|  | @ -15,8 +15,10 @@ | 
			
		
	
		
		
			
				
					|  |  | package caddytls |  |  | package caddytls | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | import ( |  |  | import ( | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	"crypto/x509" | 
			
		
	
		
		
			
				
					|  |  | 	"encoding/json" |  |  | 	"encoding/json" | 
			
		
	
		
		
			
				
					|  |  | 	"fmt" |  |  | 	"fmt" | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	"io/ioutil" | 
			
		
	
		
		
			
				
					|  |  | 	"net/url" |  |  | 	"net/url" | 
			
		
	
		
		
			
				
					|  |  | 	"time" |  |  | 	"time" | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
	
		
		
			
				
					|  | @ -47,8 +49,10 @@ type ACMEManagerMaker struct { | 
			
		
	
		
		
			
				
					|  |  | 	Challenges           ChallengesConfig `json:"challenges,omitempty"` |  |  | 	Challenges           ChallengesConfig `json:"challenges,omitempty"` | 
			
		
	
		
		
			
				
					|  |  | 	OnDemand             bool             `json:"on_demand,omitempty"` |  |  | 	OnDemand             bool             `json:"on_demand,omitempty"` | 
			
		
	
		
		
			
				
					|  |  | 	Storage              json.RawMessage  `json:"storage,omitempty"` |  |  | 	Storage              json.RawMessage  `json:"storage,omitempty"` | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	TrustedRootsPEMFiles []string         `json:"trusted_roots_pem_files,omitempty"` | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	storage  certmagic.Storage |  |  | 	storage  certmagic.Storage | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	rootPool *x509.CertPool | 
			
		
	
		
		
			
				
					|  |  | } |  |  | } | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | // CaddyModule returns the Caddy module information.
 |  |  | // CaddyModule returns the Caddy module information.
 | 
			
		
	
	
		
		
			
				
					|  | @ -91,6 +95,20 @@ func (m *ACMEManagerMaker) Provision(ctx caddy.Context) error { | 
			
		
	
		
		
			
				
					|  |  | 		m.Storage = nil // allow GC to deallocate
 |  |  | 		m.Storage = nil // allow GC to deallocate
 | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// add any custom CAs to trust store
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	if len(m.TrustedRootsPEMFiles) > 0 { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		m.rootPool = x509.NewCertPool() | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		for _, pemFile := range m.TrustedRootsPEMFiles { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			pemData, err := ioutil.ReadFile(pemFile) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			if err != nil { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				return fmt.Errorf("loading trusted root CA's PEM file: %s: %v", pemFile, err) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			if !m.rootPool.AppendCertsFromPEM(pemData) { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 				return fmt.Errorf("unable to add %s to trust pool: %v", pemFile, err) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	return nil |  |  | 	return nil | 
			
		
	
		
		
			
				
					|  |  | } |  |  | } | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
	
		
		
			
				
					|  | @ -150,6 +168,7 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf | 
			
		
	
		
		
			
				
					|  |  | 		OnDemand:                ond, |  |  | 		OnDemand:                ond, | 
			
		
	
		
		
			
				
					|  |  | 		MustStaple:              m.MustStaple, |  |  | 		MustStaple:              m.MustStaple, | 
			
		
	
		
		
			
				
					|  |  | 		Storage:                 storage, |  |  | 		Storage:                 storage, | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		TrustedRoots:            m.rootPool, | 
			
		
	
		
		
			
				
					|  |  | 		// TODO: listenHost
 |  |  | 		// TODO: listenHost
 | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | } |  |  | } | 
			
		
	
	
		
		
			
				
					|  | 
 |