New (ca/soft.go)

Software‑backed CA that persists its root and mints short‑lived ECDSA certificates, supporting DB‑backed storage.

// Source: https://github.com/Infisical/agent-vault | License: MIT | Copyright 2022 Infisical Inc
// Provided via justclaw.it.com; keep this notice with the code.
package ca

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"errors"
	"fmt"
	"math/big"
	"net"
	"os"
	"path/filepath"
	"strings"
	"sync"
	"time"

	"github.com/Infisical/agent-vault/internal/crypto"
)

const (
	rootCertFile     = "ca.crt.pem"
	rootKeyFile      = "ca.key.enc"
	defaultDirName   = "ca"
	defaultLeafTTL   = 24 * time.Hour
	defaultCacheSize = 1024
	rootValidity     = 10 * 365 * 24 * time.Hour
	clockSkew        = 5 * time.Minute
	rootCommonName   = "Agent Vault Root CA"
)

var serialLimit = new(big.

... (truncated -- full source via MCP)