ocsp

Documentation

Overview

Package ocsp exposes OCSP signing functionality, much like the signer package does for certificate signing. It also provies a basic OCSP responder stack for serving pre-signed OCSP responses.

Index

• type SignRequest
• type Signer
  • func NewSigner(issuer, responder *x509.Certificate, key crypto.Signer, interval time.Duration) (Signer, error)
  • func NewSignerFromFile(issuerFile, responderFile, keyFile string, interval time.Duration) (Signer, error)
• type StandardSigner
  • func (s StandardSigner) Sign(req SignRequest) ([]byte, error)

Types

type SignRequest

type SignRequest struct {
	Certificate *x509.Certificate
	Status      string
	Reason      int
	RevokedAt   time.Time
}

SignRequest represents the desired contents of a specific OCSP response.

type Signer

type Signer interface {
	Sign(req SignRequest) ([]byte, error)
}

Signer represents a general signer of OCSP responses. It is responsible for populating all fields in the OCSP response that are not reflected in the SignRequest.

func NewSigner

func NewSigner(issuer, responder *x509.Certificate, key crypto.Signer, interval time.Duration) (Signer, error)

NewSigner simply constructs a new StandardSigner object from the inputs, taking the interval in seconds

func NewSignerFromFile

func NewSignerFromFile(issuerFile, responderFile, keyFile string, interval time.Duration) (Signer, error)

NewSignerFromFile reads the issuer cert, the responder cert and the responder key from PEM files, and takes an interval in seconds

type StandardSigner

type StandardSigner struct {
	// contains filtered or unexported fields
}

StandardSigner is the default concrete type of OCSP signer. It represents a single responder (represented by a key and certificate) speaking for a single issuer (certificate). It is assumed that OCSP responses are issued at a regular interval, which is used to compute the nextUpdate value based on the current time.

func (StandardSigner) Sign

func (s StandardSigner) Sign(req SignRequest) ([]byte, error)

Sign is used with an OCSP signer to request the issuance of an OCSP response.