certloader

type ACMEConfig struct {
	// Must be explicitly set to true by the user to indicate
	// agreement with the ACME CA's Terms of Service.
	TOSAgreed bool

	// The fully-qualified domain name being requested in the certificate.
	FQDN string

	// The email address to be associated with the ACME account used
	// to obtain a certificate from the ACME CA. This email address
	// may receive certificate lifecycle notificates from the ACME CA.
	Email string

	// The URL for the Production ACME CA to use. Defaults to the
	// Let's Encrypt production URL if not specified.
	ProdCAURL string

	// The URL for the Test/Staging ACME CA to use. Defaults to the
	// Let's Encrypt staging URL if not specified.
	TestCAURL string

	// If true, use the Test/Staging ACME CA URL. If false, use the
	// Production ACME CA URL. Defaults to false.
	UseTestCA bool
}

type Certificate interface {
	// Reload will reload the certificate and private key. Subsequent calls
	// to GetCertificate/GetClientCertificate will return the newly loaded
	// certificate, if reloading was successful. If reloading failed, the old
	// state is kept.
	Reload() error

	// GetIdentifier returns an identifier for the certificate for logging.
	GetIdentifier() string

	// GetCertificate returns the current underlying certificate.
	// Can be used for tls.Config's GetCertificate callback.
	GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error)

	// GetClientCertificate returns the current underlying certificate.
	// Can be used for tls.Config's GetClientCertificate callback.
	GetClientCertificate(certInfo *tls.CertificateRequestInfo) (*tls.Certificate, error)

	// GetTrustStore returns the most up-to-date version of the trust store / CA bundle.
	GetTrustStore() *x509.CertPool
}

type Dialer interface {
	Dial(network, address string) (net.Conn, error)
}

type Listener struct {
	net.Listener
	// contains filtered or unexported fields
}

type TLSClientConfig interface {
	// GetClientConfig returns a TLS configuration for use as a TLS client. It
	// is safe to call concurrently.
	GetClientConfig() *tls.Config
}

type TLSConfigSource interface {
	// Reload will reload the TLS configuration. If reloading fails, the
	// existing configuration will be used. The client and server config
	// interface returned by GetClientConfig and GetServerConfig should reflect
	// any new configuration.
	Reload() error

	// CanServe returns true if the source can return configuration appropriate
	// for server roles (see GetServerConfig)
	CanServe() bool

	// GetClientConfig returns a TLSClientConfig interface that can be used to
	// obtain TLS client configuration. The base configuration is cloned and
	// used as a base for all returned TLS configuration.
	GetClientConfig(base *tls.Config) (TLSClientConfig, error)

	// GetServerConfig returns a TLSServerConfig interface that can be used to
	// obtain TLS server configuration. The base configuration is cloned and
	// used as a base for all returned TLS configuration. If the TLSConfig is
	// not appropriate for use as a server, false is returned.
	GetServerConfig(base *tls.Config) (TLSServerConfig, error)
}

type TLSServerConfig interface {
	// GetServerConfig returns a TLS configuration for use as a TLS server. It
	// is safe to call concurrently.
	GetServerConfig() *tls.Config
}