ServerConfig¶

NewRouter(&est.ServerConfig{...}) returns the EST handler. Only CA is required for a working server. NewRouter fails when PasswordRenewal is set without CheckBasicAuth or CheckBearerToken or when MaxRequestBody or RateLimit is negative. The package documentation on pkg.go.dev has the full comments.

Fields¶

Field	Default	Meaning	Guide
`CA`	Required	Issues certificates and answers the EST operations	The CA interface
`Logger`	No logging	Receives one entry per request and the causes of 500 answers	Logging
`CheckBasicAuth`	None	Checks every request to the enrollment operations and `/healthcheck` that `CheckBearerToken` does not check, including bearer requests when `CheckBearerToken` is nil	Authentication
`CheckBearerToken`	None	Checks requests with `Authorization: Bearer`	Authentication
`PasswordRenewal`	false	Renew without a client certificate after a password or token sign-in	Password renewal
`CheckCSRSignature`	`CheckSignature` of `crypto/x509`	Verifies request signatures, for algorithms `crypto/x509` lacks	Post-quantum algorithms
`VerifyClientCertificate`	Chain check against `CA.CACerts`	Checks the client certificate of a renewal	Custom certificate verification
`Refusals`	None	Receives the requests the router refuses itself	Recording refusals
`MaxRequestBody`	64 KiB	Largest request body in bytes. Larger bodies answer 413	Request size
`RateLimit`	No limit	Requests per second for all clients together, with bursts of twice that	Request rate
`Timeout`	60 seconds	Cancels the request context after this time	Request time
`AllowedHosts`	Any host	`Host` names to accept. Others answer 400	Hosts
`TrustProxyHeaders`	false	Set `r.RemoteAddr` from `X-Real-IP` or `X-Forwarded-For`, for the logs, the hooks and the CA	Behind a load balancer
`OmitTransferEncoding`	false	Leave out `Content-Transfer-Encoding`	Response headers
`OmitStrictTransportSecurity`	false	Leave out `Strict-Transport-Security: max-age=31536000`	Response headers

Hook signatures¶

CheckBasicAuth(ctx context.Context, r *http.Request, aps, username, password string) error
CheckBearerToken(ctx context.Context, r *http.Request, aps, token string) error
CheckCSRSignature(csr *x509.CertificateRequest) error
VerifyClientCertificate(ctx context.Context, r *http.Request, aps string, cert *x509.Certificate) error
RecordRefusal(ctx context.Context, refusal est.Refusal) error

The CA interface¶

CACerts(ctx, aps, r) ([]*x509.Certificate, error)
CSRAttrs(ctx, aps, r) (est.CSRAttrs, error)
Enroll(ctx, csr, aps, r) (*x509.Certificate, error)
Reenroll(ctx, cert, csr, aps, r) (*x509.Certificate, error)
ServerKeyGen(ctx, csr, aps, r) (*x509.Certificate, []byte, error)
TPMEnroll(ctx, csr, ekCerts, ekPub, akPub, aps, r) (credBlob, encSeed, cred []byte, err error)

All methods take ctx context.Context, aps string and r *http.Request. See The CA interface for what each must return.

Context helpers¶

Function	Use
`LoggerFromContext(ctx)`	The server logger inside the CA and the hooks
`WithSRPUsername(ctx, username)`	Passes the username of a TLS-SRP connection to the router
`SRPUsernameFromContext(ctx)`	The TLS-SRP username or empty

Fixed limits¶

An additional path segment is at most 255 bytes. Longer ones answer 414.
The renewal check keeps the CACerts result of at most 1024 path segments, each for 5 minutes.