ssl

Documentation

Index

• Variables
• func AddOrUpdateDHParam(name string, dh []byte) (string, error)
• func CheckCACert(caBytes []byte) ([]*x509.Certificate, error)
• func ConfigureCACert(name string, ca []byte, sslCert *ingress.SSLCert) error
• func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLCert) error
• func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error
• func CreateCACert(ca []byte) (*ingress.SSLCert, error)
• func CreateSSLCert(cert, key []byte, uid string) (*ingress.SSLCert, error)
• func GetFakeSSLCert() *ingress.SSLCert
• func IsValidHostname(hostname string, commonNames []string) bool
• func StoreSSLCertOnDisk(name string, sslCert *ingress.SSLCert) (string, error)
• type TLSListener
  • func NewTLSListener(certificate, key string) *TLSListener
  • func (tl *TLSListener) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)
  • func (tl *TLSListener) TLSConfig() *tls.Config

Variables

var FakeSSLCertificateUID = "00000000-0000-0000-0000-000000000000"

FakeSSLCertificateUID defines the default UID to use for the fake SSL certificate generated by the ingress controller

Functions

func AddOrUpdateDHParam

func AddOrUpdateDHParam(name string, dh []byte) (string, error)

AddOrUpdateDHParam creates a dh parameters file with the specified name

func CheckCACert

func CheckCACert(caBytes []byte) ([]*x509.Certificate, error)

CheckCACert validates a byte array containing one or more CA certificate/s

func ConfigureCACert

func ConfigureCACert(name string, ca []byte, sslCert *ingress.SSLCert) error

ConfigureCACert is similar to ConfigureCACertWithCertAndKey but it creates a separate file for CA cert and writes only ca into it and then sets relevant fields in sslCert

func ConfigureCACertWithCertAndKey

func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLCert) error

ConfigureCACertWithCertAndKey appends ca into existing PEM file consisting of cert and key and sets relevant fields in sslCert object

func ConfigureCRL

func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error

ConfigureCRL creates a CRL file and append it into the SSLCert

func CreateCACert

func CreateCACert(ca []byte) (*ingress.SSLCert, error)

CreateCACert is similar to CreateSSLCert but it creates instance of SSLCert only based on given ca after parsing and validating it

func CreateSSLCert

func CreateSSLCert(cert, key []byte, uid string) (*ingress.SSLCert, error)

CreateSSLCert validates cert and key, extracts common names and returns corresponding SSLCert object

func GetFakeSSLCert

func GetFakeSSLCert() *ingress.SSLCert

GetFakeSSLCert creates a Self Signed Certificate Based in the code https://golang.org/src/crypto/tls/generate_cert.go

func IsValidHostname

func IsValidHostname(hostname string, commonNames []string) bool

IsValidHostname checks if a hostname is valid in a list of common names

func StoreSSLCertOnDisk

func StoreSSLCertOnDisk(name string, sslCert *ingress.SSLCert) (string, error)

StoreSSLCertOnDisk creates a .pem file with content PemCertKey from the given sslCert and sets relevant remaining fields of sslCert object

Types

type TLSListener

type TLSListener struct {
	// contains filtered or unexported fields
}

TLSListener implements a dynamic certificate loader

func NewTLSListener

func NewTLSListener(certificate, key string) *TLSListener

NewTLSListener watches changes to th certificate and key paths and reloads it whenever it changes

func (*TLSListener) GetCertificate

func (tl *TLSListener) GetCertificate(*tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate implements the tls.Config.GetCertificate interface

func (*TLSListener) TLSConfig

func (tl *TLSListener) TLSConfig() *tls.Config

TLSConfig instanciates a TLS configuration, always providing an up to date certificate