tls

Documentation

Overview

Package tls implements helpful wrappers for dealing with TLS certificates.

Index

• func ExportPEM(cert *tls.Certificate) ([]byte, []byte, error)
• func Generate(commonName string) (*tls.Certificate, error)
• func ImportCertificatePEM(certPEM []byte) (*tls.Certificate, error)
• func ImportKeyPEM(keyPEM []byte) (interface{}, error)
• func ImportPEM(certPEM, keyPEM []byte) (*tls.Certificate, error)
• func Load(certPath, keyPath string) (*tls.Certificate, error)
• func LoadCertificate(certPath string) (*tls.Certificate, error)
• func LoadFromKey(keyPath, commonName string) (*tls.Certificate, error)
• func LoadOrGenerate(certPath, keyPath, commonName string) (*tls.Certificate, error)
• func Save(certPath, keyPath string, cert *tls.Certificate) error
• func SaveKey(keyPath string, cert *tls.Certificate) error
• func VerifyCertificate(rawCerts [][]byte, opts VerifyOptions) error
• type VerifyOptions

Functions

func ExportPEM

func ExportPEM(cert *tls.Certificate) ([]byte, []byte, error)

ExportPEM saves a TLS certificate and private key into PEM blobs.

func Generate

func Generate(commonName string) (*tls.Certificate, error)

Generate generates a new TLS certificate.

func ImportCertificatePEM

func ImportCertificatePEM(certPEM []byte) (*tls.Certificate, error)

ImportCertificatePEM loads a TLS certificate from an in-memory PEM blob.

func ImportKeyPEM

func ImportKeyPEM(keyPEM []byte) (interface{}, error)

ImportKeyPEM loads a private key from an in-memory PEM blob.

func ImportPEM

func ImportPEM(certPEM, keyPEM []byte) (*tls.Certificate, error)

ImportPEM loads a TLS certificate and private key from in-memory PEM blobs.

func Load

func Load(certPath, keyPath string) (*tls.Certificate, error)

Load loads a TLS certificate and private key.

func LoadCertificate

func LoadCertificate(certPath string) (*tls.Certificate, error)

LoadCertificate loads a TLS certificate.

func LoadFromKey

func LoadFromKey(keyPath, commonName string) (*tls.Certificate, error)

LoadFromKey loads a private key and regenerates the whole certificate from it.

func LoadOrGenerate

func LoadOrGenerate(certPath, keyPath, commonName string) (*tls.Certificate, error)

LoadOrGenerate loads a TLS certificate and private key, or generates one iff they do not exist.

func Save

func Save(certPath, keyPath string, cert *tls.Certificate) error

Save saves a TLS certificate and private key.

func SaveKey

func SaveKey(keyPath string, cert *tls.Certificate) error

SaveKey saves the private key from a certificate to a file.

func VerifyCertificate

func VerifyCertificate(rawCerts [][]byte, opts VerifyOptions) error

VerifyCertificate verifies a TLS certificate as required by Oasis Core. Instead of using CAs, public key pinning is used and certificates must follow the template.

Types

type VerifyOptions

type VerifyOptions struct {
	// CommonName is the expected certificate common name.
	CommonName string

	// Keys is the set of public keys that are allowed to sign the certificate.
	Keys map[signature.PublicKey]bool

	// AllowUnknownKeys specifies whether any key will be allowed iff Keys is nil.
	AllowUnknownKeys bool

	// AllowNoCertificate specifies whether connections presenting no certificates will be allowed.
	AllowNoCertificate bool
}

VerifyOptions are the certificate verification options.