Documentation
¶
Overview ¶
Package ca is pano's local certificate authority: it generates a root CA on first run, mints per-host leaf certificates on demand for TLS interception, and (on macOS) installs/uninstalls trust in the login keychain.
Index ¶
- Constants
- Variables
- type Authority
- func (a *Authority) CertFor(host string) (*tls.Certificate, error)
- func (a *Authority) CertPEM() []byte
- func (a *Authority) ExpiryWarning() string
- func (a *Authority) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
- func (a *Authority) NotAfter() time.Time
- func (a *Authority) Root() *x509.Certificate
- func (a *Authority) RotatedFrom() string
- func (a *Authority) Subject() string
- func (a *Authority) TLSConfig() *tls.Config
- func (a *Authority) TLSConfigForClient() *tls.Config
- type Options
- type TargetConn
- type TrustStatus
- type TrustStore
Constants ¶
const ( DefaultRootTTL = 2 * 365 * 24 * time.Hour // default root validity MaxRootTTL = 825 * 24 * time.Hour // hard cap (Apple's classic ceiling) DefaultLeafTTL = 30 * 24 * time.Hour MaxLeafTTL = 397 * 24 * time.Hour // Apple rejects longer TLS server certs // RenewWarning is how long before root expiry status output starts nagging. RenewWarning = 30 * 24 * time.Hour // SubjectPrefix starts every root CN pano has ever generated; the rest is // "<hostname>, <date>)" so rotated roots never collide in a trust store. SubjectPrefix = "pano Root CA (" )
Lifetimes. A leaked root key is only useful until the root expires, so the root is short-lived for a CA (two years, like a private dev CA, not the ten most MITM tools ship) and is regenerated automatically once it lapses.
Variables ¶
var ErrUnsupported = errors.New("ca: automatic trust install is not supported on this OS")
ErrUnsupported is returned when the OS trust store is not automated.
Functions ¶
This section is empty.
Types ¶
type Authority ¶
type Authority struct {
// contains filtered or unexported fields
}
Authority mints leaf certificates signed by a local root.
func Load ¶
Load opens the authority at the given paths, generating a root CA and leaf key if they do not exist. An expired root is replaced by a fresh one (see RotatedFrom). Key files must be mode 0600.
func (*Authority) CertFor ¶
func (a *Authority) CertFor(host string) (*tls.Certificate, error)
CertFor returns a certificate valid for host (DNS name or IP).
func (*Authority) ExpiryWarning ¶
ExpiryWarning returns a human sentence when the root is within RenewWarning of expiring (or has been rotated), else "". Front ends print it verbatim.
func (*Authority) GetCertificate ¶
func (a *Authority) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
GetCertificate implements tls.Config.GetCertificate.
func (*Authority) Root ¶
func (a *Authority) Root() *x509.Certificate
Root returns the parsed root certificate.
func (*Authority) RotatedFrom ¶
RotatedFrom returns the subject of the expired root this Load replaced, or "" when the root on disk was reused. A rotated root must be trusted again.
func (*Authority) TLSConfig ¶
TLSConfig returns a server config that mints certificates on demand and offers HTTP/2 and HTTP/1.1 via ALPN.
func (*Authority) TLSConfigForClient ¶
TLSConfigForClient returns a client config that trusts this authority, used when pano sends requests through its own proxy (replays).
type Options ¶
type Options struct {
CertFile, KeyFile, LeafKeyFile, CacheDir string
RootTTL time.Duration // default DefaultRootTTL, capped at MaxRootTTL
LeafTTL time.Duration // default DefaultLeafTTL, capped at MaxLeafTTL
MemCache int // default 4096
Organization string // default "pano"
}
Options tune the authority.
type TargetConn ¶
TargetConn is implemented by connections that know the CONNECT target, so a certificate can be chosen even when the ClientHello carries no SNI.
type TrustStatus ¶
type TrustStatus struct {
Supported bool `json:"supported"`
Installed bool `json:"installed"`
Detail string `json:"detail,omitempty"`
}
TrustStatus describes whether the root is trusted by the OS.
type TrustStore ¶
type TrustStore interface {
Install(ctx context.Context, certPath, subject string, system bool) error
Uninstall(ctx context.Context, certPath, subject string) error
Status(ctx context.Context, certPath, subject string) TrustStatus
// ManualInstructions returns human steps for platforms without automation.
ManualInstructions(certPath string) string
}
TrustStore installs the root into the operating system trust store.
func NewTrustStore ¶
func NewTrustStore() TrustStore
NewTrustStore returns a store that only prints instructions.
Source Files