ca

package module
v0.0.0-...-8df540d Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 28, 2023 License: MIT Imports: 13 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var DefaultCertValidityPeriodInSeconds = uint64(5 * 24 * 3600)

Functions

func DefaultCACertSerialGenerator 

func DefaultCACertSerialGenerator() func(CSR) (uint64, error)

DefaultCACertSerialGenerator is a helper implementation of CertSerialGenerator provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func DefaultCAGetHostCertSigner 

func DefaultCAGetHostCertSigner(c *DefaultCA) (ssh.Signer, error)

DefaultCAGetHostCertSigner is a helper implementation of GetHostCertSigner provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func DefaultCAGetUserCertSigner 

func DefaultCAGetUserCertSigner(c *DefaultCA) (ssh.Signer, error)

DefaultCAGetUserCertSigner is a helper implementation of GetUserCertSigner provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func DefaultCAMaxValidityForCertificates 

func DefaultCAMaxValidityForCertificates(seconds uint64) uint64

DefaultCAMaxValidityForCertificates is a helper implementation of CAMaxValidityForCertificates provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func DefaultCARandomProvider 

func DefaultCARandomProvider() (io.Reader, error)

DefaultCARandomProvider is a helper implementation of RandomProvider provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func DefaultCARefreshKeys 

func DefaultCARefreshKeys(c *DefaultCA) error

DefaultCARefreshKeys is a helper implementation of RefreshKeys provided for the benefit of CA implementations modeled after DefaultCA using an alias type definition

func SignCert 

func SignCert(ca CA, csr CSR) (*ssh.Certificate, error)

SignCert is a helper implementation of SignCert of CA interface provided for the benefit of any CA implementation

Types

type CA 

type CA interface {
	RandomProvider() (io.Reader, error)
	RefreshKeys() error
	SignCert(CSR) (*ssh.Certificate, error)
	GetHostCertSigner(CSR) (ssh.Signer, error)
	GetUserCertSigner(CSR) (ssh.Signer, error)
	CertSerialGenerator() func(CSR) (uint64, error)
}

CA interface is the de-facto interface for all CA implementations to follow

type CAMaxValidityForCertificates 

type CAMaxValidityForCertificates interface {
	GetCAMaxValidityInSecondsForUserCertificates() uint64
	GetCAMaxValidityInSecondsForHostCertificates() uint64
}

CAMaxValidityForCertificates is an interface that CA implementations can implement to set a max validity duration for certs signed by them

type CSR 

type CSR interface {
	GetPubKey() *ssh.PublicKey
	SetPubkey(*ssh.PublicKey)
	GetPrincipals() []string
	SetPrincipals([]string)
	GetCertType() uint32
	SetCertType(uint32)
}

type CSRCriticalOptions 

type CSRCriticalOptions interface {
	GetCriticalOptions() map[string]string
	SetCriticalOptions(map[string]string)
}

type CSRExtensions 

type CSRExtensions interface {
	GetExtensions() map[string]string
	SetExtensions(map[string]string)
}

type CSRValidity 

type CSRValidity interface {
	GetValidBefore() uint64
	SetValidBefore(uint64)
	GetValidAfter() uint64
	SetValidAfter(uint64)
}

type DefaultCA 

type DefaultCA struct {
	HostSigner           ssh.Signer
	UserSigner           ssh.Signer
	RefreshSigners       func(*DefaultCA) error
	HostCertsMaxValidity uint64
	UserCertsMaxValidity uint64
}

DefaultCA is a default model implementation of the CA interface.

func NewAWSDefaultCA 

func NewAWSDefaultCA(hostSignerKeyPEMSecretPath string,
	hostSignerKeySecretSvc secretsmanageriface.SecretsManagerAPI,
	userSignerKeyPEMSecretPath string,
	userSignerKeySecretSvc secretsmanageriface.SecretsManagerAPI,
	maxHostCertsValidityDays int,
	maxUserCertsValidityDays int) (*DefaultCA, error)

NewAWSDefaultCA is a helper func to bootstrap a DefaultCA with CA keys fetched from AWS' secrets manager service. Requires secret paths for the host cert & user cert signer keys as parameters Requires max certificate validity duration as number of seconds Requires AWS Regions for each of the secrets Requires an AWS session with the appropriate region and credentials to fetch secrets which if nil, the func will try to create one using default configuration made available by the running environment.

func (*DefaultCA) CertSerialGenerator 

func (c *DefaultCA) CertSerialGenerator() func(CSR) (uint64, error)

CertSerialGenerator implementation of the CA interface for DefaultCA

func (*DefaultCA) GetCAMaxValidityForHostCertificates 

func (c *DefaultCA) GetCAMaxValidityForHostCertificates() uint64

GetCAMaxValidityForHostCertificates implementation for DefaultCA

func (*DefaultCA) GetCAMaxValidityForUserCertificates 

func (c *DefaultCA) GetCAMaxValidityForUserCertificates() uint64

GetCAMaxValidityForUserCertificates implementation for DefaultCA

func (*DefaultCA) GetHostCertSigner 

func (c *DefaultCA) GetHostCertSigner(CSR) (ssh.Signer, error)

GetHostCertSigner implementation of the CA interface for DefaultCA

func (*DefaultCA) GetUserCertSigner 

func (c *DefaultCA) GetUserCertSigner(CSR) (ssh.Signer, error)

GetUserCertSigner implementation of the CA interface for DefaultCA

func (*DefaultCA) RandomProvider 

func (c *DefaultCA) RandomProvider() (io.Reader, error)

RandomProvider implementation of the CA interface for DefaultCA

func (*DefaultCA) RefreshKeys 

func (c *DefaultCA) RefreshKeys() error

RefreshKeys implementation of the CA interface for DefaultCA

func (*DefaultCA) SignCert 

func (c *DefaultCA) SignCert(csr CSR) (*ssh.Certificate, error)

SignCert implementation of the CA interface for DefaultCA

type DefaultCSR 

type DefaultCSR struct {
	PublicKey       *ssh.PublicKey
	Principals      []string
	CertType        uint32
	CertExtensions  map[string]string
	CriticalOptions map[string]string
	ValidAfter      *uint64
	ValidBefore     *uint64
}

func (*DefaultCSR) GetCertType 

func (c *DefaultCSR) GetCertType() uint32

func (*DefaultCSR) GetCriticalOptions 

func (c *DefaultCSR) GetCriticalOptions() map[string]string

func (*DefaultCSR) GetExtensions 

func (c *DefaultCSR) GetExtensions() map[string]string

func (*DefaultCSR) GetPrincipals 

func (c *DefaultCSR) GetPrincipals() []string

func (*DefaultCSR) GetPubKey 

func (c *DefaultCSR) GetPubKey() *ssh.PublicKey

func (*DefaultCSR) GetValidAfter 

func (c *DefaultCSR) GetValidAfter() uint64

func (*DefaultCSR) GetValidBefore 

func (c *DefaultCSR) GetValidBefore() uint64

func (*DefaultCSR) SetCertType 

func (c *DefaultCSR) SetCertType(certType uint32)

func (*DefaultCSR) SetCriticalOptions 

func (c *DefaultCSR) SetCriticalOptions(options map[string]string)

func (*DefaultCSR) SetExtensions 

func (c *DefaultCSR) SetExtensions(extensions map[string]string)

func (*DefaultCSR) SetPrincipals 

func (c *DefaultCSR) SetPrincipals(principals []string)

func (*DefaultCSR) SetPubkey 

func (c *DefaultCSR) SetPubkey(key *ssh.PublicKey)

func (*DefaultCSR) SetValidAfter 

func (c *DefaultCSR) SetValidAfter(validAfter uint64)

func (*DefaultCSR) SetValidBefore 

func (c *DefaultCSR) SetValidBefore(validBefore uint64)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.