tls

Documentation

Index

• Variables
• func GetCertExpirationDate(certPEM []byte) (time.Time, error)
• func PEMToCertificate(certPEM []byte) (*x509.Certificate, error)
• type CertificateChain
  • func GenerateTLS(hosts string, validity string) (*CertificateChain, error)
• type CertificateManager
  • func NewCertificateManager(hosts string, validity string) (*CertificateManager, error)
  • func (cm *CertificateManager) GenerateCA() error
  • func (cm *CertificateManager) GenerateClient() error
  • func (cm *CertificateManager) GeneratePeer() error
  • func (cm *CertificateManager) GenerateServer() error
  • func (cm *CertificateManager) LoadCA(caCertBytes []byte, caKeyBytes []byte, expirationThreshold time.Duration) error
  • func (cm *CertificateManager) NewChain() error
• type ClientCertificate
  • func GenerateClientCertificate(req ClientCertificateRequest, signerCert *x509.Certificate, ...) (*ClientCertificate, error)
• type ClientCertificateRequest
• type PeerCertificate
  • func GeneratePeerCertificate(req PeerCertificateRequest, signerCert *x509.Certificate, ...) (*PeerCertificate, error)
• type PeerCertificateRequest
• type SeparatedCertHosts
  • func NewSeparatedCertHosts(hosts string) *SeparatedCertHosts
  • func (sh *SeparatedCertHosts) Validate() error
• type ServerCertificate
  • func GenerateServerCertificate(req ServerCertificateRequest, signerCert *x509.Certificate, ...) (*ServerCertificate, error)
• type ServerCertificateRequest

Variables

var (
	// ErrInvalidHostName is returned when you have a hostname that has already been covered by a wildcard hostname
	ErrInvalidHostName = errors.New("invalid host name, this has been already covered by the wildcard")

	// ErrInvalidCA will be returned if the provided CA is invalid
	ErrInvalidCA = errors.New("the CA provided is not valid")

	// ErrEmptyCA will be returned if the CA provided was empty
	ErrEmptyCA = errors.New("an empty CA was provided")

	// ErrExpiredCA will be returned if the CA does not meet the required threshold of validity
	ErrExpiredCA = errors.New("the CA provided will expired before the provided threshold")
)

Functions

func GetCertExpirationDate

func GetCertExpirationDate(certPEM []byte) (time.Time, error)

GetCertExpirationDate will return a PEM encoded certificate's expiration date

func PEMToCertificate

func PEMToCertificate(certPEM []byte) (*x509.Certificate, error)

Types

type CertificateChain

type CertificateChain struct {
	CAKey      string `mapstructure:"caKey"`
	CACert     string `mapstructure:"caCert"`
	ServerKey  string `mapstructure:"serverKey"`
	ServerCert string `mapstructure:"serverCert"`
	ClientKey  string `mapstructure:"clientKey"`
	ClientCert string `mapstructure:"clientCert"`
	PeerKey    string `mapstructure:"peerKey"`
	PeerCert   string `mapstructure:"peerCert"`
}

CertificateChain represents a full certificate chain with a root CA, a server, client and peer certificate All values are in PEM format

func GenerateTLS

func GenerateTLS(hosts string, validity string) (*CertificateChain, error)

GenerateTLS generates ca, server, client and peer TLS certificates. hosts: Comma-separated hostnames and IPs to generate a certificate for validity: Duration that certificate is valid for, in Go Duration format

type CertificateManager

type CertificateManager struct {
	Chain *CertificateChain
	// contains filtered or unexported fields
}

CertificateManager contains a certificate chain and methods to generate certificates on that chain

func NewCertificateManager

func NewCertificateManager(hosts string, validity string) (*CertificateManager, error)

NewCertificateManager will return a new instance of the CertificateManager

func (*CertificateManager) GenerateCA

func (cm *CertificateManager) GenerateCA() error

GenerateCA will generate a new certificate authority

func (*CertificateManager) GenerateClient

func (cm *CertificateManager) GenerateClient() error

GenerateClient will generate a new client TLS certificate signed by the CA within the chain

func (*CertificateManager) GeneratePeer

func (cm *CertificateManager) GeneratePeer() error

GeneratePeer will generate a new peer TLS certificate signed by the CA within the chain

func (*CertificateManager) GenerateServer

func (cm *CertificateManager) GenerateServer() error

GenerateServer will generate a new server TLS certificate signed by the CA within the chain

func (*CertificateManager) LoadCA

func (cm *CertificateManager) LoadCA(caCertBytes []byte, caKeyBytes []byte, expirationThreshold time.Duration) error

LoadCA will load an existing certifiate authority into the CertificateManager and underlying chain

func (*CertificateManager) NewChain

func (cm *CertificateManager) NewChain() error

NewChain generates ca, server, client and peer TLS certificates. hosts: Comma-separated hostnames and IPs to generate a certificate for validity: Duration that certificate is valid for, in Go Duration format

type ClientCertificate

type ClientCertificate struct {
	Certificate []byte
	Key         []byte
}

ClientCertificate contains the generated certificate and key in PEM encoded format.

func GenerateClientCertificate

func GenerateClientCertificate(req ClientCertificateRequest, signerCert *x509.Certificate, signerKey crypto.Signer) (*ClientCertificate, error)

GenerateClientCertificate generates client TLS certificate and key signed by a parent CA.

type ClientCertificateRequest

type ClientCertificateRequest struct {
	Subject  pkix.Name
	Validity time.Duration
	// contains filtered or unexported fields
}

ClientCertificateRequest contains a set of options configurable for client certificate generation

type PeerCertificate

type PeerCertificate struct {
	Certificate []byte
	Key         []byte
}

PeerCertificate contains the generated certificate and key in PEM encoded format.

func GeneratePeerCertificate

func GeneratePeerCertificate(req PeerCertificateRequest, signerCert *x509.Certificate, signerKey crypto.Signer) (*PeerCertificate, error)

GeneratePeerCertificate generates peer TLS certificate and key signed by a parent CA.

type PeerCertificateRequest

type PeerCertificateRequest struct {
	Subject     pkix.Name
	Validity    time.Duration
	DNSNames    []string
	IPAddresses []net.IP
	// contains filtered or unexported fields
}

PeerCertificateRequest contains a set of options configurable for peer certificate generation.

type SeparatedCertHosts

type SeparatedCertHosts struct {
	WildCardHosts []string
	Hosts         []string
	IPs           []net.IP
}

func NewSeparatedCertHosts

func NewSeparatedCertHosts(hosts string) *SeparatedCertHosts

NewSeparatedCertHosts creates a new seperatedCertsHosts struct by parsing and separating the comma-separated host names and IPs.

func (*SeparatedCertHosts) Validate

func (sh *SeparatedCertHosts) Validate() error

Validate validates the hostnames in case of wildCard host is present eg.: *.foo.bar boo.foo.bar is not allowed, but coo.boo.foo.bar is valid

type ServerCertificate

type ServerCertificate struct {
	Certificate []byte
	Key         []byte
}

ServerCertificate contains the generated certificate and key in PEM encoded format.

func GenerateServerCertificate

func GenerateServerCertificate(req ServerCertificateRequest, signerCert *x509.Certificate, signerKey crypto.Signer) (*ServerCertificate, error)

GenerateServerCertificate generates server TLS certificate and key signed by a parent CA.

type ServerCertificateRequest

type ServerCertificateRequest struct {
	Subject     pkix.Name
	Validity    time.Duration
	DNSNames    []string
	IPAddresses []net.IP
	// contains filtered or unexported fields
}

ServerCertificateRequest contains a set of options configurable for server certificate generation.