Documentation
¶
Overview ¶
Package mitm provides a self-signed certificate authority used by the ingest proxy to intercept TLS connections. The CA is generated once and persisted to disk (so it only has to be trusted once); per-host leaf certificates are minted on the fly during the TLS handshake and cached.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is a self-signed certificate authority. Use LoadOrCreateCA to obtain one, then TLSConfigForHost to terminate a client TLS connection while impersonating the requested host.
func LoadOrCreateCA ¶
LoadOrCreateCA loads the CA from dir, generating and persisting a fresh one when it does not yet exist. The directory is created with 0700 perms; the CA private key is written 0600.
func (*CA) CertPath ¶
CertPath returns the on-disk path of the PEM-encoded CA certificate. Clients trust this file (curl --cacert, OS/browser trust store) to verify the intercepted TLS connection.
func (*CA) ExportCert ¶
ExportCert copies the CA certificate PEM to dst (0644).
func (*CA) LeafFor ¶
func (c *CA) LeafFor(host string) (*tls.Certificate, error)
LeafFor returns a leaf certificate impersonating host, minting and caching it on first use.
func (*CA) TLSConfigForHost ¶
TLSConfigForHost returns a tls.Config for terminating a client connection opened via CONNECT to connectHost. The leaf certificate is selected by SNI; when the client sends no SNI, connectHost is used as the fallback identity.
Source Files