Documentation
¶
Overview ¶
Package secrets resolves CA private key passwords from multiple sources.
Precedence chain (first non-empty wins):
- Per-CA env var: PKI_KEY_PASSWORD_<CA_NAME> (uppercase, hyphens→underscores) Example: PKI_KEY_PASSWORD_ISSUING for CA named "issuing"
- Global env var: PKI_KEY_PASSWORD (systemd LoadCredential injection)
- Secrets file: path from PKI_PASSWORD_FILE env var (format: "ca_name=password" per line)
- Config file value: the "password" field in ca.password JSON config
This allows deployments to keep passwords out of the JSON config file entirely, using systemd credentials or environment injection instead (Tier 1 security).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ResolveCAKeyPassword ¶
ResolveCAKeyPassword resolves the CA private key password using the precedence chain. caName is the logical CA name from config (e.g., "issuing", "root"). configPassword is the value from the JSON config's ca.password field (may be empty).
Types ¶
This section is empty.
Source Files
Click to show internal directories.
Click to hide internal directories.