certs

func DNSName ¶ added in v1.17.0

func DNSName(serviceName, namespace string) string

func ExtractCARootFromSecret ¶ added in v1.17.0

func ExtractCARootFromSecret(caRootSecret *corev1.Secret) ([]byte, []byte, error)

Extract the CA certificate and private key from a secret. Both are PEM encoded.

func ExtractServerCertFromSecret ¶ added in v1.17.0

func ExtractServerCertFromSecret(serverCertSecret *corev1.Secret) ([]byte, []byte, error)

Extract the server certificate and private key from a secret. Both are PEM encoded.

func GenerateCA ¶

func GenerateCA(notBefore, notAfter time.Time) ([]byte, []byte, error)

GenerateCA generates a self-signed CA root certificate and private key in PEM format. It accepts validity bounds as parameters.

func GenerateCert ¶

func GenerateCert(caCertPEM []byte,
	caPrivateKeyPEM []byte,
	notBefore time.Time,
	notAfter time.Time,
	dnsName string,
) ([]byte, []byte, error)

GenerateCert generates a certificate and private key signed by the provided CA in PEM format. It accepts the CA root certificate and private key, validity bounds, and DNS name as parameters.

func NewCertPool ¶ added in v1.17.0

func NewCertPool(certPEM []byte) (*x509.CertPool, error)

NewCertPool creates a new x509.CertPool from a PEM-encoded certificate that may contain multiple certificates.

func VerifyCA ¶ added in v1.17.0

func VerifyCA(caCertPEM, caPrivateKeyPEM []byte, at time.Time) error

func VerifyCert ¶ added in v1.17.0

func VerifyCert(certPEM, privateKeyPEM []byte, certPool *x509.CertPool, dnsName string, at time.Time) error