Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 13:15 UTC
caddytls: Option to configure certificate lifetime (#6253)
* Add option to configure certificate lifetime * Bump CertMagic dep to latest master commit * Apply suggestions and ran go mod tidy * Update modules/caddytls/acmeissuer.go Co-authored-by: Matt Holt <mholt@users.noreply.github.com> --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
clauverjat committed
Apr 24, 2024 at 22:35 UTC
76c4cf5a56b4ee576001e649e72d6e7fdf730364
5 files changed
+33
-3
caddyconfig/httpcaddyfile/options.go
+1
@@ -54,6 +54,7 @@ func init() {
54
RegisterGlobalOption("auto_https", parseOptAutoHTTPS)
55
RegisterGlobalOption("servers", parseServerOptions)
56
RegisterGlobalOption("ocsp_stapling", parseOCSPStaplingOptions)
57
+ RegisterGlobalOption("cert_lifetime", parseOptDuration)
58
RegisterGlobalOption("log", parseLogOptions)
59
RegisterGlobalOption("preferred_chains", parseOptPreferredChains)
60
RegisterGlobalOption("persist_config", parseOptPersistConfig)
caddyconfig/httpcaddyfile/tlsapp.go
+5
@@ -456,6 +456,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
456
globalACMEDNS := options["acme_dns"]
457
globalACMEEAB := options["acme_eab"]
458
globalPreferredChains := options["preferred_chains"]
459
+ globalCertLifetime := options["cert_lifetime"]
460
461
if globalEmail != nil && acmeIssuer.Email == "" {
462
acmeIssuer.Email = globalEmail.(string)
@@ -479,6 +480,10 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
480
if globalPreferredChains != nil && acmeIssuer.PreferredChains == nil {
481
acmeIssuer.PreferredChains = globalPreferredChains.(*caddytls.ChainPreference)
482
}
483
+
484
+ if globalCertLifetime != nil && acmeIssuer.CertificateLifetime == 0 {
485
+ acmeIssuer.CertificateLifetime = globalCertLifetime.(caddy.Duration)
486
+ }
487
return nil
488
}
489
go.mod
+1
-1
@@ -7,7 +7,7 @@ require (
7
github.com/Masterminds/sprig/v3 v3.2.3
8
github.com/alecthomas/chroma/v2 v2.13.0
9
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
10
- github.com/caddyserver/certmagic v0.20.1-0.20240412214119-167015dd6570
10
+ github.com/caddyserver/certmagic v0.20.1-0.20240419174353-855d4670a49d
11
github.com/caddyserver/zerossl v0.1.2
12
github.com/dustin/go-humanize v1.0.1
13
github.com/go-chi/chi/v5 v5.0.12
go.sum
+2
-2
@@ -68,8 +68,8 @@ github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
68
github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
69
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
70
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
71
-github.com/caddyserver/certmagic v0.20.1-0.20240412214119-167015dd6570 h1:SsAXjoQx2wOmLl6mEwJEwh7wwys2hb/l/mhtmxA3wts=
72
-github.com/caddyserver/certmagic v0.20.1-0.20240412214119-167015dd6570/go.mod h1:e1NhB1rF5KZnAuAX6oSyhE7sg1Ru5bWgggw5RtauhEY=
71
+github.com/caddyserver/certmagic v0.20.1-0.20240419174353-855d4670a49d h1:fi1dMdHOoyWHXpxpCbaB+H4xdAgQcBP2AXSqpXVpIcg=
72
+github.com/caddyserver/certmagic v0.20.1-0.20240419174353-855d4670a49d/go.mod h1:e1NhB1rF5KZnAuAX6oSyhE7sg1Ru5bWgggw5RtauhEY=
73
github.com/caddyserver/zerossl v0.1.2 h1:tlEu1VzWGoqcCpivs9liKAKhfpJWYJkHEMmlxRbVAxE=
74
github.com/caddyserver/zerossl v0.1.2/go.mod h1:wtiJEHbdvunr40ZzhXlnIkOB8Xj4eKtBKizCcZitJiQ=
75
github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
modules/caddytls/acmeissuer.go
+24
@@ -88,6 +88,15 @@ type ACMEIssuer struct {
88
// will be selected.
89
PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`
90
91
+ // The validity period to ask the CA to issue a certificate for.
92
+ // Default: 0 (CA chooses lifetime).
93
+ // This value is used to compute the "notAfter" field of the ACME order;
94
+ // therefore the system must have a reasonably synchronized clock.
95
+ // NOTE: Not all CAs support this. Check with your CA's ACME
96
+ // documentation to see if this is allowed and what values may
97
+ // be used. EXPERIMENTAL: Subject to change.
98
+ CertificateLifetime caddy.Duration `json:"certificate_lifetime,omitempty"`
99
+
100
rootPool *x509.CertPool
101
logger *zap.Logger
102
@@ -178,6 +187,7 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEIssuer, error) {
187
CertObtainTimeout: time.Duration(iss.ACMETimeout),
188
TrustedRoots: iss.rootPool,
189
ExternalAccount: iss.ExternalAccount,
190
+ NotAfter: time.Duration(iss.CertificateLifetime),
191
Logger: iss.logger,
192
}
193
@@ -349,6 +359,20 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
359
360
for d.NextBlock(0) {
361
switch d.Val() {
362
+ case "lifetime":
363
+ var lifetimeStr string
364
+ if !d.AllArgs(&lifetimeStr) {
365
+ return d.ArgErr()
366
+ }
367
+ lifetime, err := caddy.ParseDuration(lifetimeStr)
368
+ if err != nil {
369
+ return d.Errf("invalid lifetime %s: %v", lifetimeStr, err)
370
+ }
371
+ if lifetime < 0 {
372
+ return d.Errf("lifetime must be >= 0: %s", lifetime)
373
+ }
374
+ iss.CertificateLifetime = caddy.Duration(lifetime)
375
+
376
case "dir":
377
if iss.CA != "" {
378
return d.Errf("directory is already specified: %s", iss.CA)