pki

Documentation

Index

• func GetConfigPath() string
• func GetDBPath() string
• func GetOTTKeyPath() string
• func GetProfileConfigPath() string
• func GetProvisionerKey(caURL, rootFile, kid string) (string, error)
• func GetProvisioners(caURL, rootFile string) (provisioner.List, error)
• func GetPublicPath() string
• func GetRootCAPath() string
• func GetSecretsPath() string
• func GetTemplatesPath() string
• type ConfigOption
• type DeploymentType
  • func (d DeploymentType) String() string
• type Option
  • func WithACME() Option
  • func WithAddress(s string) Option
  • func WithAdmin() Option
  • func WithCaURL(s string) Option
  • func WithDNSNames(s []string) Option
  • func WithDeploymentType(dt DeploymentType) Option
  • func WithHelm() Option
  • func WithKMS(name string) Option
  • func WithKeyURIs(rootKey, intermediateKey, hostKey, userKey string) Option
  • func WithNoDB() Option
  • func WithPKIOnly() Option
  • func WithProvisioner(s string) Option
  • func WithSSH() Option
• type PKI
  • func New(o apiv1.Options, opts ...Option) (*PKI, error)
  • func (p *PKI) CreateCertificateAuthorityResponse(cert *x509.Certificate, key crypto.PrivateKey) *apiv1.CreateCertificateAuthorityResponse
  • func (p *PKI) GenerateConfig(opt ...ConfigOption) (*authconfig.Config, error)
  • func (p *PKI) GenerateIntermediateCertificate(name, org, resource string, parent *apiv1.CreateCertificateAuthorityResponse, ...) error
  • func (p *PKI) GenerateKeyPairs(pass []byte) error
  • func (p *PKI) GenerateRootCertificate(name, org, resource string, pass []byte) (*apiv1.CreateCertificateAuthorityResponse, error)
  • func (p *PKI) GenerateSSHSigningKeys(password []byte) error
  • func (p *PKI) GetCAConfigPath() string
  • func (p *PKI) GetCertificateAuthority() error
  • func (p *PKI) GetRootFingerprint() string
  • func (p *PKI) Save(opt ...ConfigOption) error
  • func (p *PKI) WriteFiles() error
  • func (p *PKI) WriteHelmTemplate(w io.Writer) error
  • func (p *PKI) WriteRootCertificate(rootCrt *x509.Certificate, rootKey interface{}, pass []byte) error

Functions

func GetConfigPath

func GetConfigPath() string

GetConfigPath returns the directory where the configuration files are stored based on the STEPPATH environment variable.

func GetDBPath

func GetDBPath() string

GetDBPath returns the path where the file-system persistence is stored based on the STEPPATH environment variable.

func GetOTTKeyPath

func GetOTTKeyPath() string

GetOTTKeyPath returns the path where the one-time token key is stored based on the STEPPATH environment variable.

func GetProfileConfigPath

func GetProfileConfigPath() string

GetProfileConfigPath returns the directory where the profile configuration files are stored based on the STEPPATH environment variable.

func GetProvisionerKey

func GetProvisionerKey(caURL, rootFile, kid string) (string, error)

GetProvisionerKey returns the encrypted provisioner key with the for the given kid.

func GetProvisioners

func GetProvisioners(caURL, rootFile string) (provisioner.List, error)

GetProvisioners returns the map of provisioners on the given CA.

func GetPublicPath

func GetPublicPath() string

GetPublicPath returns the directory where the public keys are stored based on the STEPPATH environment variable.

func GetRootCAPath

func GetRootCAPath() string

GetRootCAPath returns the path where the root CA is stored based on the STEPPATH environment variable.

func GetSecretsPath

func GetSecretsPath() string

GetSecretsPath returns the directory where the private keys are stored based on the STEPPATH environment variable.

func GetTemplatesPath

func GetTemplatesPath() string

GetTemplatesPath returns the path where the templates are stored.

Types

type ConfigOption

type ConfigOption func(c *authconfig.Config) error

ConfigOption is the type for modifiers over the auth config object.

type DeploymentType

type DeploymentType int

DeploymentType defines witch type of deployment a user is initializing

const (
	// StandaloneDeployment is a deployment where all the components like keys,
	// provisioners, admins, certificates and others are managed by the user.
	StandaloneDeployment DeploymentType = iota
	// LinkedDeployment is a deployment where the keys are managed by the user,
	// but provisioners, admins and the record of certificates are managed in
	// the cloud.
	LinkedDeployment
	// HostedDeployment is a deployment where all the components are managed in
	// the cloud by smallstep.com/certificate-manager.
	HostedDeployment
)

func (DeploymentType) String

func (d DeploymentType) String() string

String returns the string version of the deployment type.

type Option

type Option func(p *PKI)

Option is the type of a configuration option on the pki constructor.

func WithACME

func WithACME() Option

WithACME enables acme provisioner in step-ca.

func WithAddress

func WithAddress(s string) Option

WithAddress sets the listen address of step-ca.

func WithAdmin

func WithAdmin() Option

WithAdmin enables the admin api in step-ca.

func WithCaURL

func WithCaURL(s string) Option

WithCaURL sets the default ca-url of step-ca.

func WithDNSNames

func WithDNSNames(s []string) Option

WithDNSNames sets the SANs of step-ca.

func WithDeploymentType

func WithDeploymentType(dt DeploymentType) Option

WithDeploymentType defines the deployment type of step-ca.

func WithHelm

func WithHelm() Option

WithHelm configures the pki to create a helm values.yaml.

func WithKMS

func WithKMS(name string) Option

WithKMS enables the kms with the given name.

func WithKeyURIs

func WithKeyURIs(rootKey, intermediateKey, hostKey, userKey string) Option

WithKeyURIs defines the key uris for X.509 and SSH keys.

func WithNoDB

func WithNoDB() Option

WithNoDB disables the db in step-ca.

func WithPKIOnly

func WithPKIOnly() Option

WithPKIOnly will only generate the PKI without the step-ca config files.

func WithProvisioner

func WithProvisioner(s string) Option

WithProvisioner defines the name of the default provisioner.

func WithSSH

func WithSSH() Option

WithSSH enables ssh in step-ca.

type PKI

type PKI struct {
	linkedca.Configuration
	Defaults linkedca.Defaults
	// contains filtered or unexported fields
}

PKI represents the Public Key Infrastructure used by a certificate authority.

func New

func New(o apiv1.Options, opts ...Option) (*PKI, error)

New creates a new PKI configuration.

func (*PKI) CreateCertificateAuthorityResponse

func (p *PKI) CreateCertificateAuthorityResponse(cert *x509.Certificate, key crypto.PrivateKey) *apiv1.CreateCertificateAuthorityResponse

CreateCertificateAuthorityResponse returns a CreateCertificateAuthorityResponse that can be used as a parent of a CreateCertificateAuthority request.

func (*PKI) GenerateConfig

func (p *PKI) GenerateConfig(opt ...ConfigOption) (*authconfig.Config, error)

GenerateConfig returns the step certificates configuration.

func (*PKI) GenerateIntermediateCertificate

func (p *PKI) GenerateIntermediateCertificate(name, org, resource string, parent *apiv1.CreateCertificateAuthorityResponse, pass []byte) error

GenerateIntermediateCertificate generates an intermediate certificate with the given name and using the default key type.

func (*PKI) GenerateKeyPairs

func (p *PKI) GenerateKeyPairs(pass []byte) error

GenerateKeyPairs generates the key pairs used by the certificate authority.

func (*PKI) GenerateRootCertificate

func (p *PKI) GenerateRootCertificate(name, org, resource string, pass []byte) (*apiv1.CreateCertificateAuthorityResponse, error)

GenerateRootCertificate generates a root certificate with the given name and using the default key type.

func (*PKI) GenerateSSHSigningKeys

func (p *PKI) GenerateSSHSigningKeys(password []byte) error

GenerateSSHSigningKeys generates and encrypts a private key used for signing SSH user certificates and a private key used for signing host certificates.

func (*PKI) GetCAConfigPath

func (p *PKI) GetCAConfigPath() string

GetCAConfigPath returns the path of the CA configuration file.

func (*PKI) GetCertificateAuthority

func (p *PKI) GetCertificateAuthority() error

GetCertificateAuthority attempts to load the certificate authority from the RA.

func (*PKI) GetRootFingerprint

func (p *PKI) GetRootFingerprint() string

GetRootFingerprint returns the root fingerprint.

func (*PKI) Save

func (p *PKI) Save(opt ...ConfigOption) error

Save stores the pki on a json file that will be used as the certificate authority configuration.

func (*PKI) WriteFiles

func (p *PKI) WriteFiles() error

WriteFiles writes on disk the previously generated files.

func (*PKI) WriteHelmTemplate

func (p *PKI) WriteHelmTemplate(w io.Writer) error

func (*PKI) WriteRootCertificate

func (p *PKI) WriteRootCertificate(rootCrt *x509.Certificate, rootKey interface{}, pass []byte) error

WriteRootCertificate writes to the buffer the given certificate and key if given.