authority

Documentation

Index

• Variables
• type AuthConfig
  • func (c *AuthConfig) Validate(audiences provisioner.Audiences) error
• type Authority
  • func New(config *Config, opts ...Option) (*Authority, error)
  • func (a *Authority) Authorize(ott string) ([]provisioner.SignOption, error)
  • func (a *Authority) AuthorizeSign(ott string) ([]provisioner.SignOption, error)
  • func (a *Authority) GetDatabase() db.AuthDB
  • func (a *Authority) GetEncryptedKey(kid string) (string, error)
  • func (a *Authority) GetFederation() (federation []*x509.Certificate, err error)
  • func (a *Authority) GetProvisioners(cursor string, limit int) (provisioner.List, string, error)
  • func (a *Authority) GetRootCertificate() *x509.Certificate
  • func (a *Authority) GetRootCertificates() []*x509.Certificate
  • func (a *Authority) GetRoots() ([]*x509.Certificate, error)
  • func (a *Authority) GetTLSCertificate() (*tls.Certificate, error)
  • func (a *Authority) GetTLSOptions() *tlsutil.TLSOptions
  • func (a *Authority) LoadProvisionerByCertificate(crt *x509.Certificate) (provisioner.Interface, error)
  • func (a *Authority) Renew(oldCert *x509.Certificate) (*x509.Certificate, *x509.Certificate, error)
  • func (a *Authority) Revoke(opts *RevokeOptions) error
  • func (a *Authority) Root(sum string) (*x509.Certificate, error)
  • func (a *Authority) Shutdown() error
  • func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Options, ...) (*x509.Certificate, *x509.Certificate, error)
• type Claims
• type Config
  • func LoadConfiguration(filename string) (*Config, error)
  • func (c *Config) Save(filename string) error
  • func (c *Config) Validate() error
• type Option
  • func WithDatabase(db db.AuthDB) Option
• type RevokeOptions

Variables

var (
	// DefaultTLSOptions represents the default TLS version as well as the cipher
	// suites used in the TLS certificates.
	DefaultTLSOptions = tlsutil.TLSOptions{
		CipherSuites: x509util.CipherSuites{
			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
		},
		MinVersion:    1.2,
		MaxVersion:    1.2,
		Renegotiation: false,
	}
)

Types

type AuthConfig

type AuthConfig struct {
	Provisioners         provisioner.List    `json:"provisioners"`
	Template             *x509util.ASN1DN    `json:"template,omitempty"`
	Claims               *provisioner.Claims `json:"claims,omitempty"`
	DisableIssuedAtCheck bool                `json:"disableIssuedAtCheck,omitempty"`
}

AuthConfig represents the configuration options for the authority.

func (*AuthConfig) Validate

func (c *AuthConfig) Validate(audiences provisioner.Audiences) error

Validate validates the authority configuration.

type Authority

type Authority struct {
	// contains filtered or unexported fields
}

Authority implements the Certificate Authority internal interface.

func New

func New(config *Config, opts ...Option) (*Authority, error)

New creates and initiates a new Authority type.

func (*Authority) Authorize

func (a *Authority) Authorize(ott string) ([]provisioner.SignOption, error)

Authorize is a passthrough to AuthorizeSign. NOTE: Authorize will be deprecated in a future release. Please use the context specific Authorize[Sign|Revoke|etc.] going forwards.

func (*Authority) AuthorizeSign

func (a *Authority) AuthorizeSign(ott string) ([]provisioner.SignOption, error)

AuthorizeSign authorizes a signature request by validating and authenticating a OTT that must be sent w/ the request.

func (*Authority) GetDatabase

func (a *Authority) GetDatabase() db.AuthDB

GetDatabase returns the authority database. If the configuration does not define a database, GetDatabase will return a db.SimpleDB instance.

func (*Authority) GetEncryptedKey

func (a *Authority) GetEncryptedKey(kid string) (string, error)

GetEncryptedKey returns the JWE key corresponding to the given kid argument.

func (*Authority) GetFederation

func (a *Authority) GetFederation() (federation []*x509.Certificate, err error)

GetFederation returns all the root certificates in the federation. This method implements the Authority interface.

func (*Authority) GetProvisioners

func (a *Authority) GetProvisioners(cursor string, limit int) (provisioner.List, string, error)

GetProvisioners returns a map listing each provisioner and the JWK Key Set with their public keys.

func (*Authority) GetRootCertificate

func (a *Authority) GetRootCertificate() *x509.Certificate

GetRootCertificate returns the server root certificate.

func (*Authority) GetRootCertificates

func (a *Authority) GetRootCertificates() []*x509.Certificate

GetRootCertificates returns the server root certificates.

In the Authority interface we also have a similar method, GetRoots, at the moment the functionality of these two methods are almost identical, but this method is intended to be used internally by CA HTTP server to load the roots that will be set in the tls.Config while GetRoots will be used by the Authority interface and might have extra checks in the future.

func (*Authority) GetRoots

func (a *Authority) GetRoots() ([]*x509.Certificate, error)

GetRoots returns all the root certificates for this CA. This method implements the Authority interface.

func (*Authority) GetTLSCertificate

func (a *Authority) GetTLSCertificate() (*tls.Certificate, error)

GetTLSCertificate creates a new leaf certificate to be used by the CA HTTPS server.

func (*Authority) GetTLSOptions

func (a *Authority) GetTLSOptions() *tlsutil.TLSOptions

GetTLSOptions returns the tls options configured.

func (*Authority) LoadProvisionerByCertificate

func (a *Authority) LoadProvisionerByCertificate(crt *x509.Certificate) (provisioner.Interface, error)

LoadProvisionerByCertificate returns an interface to the provisioner that provisioned the certificate.

func (*Authority) Renew

func (a *Authority) Renew(oldCert *x509.Certificate) (*x509.Certificate, *x509.Certificate, error)

Renew creates a new Certificate identical to the old certificate, except with a validity window that begins 'now'.

func (*Authority) Revoke

func (a *Authority) Revoke(opts *RevokeOptions) error

Revoke revokes a certificate.

NOTE: Only supports passive revocation - prevent existing certificates from being renewed.

TODO: Add OCSP and CRL support.

func (*Authority) Root

func (a *Authority) Root(sum string) (*x509.Certificate, error)

Root returns the certificate corresponding to the given SHA sum argument.

func (*Authority) Shutdown

func (a *Authority) Shutdown() error

Shutdown safely shuts down any clients, databases, etc. held by the Authority.

func (*Authority) Sign

func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Options, extraOpts ...provisioner.SignOption) (*x509.Certificate, *x509.Certificate, error)

Sign creates a signed certificate from a certificate signing request.

type Claims

type Claims struct {
	jose.Claims
	SANs  []string `json:"sans,omitempty"`
	Email string   `json:"email,omitempty"`
	Nonce string   `json:"nonce,omitempty"`
}

Claims extends jose.Claims with step attributes.

type Config

type Config struct {
	Root             multiString         `json:"root"`
	FederatedRoots   []string            `json:"federatedRoots"`
	IntermediateCert string              `json:"crt"`
	IntermediateKey  string              `json:"key"`
	Address          string              `json:"address"`
	DNSNames         []string            `json:"dnsNames"`
	Logger           json.RawMessage     `json:"logger,omitempty"`
	DB               *db.Config          `json:"db,omitempty"`
	Monitoring       json.RawMessage     `json:"monitoring,omitempty"`
	AuthorityConfig  *AuthConfig         `json:"authority,omitempty"`
	TLS              *tlsutil.TLSOptions `json:"tls,omitempty"`
	Password         string              `json:"password,omitempty"`
}

Config represents the CA configuration and it's mapped to a JSON object.

func LoadConfiguration

func LoadConfiguration(filename string) (*Config, error)

LoadConfiguration parses the given filename in JSON format and returns the configuration struct.

func (*Config) Save

func (c *Config) Save(filename string) error

Save saves the configuration to the given filename.

func (*Config) Validate

func (c *Config) Validate() error

Validate validates the configuration.

type Option

type Option func(*Authority)

Option sets options to the Authority.

func WithDatabase

func WithDatabase(db db.AuthDB) Option

WithDatabase sets an already initialized authority database to a new authority. This option is intended to be use on graceful reloads.

type RevokeOptions

type RevokeOptions struct {
	Serial      string
	Reason      string
	ReasonCode  int
	PassiveOnly bool
	MTLS        bool
	Crt         *x509.Certificate
	OTT         string
	// contains filtered or unexported fields
}

RevokeOptions are the options for the Revoke API.