apiv1

package
v0.15.9-rc5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 18, 2021 License: Apache-2.0 Imports: 11 Imported by: 3

Documentation

Index

Constants

View Source 
const (
	// DefaultCAS is a CertificateAuthorityService using software.
	DefaultCAS = ""
	// SoftCAS is a CertificateAuthorityService using software.
	SoftCAS = "softcas"
	// CloudCAS is a CertificateAuthorityService using Google Cloud CAS.
	CloudCAS = "cloudcas"
)

Variables

This section is empty.

Functions

func CreateCertificateAuthorityExtension 

func CreateCertificateAuthorityExtension(typ Type, certificateID string, keyValuePairs ...string) (pkix.Extension, error)

CreateCertificateAuthorityExtension returns a X.509 extension that shows the CAS type, id and a list of optional key value pairs.

func FindCertificateAuthorityExtension 

func FindCertificateAuthorityExtension(cert *x509.Certificate) (pkix.Extension, bool)

FindCertificateAuthorityExtension returns the certificate authority extension from a signed certificate.

func Register 

func Register(t Type, fn CertificateAuthorityServiceNewFunc)

Register adds to the registry a method to create a KeyManager of type t.

func RemoveCertificateAuthorityExtension 

func RemoveCertificateAuthorityExtension(cert *x509.Certificate)

RemoveCertificateAuthorityExtension removes the certificate authority extension from a certificate template.

Types

type CertificateAuthorityCreator added in v0.15.6 

type CertificateAuthorityCreator interface {
	CreateCertificateAuthority(req *CreateCertificateAuthorityRequest) (*CreateCertificateAuthorityResponse, error)
}

CertificateAuthorityCreator is an interface implamented by a CertificateAuthorityService that has a method to create a new certificate authority.

type CertificateAuthorityExtension 

type CertificateAuthorityExtension struct {
	Type          string
	CertificateID string   `asn1:"optional,omitempty"`
	KeyValuePairs []string `asn1:"optional,omitempty"`
}

CertificateAuthorityExtension type is used to encode the certificate authority extension.

type CertificateAuthorityGetter 

type CertificateAuthorityGetter interface {
	GetCertificateAuthority(req *GetCertificateAuthorityRequest) (*GetCertificateAuthorityResponse, error)
}

CertificateAuthorityGetter is an interface implemented by a CertificateAuthorityService that has a method to get the root certificate.

type CertificateAuthorityService 

type CertificateAuthorityService interface {
	CreateCertificate(req *CreateCertificateRequest) (*CreateCertificateResponse, error)
	RenewCertificate(req *RenewCertificateRequest) (*RenewCertificateResponse, error)
	RevokeCertificate(req *RevokeCertificateRequest) (*RevokeCertificateResponse, error)
}

CertificateAuthorityService is the interface implemented to support external certificate authorities.

type CertificateAuthorityServiceNewFunc 

type CertificateAuthorityServiceNewFunc func(ctx context.Context, opts Options) (CertificateAuthorityService, error)

CertificateAuthorityServiceNewFunc is the type that represents the method to initialize a new CertificateAuthorityService.

func LoadCertificateAuthorityServiceNewFunc 

func LoadCertificateAuthorityServiceNewFunc(t Type) (CertificateAuthorityServiceNewFunc, bool)

LoadCertificateAuthorityServiceNewFunc returns the function initialize a KayManager.

type CertificateAuthorityType added in v0.15.6 

type CertificateAuthorityType int

CertificateAuthorityType indicates the type of Certificate Authority to create. 

const (
	// RootCA is the type used to create a self-signed certificate suitable for
	// use as a root CA.
	RootCA CertificateAuthorityType = iota + 1

	// IntermediateCA is the type used to create a subordinated certificate that
	// can be used to sign additional leaf certificates.
	IntermediateCA
)

type CreateCertificateAuthorityRequest added in v0.15.6 

type CreateCertificateAuthorityRequest struct {
	Name      string
	Type      CertificateAuthorityType
	Template  *x509.Certificate
	Lifetime  time.Duration
	Backdate  time.Duration
	RequestID string
	Project   string
	Location  string

	// Parent is the signer of the new CertificateAuthority.
	Parent *CreateCertificateAuthorityResponse

	// CreateKey defines the KMS CreateKeyRequest to use when creating a new
	// CertificateAuthority. If CreateKey is nil, a default algorithm will be
	// used.
	CreateKey *apiv1.CreateKeyRequest
}

CreateCertificateAuthorityRequest is the request used to generate a root or intermediate certificate.

type CreateCertificateAuthorityResponse added in v0.15.6 

type CreateCertificateAuthorityResponse struct {
	Name             string
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
	PublicKey        crypto.PublicKey
	PrivateKey       crypto.PrivateKey
	Signer           crypto.Signer
}

CreateCertificateAuthorityResponse is the response for CreateCertificateAuthority method and contains the root or intermediate certificate generated as well as the CA chain.

type CreateCertificateRequest 

type CreateCertificateRequest struct {
	Template  *x509.Certificate
	Lifetime  time.Duration
	Backdate  time.Duration
	RequestID string
}

CreateCertificateRequest is the request used to sign a new certificate.

type CreateCertificateResponse 

type CreateCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

CreateCertificateResponse is the response to a create certificate request.

type GetCertificateAuthorityRequest 

type GetCertificateAuthorityRequest struct {
	Name string
}

GetCertificateAuthorityRequest is the request used to get the root certificate from a CAS.

type GetCertificateAuthorityResponse 

type GetCertificateAuthorityResponse struct {
	RootCertificate *x509.Certificate
}

GetCertificateAuthorityResponse is the response that contains the root certificate.

type Options 

type Options struct {
	// The type of the CAS to use.
	Type string `json:"type"`

	// Path to the credentials file used in CloudCAS
	CredentialsFile string `json:"credentialsFile"`

	// CertificateAuthority reference. In CloudCAS the format is
	// `projects/*/locations/*/certificateAuthorities/*`.
	CertificateAuthority string `json:"certificateAuthority"`

	// Certificate and signer are the issuer certificate,along with any other bundled certificates to be returned in the chain for consumers, and signer used in SoftCAS.
	// They are configured in ca.json crt and key properties.
	CertificateChain []*x509.Certificate
	Signer           crypto.Signer `json:"-"`

	// IsCreator is set to true when we're creating a certificate authority. Is
	// used to skip some validations when initializing a CertificateAuthority.
	IsCreator bool `json:"-"`

	// KeyManager is the KMS used to generate keys in SoftCAS.
	KeyManager kms.KeyManager `json:"-"`

	// Project and Location are parameters used in CloudCAS to create a new
	// certificate authority.
	Project  string `json:"-"`
	Location string `json:"-"`
}

Options represents the configuration options used to select and configure the CertificateAuthorityService (CAS) to use.

func (*Options) Is 

func (o *Options) Is(t Type) bool

Is returns if the options have the given type.

func (*Options) Validate 

func (o *Options) Validate() error

Validate checks the fields in Options.

type RenewCertificateRequest 

type RenewCertificateRequest struct {
	Template  *x509.Certificate
	Lifetime  time.Duration
	Backdate  time.Duration
	RequestID string
}

RenewCertificateRequest is the request used to re-sign a certificate.

type RenewCertificateResponse 

type RenewCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

RenewCertificateResponse is the response to a renew certificate request.

type RevokeCertificateRequest 

type RevokeCertificateRequest struct {
	Certificate *x509.Certificate
	Reason      string
	ReasonCode  int
	RequestID   string
}

RevokeCertificateRequest is the request used to revoke a certificate.

type RevokeCertificateResponse 

type RevokeCertificateResponse struct {
	Certificate      *x509.Certificate
	CertificateChain []*x509.Certificate
}

RevokeCertificateResponse is the response to a revoke certificate request.

type SignatureAlgorithm added in v0.15.6 

type SignatureAlgorithm int

SignatureAlgorithm used for cryptographic signing. 

const (
	// Not specified.
	UnspecifiedSignAlgorithm SignatureAlgorithm = iota
	// RSASSA-PKCS1-v1_5 key and a SHA256 digest.
	SHA256WithRSA
	// RSASSA-PKCS1-v1_5 key and a SHA384 digest.
	SHA384WithRSA
	// RSASSA-PKCS1-v1_5 key and a SHA512 digest.
	SHA512WithRSA
	// RSASSA-PSS key with a SHA256 digest.
	SHA256WithRSAPSS
	// RSASSA-PSS key with a SHA384 digest.
	SHA384WithRSAPSS
	// RSASSA-PSS key with a SHA512 digest.
	SHA512WithRSAPSS
	// ECDSA on the NIST P-256 curve with a SHA256 digest.
	ECDSAWithSHA256
	// ECDSA on the NIST P-384 curve with a SHA384 digest.
	ECDSAWithSHA384
	// ECDSA on the NIST P-521 curve with a SHA512 digest.
	ECDSAWithSHA512
	// EdDSA on Curve25519 with a SHA512 digest.
	PureEd25519
)

type Type 

type Type string

Type represents the CAS type used.

func (Type) String 

func (t Type) String() string

String returns a string from the type. It will always return the lower case version of the Type, as we need a standard type to compare and use as the registry key.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.