fix bug
rabbitprincess committed
Mar 2, 2026 at 14:21 UTC
b2fc37d5e617c516d062373cd24f828438d57391
2 files changed
+18
-8
portal/acme/acme.go
+6
-7
@@ -208,17 +208,17 @@ func (m *AcmeManager) TLSFiles() (string, string) {
208
}
209
210
wildcardKeyFile := wildcardKeyPath(keyDir)
211
+ wildcardCertFile := fullChainPath(keyDir)
212
+ if fileExists(wildcardCertFile) && fileExists(wildcardKeyFile) {
213
+ return wildcardCertFile, wildcardKeyFile
214
+ }
215
+
216
mainKeyFile := mainKeyPath(keyDir)
217
mainCertFile := mainFullChainPath(keyDir)
218
if fileExists(mainCertFile) && fileExists(mainKeyFile) {
219
return mainCertFile, mainKeyFile
220
}
221
217
- wildcardCertFile := fullChainPath(keyDir)
218
- if fileExists(wildcardCertFile) && fileExists(wildcardKeyFile) {
219
- return wildcardCertFile, wildcardKeyFile
220
- }
221
-
222
return "", ""
223
}
224
@@ -269,8 +269,7 @@ func buildCertTargets(baseDomain, configuredKeyDir string) ([]certTarget, error)
269
Name: "wildcard",
270
KeyFile: wildcardKeyPath(keyDir),
271
CertFile: fullChainPath(keyDir),
272
- // Keep root + wildcard SAN for keyless compatibility.
273
- Domains: []string{base, "*." + base},
272
+ Domains: []string{"*." + base},
273
},
274
{
275
Name: "main",
portal/acme/renew.go
+12
-1
@@ -222,10 +222,15 @@ func (m *AcmeManager) doRenew(cfg provisionConfig) error {
222
return fmt.Errorf("read certificate for renewal: %w", err)
223
}
224
225
+ keyPEM, err := os.ReadFile(cfg.KeyFile)
226
+ if err != nil {
227
+ return fmt.Errorf("read private key for renewal: %w", err)
228
+ }
229
+
230
renewed, err := client.Certificate.Renew(certificate.Resource{
231
Domain: cfg.Domains[0],
232
Certificate: certPEM,
228
- PrivateKey: nil,
233
+ PrivateKey: keyPEM,
234
}, true, false, "")
235
if err != nil {
236
return fmt.Errorf("ACME renew: %w", err)
@@ -238,5 +243,11 @@ func (m *AcmeManager) doRenew(cfg provisionConfig) error {
243
return fmt.Errorf("write renewed certificate chain: %w", err)
244
}
245
246
+ if len(renewed.PrivateKey) > 0 {
247
+ if err := writeFileAtomic(cfg.KeyFile, renewed.PrivateKey, 0o600); err != nil {
248
+ return fmt.Errorf("write renewed private key: %w", err)
249
+ }
250
+ }
251
+
252
return nil
253
}