Documentation
¶
Index ¶
- type CertRespData
- type CertResponse
- type CommonCAResponse
- type SignResponse
- type SignResponseData
- type VaultCA
- func (ca *VaultCA) CACerts(ctx context.Context, aps string, r *http.Request) ([]*x509.Certificate, error)
- func (ca *VaultCA) CSRAttrs(ctx context.Context, aps string, r *http.Request) (attrs est.CSRAttrs, err error)
- func (ca *VaultCA) Enroll(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, error)
- func (ca *VaultCA) Reenroll(ctx context.Context, cert *x509.Certificate, csr *x509.CertificateRequest, ...) (*x509.Certificate, error)
- func (ca *VaultCA) ServerKeyGen(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, []byte, error)
- func (ca *VaultCA) TPMEnroll(ctx context.Context, csr *x509.CertificateRequest, ekcerts []*x509.Certificate, ...) ([]byte, []byte, []byte, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CertRespData ¶
type CertRespData struct {
SignResponseData
PrivateKey string `json:"private_key"`
PrivateKeyType string `json:"private_key_type"`
}
type CertResponse ¶
type CertResponse struct {
CommonCAResponse
Data *CertRespData `json:"data"`
}
type CommonCAResponse ¶
type SignResponse ¶
type SignResponse struct {
CommonCAResponse
Data *SignResponseData `json:"data"`
}
type SignResponseData ¶
type VaultCA ¶
type VaultCA struct {
}
func (*VaultCA) CACerts ¶
func (ca *VaultCA) CACerts(ctx context.Context, aps string, r *http.Request) ([]*x509.Certificate, error)
CACerts returns the CA certificates, unless the additional path segment is "triggererrors", in which case an error is returned for testing purposes.
func (*VaultCA) CSRAttrs ¶
func (ca *VaultCA) CSRAttrs(ctx context.Context, aps string, r *http.Request) (attrs est.CSRAttrs, err error)
CSRAttrs returns an empty sequence of CSR attributes, unless the additional path segment is:
- "csrattrs", in which case it returns the same example sequence described in RFC7030 4.5.2; or
- "triggererrors", in which case an error is returned for testing purposes.
func (*VaultCA) Enroll ¶
func (ca *VaultCA) Enroll(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, error)
Enroll issues a new certificate with:
- a 90 day duration from the current time
- a randomly generated 128-bit serial number
- a subject and subject alternative name copied from the provided CSR
- a default set of key usages and extended key usages
- a basic constraints extension with cA flag set to FALSE
unless the additional path segment is "triggererrors", in which case the following errors will be returned for testing purposes, depending on the common name in the CSR:
- "Trigger Error Forbidden", HTTP status 403
- "Trigger Error Deferred", HTTP status 202 with retry of 600 seconds
- "Trigger Error Unknown", untyped error expected to be interpreted as an internal server error.
func (*VaultCA) Reenroll ¶
func (ca *VaultCA) Reenroll(ctx context.Context, cert *x509.Certificate, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, error)
Reenroll implements est.CA but simply passes the request through to Enroll.
func (*VaultCA) ServerKeyGen ¶
func (ca *VaultCA) ServerKeyGen(ctx context.Context, csr *x509.CertificateRequest, aps string, r *http.Request) (*x509.Certificate, []byte, error)
ServerKeyGen creates a new RSA private key and then calls Enroll. It returns the key in PKCS8 DER-encoding, unless the additional path segment is set to "pkcs7", in which case it is returned wrapped in a CMS SignedData structure signed by the CA certificate(s), itself wrapped in a CMS EnvelopedData encrypted with the pre-shared key "pseudohistorical". A "Bit-Size" HTTP header may be passed with the values 2048, 3072 or 4096.
Source Files