security

Documentation

Index

• type Authority
  • func NewAuthority(key *Key) (*Authority, error)
  • func (a *Authority) Sign(request *Request) (*Certificate, error)
• type Certificate
  • func CertificateFromPEM(pemCert []byte) (*Certificate, error)
  • func CertificateFromTemplate(template *x509.Certificate, parent *x509.Certificate, publicKey interface{}, ...) (*Certificate, error)
  • func (c *Certificate) WritePEM(buf io.Writer) error
• type Identity
  • func NewIdentity(id string) *Identity
  • func (i *Identity) Fingerprint() [sha1.Size]byte
  • func (i *Identity) IsSigned() bool
  • func (i *Identity) IsValid() bool
  • func (i *Identity) LoadCertificate(certBytes []byte) error
  • func (i *Identity) LoadKey(pemBytes []byte) error
  • func (i *Identity) LoadRequest(pemBytes []byte) error
  • func (i *Identity) NewKey() error
  • func (i *Identity) NewRequest() error
• type IdentityType
• type Key
  • func KeyFromPEM(pemKey []byte) (*Key, error)
  • func NewKey() (*Key, error)
  • func (k *Key) GenerateSubjectKeyId() ([]byte, error)
  • func (k *Key) WritePEM(buf io.Writer) error
• type PEMWriter
• type Request
  • func NewRequest(priv *Key, template *x509.CertificateRequest) (*Request, error)
  • func RequestFromPEM(pemRequest []byte) (*Request, error)
  • func (r Request) WritePEM(buf io.Writer) error

Types

type Authority

type Authority struct {
	Key         *Key
	Certificate *Certificate
	Serial      *big.Int
}

Authority holds the CA key, certificate & serial number New CAs can be created with the NewAuthority function, otherwise simply create an Authority object and assign the attributes using CertificateFromPEM, KeyFromPEM, and your own method of storing the serial number (i.e. in etcd)

func NewAuthority

func NewAuthority(key *Key) (*Authority, error)

NewAuthority generates a new Authority that is used to sign other Certificates

func (*Authority) Sign

func (a *Authority) Sign(request *Request) (*Certificate, error)

Sign takes a Request and returns a signed Certificate The Authority data should be locked for this operation to ensure that serial numbers do not collide

type Certificate

type Certificate struct {
	*x509.Certificate
}

Certificate is our custom struct that we attach functionality to

func CertificateFromPEM

func CertificateFromPEM(pemCert []byte) (*Certificate, error)

CertificateFromPEM takes a byte slice that contains a PEM encoded certificate and returns a composed Certificate

func CertificateFromTemplate

func CertificateFromTemplate(template *x509.Certificate, parent *x509.Certificate, publicKey interface{}, privateKey *Key) (*Certificate, error)

CertificateFromTemplate takes a template, parent, public key & private key and returns a composed certificate. Generally this should be called from an Authority that takes care of filling in all of the details from higher level structs.

func (*Certificate) WritePEM

func (c *Certificate) WritePEM(buf io.Writer) error

WriteCert encodes the x509 certificate using pem and writes it to the provided Writer

type Identity

type Identity struct {
	Id          string
	Key         *Key
	Certificate *Certificate
	Request     *Request
}

Identity is used to tie a node (Id) to a Key & Certificate, also holding a Request if needed

func NewIdentity

func NewIdentity(id string) *Identity

NewIdentity returns a new Identity based on the node ID provided

func (*Identity) Fingerprint

func (i *Identity) Fingerprint() [sha1.Size]byte

Returns the fingerprint (SHA1 byte array) of the certificate

func (*Identity) IsSigned

func (i *Identity) IsSigned() bool

IsSigned returns true if the Identity has a certificate

func (*Identity) IsValid

func (i *Identity) IsValid() bool

IsValid returns true if the Identity has a cert or csr

func (*Identity) LoadCertificate

func (i *Identity) LoadCertificate(certBytes []byte) error

Loads a certificate from a PEM encoded form

func (*Identity) LoadKey

func (i *Identity) LoadKey(pemBytes []byte) error

Load a key from a PEM encoded form

func (*Identity) LoadRequest

func (i *Identity) LoadRequest(pemBytes []byte) error

Loads a signing request from a PEM encoded form

func (*Identity) NewKey

func (i *Identity) NewKey() error

Generates a new key for the identity

func (*Identity) NewRequest

func (i *Identity) NewRequest() error

Generates a new signing request for this identity

type IdentityType

type IdentityType int

IdentityType specifies the type of identity, which is used in determining KeyUsage constraints

const (
	IdentityTypeDirector IdentityType = iota
	IdentityTypeAgent
	IdentityTypeClient
)

type Key

type Key struct {
	*ecdsa.PrivateKey
}

Key is our custom type for an ecdsa private key

func KeyFromPEM

func KeyFromPEM(pemKey []byte) (*Key, error)

KeyFromPEM returns a Key based on a slice of bytes that represent the PEM encoded version

func NewKey

func NewKey() (*Key, error)

NewKey generates a new ecdsa private key

func (*Key) GenerateSubjectKeyId

func (k *Key) GenerateSubjectKeyId() ([]byte, error)

GenerateSubjectKeyId generates SubjectKeyId used in Certificate Id is 160-bit SHA-1 hash of the value of the BIT STRING subjectPublicKey

func (*Key) WritePEM

func (k *Key) WritePEM(buf io.Writer) error

WritePEM encodes the private key using pem and writes it to the provided Writer

type PEMWriter

type PEMWriter interface {
	WritePEM(buf io.Writer) error
}

PEMWriter is an interface implemented by certs, keys & requests for saving their data in PEM format

type Request

type Request struct {
	*x509.CertificateRequest
}

func NewRequest

func NewRequest(priv *Key, template *x509.CertificateRequest) (*Request, error)

NewRequest returns a new x509 signing request based on the provided template

func RequestFromPEM

func RequestFromPEM(pemRequest []byte) (*Request, error)

func (Request) WritePEM

func (r Request) WritePEM(buf io.Writer) error

WritePEM encodes the request using pem and writes it to the provided Writer