The highest tagged major version is
Documentation
¶
Index ¶
- func Blocks2Certs(blocks []*pem.Block) ([]*x509.Certificate, error)
- func ParseCsrPem(csrPem []byte) (*x509.CertificateRequest, error)
- func PemChain2Blocks(pemBuff string) ([]*pem.Block, error)
- func RawToPem(raw []byte) ([]byte, error)
- func VerifyLeafCertChain(roots *x509.CertPool, certs []*x509.Certificate) (*x509.Certificate, error)
- type CertPem
- type ClientSigner
- type DefaultSerialGenerator
- type FingerprintGenerator
- type Fingerprints
- type SerialGenerator
- type ServerSigner
- type SignFunc
- type Signer
- type SigningOpts
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Blocks2Certs ¶
func Blocks2Certs(blocks []*pem.Block) ([]*x509.Certificate, error)
func ParseCsrPem ¶
func ParseCsrPem(csrPem []byte) (*x509.CertificateRequest, error)
func VerifyLeafCertChain ¶ added in v1.6.18
func VerifyLeafCertChain(roots *x509.CertPool, certs []*x509.Certificate) (*x509.Certificate, error)
VerifyLeafCertChain verifies that the presented leaf certificate (certs[0]) chains to a trusted certificate in the given pool, and returns that verified leaf. Only certs[0] is verified: it is the certificate whose private key the TLS handshake proved the peer holds, and it is the certificate a caller derives peer identity from. Any remaining certs[1:] are treated only as candidate intermediates supplied by the peer, never as independent grounds for acceptance - so a peer cannot be admitted by presenting its own leaf alongside some other certificate that happens to chain.
roots is the verifying node's full trusted-CA pool (identity.CA()). Every certificate in it is a valid chain terminus, whether a self-signed root or an intermediate distributed as a trust anchor, matching how the node's TLS configuration establishes trust. No extended-key-usage restriction is applied: certificates issued by an external PKI with arbitrary or absent EKUs are accepted as long as the leaf chains to a trusted CA.
Types ¶
type CertPem ¶
type CertPem struct {
Cert *x509.Certificate
Pem []byte
}
type ClientSigner ¶
type ClientSigner struct {
SerialGenerator SerialGenerator
// contains filtered or unexported fields
}
func NewClientSigner ¶
func NewClientSigner(caCert *x509.Certificate, caKey crypto.PrivateKey) *ClientSigner
func (*ClientSigner) Cert ¶
func (s *ClientSigner) Cert() *x509.Certificate
func (*ClientSigner) SignCsr ¶
func (s *ClientSigner) SignCsr(csr *x509.CertificateRequest, opts *SigningOpts) ([]byte, error)
func (*ClientSigner) Signer ¶
func (s *ClientSigner) Signer() crypto.Signer
func (*ClientSigner) SigningCert ¶
func (s *ClientSigner) SigningCert() *x509.Certificate
type DefaultSerialGenerator ¶
type DefaultSerialGenerator struct{}
func (DefaultSerialGenerator) Generate ¶
func (DefaultSerialGenerator) Generate() *big.Int
type FingerprintGenerator ¶
type FingerprintGenerator interface {
FromCert(cert *x509.Certificate) string
FromCerts(certs []*x509.Certificate) Fingerprints
FromRaw(raw []byte) string
FromPem(pem []byte) string
}
func NewFingerprintGenerator ¶
func NewFingerprintGenerator() FingerprintGenerator
type Fingerprints ¶
type Fingerprints map[string]*x509.Certificate
func (Fingerprints) Contains ¶
func (fingerprints Fingerprints) Contains(fp string) bool
func (Fingerprints) Prints ¶
func (fingerprints Fingerprints) Prints() []string
type SerialGenerator ¶
type ServerSigner ¶
type ServerSigner struct {
SerialGenerator SerialGenerator
// contains filtered or unexported fields
}
func NewServerSigner ¶
func NewServerSigner(caCert *x509.Certificate, caKey crypto.PrivateKey) *ServerSigner
func (*ServerSigner) Cert ¶
func (s *ServerSigner) Cert() *x509.Certificate
func (*ServerSigner) SignCsr ¶
func (s *ServerSigner) SignCsr(csr *x509.CertificateRequest, opts *SigningOpts) ([]byte, error)
func (*ServerSigner) Signer ¶
func (s *ServerSigner) Signer() crypto.Signer
func (*ServerSigner) SigningCert ¶
func (s *ServerSigner) SigningCert() *x509.Certificate
type Signer ¶
type Signer interface {
SignCsr(*x509.CertificateRequest, *SigningOpts) ([]byte, error)
SigningCert() *x509.Certificate
Cert() *x509.Certificate
Signer() crypto.Signer
}
Source Files