caddypki: Add SignWithRoot option for ACME server

See https://caddy.community/t/setting-up-a-caddy-pki-based-on-a-windows- root-ca-was-getting-pki-config/11616/7 Also improved a godoc comment in the caddytls package.

Matthew Holt committed Feb 26, 2021 at 19:27 UTC ec309c6d52fdfce0431a1303a49f28c3f546176a

2 files changed +16 -5

modules/caddypki/acmeserver/acmeserver.go

@@ -66,6 +66,13 @@ type Handler struct {

66 // on this property long-term; check release notes.

67 PathPrefix string `json:"path_prefix,omitempty"`

69 + // If true, the CA's root will be the issuer instead of

70 + // the intermediate. This is NOT recommended and should

71 + // only be used when devices/clients do not properly

72 + // validate certificate chains. EXPERIMENTAL: Might be

73 + // changed or removed in the future.

74 + SignWithRoot bool `json:"sign_with_root,omitempty"`

75 +

76 acmeEndpoints http.Handler

77 logger *zap.Logger

78 }

@@ -109,6 +116,7 @@ func (ash *Handler) Provision(ctx caddy.Context) error {

116 }

117

118 authorityConfig := caddypki.AuthorityConfig{

119 + SignWithRoot: ash.SignWithRoot,

120 AuthConfig: &authority.AuthConfig{

121 Provisioners: provisioner.List{

122 &provisioner.ACME{

modules/caddytls/tls.go

+8 -5

@@ -478,11 +478,14 @@ type Certificate struct {

478 Tags []string

479 }

480

481 -// AutomateLoader is a no-op certificate loader module

482 -// that is treated as a special case: it uses this app's

483 -// automation features to load certificates for the

484 -// list of hostnames, rather than loading certificates

485 -// manually.

481 +// AutomateLoader will automatically manage certificates for the names

482 +// in the list, including obtaining and renewing certificates. Automated

483 +// certificates are managed according to their matching automation policy,

484 +// configured elsewhere in this app.

485 +//

486 +// This is a no-op certificate loader module that is treated as a special

487 +// case: it uses this app's automation features to load certificates for the

488 +// list of hostnames, rather than loading certificates manually.

489 type AutomateLoader []string

490

491 // CaddyModule returns the Caddy module information.