pki

Documentation

Overview

Package pki provides helpers for creating random certificate serial numbers, random private keys, and issuing test certificates.

Index

• func IssueCertificate(subjectKey crypto.PublicKey, issuerKey *ecdsa.PrivateKey, ...) (*x509.Certificate, error)
• func LoadCertificate(file string) (*x509.Certificate, error)
• func LoadPrivateKey(file string) (*ecdsa.PrivateKey, error)
• func RandKey() (*ecdsa.PrivateKey, error)
• func RandSerial() (*big.Int, error)
• type CertificatePair
  • func IssueTestCertificate(issuerKey *ecdsa.PrivateKey, issuerCert *x509.Certificate, clk clock.Clock, ...) (CertificatePair, error)

Functions

func IssueCertificate

func IssueCertificate(
	subjectKey crypto.PublicKey,
	issuerKey *ecdsa.PrivateKey,
	issuerCert, template *x509.Certificate) (*x509.Certificate, error)

IssueCertificate uses the provided issuerKey and issuerCert to issue a new X509 Certificate with the provided subjectKey based on the provided template.

func LoadCertificate

func LoadCertificate(file string) (*x509.Certificate, error)

LoadCertificate returns the *x509.Certificate loaded from the PEM encoded certificate in the provided file, or returns an error.

func LoadPrivateKey

func LoadPrivateKey(file string) (*ecdsa.PrivateKey, error)

LoadPrivateKey returns a *ecdsa.PrivateKey loaded from the BASE64 encoded DER of an ECDSA private key from the provided file, or returns an error.

func RandKey

func RandKey() (*ecdsa.PrivateKey, error)

RandKey generates a random ECDSA private key or returns an error.

func RandSerial

func RandSerial() (*big.Int, error)

RandSerial generates a random *bigInt to use as a certificate serial or returns an error.

Types

type CertificatePair

type CertificatePair struct {
	PreCert *x509.Certificate
	Cert    *x509.Certificate
}

CertificatePair is a struct for holding a precertificate and a matching final certificate.

func IssueTestCertificate

func IssueTestCertificate(
	issuerKey *ecdsa.PrivateKey,
	issuerCert *x509.Certificate,
	clk clock.Clock,
	windowStart *time.Time,
	windowEnd *time.Time) (CertificatePair, error)

If windowEnd is nil the certificate NotAfter will be set to 90 days after the current time based on the provided clock. If windowEnd is not nil then the certificate NotAfter will be set to the windowEnd minus one day.

This function creates certificates that will be submitted to public logs and so while they are not issued by a trusted root we try to avoid cablint errors to avoid requiring log monitors special-case our submissions.