Documentation
¶
Overview ¶
Package crypto handles the RSA key material every node uses for mutual TLS authentication and for the trust-store fingerprint pinning.
Keys are RSA-3072 (NIST 112-bit security, well within the safe band through ~2030). They live PEM-encoded under <data_dir>/keys/.
Index ¶
- Constants
- func Fingerprint(cert *x509.Certificate) string
- func FingerprintFromCertPEM(certPEM []byte) (string, error)
- func FingerprintFromSPKI(spki []byte) string
- func GenerateKeyPair(commonName string) (*rsa.PrivateKey, error)
- func LoadCertPEM() ([]byte, error)
- func LoadPrivateKey() (*rsa.PrivateKey, error)
Constants ¶
const CertValidity = 10 * 365 * 24 * time.Hour
CertValidity is how long self-signed certs are valid for. We use a long horizon because cert rotation is operator-driven, not automatic.
const KeySize = 3072
KeySize is the RSA modulus size used by qu.
Variables ¶
This section is empty.
Functions ¶
func Fingerprint ¶
func Fingerprint(cert *x509.Certificate) string
Fingerprint computes the SHA-256 fingerprint of an X.509 certificate's SubjectPublicKeyInfo (the same hash used by `openssl x509 -pubkey -noout | openssl dgst -sha256`). Returns the lowercase hex digest with a "sha256:" prefix to match SSH conventions.
func FingerprintFromCertPEM ¶
FingerprintFromCertPEM parses a PEM-encoded certificate and returns its fingerprint.
func FingerprintFromSPKI ¶
FingerprintFromSPKI is the underlying helper.
func GenerateKeyPair ¶
func GenerateKeyPair(commonName string) (*rsa.PrivateKey, error)
GenerateKeyPair creates a fresh RSA keypair and writes the private, public, and self-signed certificate to the standard paths. It refuses to overwrite existing keys.
func LoadCertPEM ¶
LoadCertPEM reads the self-signed cert file (used as the TLS leaf).
func LoadPrivateKey ¶
func LoadPrivateKey() (*rsa.PrivateKey, error)
LoadPrivateKey reads the on-disk RSA private key.
Types ¶
This section is empty.
Source Files