feat(pki): add CertificateAuthority boundary interface

commit: 2242016b5e3d250f0e134717d5645980695a2592
author: brice · 6mo ago · 2026-03-29 16:30 UTC
parent: cce6418
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +37 -0

A internal/boundaries/out/pki.go +37 -0

@@ -0,0 +1,37 @@
	1	+	package out
	2	+
	3	+	import (
	4	+	"crypto/tls"
	5	+	"time"
	6	+	)
	7	+
	8	+	// CertificateAuthority provides internal PKI operations.
	9	+	// The adapter handles only cryptography — allowlist checks and caching
	10	+	// belong in the use case layer.
	11	+	type CertificateAuthority interface {
	12	+	// RootCertificate returns the root CA certificate in PEM format.
	13	+	RootCertificate() []byte
	14	+
	15	+	// RootCertificateDER returns the root CA certificate in DER format
	16	+	// (for embedding in iOS .mobileconfig profiles).
	17	+	RootCertificateDER() []byte
	18	+
	19	+	// IssueCertificate generates a leaf certificate for the given domain,
	20	+	// signed by the current intermediate CA. The caller must validate the
	21	+	// domain against the route table before calling this.
	22	+	IssueCertificate(domain string) (*tls.Certificate, error)
	23	+
	24	+	// IntermediateExpiresAt returns the intermediate CA certificate expiry.
	25	+	IntermediateExpiresAt() time.Time
	26	+
	27	+	// RenewIntermediate regenerates the intermediate CA certificate,
	28	+	// signed by the root CA. Existing leaf certs remain valid.
	29	+	RenewIntermediate() error
	30	+
	31	+	// RootFingerprint returns the SHA-256 fingerprint of the root CA cert
	32	+	// formatted as colon-separated hex (e.g. "AB:CD:EF:...").
	33	+	RootFingerprint() string
	34	+
	35	+	// RootCommonName returns the CN of the root CA certificate.
	36	+	RootCommonName() string
	37	+	}

@@ -0,0 +1,37 @@
	1	+	package out
	2	+
	3	+	import (
	4	+	"crypto/tls"
	5	+	"time"
	6	+	)
	7	+
	8	+	// CertificateAuthority provides internal PKI operations.
	9	+	// The adapter handles only cryptography — allowlist checks and caching
	10	+	// belong in the use case layer.
	11	+	type CertificateAuthority interface {
	12	+	// RootCertificate returns the root CA certificate in PEM format.
	13	+	RootCertificate() []byte
	14	+
	15	+	// RootCertificateDER returns the root CA certificate in DER format
	16	+	// (for embedding in iOS .mobileconfig profiles).
	17	+	RootCertificateDER() []byte
	18	+
	19	+	// IssueCertificate generates a leaf certificate for the given domain,
	20	+	// signed by the current intermediate CA. The caller must validate the
	21	+	// domain against the route table before calling this.
	22	+	IssueCertificate(domain string) (*tls.Certificate, error)
	23	+
	24	+	// IntermediateExpiresAt returns the intermediate CA certificate expiry.
	25	+	IntermediateExpiresAt() time.Time
	26	+
	27	+	// RenewIntermediate regenerates the intermediate CA certificate,
	28	+	// signed by the root CA. Existing leaf certs remain valid.
	29	+	RenewIntermediate() error
	30	+
	31	+	// RootFingerprint returns the SHA-256 fingerprint of the root CA cert
	32	+	// formatted as colon-separated hex (e.g. "AB:CD:EF:...").
	33	+	RootFingerprint() string
	34	+
	35	+	// RootCommonName returns the CN of the root CA certificate.
	36	+	RootCommonName() string
	37	+	}