Browse Source

caddytls: Improve alt chain preference settings

This allows for finer-grained control when choosing alternate chains than
simply the previous/Certbot-esque behavior of "choose first chain that
contains an issuer's common name." This update allows you to sort by
length (if optimizing for efficiency on the wire) and also to select the
chain with a specific root CommonName.
master
Matthew Holt 4 years ago
parent
commit
e384f07a3c
No known key found for this signature in database GPG Key ID: 2A349DD577D586A5
  1. 2
      go.mod
  2. 4
      go.sum
  3. 34
      modules/caddytls/acmeissuer.go

2
go.mod

@ -6,7 +6,7 @@ require (
github.com/Masterminds/sprig/v3 v3.1.0 github.com/Masterminds/sprig/v3 v3.1.0
github.com/alecthomas/chroma v0.8.2 github.com/alecthomas/chroma v0.8.2
github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a
github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3 github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067
github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac
github.com/go-chi/chi v4.1.2+incompatible github.com/go-chi/chi v4.1.2+incompatible
github.com/google/cel-go v0.6.0 github.com/google/cel-go v0.6.0

4
go.sum

@ -85,8 +85,8 @@ github.com/bombsimon/wsl/v2 v2.0.0/go.mod h1:mf25kr/SqFEPhhcxW1+7pxzGlW+hIl/hYTK
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8= github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g= github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s= github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3 h1:NW/7kFV4p6VLwG5eQa6ECivSqxAO0MmnAsAV7esFp0o= github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067 h1:gpjCX6/8hHRgVXxy1v2AQdoAX6XRXIA8fBUZtEpnVg0=
github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3/go.mod h1:tr26xh+9fY5dN0J6IPAlMj07qpog22PJKa7Nw7j835U= github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067/go.mod h1:tr26xh+9fY5dN0J6IPAlMj07qpog22PJKa7Nw7j835U=
github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=

34
modules/caddytls/acmeissuer.go

@ -74,10 +74,11 @@ type ACMEIssuer struct {
// is internal or for development/testing purposes. // is internal or for development/testing purposes.
TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"` TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"`
// List of preferred certificate chains, by issuer's CommonName. If empty, // Preferences for selecting alternate certificate chains, if offered
// or if no matching chain is found, the first chain offered by the server // by the CA. By default, the first offered chain will be selected.
// will be used. // If configured, the chains may be sorted and the first matching chain
PreferredChains []string `json:"preferred_chains,omitempty"` // will be selected.
PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`
rootPool *x509.CertPool rootPool *x509.CertPool
template certmagic.ACMEManager template certmagic.ACMEManager
@ -163,7 +164,6 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
CertObtainTimeout: time.Duration(iss.ACMETimeout), CertObtainTimeout: time.Duration(iss.ACMETimeout),
TrustedRoots: iss.rootPool, TrustedRoots: iss.rootPool,
ExternalAccount: iss.ExternalAccount, ExternalAccount: iss.ExternalAccount,
PreferredChains: iss.PreferredChains,
Logger: iss.logger, Logger: iss.logger,
} }
@ -182,6 +182,14 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
template.ListenHost = iss.Challenges.BindHost template.ListenHost = iss.Challenges.BindHost
} }
if iss.PreferredChains != nil {
template.PreferredChains = certmagic.ChainPreference{
Smallest: iss.PreferredChains.Smallest,
AnyCommonName: iss.PreferredChains.AnyCommonName,
RootCommonName: iss.PreferredChains.RootCommonName,
}
}
return template, nil return template, nil
} }
@ -407,6 +415,22 @@ func onDemandAskRequest(ask string, name string) error {
return nil return nil
} }
// ChainPreference describes the client's preferred certificate chain,
// useful if the CA offers alternate chains. The first matching chain
// will be selected.
type ChainPreference struct {
// Prefer chains with the fewest number of bytes.
Smallest *bool `json:"smallest,omitempty"`
// Select first chain having a root with one of
// these common names.
RootCommonName []string `json:"root_common_name,omitempty"`
// Select first chain that has any issuer with one
// of these common names.
AnyCommonName []string `json:"any_common_name,omitempty"`
}
// Interface guards // Interface guards
var ( var (
_ certmagic.PreChecker = (*ACMEIssuer)(nil) _ certmagic.PreChecker = (*ACMEIssuer)(nil)

Loading…
Cancel
Save