Documentation
¶
Overview ¶
Package trust holds the root certificates used to validate the TLS endpoints and certificates we monitor.
It exists because Go's own escape hatch is a trap for this use case: SSL_CERT_FILE *replaces* the system bundle rather than extending it, so pointing it at an internal root silently drops every public CA — and when the file cannot be read, crypto/x509 returns an empty pool with a nil error, so every check fails as "unknown authority" with nothing in the logs. Operators running an internal PKI need to add a root, not swap the whole store.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DialInspect ¶ added in v1.5.0
func DialInspect(ctx context.Context, addr, serverName string, timeout time.Duration) (tls.ConnectionState, error)
DialInspect opens a TLS connection that accepts any certificate, so a chain can be reported even when it is invalid, and returns its state. DialInspect completes a TLS handshake that accepts any certificate and returns the connection state, without sending a single application byte.
func Load ¶
Load reads a PEM bundle and appends it to the system roots. Any failure is returned rather than swallowed: a misconfigured CA path must stop the process, not degrade every TLS check into a confusing "unknown authority".
Types ¶
This section is empty.
Source Files