certificate

type BasicConstraints struct {
	CA       bool `json:"ca"`
	PathLen  *int `json:"path_len,omitempty"`
	Critical bool `json:"critical"`
}

type Change struct {
	Field   string   `json:"field"`
	Changed bool     `json:"changed"`
	Old     string   `json:"old,omitempty"`
	New     string   `json:"new,omitempty"`
	Added   []string `json:"added,omitempty"`
	Removed []string `json:"removed,omitempty"`
}

type Extension struct {
	OID      string `json:"oid"`
	Name     string `json:"name,omitempty"`
	Critical bool   `json:"critical"`
	Known    bool   `json:"known"`
	Size     int    `json:"size"`
}

type Finding struct {
	ID          string `json:"id"`
	Severity    string `json:"severity"`
	Certificate string `json:"certificate"` // subject display name
	What        string `json:"what"`
	Why         string `json:"why"`
	Evidence    string `json:"evidence"`
	Reference   string `json:"reference,omitempty"`
}

type Fingerprints struct {
	SHA256     string `json:"sha256"`
	SHA1       string `json:"sha1"`
	SPKISHA256 string `json:"spki_sha256"`
}

type Info struct {
	Version            int                `json:"version"`
	Serial             string             `json:"serial"`
	Subject            Name               `json:"subject"`
	Issuer             Name               `json:"issuer"`
	SANs               SANs               `json:"sans"`
	Validity           Validity           `json:"validity"`
	PublicKey          keys.PublicKeyInfo `json:"public_key"`
	SignatureAlgorithm string             `json:"signature_algorithm"`
	SignatureStrength  string             `json:"signature_strength"`
	Fingerprints       Fingerprints       `json:"fingerprints"`
	SelfSigned         bool               `json:"self_signed"`
	IsCA               bool               `json:"is_ca"`
	BasicConstraints   *BasicConstraints  `json:"basic_constraints,omitempty"`
	KeyUsage           []string           `json:"key_usage,omitempty"`
	ExtKeyUsage        []string           `json:"extended_key_usage,omitempty"`
	SubjectKeyID       string             `json:"subject_key_id,omitempty"`
	AuthorityKeyID     string             `json:"authority_key_id,omitempty"`
	CRLDistribution    []string           `json:"crl_distribution_points,omitempty"`
	OCSPServers        []string           `json:"ocsp_servers,omitempty"`
	CAIssuers          []string           `json:"ca_issuers,omitempty"`
	Policies           []Policy           `json:"policies,omitempty"`
	NameConstraints    *NameConstraints   `json:"name_constraints,omitempty"`
	MustStaple         bool               `json:"must_staple"`
	SCTs               []SCT              `json:"scts,omitempty"`
	Extensions         []Extension        `json:"extensions"`
	DERSize            int                `json:"der_size"`
	Warnings           []string           `json:"warnings,omitempty"`
	PEM                string             `json:"pem,omitempty"`
}

type LintOptions struct {
	Now      time.Time
	Hostname string // check the leaf matches this name
	// Roots is used for trust checks when CheckTrust is set; nil = system roots.
	Roots      *x509.CertPool
	CheckTrust bool
}

type Name struct {
	DN                 string   `json:"dn"`
	CommonName         string   `json:"common_name,omitempty"`
	Organization       []string `json:"organization,omitempty"`
	OrganizationalUnit []string `json:"organizational_unit,omitempty"`
	Country            []string `json:"country,omitempty"`
	Province           []string `json:"province,omitempty"`
	Locality           []string `json:"locality,omitempty"`
}

type NameConstraints struct {
	Critical       bool     `json:"critical"`
	PermittedDNS   []string `json:"permitted_dns,omitempty"`
	ExcludedDNS    []string `json:"excluded_dns,omitempty"`
	PermittedIP    []string `json:"permitted_ip,omitempty"`
	ExcludedIP     []string `json:"excluded_ip,omitempty"`
	PermittedEmail []string `json:"permitted_email,omitempty"`
	ExcludedEmail  []string `json:"excluded_email,omitempty"`
	PermittedURI   []string `json:"permitted_uri,omitempty"`
	ExcludedURI    []string `json:"excluded_uri,omitempty"`
}

type Options struct {
	Now         time.Time // evaluation time; zero means time.Now()
	WarningDays int       // days before expiry that count as "expiring"; 0 means 30
	IncludePEM  bool
}

type Policy struct {
	OID  string `json:"oid"`
	Name string `json:"name,omitempty"`
}

type Profile string

type Request struct {
	Profile   Profile
	Subject   pkix.Name
	SANs      []string // DNS names, IPs, e-mail addresses and URIs, auto-detected
	NotBefore time.Time
	Validity  time.Duration
	// PathLen constrains CA path length; negative means unconstrained.
	PathLen int
	// Key is the subject key. PublicKey may be set instead when signing a CSR.
	Key       crypto.Signer
	PublicKey crypto.PublicKey
	// Issuer and IssuerKey sign the certificate; both nil means self-signed.
	Issuer    *x509.Certificate
	IssuerKey crypto.Signer
}

type SANs struct {
	DNS   []string `json:"dns"`
	IP    []string `json:"ip"`
	Email []string `json:"email"`
	URI   []string `json:"uri"`
}

type SCT struct {
	Version            int       `json:"version"`
	LogID              string    `json:"log_id"` // base64, as published in CT log lists
	Timestamp          time.Time `json:"timestamp"`
	HashAlgorithm      string    `json:"hash_algorithm"`
	SignatureAlgorithm string    `json:"signature_algorithm"`
}

type Validity struct {
	NotBefore     time.Time `json:"not_before"`
	NotAfter      time.Time `json:"not_after"`
	LifetimeDays  int       `json:"lifetime_days"`
	DaysRemaining int       `json:"days_remaining"`
	Status        string    `json:"status"` // valid, expiring, expired, not_yet_valid
}

type VerifyOptions struct {
	Roots         *x509.CertPool // nil: system roots
	Intermediates []*x509.Certificate
	Hostname      string
	Now           time.Time
	// KeyUsages defaults to any; TLS callers pass ServerAuth.
	KeyUsages []x509.ExtKeyUsage
}

type VerifyResult struct {
	Trusted bool `json:"trusted"`
	// Missing lists intermediates the verifier had to supply itself (for
	// example fetched via AIA by the macOS or Windows platform verifier):
	// the presented chain is incomplete even though validation succeeded.
	Missing []string `json:"missing_intermediates,omitempty"`
	Chain   []string `json:"chain,omitempty"` // subjects, leaf first, of the first verified chain
	Error   string   `json:"error,omitempty"`
	Reason  string   `json:"reason,omitempty"` // expired, unknown_authority, hostname_mismatch, invalid, ...
}