pki.go RawHistoryFolder

1package out
2
3import (
4	"crypto/tls"
5	"crypto/x509"
6	"time"
7)
8
9// AppRoutes provides ACTIVE-derived host lookup for domain validation.
10// Implemented by the apptraffic host index via AppHostSource plus the
11// installation external routes. Replaces the retired RouteChecker
12// (config-file routes are gone with the declarative-apps cutover).
13type AppRoutes interface {
14	AppHostSource
15	// GetExternalRoutes returns installation external routes.
16	GetExternalRoutes() map[string]string
17}
18
19// CertificateAuthority provides internal PKI operations.
20// The adapter handles only cryptography — allowlist checks and caching
21// belong in the use case layer.
22type CertificateAuthority interface {
23	// RootCertificate returns the root CA certificate in PEM format.
24	RootCertificate() []byte
25
26	// RootCertificateDER returns the root CA certificate in DER format
27	// (for embedding in iOS .mobileconfig profiles).
28	RootCertificateDER() []byte
29
30	// IssueCertificate generates a leaf certificate for the given domain,
31	// signed by the current intermediate CA. The caller must validate the
32	// domain against the route table before calling this.
33	IssueCertificate(domain string) (*tls.Certificate, error)
34
35	// IntermediateExpiresAt returns the intermediate CA certificate expiry.
36	IntermediateExpiresAt() time.Time
37
38	// RenewIntermediate regenerates the intermediate CA certificate,
39	// signed by the root CA. Existing leaf certs remain valid.
40	RenewIntermediate() error
41
42	// RootFingerprint returns the SHA-256 fingerprint of the root CA cert
43	// formatted as colon-separated hex (e.g. "AB:CD:EF:...").
44	RootFingerprint() string
45
46	// RootCommonName returns the CN of the root CA certificate.
47	RootCommonName() string
48
49	// LeafLifetime returns the configured leaf certificate lifetime.
50	LeafLifetime() time.Duration
51
52	// IntermediateLifetime returns the configured intermediate CA lifetime.
53	IntermediateLifetime() time.Duration
54
55	// InstallRoot installs the root CA certificate into the system trust store.
56	InstallRoot(cert *x509.Certificate) error
57
58	// UninstallRoot removes the root CA certificate from the system trust store.
59	UninstallRoot(cert *x509.Certificate) error
60}