Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Add support for externalAccountBinding ACME extension
Matthew Holt committed
Mar 31, 2020 at 21:08 UTC
9fb0b1e838e216f90d20c9a32e948ad60dcca07d
3 files changed
+42
-9
go.mod
+2
-2
@@ -5,7 +5,7 @@ go 1.14
5
require (
6
github.com/Masterminds/sprig/v3 v3.0.2
7
github.com/alecthomas/chroma v0.7.2-0.20200305040604-4f3623dce67a
8
- github.com/caddyserver/certmagic v0.10.5
8
+ github.com/caddyserver/certmagic v0.10.6
9
github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac
10
github.com/go-acme/lego/v3 v3.5.0
11
github.com/google/cel-go v0.4.1
@@ -21,7 +21,7 @@ require (
21
github.com/smallstep/cli v0.14.0-rc.3
22
github.com/smallstep/truststore v0.9.4
23
github.com/vulcand/oxy v1.1.0
24
- github.com/yuin/goldmark v1.1.26
24
+ github.com/yuin/goldmark v1.1.27
25
github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691
26
go.uber.org/zap v1.14.1
27
golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59
go.sum
+4
-4
@@ -120,8 +120,8 @@ github.com/bombsimon/wsl/v2 v2.0.0/go.mod h1:mf25kr/SqFEPhhcxW1+7pxzGlW+hIl/hYTK
120
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
121
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
122
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
123
-github.com/caddyserver/certmagic v0.10.5 h1:Dg4ipO1y23rWvFmiiRqhtUTh5Hy7PmfoFvPfDpnE8Z8=
124
-github.com/caddyserver/certmagic v0.10.5/go.mod h1:Y8jcUBctgk/IhpAzlHKfimZNyXCkfGgRTC0orl8gROQ=
123
+github.com/caddyserver/certmagic v0.10.6 h1:sCya6FmfaN74oZE46kqfaFOVoROD/mF36rTQfjN7TZc=
124
+github.com/caddyserver/certmagic v0.10.6/go.mod h1:Y8jcUBctgk/IhpAzlHKfimZNyXCkfGgRTC0orl8gROQ=
125
github.com/cenkalti/backoff/v4 v4.0.0 h1:6VeaLF9aI+MAUQ95106HwWzYZgJJpZ4stumjj6RFYAU=
126
github.com/cenkalti/backoff/v4 v4.0.0/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
127
github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -758,8 +758,8 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ
758
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
759
github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
760
github.com/yuin/goldmark v1.1.22/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
761
-github.com/yuin/goldmark v1.1.26 h1:81MfIApzizD8JqKIjnWy2Vxj7GgmQUrJlh/jYWH8yGk=
762
-github.com/yuin/goldmark v1.1.26/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
761
+github.com/yuin/goldmark v1.1.27 h1:nqDD4MMMQA0lmWq03Z2/myGPYLQoXtmi0rGVs95ntbo=
762
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
763
github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691 h1:VWSxtAiQNh3zgHJpdpkpVYjTPqRE3P6UZCOPa1nRDio=
764
github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691/go.mod h1:YLF3kDffRfUH/bTxOxHhV6lxwIB3Vfj91rEwNMS9MXo=
765
go.etcd.io/bbolt v1.3.2 h1:Z/90sZLPOeCy2PwprqkFa25PdkusRzaj9P8zm/KNyvk=
modules/caddytls/acmeissuer.go
+36
-3
@@ -17,6 +17,7 @@ package caddytls
17
import (
18
"context"
19
"crypto/x509"
20
+ "encoding/base64"
21
"fmt"
22
"io/ioutil"
23
"net/url"
@@ -54,6 +55,10 @@ type ACMEIssuer struct {
55
// other than ACME transactions.
56
Email string `json:"email,omitempty"`
57
58
+ // If using an ACME CA that requires an external account
59
+ // binding, specify the CA-provided credentials here.
60
+ ExternalAccount *ExternalAccountBinding `json:"external_account,omitempty"`
61
+
62
// Time to wait before timing out an ACME operation.
63
ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"`
64
@@ -107,12 +112,16 @@ func (m *ACMEIssuer) Provision(ctx caddy.Context) error {
112
}
113
}
114
110
- m.template = m.makeIssuerTemplate()
115
+ var err error
116
+ m.template, err = m.makeIssuerTemplate()
117
+ if err != nil {
118
+ return err
119
+ }
120
121
return nil
122
}
123
115
-func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager {
124
+func (m *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
125
template := certmagic.ACMEManager{
126
CA: m.CA,
127
Email: m.Email,
@@ -120,6 +129,20 @@ func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager {
129
TrustedRoots: m.rootPool,
130
}
131
132
+ if m.ExternalAccount != nil {
133
+ hmac, err := base64.StdEncoding.DecodeString(m.ExternalAccount.EncodedHMAC)
134
+ if err != nil {
135
+ return template, err
136
+ }
137
+ if m.ExternalAccount.KeyID == "" || len(hmac) == 0 {
138
+ return template, fmt.Errorf("when an external account binding is specified, both key ID and HMAC are required")
139
+ }
140
+ template.ExternalAccount = &certmagic.ExternalAccountBinding{
141
+ KeyID: m.ExternalAccount.KeyID,
142
+ HMAC: hmac,
143
+ }
144
+ }
145
+
146
if m.Challenges != nil {
147
if m.Challenges.HTTP != nil {
148
template.DisableHTTPChallenge = m.Challenges.HTTP.Disabled
@@ -132,7 +155,7 @@ func (m *ACMEIssuer) makeIssuerTemplate() certmagic.ACMEManager {
155
template.DNSProvider = m.Challenges.DNS
156
}
157
135
- return template
158
+ return template, nil
159
}
160
161
// SetConfig sets the associated certmagic config for this issuer.
@@ -201,6 +224,16 @@ type DNSProviderMaker interface {
224
NewDNSProvider() (challenge.Provider, error)
225
}
226
227
+// ExternalAccountBinding contains information for
228
+// binding an external account to an ACME account.
229
+type ExternalAccountBinding struct {
230
+ // The key identifier.
231
+ KeyID string `json:"key_id,omitempty"`
232
+
233
+ // The base64-encoded HMAC.
234
+ EncodedHMAC string `json:"hmac,omitempty"`
235
+}
236
+
237
// Interface guards
238
var (
239
_ certmagic.PreChecker = (*ACMEIssuer)(nil)