mtls

type Client struct {
	// PrivateKey is the private key used to authenticate
	// to the mTLS server by sending the corresponding
	// public key during the TLS handshake. If not set,
	// then the client does not authenticate itself.
	//
	// The server has to know the corresponding public key
	// identity to verify the client.
	PrivateKey PrivateKey

	// PeerIdentities contains a static mapping from network
	// addresses to identities. When establishing a connection
	// to one of the addresses, the client performs a mTLS handshake
	// expecting a public key that matches the identity assigned
	// to the address.
	//
	// For mapping identities to network address dynamicially set
	// GetPeerIdentity.
	PeerIdentities map[string]Identity

	// GetPeerIdentity is called whenever the client establishes a
	// network connection. The addr is the server's network address
	// as passed to [crypto/tls.Dial] - usually host:port. If it returns
	// true, the client performs a mTLS handshake expecting a public key
	// that matches the returned identity.
	GetPeerIdentity func(addr string) (Identity, bool)

	// Config is the TLS config used when connecting to other TLS servers
	// not within PeerIdentities or for which GetPeerIdentity returns false.
	Config *tls.Config

	// MinVersion contains the minimum TLS version that is acceptable for
	// mTLS connections. For specifying the minimum TLS versions for regular
	// TLS connections use Config.MinVersion.
	//
	// By default, TLS 1.2 is currently used as the minimum. TLS 1.0 is the
	// minimum supported by this package.
	MinVersion uint16

	// MaxVersion contains the maximum TLS version that is acceptable for
	// mTLS connections. For specifying the maximum TLS versions for regular
	// TLS connections use Config.MaxVersion.
	MaxVersion uint16

	// NextProtos is a list of supported application level protocols for mTLS
	// connections, in order of preference. If both peers support ALPN, the
	// selected protocol will be one from this list, and the connection will
	// fail if there is no mutually supported protocol. If NextProtos is empty
	// or the peer doesn't support ALPN, the connection will succeed and
	// ConnectionState.NegotiatedProtocol will be empty.
	//
	// For specifying the supported application level protocols for regular
	// TLS connections use Config.NexProtos.
	NextProtos []string

	// CipherSuites is a list of enabled TLS 1.0–1.2 cipher suites for mTLS
	// connections. The order of the list is ignored. Note that TLS 1.3
	// ciphersuites are not configurable.
	//
	// If CipherSuites is nil, a safe default list is used. The default cipher
	// suites might change over time.
	//
	// For specifying the enabled TLS 1.0-1.2 cipher suites for regular
	// TLS connections use Config.CipherSuites.
	CipherSuites []uint16

	// Dialer contains options for connecting to a network address.
	Dialer net.Dialer
	// contains filtered or unexported fields
}

type ECDSAPrivateKey struct {
	// contains filtered or unexported fields
}

type EdDSAPrivateKey struct {
	// contains filtered or unexported fields
}

type Identity struct {
	// contains filtered or unexported fields
}

type IdentityError struct {
	PeerIdentity Identity // Identity received from the connection peer
	Identity     Identity // Expected peer identity
}

type PrivateKey interface {
	// Private returns the PrivateKey's cryptographic private key.
	Private() crypto.PrivateKey

	// Public returns the PrivateKey's cryptographic public key.
	Public() crypto.PublicKey

	// Identity returns the PrivateKey's [Identity]. It identifies
	// the cryptographic public key.
	Identity() Identity

	// String returns a string representation of the PrivateKey.
	String() string
}

type Server struct {
	// PrivateKey is the server's private key used to authenticate
	// to mTLS clients by sending the corresponding public key during
	// the TLS handshake. If not set, the server will use Config for
	// all incoming TLS connections.
	//
	// Clients that try to establish a mTLS connection should send
	// the PrivateKey's public key identity as server name (SNI).
	//
	// Clients have to know the corresponding public key identity to
	// verify the client.
	PrivateKey PrivateKey

	// PeerIdentities contains a static list of accepted peers. If set,
	// the server only accepts an incoming TLS connection from peers
	// that present one of the listed public keys during the TLS handshake.
	//
	// The server requests a certificate from the clinet only if PeerIdentities
	// is not nil, or VerifyPeerIdentity is set.
	PeerIdentities []Identity

	// VerifyPeerIdentity verifies the connection peer's identity during
	// the TLS handshake. If it returns an error, the handshake is aborted.
	//
	// The server requests a certificate from the clinet only if PeerIdentities
	// is not nil, or VerifyPeerIdentity is set.
	VerifyPeerIdentity func(Identity) error

	// Config is the TLS config used for regular TLS clients that don't send
	// the PrivateKey's public key identity as SNI.
	Config *tls.Config

	// MinVersion contains the minimum TLS version that is acceptable for
	// mTLS connections. For specifying the minimum TLS versions for regular
	// TLS connections use Config.MinVersion.
	//
	// By default, TLS 1.2 is currently used as the minimum. TLS 1.0 is the
	// minimum supported by this package.
	MinVersion uint16

	// MaxVersion contains the maximum TLS version that is acceptable for
	// mTLS connections. For specifying the maximum TLS versions for regular
	// TLS connections use Config.MaxVersion.
	MaxVersion uint16

	// NextProtos is a list of supported application level protocols for mTLS
	// connections, in order of preference. If both peers support ALPN, the
	// selected protocol will be one from this list, and the connection will
	// fail if there is no mutually supported protocol. If NextProtos is empty
	// or the peer doesn't support ALPN, the connection will succeed and
	// ConnectionState.NegotiatedProtocol will be empty.
	//
	// For specifying the supported application level protocols for regular
	// TLS connections use Config.NexProtos.
	NextProtos []string

	// CipherSuites is a list of enabled TLS 1.0–1.2 cipher suites for mTLS
	// connections. The order of the list is ignored. Note that TLS 1.3
	// ciphersuites are not configurable.
	//
	// If CipherSuites is nil, a safe default list is used. The default cipher
	// suites might change over time.
	//
	// For specifying the enabled TLS 1.0-1.2 cipher suites for regular
	// TLS connections use Config.CipherSuites.
	CipherSuites []uint16
	// contains filtered or unexported fields
}