Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddyfile: tls: Tag manual certificates (#2588)
This ensure that if there are multiple certs that match a particular ServerName or other parameter, then specifically the one the user provided in the Caddyfile will be used.
Matthew Holt committed
Feb 6, 2020 at 12:55 UTC
b81ae38686fb9fb133a0308294b3dd898b769dac
2 files changed
+21
-9
caddyconfig/httpcaddyfile/builtins.go
+13
-1
@@ -127,11 +127,21 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
127
}
128
mgr.Email = firstLine[0]
129
case 2:
130
+ tag := fmt.Sprintf("cert%d", tagCounter)
131
fileLoader = append(fileLoader, caddytls.CertKeyFilePair{
132
Certificate: firstLine[0],
133
Key: firstLine[1],
133
- // TODO: add tags, to ensure this certificate is always used for this server name
134
+ Tags: []string{tag},
135
})
136
+ // tag this certificate so if multiple certs match, specifically
137
+ // this one that the user has provided will be used, see #2588:
138
+ // https://github.com/caddyserver/caddy/issues/2588
139
+ tagCounter++
140
+ certSelector := caddytls.CustomCertSelectionPolicy{Tag: tag}
141
+ if cp == nil {
142
+ cp = new(caddytls.ConnectionPolicy)
143
+ }
144
+ cp.CertSelection = caddyconfig.JSONModuleObject(certSelector, "policy", "custom", h.warnings)
145
default:
146
return nil, h.ArgErr()
147
}
@@ -382,3 +392,5 @@ func parseHandle(h Helper) (caddyhttp.MiddlewareHandler, error) {
392
393
return nil, nil
394
}
395
+
396
+var tagCounter = 0
modules/caddytls/certselection.go
+8
-8
@@ -11,14 +11,14 @@ import (
11
)
12
13
func init() {
14
- caddy.RegisterModule(Policy{})
14
+ caddy.RegisterModule(CustomCertSelectionPolicy{})
15
}
16
17
-// Policy represents a policy for selecting the certificate used to
18
-// complete a handshake when there may be multiple options. All fields
17
+// CertSelectionPolicy represents a policy for selecting the certificate used
18
+// to complete a handshake when there may be multiple options. All fields
19
// specified must match the candidate certificate for it to be chosen.
20
// This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
21
-type Policy struct {
21
+type CustomCertSelectionPolicy struct {
22
SerialNumber *big.Int `json:"serial_number,omitempty"`
23
SubjectOrganization string `json:"subject_organization,omitempty"`
24
PublicKeyAlgorithm PublicKeyAlgorithm `json:"public_key_algorithm,omitempty"`
@@ -26,15 +26,15 @@ type Policy struct {
26
}
27
28
// CaddyModule returns the Caddy module information.
29
-func (Policy) CaddyModule() caddy.ModuleInfo {
29
+func (CustomCertSelectionPolicy) CaddyModule() caddy.ModuleInfo {
30
return caddy.ModuleInfo{
31
ID: "tls.certificate_selection.custom",
32
- New: func() caddy.Module { return new(Policy) },
32
+ New: func() caddy.Module { return new(CustomCertSelectionPolicy) },
33
}
34
}
35
36
// SelectCertificate implements certmagic.CertificateSelector.
37
-func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) {
37
+func (p CustomCertSelectionPolicy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Certificate) (certmagic.Certificate, error) {
38
for _, cert := range choices {
39
if p.SerialNumber != nil && cert.SerialNumber.Cmp(p.SerialNumber) != 0 {
40
continue
@@ -68,4 +68,4 @@ func (p Policy) SelectCertificate(_ *tls.ClientHelloInfo, choices []certmagic.Ce
68
}
69
70
// Interface guard
71
-var _ certmagic.CertificateSelector = (*Policy)(nil)
71
+var _ certmagic.CertificateSelector = (*CustomCertSelectionPolicy)(nil)