Documentation
¶
Overview ¶
Package certs manages on-disk CA material for Concord nodes.
Same UserConfigDir/concord layout as node config, under concord/certs/:
ca.crt - fleet trust anchor (operator-provided; required before start). ca.key - CA private key (operator-provided; used only to sign node parcels).
Node identity lives in the Noise static key under concord/noise/, not here. Normal bootstrap never creates a CA. The operator supplies ca.crt and ca.key (factory, flash drive, etc.). Ensure only checks their presence. WriteCA is for provisioning tools, not the running node.
Dir() and DefaultPaths() expose the directory and fixed file names.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Dir ¶
Dir returns the auto-determined directory for Concord TLS material (~/.config/concord/certs). The directory is created if missing (mode 0700).
func SignNodeKey ¶
SignNodeKey binds a node ID and key generation to a Noise static public key by signing with the fleet CA private key from ca.key. A generation is the key rotation counter: 0 for a node's first static key, plus one on each rotation. The highest generation seen for a node wins, so a signature over one generation can never authorize another. The output is raw RSA signature bytes, not a certificate, and carries no timestamp or validity window. It is the node's membership credential for the Noise transport.
VerifyNodeKey checks the same binding against the CA public key. Both sides go through buildNodeKeyBinding so the signed bytes can never diverge.
func VerifyNodeKey ¶
func VerifyNodeKey( caCert *x509.Certificate, nodeID uuid.UUID, generation uint64, pub []byte, sig []byte, ) error
VerifyNodeKey checks that pub belongs to nodeID at generation under a fleet CA signature. The caCert argument is the parsed ca.crt, used only as a carrier for the CA RSA public key: never X.509 chain rules and never the certificate dates. A nil error means the key is a fleet member. Comparing generations across competing bindings is the caller's job, not this function's.
func WriteCA ¶
func WriteCA() error
WriteCA creates a new self-signed CA and writes ca.crt and ca.key to the default certs directory.
Not used on normal node bootstrap. Concord runtime never creates a CA: the operator (factory image, flash drive, offline tool) must place ca.crt and ca.key before Ensure runs. WriteCA is only for those provisioning tools and tests.
Overwrites existing CA files at those paths.
Types ¶
type Paths ¶
Paths holds the on-disk locations for CA material.
CA - PEM CA certificate (trust anchor). CAKey - PEM CA private key (signs node parcels; not used by transport).
func DefaultPaths ¶
DefaultPaths returns fixed paths for ca.crt and ca.key under Dir(). Callers cannot override them.
func Ensure ¶
Ensure returns the default CA paths for transport after checking the operator-provisioned CA material exists.
Policy: ca.crt and ca.key must already be on disk (factory, flash drive, etc.). No certificates are minted here; node identity lives in the Noise static key, not in node.crt. Normal node bootstrap never creates a CA: createCA/WriteCA are not on this path. WriteCA is only for offline provisioning tools and tests.
Source Files