devmtls

package
v0.3.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package devmtls holds the process-wide device mTLS client credential used to reach honey servers behind an mTLS gateway. The private key never lives here: signing is delegated to a registered Signer (on mobile, a callback into the Android Keystore over a gomobile reverse binding), so the key stays in the TEE while Go performs the TLS handshake.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Clear 

func Clear()

Clear removes the registration (e.g. on logout / re-enroll).

func ClientTLSConfig 

func ClientTLSConfig(serverCAPEM string) (*tls.Config, error)

ClientTLSConfig builds an mTLS client config from the registered credential. serverCAPEM, when non-empty, overrides the registered CA for trusting the gateway server certificate; empty falls back to the registered CA (else the system roots).

func Registered 

func Registered() bool

Registered reports whether a usable device mTLS credential is available.

func Set 

func Set(chainPEM, caPEM []byte, s Signer)

Set registers the device client-cert chain (PEM), the default gateway server CA (PEM, may be empty), and the signer. Replaces any prior registration.

Types

type Signer 

type Signer interface {
	Sign(digest []byte) ([]byte, error)
}

Signer signs a (already-hashed) digest with the device private key, returning an ASN.1 DER ECDSA signature. Implemented off-process (e.g. Android Keystore "NONEwithECDSA"); the key is never exported.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.