Skip to main content

issue_broker_cert

krabka_security::ca

Function issue_broker_cert 

Source 
pub fn issue_broker_cert(
    ca_cert_pem: &str,
    ca_key_pem: &str,
    cn: &str,
    base_sans: &[SubjectAltName],
    extra_sans: &[SubjectAltName],
    validity_days: u32,
) -> Result<BrokerCert, CaError>
Expand description

Sign a broker leaf cert: a server cert and a client cert in one.

The cert carries EKU = serverAuth + clientAuth and KU = digitalSignature + keyEncipherment. SANs accept a mix of DNS names and IPs. The key is ECDSA P-256.

This function merges base_sans and extra_sans into a single SAN list and drops duplicates silently. extra_sans holds entries such as the external advertised addresses for NodePort or LoadBalancer listeners.

§Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.

§Panics

Panics if validated key material has an impossible size or synchronized credential state is poisoned.