@ -74,10 +74,11 @@ type ACMEIssuer struct {
// is internal or for development/testing purposes.
// is internal or for development/testing purposes.
TrustedRootsPEMFiles [ ] string ` json:"trusted_roots_pem_files,omitempty" `
TrustedRootsPEMFiles [ ] string ` json:"trusted_roots_pem_files,omitempty" `
// List of preferred certificate chains, by issuer's CommonName. If empty,
// Preferences for selecting alternate certificate chains, if offered
// or if no matching chain is found, the first chain offered by the server
// by the CA. By default, the first offered chain will be selected.
// will be used.
// If configured, the chains may be sorted and the first matching chain
PreferredChains [ ] string ` json:"preferred_chains,omitempty" `
// will be selected.
PreferredChains * ChainPreference ` json:"preferred_chains,omitempty" `
rootPool * x509 . CertPool
rootPool * x509 . CertPool
template certmagic . ACMEManager
template certmagic . ACMEManager
@ -163,7 +164,6 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
CertObtainTimeout : time . Duration ( iss . ACMETimeout ) ,
CertObtainTimeout : time . Duration ( iss . ACMETimeout ) ,
TrustedRoots : iss . rootPool ,
TrustedRoots : iss . rootPool ,
ExternalAccount : iss . ExternalAccount ,
ExternalAccount : iss . ExternalAccount ,
PreferredChains : iss . PreferredChains ,
Logger : iss . logger ,
Logger : iss . logger ,
}
}
@ -182,6 +182,14 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
template . ListenHost = iss . Challenges . BindHost
template . ListenHost = iss . Challenges . BindHost
}
}
if iss . PreferredChains != nil {
template . PreferredChains = certmagic . ChainPreference {
Smallest : iss . PreferredChains . Smallest ,
AnyCommonName : iss . PreferredChains . AnyCommonName ,
RootCommonName : iss . PreferredChains . RootCommonName ,
}
}
return template , nil
return template , nil
}
}
@ -407,6 +415,22 @@ func onDemandAskRequest(ask string, name string) error {
return nil
return nil
}
}
// ChainPreference describes the client's preferred certificate chain,
// useful if the CA offers alternate chains. The first matching chain
// will be selected.
type ChainPreference struct {
// Prefer chains with the fewest number of bytes.
Smallest * bool ` json:"smallest,omitempty" `
// Select first chain having a root with one of
// these common names.
RootCommonName [ ] string ` json:"root_common_name,omitempty" `
// Select first chain that has any issuer with one
// of these common names.
AnyCommonName [ ] string ` json:"any_common_name,omitempty" `
}
// Interface guards
// Interface guards
var (
var (
_ certmagic . PreChecker = ( * ACMEIssuer ) ( nil )
_ certmagic . PreChecker = ( * ACMEIssuer ) ( nil )