Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 16:45 UTC
caddytls: Reuse issuer between PreCheck and Issue (#4866)
This enables EAB reuse for ZeroSSLIssuer (which is now supported by ZeroSSL).
Matt Holt committed
Jul 5, 2022 at 18:12 UTC
412dcc07d3201561302bc20b6200d893aee69657
3 files changed
+12
-13
modules/caddytls/acmeissuer.go
+9
-10
@@ -85,9 +85,11 @@ type ACMEIssuer struct {
85
PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`
86
87
rootPool *x509.CertPool
88
- template certmagic.ACMEIssuer
89
- magic *certmagic.Config
88
logger *zap.Logger
89
+
90
+ template certmagic.ACMEIssuer // set at Provision
91
+ magic *certmagic.Config // set at PreCheck
92
+ issuer *certmagic.ACMEIssuer // set at PreCheck; result of template + magic
93
}
94
95
// CaddyModule returns the Caddy module information.
@@ -217,30 +219,27 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEIssuer, error) {
219
// the ConfigSetter interface.
220
func (iss *ACMEIssuer) SetConfig(cfg *certmagic.Config) {
221
iss.magic = cfg
222
+ iss.issuer = certmagic.NewACMEIssuer(cfg, iss.template)
223
}
224
222
-// TODO: I kind of hate how each call to these methods needs to
223
-// make a new ACME manager to fill in defaults before using; can
224
-// we find the right place to do that just once and then re-use?
225
-
225
// PreCheck implements the certmagic.PreChecker interface.
226
func (iss *ACMEIssuer) PreCheck(ctx context.Context, names []string, interactive bool) error {
228
- return certmagic.NewACMEIssuer(iss.magic, iss.template).PreCheck(ctx, names, interactive)
227
+ return iss.issuer.PreCheck(ctx, names, interactive)
228
}
229
230
// Issue obtains a certificate for the given csr.
231
func (iss *ACMEIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
233
- return certmagic.NewACMEIssuer(iss.magic, iss.template).Issue(ctx, csr)
232
+ return iss.issuer.Issue(ctx, csr)
233
}
234
235
// IssuerKey returns the unique issuer key for the configured CA endpoint.
236
func (iss *ACMEIssuer) IssuerKey() string {
238
- return certmagic.NewACMEIssuer(iss.magic, iss.template).IssuerKey()
237
+ return iss.issuer.IssuerKey()
238
}
239
240
// Revoke revokes the given certificate.
241
func (iss *ACMEIssuer) Revoke(ctx context.Context, cert certmagic.CertificateResource, reason int) error {
243
- return certmagic.NewACMEIssuer(iss.magic, iss.template).Revoke(ctx, cert, reason)
242
+ return iss.issuer.Revoke(ctx, cert, reason)
243
}
244
245
// GetACMEIssuer returns iss. This is useful when other types embed ACMEIssuer, because
modules/caddytls/tls.go
+1
-1
@@ -336,7 +336,7 @@ func (t *TLS) HandleHTTPChallenge(w http.ResponseWriter, r *http.Request) bool {
336
for _, iss := range ap.magic.Issuers {
337
if am, ok := iss.(acmeCapable); ok {
338
iss := am.GetACMEIssuer()
339
- if certmagic.NewACMEIssuer(iss.magic, iss.template).HandleHTTPChallenge(w, r) {
339
+ if iss.issuer.HandleHTTPChallenge(w, r) {
340
return true
341
}
342
}
modules/caddytls/zerosslissuer.go
+2
-2
@@ -162,8 +162,8 @@ func (iss *ZeroSSLIssuer) generateEABCredentials(ctx context.Context, acct acme.
162
func (iss *ZeroSSLIssuer) initialize() {
163
iss.mu.Lock()
164
defer iss.mu.Unlock()
165
- if iss.template.NewAccountFunc == nil {
166
- iss.template.NewAccountFunc = iss.newAccountCallback
165
+ if iss.ACMEIssuer.issuer.NewAccountFunc == nil {
166
+ iss.ACMEIssuer.issuer.NewAccountFunc = iss.newAccountCallback
167
}
168
}
169