@@ -39,11 +39,11 @@ import (
39
39
40
40
const (
41
41
// Security Strength Equivalence
42
- //-----------------------------------
43
- //| ECC | DH/DSA/RSA |
44
- //| 256 | 3072 |
45
- //| 384 | 7680 |
46
- //-----------------------------------
42
+ //
43
+ // | ECC | DH/DSA/RSA |
44
+ // |----------|--------------- |
45
+ // | 256 | 3072 |
46
+ // | 384 | 7680 |
47
47
48
48
// RootKeySize is the default size of the root CA key
49
49
// It would be ideal for the root key to use P-384, but in P-384 is not optimized in go yet :(
@@ -134,25 +134,24 @@ type x509UnknownAuthError struct {
134
134
//
135
135
// Requirements:
136
136
//
137
- // - [signing CA key] must be the private key for [signing CA cert], and either both or none must be provided
138
- //
139
- // - [intermediate CA1] must have the same public key and subject as [signing CA cert], because otherwise when
140
- // appended to a leaf certificate, the intermediates will not form a chain (because [intermediate CA1] won't because
141
- // the signer of the leaf certificate)
142
- // - [intermediate CA1] must be signed by [intermediate CA2], which must be signed by [intermediate CA3]
143
- //
144
- // - When we issue a certificate, the intermediates will be appended so that the certificate looks like:
145
- // [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3]
146
- // - [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3] is guaranteed to form a
147
- // valid chain from [leaf signed by signing CA cert] to one of the root certs ([signing CA cert], [CA cert1], [CA cert2])
148
- // using zero or more of the intermediate certs ([intermediate CA1][intermediate CA2][intermediate CA3]) as intermediates
137
+ // - [signing CA key] must be the private key for [signing CA cert], and either both or none must be provided
138
+ // - [intermediate CA1] must have the same public key and subject as [signing CA cert], because otherwise when
139
+ // appended to a leaf certificate, the intermediates will not form a chain (because [intermediate CA1] won't because
140
+ // the signer of the leaf certificate)
141
+ // - [intermediate CA1] must be signed by [intermediate CA2], which must be signed by [intermediate CA3]
142
+ // - When we issue a certificate, the intermediates will be appended so that the certificate looks like:
143
+ // [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3]
144
+ // - [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3] is guaranteed to form a
145
+ // valid chain from [leaf signed by signing CA cert] to one of the root certs ([signing CA cert], [CA cert1], [CA cert2])
146
+ // using zero or more of the intermediate certs ([intermediate CA1][intermediate CA2][intermediate CA3]) as intermediates
149
147
//
150
148
// Example 1: Simple root rotation
149
+ //
151
150
// - Initial state:
152
- // - RootCA.Cert: [Root CA1 self-signed]
153
- // - RootCA.Intermediates: []
154
- // - RootCA.signer.Cert: [Root CA1 self-signed]
155
- // - Issued TLS cert: [leaf signed by Root CA1]
151
+ // - RootCA.Cert: [Root CA1 self-signed]
152
+ // - RootCA.Intermediates: []
153
+ // - RootCA.signer.Cert: [Root CA1 self-signed]
154
+ // - Issued TLS cert: [leaf signed by Root CA1]
156
155
//
157
156
// - Intermediate state (during root rotation):
158
157
// - RootCA.Cert: [Root CA1 self-signed]
@@ -165,7 +164,6 @@ type x509UnknownAuthError struct {
165
164
// - RootCA.Intermediates: []
166
165
// - RootCA.signer.Cert: [Root CA2 self-signed]
167
166
// - Issued TLS cert: [leaf signed by Root CA2]
168
- //
169
167
type RootCA struct {
170
168
// Certs contains a bundle of self-signed, PEM encoded certificates for the Root CA to be used
171
169
// as the root of trust.
0 commit comments