Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 08:15 UTC
caddytls: Give a better error message when given encrypted private keys (#6591)
Francis Lavoie committed
Sep 25, 2024 at 08:00 UTC
9dda8fbf846db052243e6ce5ab707650da8c030e
3 files changed
+24
modules/caddytls/fileloader.go
+9
@@ -18,6 +18,7 @@ import (
18
"crypto/tls"
19
"fmt"
20
"os"
21
+ "strings"
22
23
"github.com/caddyserver/caddy/v2"
24
)
@@ -92,8 +93,16 @@ func (fl FileLoader) LoadCertificates() ([]Certificate, error) {
93
switch pair.Format {
94
case "":
95
fallthrough
96
+
97
case "pem":
98
+ // if the start of the key file looks like an encrypted private key,
99
+ // reject it with a helpful error message
100
+ if strings.Contains(string(keyData[:40]), "ENCRYPTED") {
101
+ return nil, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
102
+ }
103
+
104
cert, err = tls.X509KeyPair(certData, keyData)
105
+
106
default:
107
return nil, fmt.Errorf("unrecognized certificate/key encoding format: %s", pair.Format)
108
}
modules/caddytls/folderloader.go
+6
@@ -150,6 +150,12 @@ func tlsCertFromCertAndKeyPEMBundle(bundle []byte) (tls.Certificate, error) {
150
return tls.Certificate{}, fmt.Errorf("no private key block found")
151
}
152
153
+ // if the start of the key file looks like an encrypted private key,
154
+ // reject it with a helpful error message
155
+ if strings.HasPrefix(string(keyPEMBytes[:40]), "ENCRYPTED") {
156
+ return tls.Certificate{}, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
157
+ }
158
+
159
cert, err := tls.X509KeyPair(certPEMBytes, keyPEMBytes)
160
if err != nil {
161
return tls.Certificate{}, fmt.Errorf("making X509 key pair: %v", err)
modules/caddytls/storageloader.go
+9
@@ -17,6 +17,7 @@ package caddytls
17
import (
18
"crypto/tls"
19
"fmt"
20
+ "strings"
21
22
"github.com/caddyserver/certmagic"
23
@@ -88,8 +89,16 @@ func (sl StorageLoader) LoadCertificates() ([]Certificate, error) {
89
switch pair.Format {
90
case "":
91
fallthrough
92
+
93
case "pem":
94
+ // if the start of the key file looks like an encrypted private key,
95
+ // reject it with a helpful error message
96
+ if strings.Contains(string(keyData[:40]), "ENCRYPTED") {
97
+ return nil, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
98
+ }
99
+
100
cert, err = tls.X509KeyPair(certData, keyData)
101
+
102
default:
103
return nil, fmt.Errorf("unrecognized certificate/key encoding format: %s", pair.Format)
104
}