scertecd

package

v0.0.0-...-1b2a7fa Latest Latest Go to latest Published: Sep 17, 2025 License: BSD-3-Clause Imports: 32 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tailscale/scertec

Links

Open Source Insights

Documentation ¶

Overview ¶

The scertecd package provides the code that fetches new TLS certs from LetsEncrypt as needed and puts them in setec before they expire. The code can run either in the foreground once, or most commonly as an HTTP server daemon.

It populates the following setec keys:

{prefix}acme-key: the private key for the ACME account, as a PEM-encoded ECDSA key
{prefix}domains/{domain-name}/rsa: PEM of private key, domain cert, LetsEncrypt cert
{prefix}domains/{domain-name}/ecdsa: PEM of private key, domain cert, LetsEncrypt cert

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type CertType ¶

type CertType string

CertType is the algorithm type for the cert, either RSA or ECDSA.

const (
	RSACert   CertType = "RSA"
	ECDSACert CertType = "ECDSA"
)

type Server ¶

type Server struct {
	SetecClient    setec.Client                     // required client for setec
	PublicDomains  []string                         // domains to maintain public Let's Encrypt certs for
	PrivateDomains []string                         // domains to maintain private CA certs for
	Now            func() time.Time                 // if nil, initialized to time.Now
	ACMEContact    string                           // optional email address for ACME registration
	Prefix         string                           // setec secret prefix ("prod/scertec/")
	Logf           func(format string, args ...any) // if nil, initialized to log.Printf
	// contains filtered or unexported fields
}

Server is the scertec updater server.

Despite the name "server", it can also be used in a single-shot foreground mode via its UpdateAll method.

All exported fields must be initialized before calling an exported method on the Server: either UpdateAll or Start.

func (*Server) ServeHTTP ¶

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

func (*Server) Start ¶

func (s *Server) Start(ctx context.Context) error

Start starts a background renewal goroutine for each cert domain and algorithm type. The context is used only for the initial ACME registration check and not used thereafter.

func (*Server) UpdateAll ¶

func (s *Server) UpdateAll() error

UpdateAll checks or updates all certs once and returns.

If all certs are either fine or successfully updated, it returns nil.

It is not necessary to call Start before UpdateAll.

Source Files ¶

View all Source files

scertecd.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL