github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-11-25 17:48:13 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

caddytls: Reuse issuer between PreCheck and Issue (#4866)

Browse Source 
This enables EAB reuse for ZeroSSLIssuer (which is now supported by ZeroSSL).
This commit is contained in:
Matt Holt 2022-07-05 18:12:25 -06:00 committed by GitHub
parent 660c59b6f3
commit 412dcc07d3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
modules/caddytls/acmeissuer.go
View File

@ -85,9 +85,11 @@ type ACMEIssuer struct {
PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`
rootPool *x509.CertPool
template certmagic.ACMEIssuer
magic *certmagic.Config
logger *zap.Logger
template certmagic.ACMEIssuer // set at Provision
magic *certmagic.Config // set at PreCheck
issuer *certmagic.ACMEIssuer // set at PreCheck; result of template + magic
}
// CaddyModule returns the Caddy module information.
@ -217,30 +219,27 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEIssuer, error) {
// the ConfigSetter interface.
func (iss *ACMEIssuer) SetConfig(cfg *certmagic.Config) {
iss.magic = cfg
iss.issuer = certmagic.NewACMEIssuer(cfg, iss.template)
}
// TODO: I kind of hate how each call to these methods needs to
// make a new ACME manager to fill in defaults before using; can
// we find the right place to do that just once and then re-use?
// PreCheck implements the certmagic.PreChecker interface.
func (iss *ACMEIssuer) PreCheck(ctx context.Context, names []string, interactive bool) error {
return certmagic.NewACMEIssuer(iss.magic, iss.template).PreCheck(ctx, names, interactive)
return iss.issuer.PreCheck(ctx, names, interactive)
}
// Issue obtains a certificate for the given csr.
func (iss *ACMEIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
return certmagic.NewACMEIssuer(iss.magic, iss.template).Issue(ctx, csr)
return iss.issuer.Issue(ctx, csr)
}
// IssuerKey returns the unique issuer key for the configured CA endpoint.
func (iss *ACMEIssuer) IssuerKey() string {
return certmagic.NewACMEIssuer(iss.magic, iss.template).IssuerKey()
return iss.issuer.IssuerKey()
}
// Revoke revokes the given certificate.
func (iss *ACMEIssuer) Revoke(ctx context.Context, cert certmagic.CertificateResource, reason int) error {
return certmagic.NewACMEIssuer(iss.magic, iss.template).Revoke(ctx, cert, reason)
return iss.issuer.Revoke(ctx, cert, reason)
}
// GetACMEIssuer returns iss. This is useful when other types embed ACMEIssuer, because

2
modules/caddytls/tls.go
View File

@ -336,7 +336,7 @@ func (t *TLS) HandleHTTPChallenge(w http.ResponseWriter, r *http.Request) bool {
for _, iss := range ap.magic.Issuers {
if am, ok := iss.(acmeCapable); ok {
iss := am.GetACMEIssuer()
if certmagic.NewACMEIssuer(iss.magic, iss.template).HandleHTTPChallenge(w, r) {
if iss.issuer.HandleHTTPChallenge(w, r) {
return true
}
}

4
modules/caddytls/zerosslissuer.go
View File

@ -162,8 +162,8 @@ func (iss *ZeroSSLIssuer) generateEABCredentials(ctx context.Context, acct acme.
func (iss *ZeroSSLIssuer) initialize() {
iss.mu.Lock()
defer iss.mu.Unlock()
if iss.template.NewAccountFunc == nil {
iss.template.NewAccountFunc = iss.newAccountCallback
if iss.ACMEIssuer.issuer.NewAccountFunc == nil {
iss.ACMEIssuer.issuer.NewAccountFunc = iss.newAccountCallback
}
}