pki.go RawHistoryFolder

1package out
2
3import (
4	"context"
5	"crypto/tls"
6	"crypto/x509"
7	"time"
8
9	"github.com/bnema/gordon/internal/domain"
10)
11
12// RouteChecker provides route lookup for domain validation.
13type RouteChecker interface {
14	GetRoutes(ctx context.Context) []domain.Route
15	GetExternalRoutes() map[string]string
16}
17
18// CertificateAuthority provides internal PKI operations.
19// The adapter handles only cryptography — allowlist checks and caching
20// belong in the use case layer.
21type CertificateAuthority interface {
22	// RootCertificate returns the root CA certificate in PEM format.
23	RootCertificate() []byte
24
25	// RootCertificateDER returns the root CA certificate in DER format
26	// (for embedding in iOS .mobileconfig profiles).
27	RootCertificateDER() []byte
28
29	// IssueCertificate generates a leaf certificate for the given domain,
30	// signed by the current intermediate CA. The caller must validate the
31	// domain against the route table before calling this.
32	IssueCertificate(domain string) (*tls.Certificate, error)
33
34	// IntermediateExpiresAt returns the intermediate CA certificate expiry.
35	IntermediateExpiresAt() time.Time
36
37	// RenewIntermediate regenerates the intermediate CA certificate,
38	// signed by the root CA. Existing leaf certs remain valid.
39	RenewIntermediate() error
40
41	// RootFingerprint returns the SHA-256 fingerprint of the root CA cert
42	// formatted as colon-separated hex (e.g. "AB:CD:EF:...").
43	RootFingerprint() string
44
45	// RootCommonName returns the CN of the root CA certificate.
46	RootCommonName() string
47
48	// LeafLifetime returns the configured leaf certificate lifetime.
49	LeafLifetime() time.Duration
50
51	// IntermediateLifetime returns the configured intermediate CA lifetime.
52	IntermediateLifetime() time.Duration
53
54	// InstallRoot installs the root CA certificate into the system trust store.
55	InstallRoot(cert *x509.Certificate) error
56
57	// UninstallRoot removes the root CA certificate from the system trust store.
58	UninstallRoot(cert *x509.Certificate) error
59}