Documentation
¶
Overview ¶
Package securetls provides secure TLS configuration helpers that comply with Redpanda Transport Security Guidelines.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewConfig ¶
func NewConfig(level SecurityLevel) *tls.Config
NewConfig creates a *tls.Config that complies with Redpanda Transport Security Guidelines. It sets appropriate MinVersion and CipherSuites based on the security level.
Example usage:
// For internal Redpanda-to-Redpanda communication (strict security)
tlsConf := securetls.NewConfig(securetls.SecurityLevelStrict)
For external customer-facing services (normal for compatibility)
tlsConf := securetls.NewConfig(securetls.SecurityLevelNormal)
tlsConf.Certificates = []tls.Certificate{cert}
func WithInsecureSkipVerify ¶
func WithInsecureSkipVerify(level SecurityLevel) *tls.Config
WithInsecureSkipVerify returns a secure config with InsecureSkipVerify enabled. This should only be used in testing or when certificate verification is handled through other means.
WARNING: This disables certificate verification and should not be used in production without understanding the security implications.
Types ¶
type SecurityLevel ¶
type SecurityLevel string
SecurityLevel defines the TLS security level, which determines the appropriate cipher suites according to Redpanda Transport Security Guidelines.
const ( // SecurityLevelStrict is for internal Redpanda-to-Redpanda communication. // Uses TLS 1.3 only with a restricted set of cipher suites for maximum security. SecurityLevelStrict SecurityLevel = "strict" // SecurityLevelNormal is for external Redpanda-to-customer communication. // Uses TLS 1.2+ with a broader set of cipher suites for compatibility. SecurityLevelNormal SecurityLevel = "normal" )
Source Files