caddyhttp: Use internal issuer for IPs when no APs configured

This fixes a regression in 2.8 where IP addresses would be considered qualifying for public certs by auto-HTTPS. The default issuers do not issue IP certs at this time, so if no APs are explicitly configured, we assign them to the internal issuer. We have to add a couple lines of code because CertMagic can no longer consider IPs as not qualifying for public certs, since there are public CAs that issue IP certs. This edge case is specific to Caddy's auto-HTTPS. Without this patch, Caddy will try using Let's Encrypt or ZeroSSL's ACME endpoint to get IP certs, neither of which support that.

Matthew Holt committed Oct 4, 2024 at 10:23 UTC 88fd5f3491ab888f69f0be02cea68a49164298eb

1 file changed +13 -3

modules/caddyhttp/autohttps.go

+13 -3

@@ -320,11 +320,21 @@ uniqueDomainsLoop:

320 }

321 }

322

323 - // if no automation policy exists for the name yet, we

324 - // will associate it with an implicit one

323 + // if no automation policy exists for the name yet, we will associate it with an implicit one;

324 + // we handle tailscale domains specially, and we also separate out identifiers that need the

325 + // internal issuer (self-signed certs); certmagic does not consider public IP addresses to be

326 + // disqualified for public certs, because there are public CAs that will issue certs for IPs.

327 + // However, with auto-HTTPS, many times there is no issuer explicitly defined, and the default

328 + // issuers do not (currently, as of 2024) issue IP certificates; so assign all IP subjects to

329 + // the internal issuer when there are no explicit automation policies

330 + shouldUseInternal := func(ident string) bool {

331 + usingDefaultIssuersAndIsIP := certmagic.SubjectIsIP(ident) &&

332 + (app.tlsApp == nil || app.tlsApp.Automation == nil || len(app.tlsApp.Automation.Policies) == 0)

333 + return !certmagic.SubjectQualifiesForPublicCert(d) || usingDefaultIssuersAndIsIP

334 + }

335 if isTailscaleDomain(d) {

336 tailscale = append(tailscale, d)

327 - } else if !certmagic.SubjectQualifiesForPublicCert(d) {

337 + } else if shouldUseInternal(d) {

338 internal = append(internal, d)

339 }

340 }