issuance

type CRLProfile struct {
	// contains filtered or unexported fields
}

type CRLProfileConfig struct {
	ValidityInterval config.Duration
	MaxBackdate      config.Duration

	// LintConfig is a path to a zlint config file, which can be used to control
	// the behavior of zlint's "customizable lints".
	LintConfig string
	// IgnoredLints is a list of lint names that we know will fail for this
	// profile, and which we know it is safe to ignore.
	IgnoredLints []string
}

type CRLRequest struct {
	Number *big.Int
	Shard  int64

	ThisUpdate time.Time

	Entries []x509.RevocationListEntry
}

type Certificate struct {
	*x509.Certificate
	// contains filtered or unexported fields
}

type HexMarshalableBytes []byte

type IssuanceRequest struct {
	// PublicKey is of type MarshalablePublicKey so we can log an IssuanceRequest as a JSON object.
	PublicKey    MarshalablePublicKey
	SubjectKeyId HexMarshalableBytes

	Serial HexMarshalableBytes

	NotBefore time.Time
	NotAfter  time.Time

	CommonName  string
	DNSNames    []string
	IPAddresses []net.IP

	IncludeCTPoison bool
	// contains filtered or unexported fields
}

type Issuer struct {
	// TODO(#7159): make Cert, Signer, and Linter private when all signing ops
	// are handled through this package (e.g. the CA doesn't need direct access
	// while signing CRLs anymore).
	Cert   *Certificate
	Signer crypto.Signer
	Linter *linter.Linter
	// contains filtered or unexported fields
}

type IssuerConfig struct {
	// Active determines if the issuer can be used to sign precertificates. All
	// issuers, regardless of this field, can be used to sign final certificates
	// (for which an issuance token is presented) and CRLs.
	// All Active issuers of a given key type (RSA or ECDSA) are part of a pool
	// and each precertificate will be issued randomly from a selected pool.
	// The selection of which pool depends on the precertificate's key algorithm.
	Active bool

	// Profiles is the list of profiles for which this issuer is willing to issue.
	// For the moment, this does nothing, and exists only for deployability.
	// TODO(#8390): Make this field required for active issuers.
	Profiles []string `validate:"omitempty,dive,alphanum,min=1,max=32"`

	IssuerURL  string `validate:"required,url"`
	CRLURLBase string `validate:"required,url,startswith=http://,endswith=/"`

	// TODO(#8177): Remove this.
	OCSPURL string `validate:"omitempty,url"`

	// Number of CRL shards. Must be positive, but can be 1 for no sharding.
	CRLShards int `validate:"required,min=1"`

	Location IssuerLoc
}

type IssuerLoc struct {
	// A file from which a private key will be read and parsed.
	File string `validate:"required_without_all=ConfigFile PKCS11"`
	// A file from which a pkcs11key.Config will be read and parsed, if File is not set.
	ConfigFile string `validate:"required_without_all=PKCS11 File"`
	// An in-memory pkcs11key.Config, which will be used if ConfigFile is not set.
	PKCS11 *pkcs11key.Config `validate:"required_without_all=ConfigFile File"`
	// A file from which a certificate will be read and parsed.
	CertFile string `validate:"required"`
	// Number of sessions to open with the HSM. For maximum performance,
	// this should be equal to the number of cores in the HSM. Defaults to 1.
	NumSessions int
}

type MarshalablePublicKey struct {
	crypto.PublicKey
}

type NameID int64

type PolicyConfig struct {
	OID string `validate:"required"`
}

type Profile struct {
	// contains filtered or unexported fields
}

type ProfileConfig struct {
	// AllowMustStaple, when false, causes all IssuanceRequests which specify the
	// OCSP Must Staple extension to be rejected.
	//
	// Deprecated: This has no effect, Must Staple is always omitted.
	// TODO(#8177): Remove this.
	AllowMustStaple bool

	// OmitCommonName causes the CN field to be excluded from the resulting
	// certificate, regardless of its inclusion in the IssuanceRequest.
	OmitCommonName bool
	// OmitKeyEncipherment causes the keyEncipherment bit to be omitted from the
	// Key Usage field of all certificates (instead of only from ECDSA certs).
	OmitKeyEncipherment bool
	// OmitClientAuth causes the id-kp-clientAuth OID (TLS Client Authentication)
	// to be omitted from the EKU extension.
	OmitClientAuth bool
	// OmitSKID causes the Subject Key Identifier extension to be omitted.
	OmitSKID bool
	// OmitOCSP causes the OCSP URI field to be omitted from the Authority
	// Information Access extension. This cannot be true unless
	// IncludeCRLDistributionPoints is also true, to ensure that every
	// certificate has at least one revocation mechanism included.
	//
	// Deprecated: This has no effect; OCSP is always omitted.
	// TODO(#8177): Remove this.
	OmitOCSP bool
	// IncludeCRLDistributionPoints causes the CRLDistributionPoints extension to
	// be added to all certificates issued by this profile.
	//
	// Deprecated: This has no effect; CRLDP is always included.
	// TODO(#8177): Remove this.
	IncludeCRLDistributionPoints bool

	MaxValidityPeriod   config.Duration
	MaxValidityBackdate config.Duration

	// LintConfig is a path to a zlint config file, which can be used to control
	// the behavior of zlint's "customizable lints".
	LintConfig string
	// IgnoredLints is a list of lint names that we know will fail for this
	// profile, and which we know it is safe to ignore.
	IgnoredLints []string
}