Documentation
¶
Overview ¶
Package mtls secures the link between the web (frontend) and api (backend) processes with mutual TLS: the backend only talks to a client that presents a certificate from the configured CA, and the frontend only talks to a backend that presents one. It sits next to the shared service secret, which stays required, so that either one failing does not open the link.
Certificates are read from files and picked up again when the files change, so rotating one needs no restart. The package uses only the standard library.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ClientConfig ¶
ClientConfig is the TLS configuration of the frontend's calls: it only trusts a backend with a certificate from the CA in caFile, and presents certFile as its own. serverName, if not empty, is the name the backend's certificate must carry (otherwise the host of the URL).
Types ¶
type Bundle ¶
type Bundle struct {
CA string
ServerCert string
ServerKey string
ClientCert string
ClientKey string
}
Bundle is a CA with a certificate for the backend (server) and one for the frontend (client), in PEM. The CA's private key is not kept: nothing else is meant to be issued from it.
func Generate ¶
Generate makes a bundle. serverNames are the names and addresses the frontend uses to reach the backend (host names and IP addresses, such as "api" or "10.0.0.5"); "localhost" is always added.
func GenerateFor ¶
GenerateFor is Generate for any link between two processes: serverCN and clientCN only label the two certificates (nothing checks them; the CA and the server names are what is verified). Every link should have a CA of its own, so that a certificate of one link opens nothing of another.
func GenerateValid ¶
func GenerateValid(serverNames []string, serverCN, clientCN string, validity time.Duration) (Bundle, error)
GenerateValid is GenerateFor with the validity of the two certificates (the CA's is always ten years: its key is thrown away, so it cannot issue anything else). A deployment that makes a new set at every start can use a short one.
Source Files