New signer implementation in Go
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Jan Dittberner 51afebf2c1 Test and refactor messages
- add unit tests for all handwritten code in messages package
- use uuid.NewString() instead of uuid.NewUUID() to avoid unnecessary error
- sort code in messages.go to put type related code close to each other
- move checkFailed from hsm.Access.Healthy method to messages.CertificateInfoFailed
- add typing for Status field of messages.CertificateInfo
1 year ago
cmd Test and refactor messages 1 year ago
docs Rename intermediary CA to subordinate CA 2 years ago
internal Test and refactor messages 1 year ago
pkg Test and refactor messages 1 year ago
.gitattributes First DDD based signer implementation parts 3 years ago
.gitignore Implement command type handling 2 years ago
.golangci.yml Move internal code to internal packages 2 years ago
.goreleaser.yaml Remove example comments from goreleaser configuration 2 years ago
LICENSE Configure and apply golangci-lint 2 years ago
Makefile Protocol improvements 2 years ago Add documentation section for socat PTYs 2 years ago
go.mod Tidy up dependencies 2 years ago
go.sum Implement delta CRL support 2 years ago

CAcert signer

This is the CAcert signer reimplementation in Go that implements a more robust wire protocol and has configurable support for hardware security modules (HSMs) for online and offline key pairs.

See the design document for design considerations and architecture diagrams.

Development preconditions

You will need GNU make to build the application. On Debian systems you can install GNU make and crossbuild tools for ARM binary builds using:

sudo apt install make crossbuild-essential-arm64 crossbuild-essential-armhf

Install go >= 1.17, golangci-lint >= 1.50.0 and goreleaser, as these are used for building and linting the application.

Read the documentation of these tools, to find out how to use them.

Building the binaries

There is a Makefile to automate builds of the signer and clientsim binaries. Run


to run linting, tests and binary builds.

Running with softhsm2

Setup HSM keys and certificates

sudo apt install softhsm2
umask 077
mkdir -p ~/.config/softhsm2/tokens
echo "directories.tokendir = $HOME/.config/softhsm2/tokens/" > ~/.config/softhsm2/softhsm2.conf
cp docs/config.sample.yaml config.yaml
# modify config.yaml to fit your needs
softhsm2-util --init-token --free --label localhsm --so-pin 47110815 --pin 123456
# initialize the keys
export PKCS11_PIN_LOCALHSM=123456
go run ./cmd/signer -setup

Run the signer

export PKCS11_PIN_LOCALHSM=123456
go run ./cmd/signer

Run the client simulator with socat

You may run the client simulator that sends commands via stdout and reads responses on stdin via socat to simulate traffic on an emulated serial device:

sudo apt install socat
make clientsim
socat -d -d -v pty,rawer,link=$(pwd)/testPty EXEC:./clientsim,pty,rawer

You will need to configure $(pwd)/testPty as serial/device in your config.yaml to let the signer command find the emulated serial device.

Using socat to simulate TTYs for signer and signer client

The following socat command line will open TTY pseudo devices in ./testPty as well as ../cacert-gosignerclient/testPty. This will allow both the signer and the signer client code to have testPty as device value in their configuration YAML file.

socat -d -d pty,rawer,link=$(pwd)/testPty pty,rawer,link=$(pwd)/../cacert-gosignerclient/testPty