crypto

type CACertCreatorConfig struct {
	Subject pkix.Name
}

type CertCreator interface {
	MakeCertificateTemplate(now time.Time, validity time.Duration) *x509.Certificate
	MakeCertificate(ctx context.Context, keyGetter RSAKeyGetter, signer Signer, validity time.Duration) (*x509.Certificate, *rsa.PrivateKey, error)
}

type CertificateAuthority struct {
	// contains filtered or unexported fields
}

type ClientCertCreatorConfig struct {
	Subject  pkix.Name
	DNSNames []string
}

type DesiredCertTemplate struct {
	Subject               pkixName
	KeyUsage              x509.KeyUsage
	ExtKeyUsage           []x509.ExtKeyUsage
	BasicConstraintsValid bool
	IsCA                  bool
	MaxPathLen            int
	MaxPathLenZero        bool
	// RFC 5280, 4.2.2.1 (Authority Information Access)
	OCSPServer            []string
	IssuingCertificateURL []string
	// Subject Alternate Name values.
	DNSNames       []string
	EmailAddresses []string
	IPAddresses    []net.IP
	URIs           []*url.URL
	// Name constraints
	PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
	PermittedDNSDomains         []string
	ExcludedDNSDomains          []string
	PermittedIPRanges           []*net.IPNet
	ExcludedIPRanges            []*net.IPNet
	PermittedEmailAddresses     []string
	ExcludedEmailAddresses      []string
	PermittedURIDomains         []string
	ExcludedURIDomains          []string
	// CRL Distribution Points
	CRLDistributionPoints []string
	PolicyIdentifiers     []asn1.ObjectIdentifier
}

type RSAKeyGenerator struct {
	itemgenerator.Generator[rsa.PrivateKey]
}

type RSAKeyGetter interface {
	GetNewKey(ctx context.Context) (*rsa.PrivateKey, error)
}

type SelfSignedSigner struct {
	// contains filtered or unexported fields
}

type ServingCertCreatorConfig struct {
	Subject     pkix.Name
	IPAddresses []net.IP
	DNSNames    []string
}

type Signer interface {
	Now() time.Time
	GetPublicKey() *rsa.PublicKey
	SignCertificate(template *x509.Certificate, requestKey *rsa.PublicKey) (*x509.Certificate, error)
	VerifyCertificate(cert *x509.Certificate) error
}

type X509CertCreator struct {
	Subject     pkix.Name
	IPAddresses []net.IP
	DNSNames    []string
	KeyUsage    x509.KeyUsage
	ExtKeyUsage []x509.ExtKeyUsage
	IsCA        bool
}