derivecert

Documentation

Overview

Package derivecert is used to deterministically generate TLS certificate authority and certificates out of pre-shared key

Index

• type CA
  • func CAFromPEM(p PEM) (*CA, string, error)
  • func NewCA(psk []byte) (*CA, error)
  • func (ca *CA) Key() *ecdsa.PrivateKey
  • func (ca *CA) NewServerCert(domains []string, configure ...func(*x509.Certificate)) (*PEM, error)
  • func (ca *CA) PEM() (*PEM, error)
• type PEM
  • func ToPEM(key *ecdsa.PrivateKey, certDer []byte) (*PEM, error)
  • func (p *PEM) KeyCert() (*ecdsa.PrivateKey, *x509.Certificate, error)
  • func (p *PEM) TLS() (tls.Certificate, error)

Types

type CA

type CA struct {
	// contains filtered or unexported fields
}

CA is certificate authority

func CAFromPEM

func CAFromPEM(p PEM) (*CA, string, error)

CAFromPEM loads CA from PEM encoded data

func NewCA

func NewCA(psk []byte) (*CA, error)

NewCA creates new certificate authority using a pre-shared key. This certificate authority is generated on the fly and would yield the same private key every time for the given PSK.

That allows services that have a certain pre-shared key (i.e. shared_secret) to have automatic TLS without need to share and distribute certs, and provides a better alternative to plaintext communication, but is not a replacement for proper mTLS.

func (*CA) Key

func (ca *CA) Key() *ecdsa.PrivateKey

Key returns CA private key

func (*CA) NewServerCert

func (ca *CA) NewServerCert(domains []string, configure ...func(*x509.Certificate)) (*PEM, error)

NewServerCert generates certificate for the given domain name(s)

func (*CA) PEM

func (ca *CA) PEM() (*PEM, error)

PEM returns PEM-encoded cert and key

type PEM

type PEM struct {
	Cert []byte
	Key  []byte
}

PEM representation of certificate authority data, serializable to JSON

func ToPEM

func ToPEM(key *ecdsa.PrivateKey, certDer []byte) (*PEM, error)

ToPEM converts private key and certificate into PEM representation

func (*PEM) KeyCert

func (p *PEM) KeyCert() (*ecdsa.PrivateKey, *x509.Certificate, error)

KeyCert parses private key and cert from PEM encoded format

func (*PEM) TLS

func (p *PEM) TLS() (tls.Certificate, error)

TLS parses PEM and returns TLS certificate