cfssl: Index | Files

package local

import ""

Package local implements certificate signature functionality for CFSSL.


Package Files


func OverrideHosts Uses

func OverrideHosts(template *x509.Certificate, hosts []string)

OverrideHosts fills template's IPAddresses, EmailAddresses, DNSNames, and URIs with the content of hosts, if it is not nil.

func PopulateSubjectFromCSR Uses

func PopulateSubjectFromCSR(s *signer.Subject, req pkix.Name) pkix.Name

PopulateSubjectFromCSR has functionality similar to Name, except it fills the fields of the resulting pkix.Name with req's if the subject's corresponding fields are empty

type LintError Uses

type LintError struct {
    ErrorResults map[string]lint.LintResult

LintError is an error type returned when pre-issuance linting is configured in a signing profile and a TBS Certificate fails linting. It wraps the concrete zlint LintResults so that callers can further inspect the cause of the failing lints.

func (*LintError) Error Uses

func (e *LintError) Error() string

type Signer Uses

type Signer struct {
    // contains filtered or unexported fields

Signer contains a signer that uses the standard library to support both ECDSA and RSA CA keys.

func NewSigner Uses

func NewSigner(priv crypto.Signer, cert *x509.Certificate, sigAlgo x509.SignatureAlgorithm, policy *config.Signing) (*Signer, error)

NewSigner creates a new Signer directly from a private key and certificate, with optional policy.

func NewSignerFromFile Uses

func NewSignerFromFile(caFile, caKeyFile string, policy *config.Signing) (*Signer, error)

NewSignerFromFile generates a new local signer from a caFile and a caKey file, both PEM encoded.

func (*Signer) Certificate Uses

func (s *Signer) Certificate(label, profile string) (*x509.Certificate, error)

Certificate returns the signer's certificate.

func (*Signer) GetDBAccessor Uses

func (s *Signer) GetDBAccessor() certdb.Accessor

GetDBAccessor returns the signers' cert db accessor

func (*Signer) Info Uses

func (s *Signer) Info(req info.Req) (resp *info.Resp, err error)

Info return a populated info.Resp struct or an error.

func (*Signer) Policy Uses

func (s *Signer) Policy() *config.Signing

Policy returns the signer's policy.

func (*Signer) SetDBAccessor Uses

func (s *Signer) SetDBAccessor(dba certdb.Accessor)

SetDBAccessor sets the signers' cert db accessor

func (*Signer) SetPolicy Uses

func (s *Signer) SetPolicy(policy *config.Signing)

SetPolicy sets the signer's signature policy.

func (*Signer) SetReqModifier Uses

func (s *Signer) SetReqModifier(func(*http.Request, []byte))

SetReqModifier does nothing for local

func (*Signer) SigAlgo Uses

func (s *Signer) SigAlgo() x509.SignatureAlgorithm

SigAlgo returns the RSA signer's signature algorithm.

func (*Signer) Sign Uses

func (s *Signer) Sign(req signer.SignRequest) (cert []byte, err error)

Sign signs a new certificate based on the PEM-encoded client certificate or certificate request with the signing profile, specified by profileName.

func (*Signer) SignFromPrecert Uses

func (s *Signer) SignFromPrecert(precert *x509.Certificate, scts []ct.SignedCertificateTimestamp) ([]byte, error)

SignFromPrecert creates and signs a certificate from an existing precertificate that was previously signed by and inserts the provided SCTs into the new certificate. The resulting certificate will be a exact copy of the precert except for the removal of the poison extension and the addition of the SCT list extension. SignFromPrecert does not verify that the contents of the certificate still match the signing profile of the signer, it only requires that the precert was previously signed by the Signers CA. Similarly, any linting configured by the profile used to sign the precert will not be re-applied to the final cert and must be done separately by the caller.

Package local imports 35 packages (graph) and is imported by 302 packages. Updated 2020-10-22. Refresh now. Tools for package owners.