Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
tls/acme: Ability to customize trusted roots for ACME servers (#2756)
Closes #2702
Matt Holt committed
Sep 24, 2019 at 15:46 UTC
11696793bd15503006f44876c0f9f3b5d53e4d18
3 files changed
+33
-14
go.mod
+1
-1
@@ -18,7 +18,7 @@ require (
18
github.com/klauspost/compress v1.7.1-0.20190613161414-0b31f265a57b
19
github.com/klauspost/cpuid v1.2.1
20
github.com/lucas-clemente/quic-go v0.7.1-0.20190908032346-fc962d18373a
21
- github.com/mholt/certmagic v0.7.3
21
+ github.com/mholt/certmagic v0.7.3-0.20190917224939-65d418add14f
22
github.com/muhammadmuzzammil1998/jsonc v0.0.0-20190902132743-e4903c4dea48
23
github.com/rs/cors v1.6.0
24
github.com/russross/blackfriday/v2 v2.0.1
go.sum
+2
-2
@@ -156,8 +156,8 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
156
github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
157
github.com/mattn/go-tty v0.0.0-20180219170247-931426f7535a/go.mod h1:XPvLUNfbS4fJH25nqRHfWLMa1ONC8Amw+mIA639KxkE=
158
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
159
-github.com/mholt/certmagic v0.7.3 h1:1QOfAmk5uyWcfXJFQqFZZiEsJbPMBQ1vw/ttpVOUXQU=
160
-github.com/mholt/certmagic v0.7.3/go.mod h1:hqHzDsY32TwZpj/KswVylheSISjquF/eOVOaJTYV15w=
159
+github.com/mholt/certmagic v0.7.3-0.20190917224939-65d418add14f h1:IocLraK7JNMvVbuZShaLJMsWMPgdElPNwmPPWPb0XMI=
160
+github.com/mholt/certmagic v0.7.3-0.20190917224939-65d418add14f/go.mod h1:hqHzDsY32TwZpj/KswVylheSISjquF/eOVOaJTYV15w=
161
github.com/miekg/dns v1.1.15 h1:CSSIDtllwGLMoA6zjdKnaE6Tx6eVUxQ29LUgGetiDCI=
162
github.com/miekg/dns v1.1.15/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
163
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
modules/caddytls/acmemanager.go
+30
-11
@@ -15,8 +15,10 @@
15
package caddytls
16
17
import (
18
+ "crypto/x509"
19
"encoding/json"
20
"fmt"
21
+ "io/ioutil"
22
"net/url"
23
"time"
24
@@ -38,17 +40,19 @@ func init() {
40
// after you have configured this struct
41
// to your liking.
42
type ACMEManagerMaker struct {
41
- CA string `json:"ca,omitempty"`
42
- Email string `json:"email,omitempty"`
43
- RenewAhead caddy.Duration `json:"renew_ahead,omitempty"`
44
- KeyType string `json:"key_type,omitempty"`
45
- ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"`
46
- MustStaple bool `json:"must_staple,omitempty"`
47
- Challenges ChallengesConfig `json:"challenges,omitempty"`
48
- OnDemand bool `json:"on_demand,omitempty"`
49
- Storage json.RawMessage `json:"storage,omitempty"`
50
-
51
- storage certmagic.Storage
43
+ CA string `json:"ca,omitempty"`
44
+ Email string `json:"email,omitempty"`
45
+ RenewAhead caddy.Duration `json:"renew_ahead,omitempty"`
46
+ KeyType string `json:"key_type,omitempty"`
47
+ ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"`
48
+ MustStaple bool `json:"must_staple,omitempty"`
49
+ Challenges ChallengesConfig `json:"challenges,omitempty"`
50
+ OnDemand bool `json:"on_demand,omitempty"`
51
+ Storage json.RawMessage `json:"storage,omitempty"`
52
+ TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"`
53
+
54
+ storage certmagic.Storage
55
+ rootPool *x509.CertPool
56
}
57
58
// CaddyModule returns the Caddy module information.
@@ -91,6 +95,20 @@ func (m *ACMEManagerMaker) Provision(ctx caddy.Context) error {
95
m.Storage = nil // allow GC to deallocate
96
}
97
98
+ // add any custom CAs to trust store
99
+ if len(m.TrustedRootsPEMFiles) > 0 {
100
+ m.rootPool = x509.NewCertPool()
101
+ for _, pemFile := range m.TrustedRootsPEMFiles {
102
+ pemData, err := ioutil.ReadFile(pemFile)
103
+ if err != nil {
104
+ return fmt.Errorf("loading trusted root CA's PEM file: %s: %v", pemFile, err)
105
+ }
106
+ if !m.rootPool.AppendCertsFromPEM(pemData) {
107
+ return fmt.Errorf("unable to add %s to trust pool: %v", pemFile, err)
108
+ }
109
+ }
110
+ }
111
+
112
return nil
113
}
114
@@ -150,6 +168,7 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf
168
OnDemand: ond,
169
MustStaple: m.MustStaple,
170
Storage: storage,
171
+ TrustedRoots: m.rootPool,
172
// TODO: listenHost
173
}
174
}