config

type AuthKey struct {
	// Type contains information needed to select the appropriate
	// constructor. For example, "standard" for HMAC-SHA-256,
	// "standard-ip" for HMAC-SHA-256 incorporating the client's
	// IP.
	Type string `json:"type"`
	// Key contains the key information, such as a hex-encoded
	// HMAC key.
	Key string `json:"key"`
}

type AuthRemote struct {
	RemoteName  string `json:"remote"`
	AuthKeyName string `json:"auth_key"`
}

type CAConstraint struct {
	IsCA           bool `json:"is_ca"`
	MaxPathLen     int  `json:"max_path_len"`
	MaxPathLenZero bool `json:"max_path_len_zero"`
}

type CSRWhitelist struct {
	Subject, PublicKeyAlgorithm, PublicKey, SignatureAlgorithm bool
	DNSNames, IPAddresses, EmailAddresses, URIs                bool
}

type CertificatePolicy struct {
	ID         OID
	Qualifiers []CertificatePolicyQualifier
}

type CertificatePolicyQualifier struct {
	Type  string
	Value string
}

type Config struct {
	Signing  *Signing           `json:"signing"`
	OCSP     *ocspConfig.Config `json:"ocsp"`
	AuthKeys map[string]AuthKey `json:"auth_keys,omitempty"`
	Remotes  map[string]string  `json:"remotes,omitempty"`
}

type OID asn1.ObjectIdentifier

type Signing struct {
	Profiles map[string]*SigningProfile `json:"profiles"`
	Default  *SigningProfile            `json:"default"`
}

type SigningProfile struct {
	Usage               []string     `json:"usages"`
	IssuerURL           []string     `json:"issuer_urls"`
	OCSP                string       `json:"ocsp_url"`
	CRL                 string       `json:"crl_url"`
	CAConstraint        CAConstraint `json:"ca_constraint"`
	OCSPNoCheck         bool         `json:"ocsp_no_check"`
	ExpiryString        string       `json:"expiry"`
	BackdateString      string       `json:"backdate"`
	AuthKeyName         string       `json:"auth_key"`
	CopyExtensions      bool         `json:"copy_extensions"`
	PrevAuthKeyName     string       `json:"prev_auth_key"` // to support key rotation
	RemoteName          string       `json:"remote"`
	NotBefore           time.Time    `json:"not_before"`
	NotAfter            time.Time    `json:"not_after"`
	NameWhitelistString string       `json:"name_whitelist"`
	AuthRemote          AuthRemote   `json:"auth_remote"`
	CTLogServers        []string     `json:"ct_log_servers"`
	AllowedExtensions   []OID        `json:"allowed_extensions"`
	CertStore           string       `json:"cert_store"`
	// LintErrLevel controls preissuance linting for the signing profile.
	// 0 = no linting is performed [default]
	// 2..3 = reserved
	// 3 = all lint results except pass are considered errors
	// 4 = all lint results except pass and notice are considered errors
	// 5 = all lint results except pass, notice and warn are considered errors
	// 6 = all lint results except pass, notice, warn and error are considered errors.
	// 7 = lint is performed, no lint results are treated as errors.
	LintErrLevel lint.LintStatus `json:"lint_error_level"`
	// ExcludeLints lists ZLint lint names to exclude from preissuance linting.
	ExcludeLints []string `json:"ignored_lints"`
	// ExcludeLintSources lists ZLint lint sources to exclude from preissuance
	// linting.
	ExcludeLintSources []string `json:"ignored_lint_sources"`

	Policies                    []CertificatePolicy
	Expiry                      time.Duration
	Backdate                    time.Duration
	Provider                    auth.Provider
	PrevProvider                auth.Provider // to suppport key rotation
	RemoteProvider              auth.Provider
	RemoteServer                string
	RemoteCAs                   *x509.CertPool
	ClientCert                  *tls.Certificate
	CSRWhitelist                *CSRWhitelist
	NameWhitelist               *regexp.Regexp
	ExtensionWhitelist          map[string]bool
	ClientProvidesSerialNumbers bool
	// LintRegistry is the collection of lints that should be used if
	// LintErrLevel is configured. By default all ZLint lints are used. If
	// ExcludeLints or ExcludeLintSources are set then this registry will be
	// filtered in populate() to exclude the named lints and lint sources.
	LintRegistry lint.Registry
}