security

Documentation

Index

• Constants
• func CreateCAPair(certsDir, caKeyPath string, keySize int, lifetime time.Duration, ...) error
• func CreateClientPair(certsDir, caKeyPath string, keySize int, lifetime time.Duration, ...) error
• func CreateNodePair(certsDir, caKeyPath string, keySize int, lifetime time.Duration, ...) error
• func LookPathCrdb() error
• type PemUsage
• type SQLUsername

Constants

const (
	CR            string = "cockroach"
	CERT          string = "cert"
	CREATE_CA     string = "create-ca"
	CREATE_NODE   string = "create-node"
	CREATE_CLIENT string = "create-client"

	CERTS_DIR string = "--certs-dir=%s"
	CA_KEY    string = "--ca-key=%s"
)

The following constants are used to run the crdb binary

Functions

func CreateCAPair

func CreateCAPair(
	certsDir, caKeyPath string,
	keySize int,
	lifetime time.Duration,
	allowKeyReuse bool,
	overwrite bool,
) error

CreateCAPair creates a general CA certificate and associated key.

func CreateClientPair

func CreateClientPair(
	certsDir, caKeyPath string,
	keySize int,
	lifetime time.Duration,
	overwrite bool,
	user SQLUsername,
	wantPKCS8Key bool,
) error

CreateClientPair creates a node key and certificate. The CA cert and key must load properly. If multiple certificates exist in the CA cert, the first one is used. If a client CA exists, this is used instead. If wantPKCS8Key is true, the private key in PKCS#8 encoding is written as well.

func CreateNodePair

func CreateNodePair(certsDir, caKeyPath string, keySize int, lifetime time.Duration, overwrite bool, hosts []string) error

CreateNodePair creates a node key and certificate. The CA cert and key must load properly. If multiple certificates exist in the CA cert, the first one is used.

func LookPathCrdb

func LookPathCrdb() error

Types

type PemUsage

type PemUsage uint32

PemUsage indicates the purpose of a given certificate.

const (

	// CAPem describes the main CA certificate.
	CAPem PemUsage
	// TenantClientCAPem describes the CA certificate used to broker authN/Z for SQL
	// tenants wishing to access the KV layer.
	TenantClientCAPem
	// ClientCAPem describes the CA certificate used to verify client certificates.
	ClientCAPem
	// UICAPem describes the CA certificate used to verify the Admin UI server certificate.
	UICAPem
	// NodePem describes the server certificate for the node, possibly a combined server/client
	// certificate for user Node if a separate 'client.node.crt' is not present.
	NodePem
	// UIPem describes the server certificate for the admin UI.
	UIPem
	// ClientPem describes a client certificate.
	ClientPem
	// TenantClientPem describes a SQL tenant client certificate.
	TenantClientPem
)

type SQLUsername

type SQLUsername struct {
	U string
}

SQLUsername is used to define the username created in the client certificate