@@ -39,11 +39,11 @@ import (
3939
4040const (
4141 // Security Strength Equivalence
42- //-----------------------------------
43- //| ECC | DH/DSA/RSA |
44- //| 256 | 3072 |
45- //| 384 | 7680 |
46- //-----------------------------------
42+ //
43+ // | ECC | DH/DSA/RSA |
44+ // |----------|--------------- |
45+ // | 256 | 3072 |
46+ // | 384 | 7680 |
4747
4848 // RootKeySize is the default size of the root CA key
4949 // It would be ideal for the root key to use P-384, but in P-384 is not optimized in go yet :(
@@ -134,25 +134,24 @@ type x509UnknownAuthError struct {
134134//
135135// Requirements:
136136//
137- // - [signing CA key] must be the private key for [signing CA cert], and either both or none must be provided
138- //
139- // - [intermediate CA1] must have the same public key and subject as [signing CA cert], because otherwise when
140- // appended to a leaf certificate, the intermediates will not form a chain (because [intermediate CA1] won't because
141- // the signer of the leaf certificate)
142- // - [intermediate CA1] must be signed by [intermediate CA2], which must be signed by [intermediate CA3]
143- //
144- // - When we issue a certificate, the intermediates will be appended so that the certificate looks like:
145- // [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3]
146- // - [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3] is guaranteed to form a
147- // valid chain from [leaf signed by signing CA cert] to one of the root certs ([signing CA cert], [CA cert1], [CA cert2])
148- // using zero or more of the intermediate certs ([intermediate CA1][intermediate CA2][intermediate CA3]) as intermediates
137+ // - [signing CA key] must be the private key for [signing CA cert], and either both or none must be provided
138+ // - [intermediate CA1] must have the same public key and subject as [signing CA cert], because otherwise when
139+ // appended to a leaf certificate, the intermediates will not form a chain (because [intermediate CA1] won't because
140+ // the signer of the leaf certificate)
141+ // - [intermediate CA1] must be signed by [intermediate CA2], which must be signed by [intermediate CA3]
142+ // - When we issue a certificate, the intermediates will be appended so that the certificate looks like:
143+ // [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3]
144+ // - [leaf signed by signing CA cert][intermediate CA1][intermediate CA2][intermediate CA3] is guaranteed to form a
145+ // valid chain from [leaf signed by signing CA cert] to one of the root certs ([signing CA cert], [CA cert1], [CA cert2])
146+ // using zero or more of the intermediate certs ([intermediate CA1][intermediate CA2][intermediate CA3]) as intermediates
149147//
150148// Example 1: Simple root rotation
149+ //
151150// - Initial state:
152- // - RootCA.Cert: [Root CA1 self-signed]
153- // - RootCA.Intermediates: []
154- // - RootCA.signer.Cert: [Root CA1 self-signed]
155- // - Issued TLS cert: [leaf signed by Root CA1]
151+ // - RootCA.Cert: [Root CA1 self-signed]
152+ // - RootCA.Intermediates: []
153+ // - RootCA.signer.Cert: [Root CA1 self-signed]
154+ // - Issued TLS cert: [leaf signed by Root CA1]
156155//
157156// - Intermediate state (during root rotation):
158157// - RootCA.Cert: [Root CA1 self-signed]
@@ -165,7 +164,6 @@ type x509UnknownAuthError struct {
165164// - RootCA.Intermediates: []
166165// - RootCA.signer.Cert: [Root CA2 self-signed]
167166// - Issued TLS cert: [leaf signed by Root CA2]
168- //
169167type RootCA struct {
170168 // Certs contains a bundle of self-signed, PEM encoded certificates for the Root CA to be used
171169 // as the root of trust.
0 commit comments