Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Set Issuer properly on automation policies (fix #3150)
When using the default automation policy specifically, ap.Issuer would be nil, so we'd end up overwriting the ap.magic.Issuer's default value (after New()) with nil; this instead sets Issuer on the template before New() is called, and no overwriting is done.
Matthew Holt committed
Mar 15, 2020 at 09:24 UTC
115b877e1a83527e4b5e1bf33bb2d9b62f3f3059
1 file changed
+15
-13
modules/caddytls/tls.go
+15
-13
@@ -479,6 +479,9 @@ type AutomationPolicy struct {
479
// TODO: is this really necessary per-policy? why not a global setting...
480
ManageSync bool `json:"manage_sync,omitempty"`
481
482
+ // Issuer stores the decoded issuer parameters. This is only
483
+ // used to populate an underlying certmagic.Config's Issuer
484
+ // field; it is not referenced thereafter.
485
Issuer certmagic.Issuer `json:"-"`
486
487
magic *certmagic.Config
@@ -527,6 +530,14 @@ func (ap *AutomationPolicy) provision(tlsApp *TLS) error {
530
}
531
}
532
533
+ if ap.IssuerRaw != nil {
534
+ val, err := tlsApp.ctx.LoadModule(ap, "IssuerRaw")
535
+ if err != nil {
536
+ return fmt.Errorf("loading TLS automation management module: %s", err)
537
+ }
538
+ ap.Issuer = val.(certmagic.Issuer)
539
+ }
540
+
541
keySource := certmagic.StandardKeyGenerator{
542
KeyType: supportedCertKeyTypes[ap.KeyType],
543
}
@@ -542,16 +553,12 @@ func (ap *AutomationPolicy) provision(tlsApp *TLS) error {
553
KeySource: keySource,
554
OnDemand: ond,
555
Storage: storage,
556
+ Issuer: ap.Issuer, // if nil, certmagic.New() will set default in returned Config
557
}
546
- ap.magic = certmagic.New(tlsApp.certCache, template)
547
-
548
- if ap.IssuerRaw != nil {
549
- val, err := tlsApp.ctx.LoadModule(ap, "IssuerRaw")
550
- if err != nil {
551
- return fmt.Errorf("loading TLS automation management module: %s", err)
552
- }
553
- ap.Issuer = val.(certmagic.Issuer)
558
+ if rev, ok := ap.Issuer.(certmagic.Revoker); ok {
559
+ template.Revoker = rev
560
}
561
+ ap.magic = certmagic.New(tlsApp.certCache, template)
562
563
// sometimes issuers may need the parent certmagic.Config in
564
// order to function properly (for example, ACMEIssuer needs
@@ -562,11 +569,6 @@ func (ap *AutomationPolicy) provision(tlsApp *TLS) error {
569
configger.SetConfig(ap.magic)
570
}
571
565
- ap.magic.Issuer = ap.Issuer
566
- if rev, ok := ap.Issuer.(certmagic.Revoker); ok {
567
- ap.magic.Revoker = rev
568
- }
569
-
572
return nil
573
}
574