ca

Documentation

Index

• type CertificateAuthorityImpl
  • func NewCertificateAuthorityImpl(config cmd.CAConfig, clk clock.Clock, stats metrics.Scope, issuers []Issuer, ...) (*CertificateAuthorityImpl, error)
  • func (ca *CertificateAuthorityImpl) GenerateOCSP(ctx context.Context, xferObj core.OCSPSigningRequest) ([]byte, error)
  • func (ca *CertificateAuthorityImpl) IssueCertificate(ctx context.Context, csr x509.CertificateRequest, regID int64) (core.Certificate, error)
• type Issuer

Types

type CertificateAuthorityImpl

type CertificateAuthorityImpl struct {
	SA        certificateStorage
	PA        core.PolicyAuthority
	Publisher core.Publisher
	// contains filtered or unexported fields
}

CertificateAuthorityImpl represents a CA that signs certificates, CRLs, and OCSP responses.

func NewCertificateAuthorityImpl

func NewCertificateAuthorityImpl(
	config cmd.CAConfig,
	clk clock.Clock,
	stats metrics.Scope,
	issuers []Issuer,
	keyPolicy goodkey.KeyPolicy,
	logger blog.Logger,
) (*CertificateAuthorityImpl, error)

NewCertificateAuthorityImpl creates a CA instance that can sign certificates from a single issuer (the first first in the issuers slice), and can sign OCSP for any of the issuer certificates provided.

func (*CertificateAuthorityImpl) GenerateOCSP

func (ca *CertificateAuthorityImpl) GenerateOCSP(ctx context.Context, xferObj core.OCSPSigningRequest) ([]byte, error)

GenerateOCSP produces a new OCSP response and returns it

func (*CertificateAuthorityImpl) IssueCertificate

func (ca *CertificateAuthorityImpl) IssueCertificate(ctx context.Context, csr x509.CertificateRequest, regID int64) (core.Certificate, error)

IssueCertificate attempts to convert a CSR into a signed Certificate, while enforcing all policies. Names (domains) in the CertificateRequest will be lowercased before storage. Currently it will always sign with the defaultIssuer.

type Issuer

type Issuer struct {
	Signer crypto.Signer
	Cert   *x509.Certificate
}

Issuer represents a single issuer certificate, along with its key.