Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 19:30 UTC
tls: add reuse_private_keys (#6025)
Rithvik Vibhu committed
Jan 10, 2024 at 04:30 UTC
ed41c924cfdee562b36c86cced5571c2800348d8
3 files changed
+32
caddyconfig/httpcaddyfile/builtins.go
+16
@@ -90,6 +90,7 @@ func parseBind(h Helper) ([]ConfigValue, error) {
90
// dns_ttl <duration>
91
// dns_challenge_override_domain <domain>
92
// on_demand
93
+// reuse_private_keys
94
// eab <key_id> <mac_key>
95
// issuer <module_name> [...]
96
// get_certificate <module_name> [...]
@@ -106,6 +107,7 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
107
var issuers []certmagic.Issuer
108
var certManagers []certmagic.Manager
109
var onDemand bool
110
+ var reusePrivateKeys bool
111
112
for h.Next() {
113
// file certificate loader
@@ -483,6 +485,12 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
485
}
486
onDemand = true
487
488
+ case "reuse_private_keys":
489
+ if h.NextArg() {
490
+ return nil, h.ArgErr()
491
+ }
492
+ reusePrivateKeys = true
493
+
494
case "insecure_secrets_log":
495
if !h.NextArg() {
496
return nil, h.ArgErr()
@@ -589,6 +597,14 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
597
})
598
}
599
600
+ // reuse private keys TLS
601
+ if reusePrivateKeys {
602
+ configVals = append(configVals, ConfigValue{
603
+ Class: "tls.reuse_private_keys",
604
+ Value: true,
605
+ })
606
+ }
607
+
608
// custom certificate selection
609
if len(certSelector.AnyTag) > 0 {
610
cp.CertSelection = &certSelector
caddyconfig/httpcaddyfile/tlsapp.go
+6
@@ -118,6 +118,11 @@ func (st ServerType) buildTLSApp(
118
ap.OnDemand = true
119
}
120
121
+ // reuse private keys tls
122
+ if _, ok := sblock.pile["tls.reuse_private_keys"]; ok {
123
+ ap.ReusePrivateKeys = true
124
+ }
125
+
126
if keyTypeVals, ok := sblock.pile["tls.key_type"]; ok {
127
ap.KeyType = keyTypeVals[0].Value.(string)
128
}
@@ -587,6 +592,7 @@ outer:
592
aps[i].MustStaple == aps[j].MustStaple &&
593
aps[i].KeyType == aps[j].KeyType &&
594
aps[i].OnDemand == aps[j].OnDemand &&
595
+ aps[i].ReusePrivateKeys == aps[j].ReusePrivateKeys &&
596
aps[i].RenewalWindowRatio == aps[j].RenewalWindowRatio {
597
if len(aps[i].SubjectsRaw) > 0 && len(aps[j].SubjectsRaw) == 0 {
598
// later policy (at j) has no subjects ("catch-all"), so we can
modules/caddytls/automation.go
+10
@@ -138,6 +138,15 @@ type AutomationPolicy struct {
138
// load. This enables On-Demand TLS for this policy.
139
OnDemand bool `json:"on_demand,omitempty"`
140
141
+ // If true, private keys already existing in storage
142
+ // will be reused. Otherwise, a new key will be
143
+ // created for every new certificate to mitigate
144
+ // pinning and reduce the scope of key compromise.
145
+ // TEMPORARY: Key pinning is against industry best practices.
146
+ // This property will likely be removed in the future.
147
+ // Do not rely on it forever; watch the release notes.
148
+ ReusePrivateKeys bool `json:"reuse_private_keys,omitempty"`
149
+
150
// Disables OCSP stapling. Disabling OCSP stapling puts clients at
151
// greater risk, reduces their privacy, and usually lowers client
152
// performance. It is NOT recommended to disable this unless you
@@ -288,6 +297,7 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
297
KeySource: keySource,
298
OnEvent: tlsApp.onEvent,
299
OnDemand: ond,
300
+ ReusePrivateKeys: ap.ReusePrivateKeys,
301
OCSP: certmagic.OCSPConfig{
302
DisableStapling: ap.DisableOCSPStapling,
303
ResponderOverrides: ap.OCSPOverrides,