Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 19:15 UTC
caddypki: Load intermediate for signing on-the-fly (#4669)
* caddypki: Load intermediate for signing on-the-fly Fixes #4517 Big thanks to @maraino for adding an API in `smallstep/certificates` so that we can fix this * Debug log * Trying a hunch, does it need to be a pointer receiver? * Clarify pointer receiver Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
Francis Lavoie committed
Apr 13, 2022 at 12:20 UTC
bc15b4b0e799c52be8be86e85e9624141319474d
3 files changed
+30
-9
go.mod
+1
-1
@@ -17,7 +17,7 @@ require (
17
github.com/lucas-clemente/quic-go v0.26.0
18
github.com/mholt/acmez v1.0.2
19
github.com/prometheus/client_golang v1.12.1
20
- github.com/smallstep/certificates v0.18.3-0.20220328195804-49de04661b85
20
+ github.com/smallstep/certificates v0.18.3-0.20220329212333-b42c1dfe64cf
21
github.com/smallstep/cli v0.18.0
22
github.com/smallstep/nosql v0.4.0
23
github.com/smallstep/truststore v0.11.0
go.sum
+2
-2
@@ -945,8 +945,8 @@ github.com/smallstep/assert v0.0.0-20180720014142-de77670473b5/go.mod h1:TC9A4+R
945
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
946
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
947
github.com/smallstep/certificates v0.18.0/go.mod h1:8eHwHNg/bRWvNZo9S0uWFVMkS+LSpDYxM4//EgBhkFM=
948
-github.com/smallstep/certificates v0.18.3-0.20220328195804-49de04661b85 h1:iXoo8eraLn0rFbn92eVd8dNjj1jcHcYsOQaqssUPTZ4=
949
-github.com/smallstep/certificates v0.18.3-0.20220328195804-49de04661b85/go.mod h1:K4gQuZo7j4kzQb0zF0A2s6/kiPh3ZhmFThlHh2B+Gwg=
948
+github.com/smallstep/certificates v0.18.3-0.20220329212333-b42c1dfe64cf h1:Ky0hrHTjd/sXrLZj1rKEBYRo/3nmOUIk3xyqnrs04jY=
949
+github.com/smallstep/certificates v0.18.3-0.20220329212333-b42c1dfe64cf/go.mod h1:K4gQuZo7j4kzQb0zF0A2s6/kiPh3ZhmFThlHh2B+Gwg=
950
github.com/smallstep/certinfo v1.5.2/go.mod h1:gA7HBbue0Wwr3kD60P2UtgTIFfMAOC66D3rzYhI0GZ4=
951
github.com/smallstep/cli v0.18.0 h1:BslbUHuMfj/LbVHxuZ4Hv1sL+vAHHidqia4JRoCBwXs=
952
github.com/smallstep/cli v0.18.0/go.mod h1:C8ZSfMm/pKdCHnN1C3Pc44bjIOkBbyuoyq6XjS/K9lI=
modules/caddypki/ca.go
+27
-6
@@ -182,30 +182,51 @@ func (ca CA) IntermediateKey() interface{} {
182
}
183
184
// NewAuthority returns a new Smallstep-powered signing authority for this CA.
185
-func (ca CA) NewAuthority(authorityConfig AuthorityConfig) (*authority.Authority, error) {
185
+// Note that we receive *CA (a pointer) in this method to ensure the closure within it, which
186
+// executes at a later time, always has the only copy of the CA so it can access the latest,
187
+// renewed certificates since NewAuthority was called. See #4517 and #4669.
188
+func (ca *CA) NewAuthority(authorityConfig AuthorityConfig) (*authority.Authority, error) {
189
// get the root certificate and the issuer cert+key
190
rootCert := ca.RootCertificate()
188
- var issuerCert *x509.Certificate
189
- var issuerKey interface{}
191
+
192
+ // set up the signer; cert/key which signs the leaf certs
193
+ var signerOption authority.Option
194
if authorityConfig.SignWithRoot {
195
+ // if we're signing with root, we can just pass the
196
+ // cert/key directly, since it's unlikely to expire
197
+ // while Caddy is running (long lifetime)
198
+ var issuerCert *x509.Certificate
199
+ var issuerKey interface{}
200
issuerCert = rootCert
201
var err error
202
issuerKey, err = ca.RootKey()
203
if err != nil {
204
return nil, fmt.Errorf("loading signing key: %v", err)
205
}
206
+ signerOption = authority.WithX509Signer(issuerCert, issuerKey.(crypto.Signer))
207
} else {
198
- issuerCert = ca.IntermediateCertificate()
199
- issuerKey = ca.IntermediateKey()
208
+ // if we're signing with intermediate, we need to make
209
+ // sure it's always fresh, because the intermediate may
210
+ // renew while Caddy is running (medium lifetime)
211
+ signerOption = authority.WithX509SignerFunc(func() ([]*x509.Certificate, crypto.Signer, error) {
212
+ issuerCert := ca.IntermediateCertificate()
213
+ issuerKey := ca.IntermediateKey().(crypto.Signer)
214
+ ca.log.Debug("using intermediate signer",
215
+ zap.String("serial", issuerCert.SerialNumber.String()),
216
+ zap.String("not_before", issuerCert.NotBefore.String()),
217
+ zap.String("not_after", issuerCert.NotAfter.String()))
218
+ return []*x509.Certificate{issuerCert}, issuerKey, nil
219
+ })
220
}
221
222
opts := []authority.Option{
223
authority.WithConfig(&authority.Config{
224
AuthorityConfig: authorityConfig.AuthConfig,
225
}),
206
- authority.WithX509Signer(issuerCert, issuerKey.(crypto.Signer)),
226
+ signerOption,
227
authority.WithX509RootCerts(rootCert),
228
}
229
+
230
// Add a database if we have one
231
if authorityConfig.DB != nil {
232
opts = append(opts, authority.WithDatabase(*authorityConfig.DB))