util

Documentation

Index

• type CertPool
  • func NewCertPool(options ...Option) *CertPool
  • func (cp *CertPool) AddCertsFromPEM(pemData []byte) error
  • func (certPool *CertPool) Certificates() []*x509.Certificate
  • func (certPool *CertPool) PEM() string
  • func (certPool *CertPool) PEMSplit() []string
  • func (cp *CertPool) Size() int
• type Option
  • func WithFilteredExpiredCerts(filterExpired bool) Option

Types

type CertPool

type CertPool struct {
	// contains filtered or unexported fields
}

CertPool is a set of certificates.

func NewCertPool

func NewCertPool(options ...Option) *CertPool

NewCertPool returns a new, empty CertPool. It will deduplicate certificates based on their SHA256 hash. Optionally, it can filter out expired certificates.

func (*CertPool) AddCertsFromPEM

func (cp *CertPool) AddCertsFromPEM(pemData []byte) error

AddCertsFromPEM strictly validates a given input PEM bundle to confirm it contains only valid CERTIFICATE PEM blocks. If successful, returns the validated PEM blocks with any comments or extra data stripped.

This validation is broadly similar to the standard library function crypto/x509.CertPool.AppendCertsFromPEM - that is, we decode each PEM block at a time and parse it as a certificate.

The difference here is that we want to ensure that the bundle _only_ contains certificates, and not just skip over things which aren't certificates.

If, for example, someone accidentally used a combined cert + private key as an input to a trust bundle, we wouldn't want to then distribute the private key in the target.

In addition, the standard library AppendCertsFromPEM also silently skips PEM blocks with non-empty Headers. We error on such PEM blocks, for the same reason as above; headers could contain (accidental) private information. They're also non-standard according to https://www.rfc-editor.org/rfc/rfc7468

Additionally, if the input PEM bundle contains no non-expired certificates, an error is returned. TODO: Reconsider what should happen if the input only contains expired certificates.

func (*CertPool) Certificates

func (certPool *CertPool) Certificates() []*x509.Certificate

Get the list of all x509 Certificates in the certificates pool

func (*CertPool) PEM

func (certPool *CertPool) PEM() string

func (*CertPool) PEMSplit

func (certPool *CertPool) PEMSplit() []string

func (*CertPool) Size

func (cp *CertPool) Size() int

Get certificates quantity in the certificates pool

type Option

type Option func(*CertPool)

func WithFilteredExpiredCerts

func WithFilteredExpiredCerts(filterExpired bool) Option