* caddytls: Support multiple issuers
Defaults are Let's Encrypt and ZeroSSL.
There are probably bugs.
* Commit updated integration tests, d'oh
* Update go.mod
returnnil,warnings,fmt.Errorf("automation policy from site block is also default/catch-all policy because of key without hostname, and the two are in conflict: %#v != %#v",ap.Issuer,issuer)
returnnil,warnings,fmt.Errorf("automation policy from site block is also default/catch-all policy because of key without hostname, and the two are in conflict: %#v != %#v",ap.Issuers,issuers)
}
}
// custom bind host
for_,cfgVal:=rangesblock.pile["bind"]{
// if an issuer was already configured and it is NOT an ACME
// issuer, skip, since we intend to adjust only ACME issuers
for_,iss:=rangeap.Issuers{
// if an issuer was already configured and it is NOT an ACME issuer,
// skip, since we intend to adjust only ACME issuers; ensure we
// include any issuer that embeds/wraps an underlying ACME issuer
varacmeIssuer*caddytls.ACMEIssuer
ifap.Issuer!=nil{
// ensure we include any issuer that embeds/wraps an underlying ACME issuer
ap.Issuers=[]certmagic.Issuer{acme,zerossl}// TODO: keep this in sync with Caddy's other issuer defaults elsewhere, like in caddytls/automation.go (DefaultIssuers).
// if a non-ZeroSSL endpoint is specified, we assume we can't use the ZeroSSL issuer successfully
returnnil,fmt.Errorf("global options are ambiguous: cert_issuer is confusing when combined with acme_*, email, or local_certs options")
ifhasIssuer&&hasLocalCerts{
returnnil,fmt.Errorf("global options are ambiguous: local_certs is confusing when combined with cert_issuer, because local_certs is also a specific kind of issuer")
}
ap.Issuer=issuer.(certmagic.Issuer)
}elseiflocalCerts!=nil{
// internal issuer enabled trumps any ACME configurations; useful in testing
ap.Issuer=new(caddytls.InternalIssuer)// we'll encode it later
// if this automation policy has no Issuer defined, and
// none of the subjects qualify for a public certificate,
// set the issuer to internal so that these names can all
// get certificates; critically, we can only do this if an
// issuer is not explicitly configured (IssuerRaw, vs. just
// Issuer) AND if the list of subjects is non-empty
ifap.IssuerRaw==nil&&len(ap.Subjects)>0{
varanyPublicbool
for_,s:=rangeap.Subjects{
ifcertmagic.SubjectQualifiesForPublicCert(s){
anyPublic=true
break
// TODO: IssuerRaw field deprecated as of November 2020 - remove this shim after deprecation is complete
ifap.IssuerRaw!=nil{
tlsApp.logger.Warn("the 'issuer' field is deprecated and will be removed in the future; use 'issuers' instead; your issuer has been appended automatically for now")
ap.IssuersRaw=append(ap.IssuersRaw,ap.IssuerRaw)
}
// load and provision any explicitly-configured issuer modules