realca

Documentation

Index

• type RealCA
  • func Load(certFile, keyFile string) (*RealCA, error)
  • func New(cacerts []*x509.Certificate, key interface{}) (*RealCA, error)
  • func (ca *RealCA) CACerts(ctx context.Context, aps string, r *http.Request) ([]*x509.Certificate, error)
  • func (ca *RealCA) CSRAttrs(ctx context.Context, aps string, r *http.Request) (attrs est.CSRAttrs, err error)
  • func (ca *RealCA) Enroll(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, error)
  • func (ca *RealCA) Reenroll(ctx context.Context, cert *x509.Certificate, csr *x509.CertificateRequest, ...) (*x509.Certificate, error)
  • func (ca *RealCA) RevocationList(ctx context.Context, r *http.Request) ([]byte, error)
  • func (ca *RealCA) ServerKeyGen(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, []byte, error)

Types

type RealCA

type RealCA struct {
	// contains filtered or unexported fields
}

RealCA is a simple CA implementation that uses a single key pair and certificate to sign requests. It uses Root 1 Intermediate 2 Entity hierarchy.

func Load

func Load(certFile, keyFile string) (*RealCA, error)

Load CA certificates and key from PEM files.

func New

func New(cacerts []*x509.Certificate, key interface{}) (*RealCA, error)

New creates a new mock certificate authority. If more than one CA certificate is provided, they should be in order with the issuing (intermediate) CA certificate first, and the root CA certificate last. The private key should be associated with the public key in the first, issuing CA certificate.

func (*RealCA) CACerts

func (ca *RealCA) CACerts(
	ctx context.Context,
	aps string,
	r *http.Request,
) ([]*x509.Certificate, error)

CACerts returns the CA certificates, unless the additional path segment is "triggererrors", in which case an error is returned for testing purposes.

func (*RealCA) CSRAttrs

func (ca *RealCA) CSRAttrs(
	ctx context.Context,
	aps string,
	r *http.Request,
) (attrs est.CSRAttrs, err error)

CSRAttrs returns an empty sequence of CSR attributes, unless the additional path segment is:

• "csrattrs", in which case it returns the same example sequence described in RFC7030 4.5.2; or
• "triggererrors", in which case an error is returned for testing purposes.

func (*RealCA) Enroll

func (ca *RealCA) Enroll(
	ctx context.Context,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, error)

Enroll issues a new certificate with:

• a 90 day duration from the current time
• a randomly generated 128-bit serial number
• a subject and subject alternative name copied from the provided CSR
• a default set of key usages and extended key usages
• a basic constraints extension with cA flag set to FALSE

unless the additional path segment is "triggererrors", in which case the following errors will be returned for testing purposes, depending on the common name in the CSR:

• "Trigger Error Forbidden", HTTP status 403
• "Trigger Error Deferred", HTTP status 202 with retry of 600 seconds
• "Trigger Error Unknown", untyped error expected to be interpreted as an internal server error.

func (*RealCA) Reenroll

func (ca *RealCA) Reenroll(
	ctx context.Context,
	cert *x509.Certificate,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, error)

Reenroll implements est.CA but simply passes the request through to Enroll.

func (*RealCA) RevocationList

func (ca *RealCA) RevocationList(ctx context.Context, r *http.Request) ([]byte, error)

func (*RealCA) ServerKeyGen

func (ca *RealCA) ServerKeyGen(
	ctx context.Context,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, []byte, error)

ServerKeyGen creates a new RSA private key and then calls Enroll. It returns the key in PKCS8 DER-encoding, unless the additional path segment is set to "pkcs7", in which case it is returned wrapped in a CMS SignedData structure signed by the CA certificate(s), itself wrapped in a CMS EnvelopedData encrypted with the pre-shared key "pseudohistorical". A "Bit-Size" HTTP header may be passed with the values 2048, 3072 or 4096.