ca

type CertificateAuthority interface {
	CreateCertificate(context.Context, identity.Principal, crypto.PublicKey) (*CodeSigningCertificate, error)
	TrustBundle(ctx context.Context) ([][]*x509.Certificate, error)
	Close() error
}

type CodeSigningCertificate struct {
	FinalCertificate *x509.Certificate
	FinalChain       []*x509.Certificate
	// contains filtered or unexported fields
}

type CodeSigningPreCertificate struct {
	// PreCert contains the precertificate. Not a valid certificate due to a critical poison extension.
	PreCert *x509.Certificate
	// CertChain contains the certificate chain to verify the precertificate.
	CertChain []*x509.Certificate
	// PrivateKey contains the signing key used to sign the precertificate. Will be used to sign the certificate.
	// Included in case the signing key is rotated in between precertificate generation and final issuance.
	PrivateKey crypto.Signer
}

type EmbeddedSCTCA interface {
	CreatePrecertificate(context.Context, identity.Principal, crypto.PublicKey) (*CodeSigningPreCertificate, error)
	IssueFinalCertificate(ctx context.Context, precert *CodeSigningPreCertificate, sct *ct.SignedCertificateTimestamp) (*CodeSigningCertificate, error)
}

type SignerCerts struct {
	// Signer signs issued certificates
	Signer crypto.Signer
	// Certs contains the chain of certificates from intermediate to root
	Certs []*x509.Certificate
}

type SignerCertsMutex struct {
	sync.RWMutex

	// Certs contains the chain of certificates from intermediate to root
	Certs []*x509.Certificate
	// Signer signs issued certificates
	Signer crypto.Signer
}

type SignerWithChain interface {
	GetSignerWithChain() ([]*x509.Certificate, crypto.Signer)
}

type ValidationError error