Documentation
¶
Overview ¶
Package testtls issues certificate material for tests that need real TLS sockets: one authority, the identities it signs, and the unusable variants a verification test has to reject. Everything is generated in the running process and written into a caller-owned directory, so no key is checked in and no test depends on an external tool.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Authority ¶
type Authority struct {
Identity
// contains filtered or unexported fields
}
Authority signs identities and is the trust root its peers configure.
func NewAuthority ¶
NewAuthority creates a self-signed authority in dir. Its CertFile is the PEM file a peer names as its trust root.
func NewExpiredAuthority ¶
NewExpiredAuthority creates an authority whose own certificate has expired, for the checks that refuse a root no chain could be built on.
func (*Authority) ClientConfig ¶
ClientConfig verifies the peer against this authority. A nil identity sends no client certificate, which is what an unenrolled peer looks like.
type Identity ¶
type Identity struct {
CertFile, KeyFile string
CertPEM, KeyPEM []byte
Certificate tls.Certificate
}
Identity is one issued certificate with its private key, held in memory and written as the PEM files a daemon configuration names.
type Options ¶
type Options struct {
// Hosts are the DNS names and IP addresses the certificate carries.
Hosts []string
// Client and Server select the extended key usages. Neither selected is
// a server identity, which is what most fixtures need.
Client, Server bool
// NotBefore and NotAfter bound validity; zero spans an hour around now.
NotBefore, NotAfter time.Time
}
Options selects what an issued identity is usable for. The zero value is a server identity valid for an hour around now and carrying no name.
Source Files