Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 19:30 UTC
httpcaddyfile: Fix cert file decoding to load multiple PEM in one file (#5997)
Francis Lavoie committed
Dec 20, 2023 at 10:37 UTC
f976c84d9e5b3fe5b30102e37527062e6c6a2378
1 file changed
+19
-9
caddyconfig/httpcaddyfile/builtins.go
+19
-9
@@ -246,16 +246,26 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
246
if err != nil {
247
return nil, err
248
}
249
- block, _ := pem.Decode(certDataPEM)
250
- if block == nil || block.Type != "CERTIFICATE" {
251
- return nil, h.Errf("no CERTIFICATE pem block found in %s", h.Val())
249
+ // while block is not nil, we have more certificates in the file
250
+ for block, rest := pem.Decode(certDataPEM); block != nil; block, rest = pem.Decode(rest) {
251
+ if block.Type != "CERTIFICATE" {
252
+ return nil, h.Errf("no CERTIFICATE pem block found in %s", filename)
253
+ }
254
+ if subdir == "trusted_ca_cert_file" {
255
+ cp.ClientAuthentication.TrustedCACerts = append(
256
+ cp.ClientAuthentication.TrustedCACerts,
257
+ base64.StdEncoding.EncodeToString(block.Bytes),
258
+ )
259
+ } else {
260
+ cp.ClientAuthentication.TrustedLeafCerts = append(
261
+ cp.ClientAuthentication.TrustedLeafCerts,
262
+ base64.StdEncoding.EncodeToString(block.Bytes),
263
+ )
264
+ }
265
}
253
- if subdir == "trusted_ca_cert_file" {
254
- cp.ClientAuthentication.TrustedCACerts = append(cp.ClientAuthentication.TrustedCACerts,
255
- base64.StdEncoding.EncodeToString(block.Bytes))
256
- } else {
257
- cp.ClientAuthentication.TrustedLeafCerts = append(cp.ClientAuthentication.TrustedLeafCerts,
258
- base64.StdEncoding.EncodeToString(block.Bytes))
266
+ // if we decoded nothing, return an error
267
+ if len(cp.ClientAuthentication.TrustedCACerts) == 0 && len(cp.ClientAuthentication.TrustedLeafCerts) == 0 {
268
+ return nil, h.Errf("no CERTIFICATE pem block found in %s", filename)
269
}
270
271
default: