Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 21:00 UTC
caddypki: check intermediate lifetime to actual root cert lifetime (#7272)
Y.Horie committed
Sep 27, 2025 at 01:24 UTC
1e82f9652ec561cc0c84bec501976045aa01a310
1 file changed
+4
-2
modules/caddypki/ca.go
+4
-2
@@ -124,8 +124,6 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error {
124
}
125
if ca.IntermediateLifetime == 0 {
126
ca.IntermediateLifetime = caddy.Duration(defaultIntermediateLifetime)
127
- } else if time.Duration(ca.IntermediateLifetime) >= defaultRootLifetime {
128
- return fmt.Errorf("intermediate certificate lifetime must be less than root certificate lifetime (%s)", defaultRootLifetime)
127
}
128
129
// load the certs and key that will be used for signing
@@ -144,6 +142,10 @@ func (ca *CA) Provision(ctx caddy.Context, id string, log *zap.Logger) error {
142
if err != nil {
143
return err
144
}
145
+ actualRootLifetime := time.Until(rootCert.NotAfter)
146
+ if time.Duration(ca.IntermediateLifetime) >= actualRootLifetime {
147
+ return fmt.Errorf("intermediate certificate lifetime must be less than actual root certificate lifetime (%s)", actualRootLifetime)
148
+ }
149
if ca.Intermediate != nil {
150
interCert, interKey, err = ca.Intermediate.Load()
151
} else {