pki.go RawHistoryFolder

1package out
2
3import (
4	"context"
5	"crypto/tls"
6	"time"
7
8	"github.com/bnema/gordon/internal/domain"
9)
10
11// RouteChecker provides route lookup for domain validation.
12type RouteChecker interface {
13	GetRoutes(ctx context.Context) []domain.Route
14	GetExternalRoutes() map[string]string
15}
16
17// CertificateAuthority provides internal PKI operations.
18// The adapter handles only cryptography — allowlist checks and caching
19// belong in the use case layer.
20type CertificateAuthority interface {
21	// RootCertificate returns the root CA certificate in PEM format.
22	RootCertificate() []byte
23
24	// RootCertificateDER returns the root CA certificate in DER format
25	// (for embedding in iOS .mobileconfig profiles).
26	RootCertificateDER() []byte
27
28	// IssueCertificate generates a leaf certificate for the given domain,
29	// signed by the current intermediate CA. The caller must validate the
30	// domain against the route table before calling this.
31	IssueCertificate(domain string) (*tls.Certificate, error)
32
33	// IntermediateExpiresAt returns the intermediate CA certificate expiry.
34	IntermediateExpiresAt() time.Time
35
36	// RenewIntermediate regenerates the intermediate CA certificate,
37	// signed by the root CA. Existing leaf certs remain valid.
38	RenewIntermediate() error
39
40	// RootFingerprint returns the SHA-256 fingerprint of the root CA cert
41	// formatted as colon-separated hex (e.g. "AB:CD:EF:...").
42	RootFingerprint() string
43
44	// RootCommonName returns the CN of the root CA certificate.
45	RootCommonName() string
46
47	// LeafLifetime returns the configured leaf certificate lifetime.
48	LeafLifetime() time.Duration
49
50	// IntermediateLifetime returns the configured intermediate CA lifetime.
51	IntermediateLifetime() time.Duration
52}