Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 21:00 UTC
caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238)
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
Pavel committed
Sep 5, 2025 at 17:41 UTC
d9cc24f3df663e1bab58dc08ac12bf818c9f6852
2 files changed
+29
-1
caddyconfig/httpcaddyfile/pkiapp.go
+13
-1
@@ -15,6 +15,8 @@
15
package httpcaddyfile
16
17
import (
18
+ "slices"
19
+
20
"github.com/caddyserver/caddy/v2"
21
"github.com/caddyserver/caddy/v2/caddyconfig"
22
"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
@@ -178,6 +180,15 @@ func (st ServerType) buildPKIApp(
180
if _, ok := options["skip_install_trust"]; ok {
181
skipInstallTrust = true
182
}
183
+
184
+ // check if auto_https is off - in that case we should not create
185
+ // any PKI infrastructure even with skip_install_trust directive
186
+ autoHTTPS := []string{}
187
+ if ah, ok := options["auto_https"].([]string); ok {
188
+ autoHTTPS = ah
189
+ }
190
+ autoHTTPSOff := slices.Contains(autoHTTPS, "off")
191
+
192
falseBool := false
193
194
// Load the PKI app configured via global options
@@ -218,7 +229,8 @@ func (st ServerType) buildPKIApp(
229
// if there was no CAs defined in any of the servers,
230
// and we were requested to not install trust, then
231
// add one for the default/local CA to do so
221
- if len(pkiApp.CAs) == 0 && skipInstallTrust {
232
+ // only if auto_https is not completely disabled
233
+ if len(pkiApp.CAs) == 0 && skipInstallTrust && !autoHTTPSOff {
234
ca := new(caddypki.CA)
235
ca.ID = caddypki.DefaultCAID
236
ca.InstallTrust = &falseBool
modules/caddyhttp/autohttps.go
+16
@@ -265,6 +265,22 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
265
}
266
}
267
268
+ // if all servers have auto_https disabled and no domains need certs,
269
+ // skip the rest of the TLS automation setup to avoid creating
270
+ // unnecessary PKI infrastructure and automation policies
271
+ allServersDisabled := true
272
+ for _, srv := range app.Servers {
273
+ if srv.AutoHTTPS == nil || !srv.AutoHTTPS.Disabled {
274
+ allServersDisabled = false
275
+ break
276
+ }
277
+ }
278
+
279
+ if allServersDisabled && len(uniqueDomainsForCerts) == 0 {
280
+ logger.Debug("all servers have automatic HTTPS disabled and no domains need certificates, skipping TLS automation setup")
281
+ return nil
282
+ }
283
+
284
// we now have a list of all the unique names for which we need certs
285
var internal, tailscale []string
286
uniqueDomainsLoop: