Documentation
¶
Index ¶
- Constants
- func CertsFromPEM(pemCerts []byte) ([]*x509.Certificate, error)
- func CipherSuite(cipherName string) (uint16, error)
- func CipherSuiteToNameOrDie(intVal uint16) string
- func CipherSuitesOrDie(cipherNames []string) []uint16
- func CipherSuitesToNamesOrDie(intVals []uint16) []string
- func DefaultCiphers() []uint16
- func DefaultTLSVersion() uint16
- func IPAddressesDNSNames(hosts []string) ([]net.IP, []string)
- func NewKeyPair() (crypto.PublicKey, crypto.PrivateKey, error)
- func SecureTLSConfig(config *tls.Config) *tls.Config
- func TLSVersion(versionName string) (uint16, error)
- func TLSVersionOrDie(versionName string) uint16
- func TLSVersionToNameOrDie(intVal uint16) string
- func ValidCipherSuites() []string
- func ValidTLSVersions() []string
- type CA
- func (ca *CA) EnsureClientCertificate(certFile, keyFile string, u user.Info, expireDays int) (*TLSCertificateConfig, bool, error)
- func (ca *CA) EnsureServerCert(certFile, keyFile string, hostnames sets.String, expireDays int) (*TLSCertificateConfig, bool, error)
- func (ca *CA) MakeAndWriteServerCert(certFile, keyFile string, hostnames sets.String, expireDays int) (*TLSCertificateConfig, error)
- func (ca *CA) MakeClientCertificate(certFile, keyFile string, u user.Info, expireDays int) (*TLSCertificateConfig, error)
- func (ca *CA) MakeServerCert(hostnames sets.String, expireDays int, fns ...CertificateExtensionFunc) (*TLSCertificateConfig, error)
- type CertificateExtensionFunc
- type RandomSerialGenerator
- type SerialFileGenerator
- type SerialGenerator
- type TLSCARoots
- type TLSCertificateConfig
Constants ¶
const ( DefaultCertificateLifetimeInDays = 365 * 2 // 2 years DefaultCACertificateLifetimeInDays = 365 * 5 // 5 years )
Variables ¶
This section is empty.
Functions ¶
func CertsFromPEM ¶
func CertsFromPEM(pemCerts []byte) ([]*x509.Certificate, error)
func CipherSuite ¶
func CipherSuiteToNameOrDie ¶
CipherSuiteToNameOrDie given a cipher suite as an int, return its readable name
func CipherSuitesOrDie ¶
func CipherSuitesToNamesOrDie ¶
CipherSuitesToNamesOrDie given a list of cipher suites as ints, return their readable names
func DefaultCiphers ¶
func DefaultCiphers() []uint16
func DefaultTLSVersion ¶
func DefaultTLSVersion() uint16
func NewKeyPair ¶
func NewKeyPair() (crypto.PublicKey, crypto.PrivateKey, error)
func SecureTLSConfig ¶
SecureTLSConfig enforces the default minimum security settings for the cluster.
func TLSVersion ¶
func TLSVersionOrDie ¶
func TLSVersionToNameOrDie ¶
TLSVersionToNameOrDie given a tls version as an int, return its readable name
func ValidCipherSuites ¶
func ValidCipherSuites() []string
func ValidTLSVersions ¶
func ValidTLSVersions() []string
Types ¶
type CA ¶
type CA struct { Config *TLSCertificateConfig SerialGenerator SerialGenerator }
func EnsureCA ¶
EnsureCA returns a CA, whether it was created (as opposed to pre-existing), and any error if serialFile is empty, a RandomSerialGenerator will be used
func (*CA) EnsureClientCertificate ¶
func (*CA) EnsureServerCert ¶
func (*CA) MakeAndWriteServerCert ¶
func (*CA) MakeClientCertificate ¶
func (*CA) MakeServerCert ¶
func (ca *CA) MakeServerCert(hostnames sets.String, expireDays int, fns ...CertificateExtensionFunc) (*TLSCertificateConfig, error)
type CertificateExtensionFunc ¶
type CertificateExtensionFunc func(*x509.Certificate) error
CertificateExtensionFunc is passed a certificate that it may extend, or return an error if the extension attempt failed.
type RandomSerialGenerator ¶
type RandomSerialGenerator struct { }
RandomSerialGenerator returns a serial based on time.Now and the subject
func (*RandomSerialGenerator) Next ¶
func (s *RandomSerialGenerator) Next(template *x509.Certificate) (int64, error)
type SerialFileGenerator ¶
type SerialFileGenerator struct { SerialFile string Serial int64 // contains filtered or unexported fields }
SerialFileGenerator returns a unique, monotonically increasing serial number and ensures the CA on disk records that value.
func NewSerialFileGenerator ¶
func NewSerialFileGenerator(serialFile string, createIfNeeded bool) (*SerialFileGenerator, error)
func (*SerialFileGenerator) Next ¶
func (s *SerialFileGenerator) Next(template *x509.Certificate) (int64, error)
Next returns a unique, monotonically increasing serial number and ensures the CA on disk records that value.
type SerialGenerator ¶
type SerialGenerator interface {
Next(template *x509.Certificate) (int64, error)
}
SerialGenerator is an interface for getting a serial number for the cert. It MUST be thread-safe.
type TLSCARoots ¶
type TLSCARoots struct {
Roots []*x509.Certificate
}
func GetTLSCARoots ¶
func GetTLSCARoots(caFile string) (*TLSCARoots, error)
type TLSCertificateConfig ¶
type TLSCertificateConfig struct { Certs []*x509.Certificate Key crypto.PrivateKey }
func GetServerCert ¶
func GetServerCert(certFile, keyFile string, hostnames sets.String) (*TLSCertificateConfig, error)
func GetTLSCertificateConfig ¶
func GetTLSCertificateConfig(certFile, keyFile string) (*TLSCertificateConfig, error)
func (*TLSCertificateConfig) GetPEMBytes ¶
func (c *TLSCertificateConfig) GetPEMBytes() ([]byte, []byte, error)
Directories
¶
Path | Synopsis |
---|---|
Package extensions defines cryptographic extensions for OpenShift.
|
Package extensions defines cryptographic extensions for OpenShift. |