pki

Documentation

Overview

Package pki contains bits and pieces to work with OpenVPN PKI related operations.

Index

• Constants
• func NewCRL(ca *CA, serials ...*big.Int) (string, error)
• func ReadCertFromPEM(s string) (*x509.Certificate, error)
• type CA
  • func NewCA() (*CA, error)
• type CertHolder
  • func NewClientCertHolder(ca *CA, username string) (*CertHolder, error)
  • func NewServerCertHolder(ca *CA) (*CertHolder, error)

Constants

const (
	PEMCertificateBlockType   string = "CERTIFICATE"
	PEMRSAPrivateKeyBlockType        = "RSA PRIVATE KEY"
	PEMx509CRLBlockType              = "X509 CRL"
	PEMCSRBlockType                  = "CERTIFICATE REQUEST"
)

PEM encoding types

Functions

func NewCRL

func NewCRL(ca *CA, serials ...*big.Int) (string, error)

NewCRL takes in a list of certificate serial numbers to-be-revoked and a CA then makes a PEM encoded CRL and returns it as a string.

func ReadCertFromPEM

func ReadCertFromPEM(s string) (*x509.Certificate, error)

ReadCertFromPEM decodes a PEM encoded string into a x509.Certificate.

Types

type CA

type CA struct {
	CertHolder
	CSR string
}

CA is a special type of CertHolder that also has a CSR in it.

func NewCA

func NewCA() (*CA, error)

NewCA returns a newly generated CA.

This will generate a public/private RSA keypair and a authority certificate signed by itself.

type CertHolder

type CertHolder struct {
	Cert string // PEM Encoded Certificate
	Key  string // PEM Encoded Private Key
}

CertHolder encapsulates a public certificate and the corresponding private key.

func NewClientCertHolder

func NewClientCertHolder(ca *CA, username string) (*CertHolder, error)

NewClientCertHolder generates a RSA key-pair and a x509 certificate signed by the CA for the client.

func NewServerCertHolder

func NewServerCertHolder(ca *CA) (*CertHolder, error)

NewServerCertHolder generates a RSA key-pair and a x509 certificate signed by the CA for the server.