caddytls: Ensure key list always gets set (fix #7555)

Matthew Holt committed Mar 16, 2026 at 16:21 UTC 8499e34e10c4f5d8445d8d3cca3338cbb13bc2e1

1 file changed +9 -4

modules/caddytls/ech.go

+9 -4

@@ -132,7 +132,10 @@ func (ech *ECH) Provision(ctx caddy.Context) ([]string, error) {

132 }

133 }

134

135 - // ensure old keys are rotated out

135 + // convert the configs into a structure ready for the std lib to use

136 + ech.updateKeyList()

137 +

138 + // ensure any old keys are rotated out

139 if err = ech.rotateECHKeys(ctx, logger, true); err != nil {

140 return nil, fmt.Errorf("rotating ECH configs: %w", err)

141 }

@@ -179,9 +182,11 @@ func (ech *ECH) setConfigsFromStorage(ctx caddy.Context, logger *zap.Logger) ([]

182 return outerNames, nil

183 }

184

182 -// rotateECHKeys updates the ECH keys/configs that are outdated. It should be called

183 -// in a write lock on ech.configsMu. If a lock is already obtained in storage, then

184 -// pass true for storageSynced.

185 +// rotateECHKeys updates the ECH keys/configs that are outdated if rotation is needed.

186 +// It should be called in a write lock on ech.configsMu. If a lock is already obtained

187 +// in storage, then pass true for storageSynced.

188 +//

189 +// This function sets/updates the stdlib-ready key list only if a rotation occurs.

190 func (ech *ECH) rotateECHKeys(ctx caddy.Context, logger *zap.Logger, storageSynced bool) error {

191 storage := ctx.Storage()

192