Documentation
¶
Overview ¶
Package tlsconfig builds *tls.Config values for Fred's internal providerd <-> backend HTTP hop (ENG-103). Server configs optionally require a client certificate (mTLS) and optionally pin the client's identity (CN / DNS SAN) to an allowlist; client configs optionally trust a private CA and present a client certificate. Both pin MinVersion to TLS 1.3.
Certificates are read from files once, at call time; rotation requires a restart (hot-reload is tracked in ENG-294).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClientConfig ¶
func ClientConfig(caFile string, skipVerify bool, clientCertFile, clientKeyFile string) (*tls.Config, error)
ClientConfig builds a client-side *tls.Config. When caFile is non-empty it is used as the root CA set (otherwise the system roots apply). When both clientCertFile and clientKeyFile are non-empty, the pair is presented for mutual TLS; supplying only one of the two is an error. skipVerify disables server certificate verification (dev only).
func ServerConfig ¶
func ServerConfig(certFile, keyFile, clientCAFile string, allowedClientNames []string) (*tls.Config, error)
ServerConfig builds a server-side *tls.Config from a certificate/key pair.
When clientCAFile is non-empty, mutual TLS is enabled: the server requires and verifies a client certificate signed by that CA.
When allowedClientNames is non-empty (which requires clientCAFile), the server additionally pins the client's identity: the presented certificate's CommonName or one of its DNS SANs must appear in the list. This closes the gap that RequireAndVerifyClientCert only checks the chain, not *who* the client is — without it, any certificate signed by the CA would be accepted.
Types ¶
This section is empty.
Source Files