Module ca 

Pure X.509 CA + leaf-cert generation for the operator’s clients-CA bootstrap. Inter-broker mTLS and cert hot-reload tests can reuse it.

No async, no I/O. These helpers return PEM-encoded material that callers persist to Kubernetes Secrets, files, or anywhere else.

Structs

BrokerCert

A broker leaf cert, which is a server cert and a client cert in one.

CaMaterial

Self-signed clients-CA material.

UserCert

A leaf cert issued by a clients-CA. not_after is RFC3339.

Enums

CaError

SubjectAltName

SAN entry for a leaf cert. ECDSA leaf certs accept any mix of DNS names and IP addresses, and the broker-cert path uses a mix.

Functions

generate_clients_ca

Generate a self-signed clients CA with Subject = CN=<cn>, O=krabka, BasicConstraints: CA:TRUE, and KeyUsage = keyCertSign|cRLSign. ECDSA P-256.

generate_cluster_ca

Generate a self-signed cluster CA.

issue_broker_cert

Sign a broker leaf cert: a server cert and a client cert in one.

issue_user_cert

Sign a leaf client cert with Subject = CN=<cn>.

renew_clients_ca

Re-sign a clients CA cert with an existing key, a same-key renewal.

renew_cluster_ca

Re-sign a cluster CA cert with an existing key, a same-key renewal.