mockca

func (*MockCA) CACerts ¶

func (ca *MockCA) CACerts(
	ctx context.Context,
	aps string,
	r *http.Request,
) ([]*x509.Certificate, error)

CACerts returns the CA certificates, unless the additional path segment is "triggererrors", in which case an error is returned for testing purposes.

func (*MockCA) CSRAttrs ¶

func (ca *MockCA) CSRAttrs(
	ctx context.Context,
	aps string,
	r *http.Request,
) (attrs est.CSRAttrs, err error)

CSRAttrs returns an empty sequence of CSR attributes, unless the additional path segment is:

• "csrattrs", in which case it returns the same example sequence described in RFC7030 4.5.2; or
• "triggererrors", in which case an error is returned for testing purposes.

func (*MockCA) Enroll ¶

func (ca *MockCA) Enroll(
	ctx context.Context,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, error)

Enroll issues a new certificate with:

• a 90 day duration from the current time
• a randomly generated 128-bit serial number
• a subject and subject alternative name copied from the provided CSR
• a default set of key usages and extended key usages
• a basic constraints extension with cA flag set to FALSE

unless the additional path segment is "triggererrors", in which case the following errors will be returned for testing purposes, depending on the common name in the CSR:

• "Trigger Error Forbidden", HTTP status 403
• "Trigger Error Deferred", HTTP status 202 with retry of 600 seconds
• "Trigger Error Unknown", untyped error expected to be interpreted as an internal server error.

func (*MockCA) Reenroll ¶

func (ca *MockCA) Reenroll(
	ctx context.Context,
	cert *x509.Certificate,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, error)

Reenroll implements est.CA but simply passes the request through to Enroll.

func (*MockCA) ServerKeyGen ¶

func (ca *MockCA) ServerKeyGen(
	ctx context.Context,
	csr *x509.CertificateRequest,
	aps string,
	r *http.Request,
) (*x509.Certificate, []byte, error)

ServerKeyGen creates a new RSA private key and then calls Enroll. It returns the key in PKCS8 DER-encoding, unless the additional path segment is set to "pkcs7", in which case it is returned wrapped in a CMS SignedData structure signed by the CA certificate(s), itself wrapped in a CMS EnvelopedData encrypted with the pre-shared key "pseudohistorical". A "Bit-Size" HTTP header may be passed with the values 2048, 3072 or 4096.

func (*MockCA) TPMEnroll ¶

func (ca *MockCA) TPMEnroll(
	ctx context.Context,
	csr *x509.CertificateRequest,
	ekcerts []*x509.Certificate,
	ekPub, akPub []byte,
	aps string,
	r *http.Request,
) ([]byte, []byte, []byte, error)

TPMEnroll requests a new certificate using the TPM 2.0 privacy-preserving protocol. An EK certificate chain with a length of at least one must be provided, along with the EK and AK public areas. The return values are an encrypted credential, a wrapped encryption key, and the certificate itself encrypted with the encrypted credential in AES 128 Galois Counter Mode inside a CMS EnvelopedData structure.