ca

package

v1.20.0 Latest Latest Go to latest Published: Oct 7, 2026 License: AGPL-3.0 Imports: 20 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

gitlab.com/shardkeep/shardkeep

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ca is the Controller's certificate authority. It signs Node client certificates from the CSRs Agents send at enrollment and rotation, and the Controller's own certificate for the Agent listeners. Its private key lives only in the Controller's data directory.

Index ¶

Constants
Variables
func NodeIDFromCert(cert *x509.Certificate) (uuid.UUID, error)
func NodeURI(nodeID uuid.UUID) *url.URL
func SerialHex(cert *x509.Certificate) string
type CA
- func LoadOrCreate(dir string, now func() time.Time, logger *slog.Logger) (*CA, error)
type NodeCert

Constants ¶

View Source

const (

	// NodeCertValidity is how long a Node certificate is valid. Agents renew
	// at two thirds of it.
	NodeCertValidity = 90 * 24 * time.Hour
)

Variables ¶

View Source

var ErrBadCSR = errors.New("invalid certificate signing request")

ErrBadCSR is returned for a CSR that is malformed, carries a bad signature or uses a key type the CA does not accept.

Functions ¶

func NodeIDFromCert ¶

func NodeIDFromCert(cert *x509.Certificate) (uuid.UUID, error)

NodeIDFromCert returns the Node ID a certificate this CA issued names.

func NodeURI ¶

func NodeURI(nodeID uuid.UUID) *url.URL

NodeURI is the URI SAN identifying a Node.

func SerialHex ¶

func SerialHex(cert *x509.Certificate) string

SerialHex returns a certificate's serial as stored in the database.

Types ¶

type CA ¶

type CA struct {
	// contains filtered or unexported fields
}

CA signs certificates with the Controller's CA key.

func LoadOrCreate ¶

func LoadOrCreate(dir string, now func() time.Time, logger *slog.Logger) (*CA, error)

LoadOrCreate loads the CA from dir, creating it on first start. now may be nil for time.Now.

func (*CA) Certificate ¶

func (c *CA) Certificate() *x509.Certificate

Certificate returns the CA certificate.

func (*CA) Pin ¶

func (c *CA) Pin() []byte

Pin returns the SHA-256 of the CA's SubjectPublicKeyInfo, the value enrollment tokens carry.

func (*CA) PinHex ¶

func (c *CA) PinHex() string

PinHex returns Pin in hex, as it appears in enrollment tokens.

func (*CA) Pool ¶

func (c *CA) Pool() *x509.CertPool

Pool returns a pool trusting only this CA.

func (*CA) ServerCertificate ¶

func (c *CA) ServerCertificate(names []string) (der []byte, key crypto.Signer, notAfter time.Time, err error)

ServerCertificate issues the Controller's certificate for the Agent listeners, for a fresh key it returns as well.

func (*CA) SignNode ¶

func (c *CA) SignNode(nodeID uuid.UUID, csrDER []byte) (NodeCert, error)

SignNode issues a client certificate for nodeID over the public key in csrDER. Only the public key is taken from the CSR, after its signature is checked: the subject and extensions are set here, so a CSR cannot claim another identity.

type NodeCert ¶

type NodeCert struct {
	DER       []byte
	Serial    string
	NotBefore time.Time
	NotAfter  time.Time
	// Fingerprint is the SHA-256 of DER in hex.
	Fingerprint string
}

NodeCert is a signed Node certificate.

Source Files ¶

View all Source files

ca.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL