCertRequest struct {
	Subject        pkix.Name
	ValidityDays   int
	KeyUsages      x509.KeyUsage
	ExtKeyUsages   []x509.ExtKeyUsage
	DNSNames       []string
	IPAddresses    []net.IP
	EmailAddresses []string
}

type KeyStore interface {
	// GenerateKey creates a new signing key and returns an opaque identifier.
	// The caller must not assume anything about the key material — for HSM/KMS
	// backends the private key never leaves the hardware.
	GenerateKey() (keyID string, err error)

	// Signer returns a [crypto.Signer] for the key identified by keyID.
	// The returned Signer is used by x509.CreateCertificate and
	// x509.CreateRevocationList, which only need the Sign method and
	// Public() for embedding the public key in certificates.
	//
	// For software keys this wraps the *ecdsa.PrivateKey; for HSM/KMS
	// implementations it delegates signing to the external device.
	Signer(keyID string) (crypto.Signer, error)

	// ExportPEM returns the private key in PEM-encoded PKCS8 or SEC1 format.
	// HSM/KMS implementations may return ErrKeyNotExportable, or a reference
	// string (e.g. "PKCS11:<label>") that ImportPEM can later interpret.
	ExportPEM(keyID string) (string, error)

	// ImportPEM loads a PEM-encoded private key into the store and returns
	// its key ID. This is used when reading existing keys from vault storage.
	// HSM/KMS implementations may return ErrKeyNotExportable for real PEM data,
	// or interpret reference strings produced by their own ExportPEM.
	ImportPEM(pemData string) (keyID string, err error)

	// Delete removes the key identified by keyID from the store.
	// For software stores this is a no-op (vault manages lifecycle).
	// For HSM/KMS this might schedule key destruction.
	Delete(keyID string) error
}

type PKCS11Config struct {
	ModulePath string
	TokenLabel string
	PIN        string
	SlotNumber *int
}

type PKCS11KeyStore struct{}

type RevocationEntry struct {
	SerialNumber string `json:"serial_number"`
	RevokedAt    string `json:"revoked_at"`
	Reason       int    `json:"reason"`
	ItemID       string `json:"item_id"`
}

type SoftwareKeyStore struct {
	// contains filtered or unexported fields
}