pki

Oct 2, 2024

Changes in this version

+ func FuzzyX509AltNamesMatchSpec(x509cert *x509.Certificate, spec cmapi.CertificateSpec) []string

+ func RenewBefore(actualDuration time.Duration, renewBefore *metav1.Duration, ...) time.Duration

Feb 8, 2024

Changes in this version

+ func IsASN1SubjectEmpty(asn1Subject []byte) bool

Jan 31, 2024

Changes in this version

+ var OIDExtensionNameConstraints = []int

+ func ExtractCommonNameFromRDNSequence(rdns pkix.RDNSequence) string

+ func IPAddressesFromStrings(ipStrings []string) ([]net.IP, error)

+ func MarshalNameConstraints(nameConstraints *NameConstraints, critical bool) (pkix.Extension, error)

+ func MarshalSANs(gns GeneralNames, hasSubject bool) (pkix.Extension, error)

+ func MarshalUniversalValue(uv UniversalValue) ([]byte, error)

+ func ParseObjectIdentifier(oidString string) (oid asn1.ObjectIdentifier, err error)

+ type EDIPartyName struct

+ NameAssigner string

+ PartyName string

+ type GeneralNames struct

+ DNSNames []string

+ DirectoryNames []pkix.RDNSequence

+ EDIPartyNames []EDIPartyName

+ IPAddresses []net.IP

+ OtherNames []OtherName

+ RFC822Names []string

+ RegisteredIDs []asn1.ObjectIdentifier

+ UniformResourceIdentifiers []string

+ X400Addresses []asn1.RawValue

+ func UnmarshalSANs(value []byte) (GeneralNames, error)

+ func (gns GeneralNames) Empty() bool

type GenerateCSROption

+ func WithNameConstraints(enabled bool) GenerateCSROption

+ func WithOtherNames(enabled bool) GenerateCSROption

+ type NameConstraints struct

+ ExcludedDNSDomains []string

+ ExcludedEmailAddresses []string

+ ExcludedIPRanges []*net.IPNet

+ ExcludedURIDomains []string

+ PermittedDNSDomains []string

+ PermittedEmailAddresses []string

+ PermittedIPRanges []*net.IPNet

+ PermittedURIDomains []string

+ func UnmarshalNameConstraints(value []byte) (*NameConstraints, error)

+ func (nc NameConstraints) IsEmpty() bool

+ type OtherName struct

+ TypeID asn1.ObjectIdentifier

+ Value asn1.RawValue

+ type UniversalValue struct

+ Bytes []byte

+ IA5String string

+ PrintableString string

+ UTF8String string

+ func UnmarshalUniversalValue(rawValue asn1.RawValue) (UniversalValue, error)

+ func (uv UniversalValue) Type() UniversalValueType

+ type UniversalValueType int

+ const UniversalValueTypeBytes

+ const UniversalValueTypeIA5String

+ const UniversalValueTypePrintableString

+ const UniversalValueTypeUTF8String

Sep 12, 2023

Changes in this version

+ var CertificateTemplateFromCertificateRequest = makeCertificateTemplateFromCertificateRequestFunc(false)

+ var DeprecatedCertificateTemplateFromCertificateRequestAndAllowInsecureCSRUsageDefinition = makeCertificateTemplateFromCertificateRequestFunc(true)

+ func CertificateTemplateFromCSR(csr *x509.CertificateRequest, ...) (*x509.Certificate, error)

+ func CertificateTemplateFromCSRPEM(csrPEM []byte, validatorMutators ...CertificateTemplateValidatorMutator) (*x509.Certificate, error)

+ func CertificateTemplateFromCertificate(crt *v1.Certificate) (*x509.Certificate, error)

+ func CertificateTemplateFromCertificateSigningRequest(csr *certificatesv1.CertificateSigningRequest) (*x509.Certificate, error)

+ func UnmarshalBasicConstraints(value []byte) (isCA bool, maxPathLen *int, err error)

+ func UnmarshalExtKeyUsage(value []byte) (extUsages []x509.ExtKeyUsage, unknownUsages []asn1.ObjectIdentifier, err error)

+ func UnmarshalKeyUsage(value []byte) (usage x509.KeyUsage, err error)

+ type CertificateTemplateValidatorMutator func(*x509.CertificateRequest, *x509.Certificate) error

+ func CertificateTemplateOverrideDuration(duration time.Duration) CertificateTemplateValidatorMutator

+ func CertificateTemplateValidateAndOverrideBasicConstraints(isCA bool, maxPathLen *int) CertificateTemplateValidatorMutator

+ func CertificateTemplateValidateAndOverrideKeyUsages(keyUsage x509.KeyUsage, extKeyUsage []x509.ExtKeyUsage) CertificateTemplateValidatorMutator

+ type GenerateCSROption func(*generateCSROptions)

+ func WithEncodeBasicConstraintsInRequest(encode bool) GenerateCSROption

+ func WithUseLiteralSubject(useLiteralSubject bool) GenerateCSROption

Mar 8, 2024

Changes in this version

+ func DecodeX509CertificateSetBytes(certBytes []byte) ([]*x509.Certificate, error)

May 12, 2023

Changes in this version

+ func GenerateLocallySignedTemporaryCertificate(crt *cmapi.Certificate, pkData []byte) ([]byte, error)

+ func KeyUsagesForCertificateOrCertificateRequest(usages []v1.KeyUsage, isCA bool) (ku x509.KeyUsage, eku []x509.ExtKeyUsage, err error)

+ func MarshalBasicConstraints(isCA bool) (pkix.Extension, error)

+ func MarshalExtKeyUsage(extUsages []x509.ExtKeyUsage, unknownUsages []asn1.ObjectIdentifier) (pkix.Extension, error)

+ func MarshalKeyUsage(usage x509.KeyUsage) (pkix.Extension, error)

+ func MarshalRDNSequenceToRawDERBytes(rdnSequence pkix.RDNSequence) ([]byte, error)

+ func ParseSubjectStringToRawDERBytes(subject string) ([]byte, error)

+ func PrivateKeyMatchesSpec(pk crypto.PrivateKey, spec cmapi.CertificateSpec) ([]string, error)

+ func RenewalTime(notBefore, notAfter time.Time, renewBeforeOverride *metav1.Duration) *metav1.Time

+ func RequestMatchesSpec(req *cmapi.CertificateRequest, spec cmapi.CertificateSpec) ([]string, error)

+ func SecretDataAltNamesMatchSpec(secret *corev1.Secret, spec cmapi.CertificateSpec) ([]string, error)

+ func UnmarshalRawDerBytesToRDNSequence(der []byte) (rdnSequence pkix.RDNSequence, err error)

+ func UnmarshalSubjectStringToRDNSequence(subject string) (pkix.RDNSequence, error)

+ type RenewalTimeFunc func(time.Time, time.Time, *metav1.Duration) *metav1.Time

Jan 11, 2023

Changes in this version

+ var OIDExtensionBasicConstraints = []int

Jul 21, 2022

Changes in this version

+ var OIDConstants = struct{ ... }

+ func ParseSubjectStringToRawDerBytes(subject string) ([]byte, error)

+ func ParseSubjectStringToRdnSequence(subject string) (pkix.RDNSequence, error)

Apr 1, 2022

Changes in this version

+ var OIDExtensionExtendedKeyUsage = []int

+ var OIDExtensionKeyUsage = []int

+ func BuildCertManagerKeyUsages(ku x509.KeyUsage, eku []x509.ExtKeyUsage) []v1.KeyUsage

+ func BuildKeyUsages(usages []v1.KeyUsage, isCA bool) (ku x509.KeyUsage, eku []x509.ExtKeyUsage, err error)

+ func BuildKeyUsagesKube(usages []certificatesv1.KeyUsage) (x509.KeyUsage, []x509.ExtKeyUsage, error)

+ func DecodeX509CertificateRequestBytes(csrBytes []byte) (*x509.CertificateRequest, error)

+ func DurationFromCertificateSigningRequest(csr *certificatesv1.CertificateSigningRequest) (time.Duration, error)

+ func ExtKeyUsageFromOID(oid asn1.ObjectIdentifier) (eku x509.ExtKeyUsage, ok bool)

+ func GenerateEd25519PrivateKey() (ed25519.PrivateKey, error)

+ func GenerateTemplateFromCSRPEM(csrPEM []byte, duration time.Duration, isCA bool) (*x509.Certificate, error)

+ func GenerateTemplateFromCSRPEMWithUsages(csrPEM []byte, duration time.Duration, isCA bool, keyUsage x509.KeyUsage, ...) (*x509.Certificate, error)

+ func GenerateTemplateFromCertificateRequest(cr *v1.CertificateRequest) (*x509.Certificate, error)

+ func GenerateTemplateFromCertificateSigningRequest(csr *certificatesv1.CertificateSigningRequest) (*x509.Certificate, error)

+ func OIDFromExtKeyUsage(eku x509.ExtKeyUsage) (oid asn1.ObjectIdentifier, ok bool)

+ func PublicKeysEqual(a, b crypto.PublicKey) (bool, error)

+ func SubjectForCertificate(crt *v1.Certificate) v1.X509Subject

+ func URIsForCertificate(crt *v1.Certificate) ([]*url.URL, error)

+ func URLsFromStrings(urlStrs []string) ([]*url.URL, error)

+ func URLsToString(uris []*url.URL) []string

+ type PEMBundle struct

+ CAPEM []byte

+ ChainPEM []byte

+ func ParseSingleCertificateChain(certs []*x509.Certificate) (PEMBundle, error)

+ func ParseSingleCertificateChainPEM(pembundle []byte) (PEMBundle, error)

+ func SignCSRTemplate(caCerts []*x509.Certificate, caKey crypto.Signer, template *x509.Certificate) (PEMBundle, error)

Mar 8, 2019

Changes in this version

+ func EncodePKCS8PrivateKey(pk interface{}) ([]byte, error)

+ func IPAddressesForCertificate(crt *v1alpha1.Certificate) []net.IP

+ func IPAddressesToString(ipAddresses []net.IP) []string

Jan 22, 2019

Changes in this version

+ func DecodeX509CertificateChainBytes(certBytes []byte) ([]*x509.Certificate, error)

+ func EncodeX509Chain(certs []*x509.Certificate) ([]byte, error)

Oct 13, 2017

Changes in this version

+ func DecodeDERCertificateBytes(derBytes []byte) (*x509.Certificate, error)

Nov 8, 2018

Changes in this version

+ const ECCurve256

+ const ECCurve384

+ const ECCurve521

+ const MaxRSAKeySize

+ const MinRSAKeySize

+ func CommonNameForCertificate(crt *v1alpha1.Certificate) string

+ func DNSNamesForCertificate(crt *v1alpha1.Certificate) []string

+ func DecodePKCS1PrivateKeyBytes(keyBytes []byte) (*rsa.PrivateKey, error)

+ func DecodePrivateKeyBytes(keyBytes []byte) (crypto.Signer, error)

+ func DecodeX509CertificateBytes(certBytes []byte) (*x509.Certificate, error)

+ func EncodeCSR(template *x509.CertificateRequest, key crypto.Signer) ([]byte, error)

+ func EncodeECPrivateKey(pk *ecdsa.PrivateKey) ([]byte, error)

+ func EncodePKCS1PrivateKey(pk *rsa.PrivateKey) []byte

+ func EncodePrivateKey(pk crypto.PrivateKey) ([]byte, error)

+ func EncodeX509(cert *x509.Certificate) ([]byte, error)

+ func GenerateCSR(issuer v1alpha1.GenericIssuer, crt *v1alpha1.Certificate) (*x509.CertificateRequest, error)

+ func GenerateECPrivateKey(keySize int) (*ecdsa.PrivateKey, error)

+ func GeneratePrivateKeyForCertificate(crt *v1alpha1.Certificate) (crypto.Signer, error)

+ func GenerateRSAPrivateKey(keySize int) (*rsa.PrivateKey, error)

+ func GenerateTemplate(issuer v1alpha1.GenericIssuer, crt *v1alpha1.Certificate) (*x509.Certificate, error)

+ func OrganizationForCertificate(crt *v1alpha1.Certificate) []string

+ func PublicKeyForPrivateKey(pk crypto.PrivateKey) (crypto.PublicKey, error)

+ func PublicKeyMatchesCSR(check crypto.PublicKey, csr *x509.CertificateRequest) (bool, error)

+ func PublicKeyMatchesCertificate(check crypto.PublicKey, crt *x509.Certificate) (bool, error)

+ func SignCertificate(template *x509.Certificate, issuerCert *x509.Certificate, ...) ([]byte, *x509.Certificate, error)

+ func SignatureAlgorithm(crt *v1alpha1.Certificate) (x509.PublicKeyAlgorithm, x509.SignatureAlgorithm, error)