Server options¶

Options of server.New and server.NewCAServer. The package documentation describes each in full.

Identity and credentials¶

Option	Default	Effect
`WithSigner`	None	Key, certificate and chain that sign responses. `Err` reports a key that does not match
`WithUnprotectedErrorsBeforeAuthentication`	Off	Leaves errors raised before authentication unprotected, so a slow signer does not sign them
`WithExtraCerts`	None	Certificates added to `extraCerts` of every response
`WithSender`	Subject of the signer certificate	Server name in response headers. A request for another recipient is refused
`WithSecretLookup`	None	Finds shared secrets. Without it MAC-protected messages are refused
`WithCertificateLookup`	None	Finds sender certificates. Without it signed messages are refused
`WithRAAuthorizer`	None	Accepts nested messages from registration authorities
`WithMACIterationLimits`	100 to 1000000	Accepted MAC iteration counts, for PBMAC1 multiplied by the PRF blocks of the key length
`WithSHA1Signatures`	Off	Accepts SHA-1 signatures in protection and proof of possession

Option	Default	Effect
`WithConfirmWaitTime`	10 seconds	How long an issued certificate or a challenge waits for its answer
`WithImplicitConfirm`	Off	Grants implicit confirmation to clients that ask for it
`WithWaitingLifetime`	24 hours	How long a waiting request stays after its last poll
`WithWaitingExpirer`	The CA, if it implements `WaitingExpirer`	Hears about waiting requests that `CleanupExpired` removes

Option	Default	Effect
`WithEncryptedCertificatePOP`	Off	Accepts the encrypted certificate method
`WithChallengeResponsePOP`	Off	Accepts the challenge-response method
`WithEnvelopedDataForVersion2`	Off	Sends EnvelopedData instead of EncryptedValue to CMP version 2 RSA requests
`WithSignatureProtectionPOP`	Off	Accepts a request without proof whose protection was signed with the requested key
`WithPoposkInputVariants`	Off	Accepts the signature proof the Insta Certifier 10 cmpclient sends

Option	Default	Effect
`WithCentralKeyGeneration`	Off	Generates the key pair for requests without a public key and signs the private key with a key generation authority
`WithCentralKeyGenerationAESKeyWrap`	Off	Encrypts the key for a MAC-protected request with the AES key wrap instead of the RFC 3211 key wrap that OpenSSL reads
`WithCentralKeyGenerationAsymmetricKeyPackage`	Off	Signs the key as an RFC 9810 AsymmetricKeyPackage instead of the id-data that OpenSSL reads

Option	Default	Effect
`WithStrictProfileValidation`	Off	Enforces the RFC 9483 message construction rules and overrides the relaxing options
`WithMessageTimeTolerance`	Off	Refuses a messageTime further than the tolerance with badTime
`WithOptionalCertConfRecipNonce`	Off	Accepts `certConf` without recipNonce
`WithOptionalPollReqRecipNonce`	Off	Accepts `pollReq` without recipNonce
`WithOptionalSubject`	Off	Accepts a template without the subject field when it requests a subjectAltName
`WithAnyCertReqID`	Off	Accepts an ir, cr or kur with a certReqId other than 0 and repeats it in the response
`WithRawSubject`	Off	Passes the requested subject unchanged in `template.RawSubject`
`WithOptionalRevocationReason`	Off	Accepts a revocation request without reasonCode
`WithOptionalRevocationIssuer`	Off	Accepts a revocation request without an issuer
`WithMACRevocation`	Off	Passes MAC-protected revocation requests to `RevocationAuthorizer`

Setting	Default	Effect
`WithMaxTransactions`	10000	Concurrent transactions in the server
`WithMaxTransactionsPerCredential`	100	Concurrent transactions per client credential
`MaxRequestBodySize`	1 MiB	Largest accepted request body, a package variable