Documentation
¶
Overview ¶
Package testpki generates the certificate fixtures mutual TLS scenarios present and pool: authorities, intermediates, client leaves and gateway identities, each addressed by a fixture name. Several fixtures are defined relative to the generation time (expired, not yet valid, expiring soon), so the set is generated in memory once per process and never written to disk. Every key is throwaway test material.
Index ¶
Constants ¶
const TLSBackendHost = "tls-backend"
TLSBackendHost is the name the gateway dials to reach the TLS backends. Their server certificates carry it, except the wrong-host backend's.
const WrongHostName = "not-this-host.test"
WrongHostName is the only name the wrong-host backend's certificate carries.
Variables ¶
var Default = sync.OnceValues(func() (*Set, error) { return Generate(time.Now()) })
Default returns the fixture set for this process, generated on first use.
Functions ¶
This section is empty.
Types ¶
type Fixture ¶
type Fixture struct {
// Name addresses the fixture, for example "client-valid".
Name string
// Certificate is the parsed certificate.
Certificate *x509.Certificate
// CertPEM is the certificate alone.
CertPEM []byte
// KeyPEM is the PKCS#8 private key.
KeyPEM []byte
// ChainPEM holds the issuing intermediates, immediate issuer first, up to but excluding
// the root. It is empty for a root, a self-signed leaf and anything a root signed directly.
ChainPEM []byte
// Thumbprint is the lowercase hexadecimal SHA-256 of the certificate's DER encoding.
Thumbprint string
}
Fixture is one generated certificate with its private key.
func (*Fixture) EncryptedKeyPEM ¶
EncryptedKeyPEM returns the fixture's private key as a passphrase-protected PKCS#8 "ENCRYPTED PRIVATE KEY", the form `openssl pkcs8 -topk8 -v2 aes-256-cbc` writes. Each call draws a fresh salt and IV.
func (*Fixture) TLSCertificate ¶
func (f *Fixture) TLSCertificate(withChain bool) (tls.Certificate, error)
TLSCertificate returns the fixture as a client certificate, followed by its issuing intermediates when withChain is true.
Source Files