1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
package cautils
import (
"crypto/x509"
"net/http"
"os"
"github.com/smallstep/certificates/api"
"github.com/smallstep/certificates/ca"
"github.com/smallstep/certificates/pki"
"github.com/smallstep/cli/errs"
"github.com/smallstep/cli/flags"
"github.com/urfave/cli"
)
// CaClient is the interface implemented by a client used to sign, renew, revoke
// certificates among other things.
type CaClient interface {
Sign(req *api.SignRequest) (*api.SignResponse, error)
Renew(tr http.RoundTripper) (*api.SignResponse, error)
Revoke(req *api.RevokeRequest, tr http.RoundTripper) (*api.RevokeResponse, error)
SSHSign(req *api.SSHSignRequest) (*api.SSHSignResponse, error)
SSHRenew(req *api.SSHRenewRequest) (*api.SSHRenewResponse, error)
SSHRekey(req *api.SSHRekeyRequest) (*api.SSHRekeyResponse, error)
SSHRevoke(req *api.SSHRevokeRequest) (*api.SSHRevokeResponse, error)
SSHRoots() (*api.SSHRootsResponse, error)
SSHFederation() (*api.SSHRootsResponse, error)
SSHConfig(req *api.SSHConfigRequest) (*api.SSHConfigResponse, error)
SSHCheckHost(principal string, token string) (*api.SSHCheckPrincipalResponse, error)
SSHGetHosts() (*api.SSHGetHostsResponse, error)
SSHBastion(req *api.SSHBastionRequest) (*api.SSHBastionResponse, error)
Version() (*api.VersionResponse, error)
GetRootCAs() *x509.CertPool
}
// NewClient returns a client of an online or offline CA. Requires the flags
// `offline`, `ca-config`, `ca-url`, and `root`.
func NewClient(ctx *cli.Context, opts ...ca.ClientOption) (CaClient, error) {
if ctx.Bool("offline") {
caConfig := ctx.String("ca-config")
if caConfig == "" {
return nil, errs.InvalidFlagValue(ctx, "ca-config", "", "")
}
return NewOfflineCA(caConfig)
}
caURL, err := flags.ParseCaURL(ctx)
if err != nil {
return nil, err
}
root := ctx.String("root")
if len(root) == 0 {
root = pki.GetRootCAPath()
if _, err := os.Stat(root); err != nil {
return nil, errs.RequiredFlag(ctx, "root")
}
}
opts = append([]ca.ClientOption{ca.WithRootFile(root)}, opts...)
return ca.NewClient(caURL, opts...)
}
|
