internal

Mar 9, 2026

Changes in this version

+ var ErrUnsupportedCurve = errors.New("unsupported key curve")

+ var ErrUnsupportedKeyAlgorithm = errors.New("unsupported key algorithm")

+ func ArchiveHasMagic(format string, data []byte) bool

type ScanTextSummaryInput

+ Files int

Mar 2, 2026

Changes in this version

+ func FormatDiagnoses(diags []Diagnosis) string

+ func FormatScanTextSummary(input ScanTextSummaryInput) string

+ func ProcessUserPasswords(passwordList []string, passwordFile string) ([]string, error)

+ func ReadFileLimited(path string, maxBytes int64) ([]byte, error)

+ func WalkScanFiles(input WalkScanFilesInput) error

type ChainCert

+ AKI string

+ CertType string

+ EKUs []string

+ Issuer string

+ KeyAlgo string

+ KeySize string

+ KeyUsages []string

+ NotAfter string

+ NotBefore string

+ SHA1 string

+ SHA256 string

+ Serial string

+ SigAlg string

+ type DiagnoseChainInput struct

+ Cert *x509.Certificate

+ ExtraCerts []*x509.Certificate

+ type Diagnosis struct

+ Check string

+ Detail string

+ Status string

+ func DiagnoseChain(input DiagnoseChainInput) []Diagnosis

+ type ExportBundlesInput struct

+ Configs []BundleConfig

+ Duplicates bool

+ ForceBundle bool

+ OutDir string

+ P12Password string

+ Store *certstore.MemStore

+ type GenerateKeyInput struct

+ Algorithm string

+ Bits int

+ Curve string

type InspectResult

+ AIAFetched bool

+ type PasswordSets struct

+ Decode []string

+ Export []string

+ func ProcessPasswordSets(passwordList []string, passwordFile string) (PasswordSets, error)

+ type ProcessDataInput struct

+ Data []byte

+ MaxBytes int64

+ Passwords []string

+ Store *certstore.MemStore

+ VirtualPath string

+ type ProcessFileInput struct

+ MaxBytes int64

+ Passwords []string

+ Path string

+ Store *certstore.MemStore

+ type ResolveInspectAIAInput struct

+ AllowPrivateNetworks bool

+ Fetch certstore.AIAFetcher

+ Results []InspectResult

+ type ScanTextSummaryInput struct

+ ExpiredIntermediates int

+ ExpiredLeaves int

+ ExpiredRoots int

+ Intermediates int

+ Keys int

+ Leaves int

+ Matched int

+ Roots int

+ UntrustedIntermediates int

+ UntrustedLeaves int

+ UntrustedRoots int

type VerifyInput

+ AllowPrivateNetworks bool

+ CheckCRL bool

+ CheckOCSP bool

+ Verbose bool

type VerifyResult

+ AKI string

+ CRL *certkit.CRLCheckResult

+ CertType string

+ Diagnostics []Diagnosis

+ EKUs []string

+ IsCA *bool

+ Issuer string

+ KeyAlgo string

+ KeySize string

+ KeyUsages []string

+ NotBefore string

+ OCSP *certkit.OCSPResult

+ SHA1 string

+ SHA256 string

+ Serial string

+ SigAlg string

+ type WalkScanFilesInput struct

+ MaxFileSize int64

+ OnFile func(path string) error

+ RootPath string

Feb 25, 2026

Changes in this version

type InspectResult

+ EKUs []string

+ IsCA *bool

+ KeyUsages []string

+ func InspectData(data []byte, passwords []string) []InspectResult

+ func ResolveInspectAIA(ctx context.Context, results []InspectResult, fetch certstore.AIAFetcher) ([]InspectResult, []string)

Feb 23, 2026

Changes in this version

+ func AnnotateInspectTrust(results []InspectResult) error

+ func CertAnnotation(expired, untrusted int) string

type InspectResult

+ Expired *bool

+ Trusted *bool

Feb 15, 2026

Changes in this version

+ func AssignBundleNames(store *certstore.MemStore, configs []BundleConfig)

type ProcessArchiveInput

+ Passwords []string

+ Store *certstore.MemStore

Feb 14, 2026

Changes in this version

+ func ArchiveFormat(path string) string

+ func IsArchive(path string) bool

+ func IsSkippableDir(name string) bool

+ func ProcessArchive(input ProcessArchiveInput) (int, error)

+ func ProcessData(data []byte, virtualPath string, cfg *Config) error

+ type ArchiveLimits struct

+ MaxDecompressionRatio int64

+ MaxEntryCount int

+ MaxEntrySize int64

+ MaxTotalSize int64

+ func DefaultArchiveLimits() ArchiveLimits

type DB

+ func (db *DB) LoadFromDisk(path string) error

+ func (db *DB) SaveToDisk(path string) error

+ type ProcessArchiveInput struct

+ ArchivePath string

+ Config *Config

+ Data []byte

+ Format string

+ Limits ArchiveLimits

Feb 12, 2026

Changes in this version

type InspectResult

+ SKILegacy string

Feb 11, 2026

Changes in this version

+ type ChainCert struct

+ Expiry string

+ IsRoot bool

+ SKI string

+ Subject string

type VerifyResult

+ Chain []ChainCert

+ KeyInfo string

+ SANs []string

+ SKI string

Feb 11, 2026

Changes in this version

+ type ContainerContents struct

+ ExtraCerts []*x509.Certificate

+ Key crypto.PrivateKey

+ Leaf *x509.Certificate

+ func LoadContainerFile(path string, passwords []string) (*ContainerContents, error)

+ func ParseContainerData(data []byte, passwords []string) (*ContainerContents, error)

+ type VerifyInput struct

+ Cert *x509.Certificate

+ CheckChain bool

+ CheckKeyMatch bool

+ CustomRoots []*x509.Certificate

+ ExpiryDuration time.Duration

+ ExtraCerts []*x509.Certificate

+ Key crypto.PrivateKey

+ TrustStore string

Feb 11, 2026

Changes in this version

type CSRResult

+ CSRPEM string

+ KeyPEM string

type Config

+ IncludeExpired bool

type DB

+ func (db *DB) GetAllCerts() ([]CertificateRecord, error)

type KeygenResult

+ CSRPEM string

+ KeyPEM string

+ PubPEM string

Feb 11, 2026

Changes in this version

type DB

+ func (db *DB) GetCertBySKI(ski string) (*CertificateRecord, error)

type InspectResult

+ AKI string

+ SKI string

Feb 11, 2026

Changes in this version

+ func ExportBundles(ctx context.Context, cfgs []BundleConfig, outDir string, db *DB, ...) error

+ func FormatInspectResults(results []InspectResult, format string) (string, error)

+ func FormatVerifyResult(r *VerifyResult) string

+ func GenerateKey(algorithm string, bits int, curve string) (crypto.Signer, error)

+ func LoadPasswordsFromFile(filename string) ([]string, error)

+ func ParseLogLevel(level string) slog.Level

+ func ProcessFile(path string, cfg *Config) error

+ func ProcessPasswords(passwordList []string, passwordFile string) ([]string, error)

+ func SetupLogger(level string)

+ type BundleConfig struct

+ BundleName string

+ CommonNames []string

+ Subject *SubjectConfig

+ func LoadBundleConfigs(path string) ([]BundleConfig, error)

+ type BundlesYAML struct

+ Bundles []BundleConfig

+ DefaultSubject *SubjectConfig

+ type CSROptions struct

+ Algorithm string

+ Bits int

+ CSRPath string

+ CertPath string

+ Curve string

+ KeyPath string

+ OutPath string

+ Passwords []string

+ TemplatePath string

+ type CSRResult struct

+ CSRFile string

+ KeyFile string

+ func GenerateCSRFiles(opts CSROptions) (*CSRResult, error)

+ type CertificateRecord struct

+ AuthorityKeyIdentifier string

+ BundleName string

+ CertType string

+ CommonName sql.NullString

+ Expiry time.Time

+ KeyType string

+ MetadataJSON types.JSONText

+ NotBefore *time.Time

+ PEM string

+ SANsJSON types.JSONText

+ SerialNumber string

+ SubjectKeyIdentifier string

+ type Config struct

+ BundleConfigs []BundleConfig

+ DB *DB

+ ExportBundles bool

+ ForceExport bool

+ InputPath string

+ OutDir string

+ Passwords []string

+ type DB struct

+ func NewDB(dbPath string) (*DB, error)

+ func (db *DB) DumpDB() error

+ func (db *DB) GetAllKeys() ([]KeyRecord, error)

+ func (db *DB) GetCert(serial, aki string) (*CertificateRecord, error)

+ func (db *DB) GetCertBySKID(skid string) (*CertificateRecord, error)

+ func (db *DB) GetKey(skid string) (*KeyRecord, error)

+ func (db *DB) GetScanSummary() (*ScanSummary, error)

+ func (db *DB) InsertCertificate(cert CertificateRecord) error

+ func (db *DB) InsertKey(key KeyRecord) error

+ func (db *DB) ResolveAKIs() error

+ type InspectResult struct

+ AKID string

+ CSRDNSNames []string

+ CSRSubject string

+ CertType string

+ Issuer string

+ KeyAlgo string

+ KeySize string

+ KeyType string

+ NotAfter string

+ NotBefore string

+ SANs []string

+ SHA1 string

+ SHA256 string

+ SKID string

+ Serial string

+ SigAlg string

+ Subject string

+ Type string

+ func InspectFile(path string, passwords []string) ([]InspectResult, error)

+ type K8sMetadata struct

+ Annotations map[string]string

+ Name string

+ type K8sSecret struct

+ APIVersion string

+ Data map[string]string

+ Kind string

+ Metadata K8sMetadata

+ Type string

+ type KeyRecord struct

+ BitLength int

+ Curve string

+ KeyData []byte

+ KeyType string

+ Modulus string

+ PublicExponent int

+ SubjectKeyIdentifier string

+ type KeygenOptions struct

+ Algorithm string

+ Bits int

+ CN string

+ Curve string

+ OutPath string

+ SANs []string

+ type KeygenResult struct

+ CSRFile string

+ KeyFile string

+ PubFile string

+ func GenerateKeyFiles(opts KeygenOptions) (*KeygenResult, error)

+ type ScanSummary struct

+ Intermediates int

+ Keys int

+ Leaves int

+ Matched int

+ Roots int

+ type SubjectConfig struct

+ Country []string

+ Locality []string

+ Organization []string

+ OrganizationalUnit []string

+ Province []string

+ type VerifyResult struct

+ ChainErr string

+ ChainValid *bool

+ Errors []string

+ Expiry *bool

+ ExpiryInfo string

+ KeyMatch *bool

+ KeyMatchErr string

+ NotAfter string

+ Subject string

+ func VerifyCert(ctx context.Context, certPath, keyPath string, checkChain bool, ...) (*VerifyResult, error)