CertificatePolicy
in package
implements
JsonSerializable
Certificate issuance constraints.
Table of Contents
Interfaces
- JsonSerializable
Properties
- $defaultCertValidityDays : int
- $maxCertValidityDays : int
- $serverCertAllowedNames : array<string|int, mixed>|null
Methods
- __construct() : mixed
- Constructs a CertificatePolicy.
- fromArray() : self
- Rebuilds a CertificatePolicy from one decoded JSON object.
- jsonSerialize() : array<string, mixed>
- Renders this object for `json_encode()`.
- toArray() : array<string, mixed>
- Renders this object back to its wire form.
Properties
$defaultCertValidityDays read-only
public
int
$defaultCertValidityDays
$maxCertValidityDays read-only
public
int
$maxCertValidityDays
$serverCertAllowedNames read-only
public
array<string|int, mixed>|null
$serverCertAllowedNames
= null
Methods
__construct()
Constructs a CertificatePolicy.
public
__construct(int $defaultCertValidityDays, int $maxCertValidityDays[, array<int, string>|null $serverCertAllowedNames = null ]) : mixed
Parameters
- $defaultCertValidityDays : int
-
the server's
default_cert_validity_daysfield - $maxCertValidityDays : int
-
the server's
max_cert_validity_daysfield - $serverCertAllowedNames : array<int, string>|null = null
-
The names a
Servercertificate may be issued for (S-7, DF-001): DNS suffixes (.lakeside.internal, strictly below), exact hosts (lakeside.internal) and IP prefixes (10.0.0.0/8,fd00::/8). See [crate::models::server_names] for the matching rules. Empty by default, and empty refuses everyServerrequest (I1). A certificate for a name, signed under the organization root, is trusted by every relying party that trusts that root, so the list is written where the root is owned. A tenant override may only remove an entry or narrow one; when the baseline later shrinks, the tenant's effective list is the intersection of the two. (optional)
fromArray()
Rebuilds a CertificatePolicy from one decoded JSON object.
public
static fromArray(array<string, mixed> $data) : self
Parameters
- $data : array<string, mixed>
-
The raw wire object.
Return values
selfjsonSerialize()
Renders this object for `json_encode()`.
public
jsonSerialize() : array<string, mixed>
Any Sensitive it carries stays WRAPPED here, so a log line or a
json_encode($model) in application code prints [SENSITIVE]. The one place a secret
is revealed is ManagementTransport, on the way to the wire
and nowhere else (§27.5).
Return values
array<string, mixed>toArray()
Renders this object back to its wire form.
public
toArray() : array<string, mixed>
§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.