Documentation
¶
Overview ¶
Package pki provides a simple way to generate a CA and signed server keypair.
Index ¶
- func CheckForExpiredCert(ctx context.Context, pk GeneratedPKI) error
- func GenerateCA(subject string) ([]byte, []byte, error)
- func GenerateClientCert(caCertPEM, caKeyPEM []byte, commonName string) ([]byte, []byte, error)
- func GenerateMTLSCerts(caSubject string, serverDNSNames []string, serverCommonName string, ...) (server GeneratedPKI, client GeneratedPKI, err error)
- func GenerateServerCert(caCertPEM, caKeyPEM []byte, commonName string, dnsNames []string) ([]byte, []byte, error)
- func GetRemainingCertLifePercentage(certData []byte) (float64, error)
- func ParseCertFromPEM(certData []byte) (*x509.Certificate, error)
- func TransportWithKey(certs GeneratedPKI) (http.RoundTripper, error)
- type CertType
- type GenerateOptions
- type GeneratedPKI
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckForExpiredCert ¶ added in v0.52.0
func CheckForExpiredCert(ctx context.Context, pk GeneratedPKI) error
CheckForExpiredCert checks if the certificate is expired
func GenerateCA ¶ added in v0.71.0
GenerateCA creates a CA certificate and returns the PEM-encoded certificate and private key
func GenerateClientCert ¶ added in v0.71.0
GenerateClientCert creates a client certificate signed by the provided CA
func GenerateMTLSCerts ¶ added in v0.71.0
func GenerateMTLSCerts(caSubject string, serverDNSNames []string, serverCommonName string, clientCommonName string) (server GeneratedPKI, client GeneratedPKI, err error)
GenerateMTLSCerts generates a complete set of mTLS certificates including CA, server cert, and client cert. Returns two GeneratedPKI structs: one for the server (containing server cert, key, and CA) and one for the client (containing client cert, key, and CA).
func GenerateServerCert ¶ added in v0.71.0
func GenerateServerCert(caCertPEM, caKeyPEM []byte, commonName string, dnsNames []string) ([]byte, []byte, error)
GenerateServerCert creates a server certificate signed by the provided CA
func GetRemainingCertLifePercentage ¶ added in v0.71.0
GetRemainingCertLifePercentage gives back the percentage of the given certificates total lifespan that it has left before it's expired
func ParseCertFromPEM ¶ added in v0.75.0
func ParseCertFromPEM(certData []byte) (*x509.Certificate, error)
ParseCertFromPEM parses a certificate from PEM data.
func TransportWithKey ¶ added in v0.71.0
func TransportWithKey(certs GeneratedPKI) (http.RoundTripper, error)
TransportWithKey creates an HTTP transport configured with mTLS certificates.
The registry CA is added to, rather than replaces, the system trust store. Registry storage drivers can redirect blob requests to external endpoints such as S3
Types ¶
type CertType ¶ added in v0.71.0
type CertType int
CertType defines the type of certificate to generate
type GenerateOptions ¶ added in v0.75.0
type GenerateOptions struct {
// Duration sets the certificate lifetime. Defaults to validFor (375 days) when zero.
Duration time.Duration
// DNSNames specifies additional Subject Alternative Names for the certificate.
DNSNames []string
}
GenerateOptions configures optional parameters for PKI generation.
type GeneratedPKI ¶ added in v0.52.0
type GeneratedPKI struct {
CA []byte `json:"ca"`
Cert []byte `json:"cert"`
Key []byte `json:"key"`
}
GeneratedPKI is a struct for storing generated PKI data.
func GeneratePKI ¶
func GeneratePKI(host string, dnsNames ...string) (GeneratedPKI, error)
GeneratePKI create a CA and signed server keypair.
func GeneratePKIWithOptions ¶ added in v0.75.0
func GeneratePKIWithOptions(host string, opts GenerateOptions) (GeneratedPKI, error)
GeneratePKIWithOptions creates a CA and signed server keypair with configurable options.
Source Files