Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
admin: Replace admin cert cache when reloading (fix #4184)
Matthew Holt committed
Jun 3, 2021 at 12:24 UTC
323ffd20764e0f31a26ac700952adbb937b9eb69
1 file changed
+10
-10
admin.go
+10
-10
@@ -364,11 +364,6 @@ func manageIdentity(ctx Context, cfg *Config) error {
364
return nil
365
}
366
367
- oldIdentityCertCache := identityCertCache
368
- if oldIdentityCertCache != nil {
369
- defer oldIdentityCertCache.Stop()
370
- }
371
-
367
// set default issuers; this is pretty hacky because we can't
368
// import the caddytls package -- but it works
369
if cfg.Admin.Identity.IssuersRaw == nil {
@@ -389,8 +384,13 @@ func manageIdentity(ctx Context, cfg *Config) error {
384
}
385
}
386
387
+ // we'll make a new cache when we make the CertMagic config, so stop any previous cache
388
+ if identityCertCache != nil {
389
+ identityCertCache.Stop()
390
+ }
391
+
392
logger := Log().Named("admin.identity")
393
- cmCfg := cfg.Admin.Identity.certmagicConfig(logger)
393
+ cmCfg := cfg.Admin.Identity.certmagicConfig(logger, true)
394
395
// issuers have circular dependencies with the configs because,
396
// as explained in the caddytls package, they need access to the
@@ -456,7 +456,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
456
}
457
458
// create TLS config that will enforce mutual authentication
459
- cmCfg := cfg.Admin.Identity.certmagicConfig(remoteLogger)
459
+ cmCfg := cfg.Admin.Identity.certmagicConfig(remoteLogger, false)
460
tlsConfig := cmCfg.TLSConfig()
461
tlsConfig.NextProtos = nil // this server does not solve ACME challenges
462
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
@@ -499,7 +499,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
499
return nil
500
}
501
502
-func (ident *IdentityConfig) certmagicConfig(logger *zap.Logger) *certmagic.Config {
502
+func (ident *IdentityConfig) certmagicConfig(logger *zap.Logger, makeCache bool) *certmagic.Config {
503
if ident == nil {
504
// user might not have configured identity; that's OK, we can still make a
505
// certmagic config, although it'll be mostly useless for remote management
@@ -510,7 +510,7 @@ func (ident *IdentityConfig) certmagicConfig(logger *zap.Logger) *certmagic.Conf
510
Logger: logger,
511
Issuers: ident.issuers,
512
}
513
- if identityCertCache == nil {
513
+ if makeCache {
514
identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
515
GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
516
return cmCfg, nil
@@ -533,7 +533,7 @@ func (ctx Context) IdentityCredentials(logger *zap.Logger) ([]tls.Certificate, e
533
if logger == nil {
534
logger = Log()
535
}
536
- magic := ident.certmagicConfig(logger)
536
+ magic := ident.certmagicConfig(logger, false)
537
return magic.ClientCredentials(ctx, ident.Identifiers)
538
}
539