pki

Documentation

Overview

Package pki contains the domain concept definitions needed to support Magistrala Certs service functionality. It provides the abstraction of the PKI (Public Key Infrastructure) Valut service, which is used to issue and revoke certificates.

Package pki wraps vault client

Index

• Variables
• type Agent
  • func NewVaultClient(appRole, appSecret, host, namespace, path, role string, logger *slog.Logger) (Agent, error)
• type Cert

Variables

var (
	// ErrMissingCACertificate indicates missing CA certificate.
	ErrMissingCACertificate = errors.New("missing CA certificate for certificate signing")

	// ErrFailedCertCreation indicates failed to certificate creation.
	ErrFailedCertCreation = errors.New("failed to create client certificate")

	// ErrFailedCertRevocation indicates failed certificate revocation.
	ErrFailedCertRevocation = errors.New("failed to revoke certificate")
)

Types

type Agent

type Agent interface {
	// IssueCert issues certificate on PKI
	IssueCert(cn, ttl string) (Cert, error)

	// Read retrieves certificate from PKI
	Read(serial string) (Cert, error)

	// Revoke revokes certificate from PKI
	Revoke(serial string) (time.Time, error)

	// Login to PKI and renews token
	LoginAndRenew(ctx context.Context) error
}

Agent represents the Vault PKI interface.

func NewVaultClient

func NewVaultClient(appRole, appSecret, host, namespace, path, role string, logger *slog.Logger) (Agent, error)

NewVaultClient instantiates a Vault client.

type Cert

type Cert struct {
	ClientCert     string   `json:"client_cert" mapstructure:"certificate"`
	IssuingCA      string   `json:"issuing_ca" mapstructure:"issuing_ca"`
	CAChain        []string `json:"ca_chain" mapstructure:"ca_chain"`
	ClientKey      string   `json:"client_key" mapstructure:"private_key"`
	PrivateKeyType string   `json:"private_key_type" mapstructure:"private_key_type"`
	Serial         string   `json:"serial" mapstructure:"serial_number"`
	Expire         int64    `json:"expire" mapstructure:"expiration"`
}