Documentation
¶
Overview ¶
Package tlstest provides an in-memory certificate authority for tests that need real TLS material.
Use New to obtain a root CA. Its certificate is available as PEM for writing to a ca.crt file, and as an x509.CertPool for use as a trust store. CA.IssueServer and CA.IssueClient issue leaf certificates from it, CA.Intermediate lengthens the chain, and Leaf.WriteFiles writes a leaf to disk in the layout Kubernetes projects from a kubernetes.io/tls secret. CA.HTTPClient returns a client that trusts the CA.
Certificates use ECDSA P-256 keys, which are fast enough to generate per test and are available under every FIPS backend.
Warning: this package is intended for use in tests only.
Index ¶
- type CA
- func (c *CA) CertPEM() []byte
- func (c *CA) HTTPClient(tb testing.TB, opts ...ClientOption) *http.Client
- func (c *CA) Intermediate(tb testing.TB, cn string) *CA
- func (c *CA) IssueClient(tb testing.TB, cn string) *Leaf
- func (c *CA) IssueServer(tb testing.TB, sans ...string) *Leaf
- func (c *CA) Issuing(notBefore, notAfter time.Time) *CA
- func (c *CA) Pool() *x509.CertPool
- func (c *CA) WriteCAFile(tb testing.TB, dir string) string
- func (c *CA) X509() *x509.Certificate
- type ClientOption
- type Leaf
- type Option
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CA ¶
type CA struct {
// contains filtered or unexported fields
}
CA is a certificate authority that issues certificates for tests. Construct a root with New.
func (*CA) CertPEM ¶
CertPEM returns c's own certificate in PEM form, suitable for writing to a ca.crt file or passing as a client CA bundle.
func (*CA) HTTPClient ¶
HTTPClient returns a client that trusts c, attempts HTTP/2, and times its requests out.
func (*CA) Intermediate ¶
Intermediate returns an intermediate CA signed by c, for tests that need a longer certificate chain. It shares c's validity window, and certificates it issues present it alongside themselves so a peer trusting only the root can still build the chain.
func (*CA) IssueClient ¶
IssueClient returns a client certificate with the given common name, for mutual TLS tests. Its extended key usage is clientAuth, so it satisfies a server verifying client certificates.
func (*CA) IssueServer ¶
IssueServer returns a server certificate for the given subject alternative names. An entry that parses as an IP address becomes an IP SAN, anything else becomes a DNS SAN, so IssueServer(tb, "localhost", "127.0.0.1") produces a certificate usable against either.
func (*CA) Issuing ¶ added in v2.48.0
Issuing returns a view of c that stamps the given validity window on the certificates it issues. c itself is unchanged, so a test can hold a valid authority that issues an expired leaf.
func (*CA) WriteCAFile ¶
WriteCAFile writes c's certificate to ca.crt in dir and returns the path. It is re-callable on the same directory, so a test can replace a CA bundle in place.
func (*CA) X509 ¶ added in v2.48.0
func (c *CA) X509() *x509.Certificate
X509 returns c's own parsed certificate, for assertions on the subject or the validity window.
type ClientOption ¶ added in v2.48.0
type ClientOption func(*clientOptions)
ClientOption customises the client CA.HTTPClient returns.
func WithClientCertificate ¶ added in v2.48.0
func WithClientCertificate(leaf *Leaf) ClientOption
WithClientCertificate presents leaf to the server, for mutual TLS tests.
type Leaf ¶
type Leaf struct {
// contains filtered or unexported fields
}
Leaf is an issued end-entity certificate and its private key.
func (*Leaf) CertPEM ¶
CertPEM returns the certificate chain in PEM form: the leaf, then any intermediates.
func (*Leaf) Certificate ¶
func (l *Leaf) Certificate() *stdtls.Certificate
Certificate returns l as a crypto/tls certificate, ready to serve or to present as a client certificate. It carries any intermediates needed to chain to the root.
func (*Leaf) WriteFiles ¶
WriteFiles writes the certificate and the key into dir as tls.crt and tls.key, the layout Kubernetes projects from a kubernetes.io/tls secret, and returns their paths. It is re-callable on the same directory, so a rotation test issues a new leaf and calls WriteFiles again.
func (*Leaf) X509 ¶
func (l *Leaf) X509() *x509.Certificate
X509 returns the parsed certificate, for assertions on the subject, the subject alternative names or the validity window.
type Option ¶
type Option func(*options)
Option customises a CA and the certificates it issues.
func WithValidity ¶
WithValidity sets the validity window of the CA's certificate and of every certificate it issues. A window in the past yields expired certificates. The default opens an hour ago and lasts a year.
Source Files