Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Improve alt chain preference settings
This allows for finer-grained control when choosing alternate chains than simply the previous/Certbot-esque behavior of "choose first chain that contains an issuer's common name." This update allows you to sort by length (if optimizing for efficiency on the wire) and also to select the chain with a specific root CommonName.
Matthew Holt committed
Dec 15, 2020 at 12:16 UTC
e384f07a3ce91ddbc8c4d4344f03a0dafe3df9f3
3 files changed
+32
-8
go.mod
+1
-1
@@ -6,7 +6,7 @@ require (
6
github.com/Masterminds/sprig/v3 v3.1.0
7
github.com/alecthomas/chroma v0.8.2
8
github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a
9
- github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3
9
+ github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067
10
github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac
11
github.com/go-chi/chi v4.1.2+incompatible
12
github.com/google/cel-go v0.6.0
go.sum
+2
-2
@@ -85,8 +85,8 @@ github.com/bombsimon/wsl/v2 v2.0.0/go.mod h1:mf25kr/SqFEPhhcxW1+7pxzGlW+hIl/hYTK
85
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
86
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
87
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
88
-github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3 h1:NW/7kFV4p6VLwG5eQa6ECivSqxAO0MmnAsAV7esFp0o=
89
-github.com/caddyserver/certmagic v0.12.1-0.20201209195841-b726d1ed13c3/go.mod h1:tr26xh+9fY5dN0J6IPAlMj07qpog22PJKa7Nw7j835U=
88
+github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067 h1:gpjCX6/8hHRgVXxy1v2AQdoAX6XRXIA8fBUZtEpnVg0=
89
+github.com/caddyserver/certmagic v0.12.1-0.20201215190346-201f83a06067/go.mod h1:tr26xh+9fY5dN0J6IPAlMj07qpog22PJKa7Nw7j835U=
90
github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
91
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
92
github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
modules/caddytls/acmeissuer.go
+29
-5
@@ -74,10 +74,11 @@ type ACMEIssuer struct {
74
// is internal or for development/testing purposes.
75
TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"`
76
77
- // List of preferred certificate chains, by issuer's CommonName. If empty,
78
- // or if no matching chain is found, the first chain offered by the server
79
- // will be used.
80
- PreferredChains []string `json:"preferred_chains,omitempty"`
77
+ // Preferences for selecting alternate certificate chains, if offered
78
+ // by the CA. By default, the first offered chain will be selected.
79
+ // If configured, the chains may be sorted and the first matching chain
80
+ // will be selected.
81
+ PreferredChains *ChainPreference `json:"preferred_chains,omitempty"`
82
83
rootPool *x509.CertPool
84
template certmagic.ACMEManager
@@ -163,7 +164,6 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
164
CertObtainTimeout: time.Duration(iss.ACMETimeout),
165
TrustedRoots: iss.rootPool,
166
ExternalAccount: iss.ExternalAccount,
166
- PreferredChains: iss.PreferredChains,
167
Logger: iss.logger,
168
}
169
@@ -182,6 +182,14 @@ func (iss *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
182
template.ListenHost = iss.Challenges.BindHost
183
}
184
185
+ if iss.PreferredChains != nil {
186
+ template.PreferredChains = certmagic.ChainPreference{
187
+ Smallest: iss.PreferredChains.Smallest,
188
+ AnyCommonName: iss.PreferredChains.AnyCommonName,
189
+ RootCommonName: iss.PreferredChains.RootCommonName,
190
+ }
191
+ }
192
+
193
return template, nil
194
}
195
@@ -407,6 +415,22 @@ func onDemandAskRequest(ask string, name string) error {
415
return nil
416
}
417
418
+// ChainPreference describes the client's preferred certificate chain,
419
+// useful if the CA offers alternate chains. The first matching chain
420
+// will be selected.
421
+type ChainPreference struct {
422
+ // Prefer chains with the fewest number of bytes.
423
+ Smallest *bool `json:"smallest,omitempty"`
424
+
425
+ // Select first chain having a root with one of
426
+ // these common names.
427
+ RootCommonName []string `json:"root_common_name,omitempty"`
428
+
429
+ // Select first chain that has any issuer with one
430
+ // of these common names.
431
+ AnyCommonName []string `json:"any_common_name,omitempty"`
432
+}
433
+
434
// Interface guards
435
var (
436
_ certmagic.PreChecker = (*ACMEIssuer)(nil)