|
@ -17,6 +17,7 @@ package caddytls |
|
|
import ( |
|
|
import ( |
|
|
"context" |
|
|
"context" |
|
|
"crypto/x509" |
|
|
"crypto/x509" |
|
|
|
|
|
"encoding/base64" |
|
|
"fmt" |
|
|
"fmt" |
|
|
"io/ioutil" |
|
|
"io/ioutil" |
|
|
"net/url" |
|
|
"net/url" |
|
@ -54,6 +55,10 @@ type ACMEIssuer struct { |
|
|
// other than ACME transactions.
|
|
|
// other than ACME transactions.
|
|
|
Email string `json:"email,omitempty"` |
|
|
Email string `json:"email,omitempty"` |
|
|
|
|
|
|
|
|
|
|
|
// If using an ACME CA that requires an external account
|
|
|
|
|
|
// binding, specify the CA-provided credentials here.
|
|
|
|
|
|
ExternalAccount *ExternalAccountBinding `json:"external_account,omitempty"` |
|
|
|
|
|
|
|
|
// Time to wait before timing out an ACME operation.
|
|
|
// Time to wait before timing out an ACME operation.
|
|
|
ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` |
|
|
ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` |
|
|
|
|
|
|
|
@ -107,12 +112,16 @@ func (m *ACMEIssuer) Provision(ctx caddy.Context) error { |
|
|
} |
|
|
} |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
m.template = m.makeIssuerTemplate() |
|
|
var err error |
|
|
|
|
|
m.template, err = m.makeIssuerTemplate() |
|
|
|
|
|
if err != nil { |
|
|
|
|
|
return err |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
return nil |
|
|
return nil |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager { |
|
|
func (m *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) { |
|
|
template := certmagic.ACMEManager{ |
|
|
template := certmagic.ACMEManager{ |
|
|
CA: m.CA, |
|
|
CA: m.CA, |
|
|
Email: m.Email, |
|
|
Email: m.Email, |
|
@ -120,6 +129,20 @@ func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager { |
|
|
TrustedRoots: m.rootPool, |
|
|
TrustedRoots: m.rootPool, |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
if m.ExternalAccount != nil { |
|
|
|
|
|
hmac, err := base64.StdEncoding.DecodeString(m.ExternalAccount.EncodedHMAC) |
|
|
|
|
|
if err != nil { |
|
|
|
|
|
return template, err |
|
|
|
|
|
} |
|
|
|
|
|
if m.ExternalAccount.KeyID == "" || len(hmac) == 0 { |
|
|
|
|
|
return template, fmt.Errorf("when an external account binding is specified, both key ID and HMAC are required") |
|
|
|
|
|
} |
|
|
|
|
|
template.ExternalAccount = &certmagic.ExternalAccountBinding{ |
|
|
|
|
|
KeyID: m.ExternalAccount.KeyID, |
|
|
|
|
|
HMAC: hmac, |
|
|
|
|
|
} |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
if m.Challenges != nil { |
|
|
if m.Challenges != nil { |
|
|
if m.Challenges.HTTP != nil { |
|
|
if m.Challenges.HTTP != nil { |
|
|
template.DisableHTTPChallenge = m.Challenges.HTTP.Disabled |
|
|
template.DisableHTTPChallenge = m.Challenges.HTTP.Disabled |
|
@ -132,7 +155,7 @@ func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager { |
|
|
template.DNSProvider = m.Challenges.DNS |
|
|
template.DNSProvider = m.Challenges.DNS |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
return template |
|
|
return template, nil |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
// SetConfig sets the associated certmagic config for this issuer.
|
|
|
// SetConfig sets the associated certmagic config for this issuer.
|
|
@ -201,6 +224,16 @@ type DNSProviderMaker interface { |
|
|
NewDNSProvider() (challenge.Provider, error) |
|
|
NewDNSProvider() (challenge.Provider, error) |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// ExternalAccountBinding contains information for
|
|
|
|
|
|
// binding an external account to an ACME account.
|
|
|
|
|
|
type ExternalAccountBinding struct { |
|
|
|
|
|
// The key identifier.
|
|
|
|
|
|
KeyID string `json:"key_id,omitempty"` |
|
|
|
|
|
|
|
|
|
|
|
// The base64-encoded HMAC.
|
|
|
|
|
|
EncodedHMAC string `json:"hmac,omitempty"` |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
// Interface guards
|
|
|
// Interface guards
|
|
|
var ( |
|
|
var ( |
|
|
_ certmagic.PreChecker = (*ACMEIssuer)(nil) |
|
|
_ certmagic.PreChecker = (*ACMEIssuer)(nil) |
|
|