|
@ -15,8 +15,10 @@ |
|
|
package caddytls |
|
|
package caddytls |
|
|
|
|
|
|
|
|
import ( |
|
|
import ( |
|
|
|
|
|
"crypto/x509" |
|
|
"encoding/json" |
|
|
"encoding/json" |
|
|
"fmt" |
|
|
"fmt" |
|
|
|
|
|
"io/ioutil" |
|
|
"net/url" |
|
|
"net/url" |
|
|
"time" |
|
|
"time" |
|
|
|
|
|
|
|
@ -38,17 +40,19 @@ func init() { |
|
|
// after you have configured this struct
|
|
|
// after you have configured this struct
|
|
|
// to your liking.
|
|
|
// to your liking.
|
|
|
type ACMEManagerMaker struct { |
|
|
type ACMEManagerMaker struct { |
|
|
CA string `json:"ca,omitempty"` |
|
|
CA string `json:"ca,omitempty"` |
|
|
Email string `json:"email,omitempty"` |
|
|
Email string `json:"email,omitempty"` |
|
|
RenewAhead caddy.Duration `json:"renew_ahead,omitempty"` |
|
|
RenewAhead caddy.Duration `json:"renew_ahead,omitempty"` |
|
|
KeyType string `json:"key_type,omitempty"` |
|
|
KeyType string `json:"key_type,omitempty"` |
|
|
ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` |
|
|
ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` |
|
|
MustStaple bool `json:"must_staple,omitempty"` |
|
|
MustStaple bool `json:"must_staple,omitempty"` |
|
|
Challenges ChallengesConfig `json:"challenges,omitempty"` |
|
|
Challenges ChallengesConfig `json:"challenges,omitempty"` |
|
|
OnDemand bool `json:"on_demand,omitempty"` |
|
|
OnDemand bool `json:"on_demand,omitempty"` |
|
|
Storage json.RawMessage `json:"storage,omitempty"` |
|
|
Storage json.RawMessage `json:"storage,omitempty"` |
|
|
|
|
|
TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"` |
|
|
storage certmagic.Storage |
|
|
|
|
|
|
|
|
storage certmagic.Storage |
|
|
|
|
|
rootPool *x509.CertPool |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
// CaddyModule returns the Caddy module information.
|
|
|
// CaddyModule returns the Caddy module information.
|
|
@ -91,6 +95,20 @@ func (m *ACMEManagerMaker) Provision(ctx caddy.Context) error { |
|
|
m.Storage = nil // allow GC to deallocate
|
|
|
m.Storage = nil // allow GC to deallocate
|
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// add any custom CAs to trust store
|
|
|
|
|
|
if len(m.TrustedRootsPEMFiles) > 0 { |
|
|
|
|
|
m.rootPool = x509.NewCertPool() |
|
|
|
|
|
for _, pemFile := range m.TrustedRootsPEMFiles { |
|
|
|
|
|
pemData, err := ioutil.ReadFile(pemFile) |
|
|
|
|
|
if err != nil { |
|
|
|
|
|
return fmt.Errorf("loading trusted root CA's PEM file: %s: %v", pemFile, err) |
|
|
|
|
|
} |
|
|
|
|
|
if !m.rootPool.AppendCertsFromPEM(pemData) { |
|
|
|
|
|
return fmt.Errorf("unable to add %s to trust pool: %v", pemFile, err) |
|
|
|
|
|
} |
|
|
|
|
|
} |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
return nil |
|
|
return nil |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
@ -150,6 +168,7 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf |
|
|
OnDemand: ond, |
|
|
OnDemand: ond, |
|
|
MustStaple: m.MustStaple, |
|
|
MustStaple: m.MustStaple, |
|
|
Storage: storage, |
|
|
Storage: storage, |
|
|
|
|
|
TrustedRoots: m.rootPool, |
|
|
// TODO: listenHost
|
|
|
// TODO: listenHost
|
|
|
} |
|
|
} |
|
|
} |
|
|
} |
|
|