cert_manager

Documentation

Index

• type AcmeClient
• type AcmeClientManager
• type CertDescription
  • func CertDescriptionFromDomain(domain domain.DomainName, keyType KeyType, autoSubDomains []string) CertDescription
  • func (n CertDescription) CertStoreName() string
  • func (n CertDescription) DomainNames() []domain.DomainName
  • func (n CertDescription) KeyStoreName() string
  • func (n CertDescription) LockName() string
  • func (n CertDescription) MetaStoreName() string
  • func (n CertDescription) String() string
  • func (n CertDescription) ZapField() zap.Field
• type DomainChecker
• type GetContext
• type KeyType
  • func (t KeyType) Generate() (crypto.Signer, error)
  • func (t KeyType) String() string
• type Manager
  • func New(acmeClientManager AcmeClientManager, c cache.Bytes, r prometheus.Registerer) *Manager
  • func (m *Manager) GetCertificate(hello *tls.ClientHelloInfo) (resultCert *tls.Certificate, err error)
  • func (m *Manager) HandleHTTPValidation(w http.ResponseWriter, r *http.Request) bool

Types

type AcmeClient

type AcmeClient interface {
	Accept(ctx context.Context, chal *acme.Challenge) (*acme.Challenge, error)
	AuthorizeOrder(ctx context.Context, id []acme.AuthzID, opt ...acme.OrderOption) (*acme.Order, error)
	CreateOrderCert(ctx context.Context, url string, csr []byte, bundle bool) (der [][]byte, certURL string, err error)
	GetAuthorization(ctx context.Context, url string) (*acme.Authorization, error)
	HTTP01ChallengeResponse(token string) (string, error)
	RevokeAuthorization(ctx context.Context, url string) error
	TLSALPN01ChallengeCert(token, domain string, opt ...acme.CertOption) (cert tls.Certificate, err error)
	WaitAuthorization(ctx context.Context, url string) (*acme.Authorization, error)
	WaitOrder(ctx context.Context, url string) (*acme.Order, error)
}

type AcmeClientManager

type AcmeClientManager interface {
	Close() error
	GetClient(ctx context.Context) (client *acme.Client, clientDisableFunc func(), err error)
}

type CertDescription

type CertDescription struct {
	MainDomain string
	KeyType    KeyType
	Subdomains []string
}

func CertDescriptionFromDomain

func CertDescriptionFromDomain(domain domain.DomainName, keyType KeyType, autoSubDomains []string) CertDescription

func (CertDescription) CertStoreName

func (n CertDescription) CertStoreName() string

func (CertDescription) DomainNames

func (n CertDescription) DomainNames() []domain.DomainName

func (CertDescription) KeyStoreName

func (n CertDescription) KeyStoreName() string

func (CertDescription) LockName

func (n CertDescription) LockName() string

func (CertDescription) MetaStoreName

func (n CertDescription) MetaStoreName() string

func (CertDescription) String

func (n CertDescription) String() string

func (CertDescription) ZapField

func (n CertDescription) ZapField() zap.Field

type DomainChecker

type DomainChecker interface {
	// IsDomainAllowed called for check domain for allow certificate
	// It can call concurrency for many domains same time
	// guarantee about domain will correct domain name (as minimum for character set)
	IsDomainAllowed(ctx context.Context, domain string) (bool, error)
}

type GetContext

type GetContext interface {
	GetContext() context.Context
}

type KeyType

type KeyType string

const KeyECDSA KeyType = "ecdsa"

const KeyRSA KeyType = "rsa"

func (KeyType) Generate

func (t KeyType) Generate() (crypto.Signer, error)

func (KeyType) String

func (t KeyType) String() string

type Manager

type Manager struct {
	CertificateIssueTimeout time.Duration
	Cache                   cache.Bytes

	// Subdomains, auto-issued with main domain.
	// Every subdomain must have suffix dot. For example: "www."
	AutoSubdomains []string

	DomainChecker           DomainChecker
	EnableHTTPValidation    bool
	EnableTLSValidation     bool
	SaveJSONMeta            bool
	AllowECDSACert          bool
	AllowRSACert            bool
	AllowInsecureTLSChipers bool
	// contains filtered or unexported fields
}

Manager interface inspired to https://godoc.org/golang.org/x/crypto/acme/autocert#Manager but not compatible guarantee

func New

func New(acmeClientManager AcmeClientManager, c cache.Bytes, r prometheus.Registerer) *Manager

func (*Manager) GetCertificate

func (m *Manager) GetCertificate(hello *tls.ClientHelloInfo) (resultCert *tls.Certificate, err error)

GetCertificate implements the tls.Config.GetCertificate hook.

func (*Manager) HandleHTTPValidation

func (m *Manager) HandleHTTPValidation(w http.ResponseWriter, r *http.Request) bool