CERBERUS/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2026-09-01 00:48:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

httpcaddyfile: Fix default issuers when email provided

Browse source 
If `tls <email>` is used, we should apply that to all applicable default issuers, not drop them. This refactoring applies implicit ACME issuer settings from the tls directive to all default ACME issuers, like ZeroSSL.

We also consolidate some annoying logic and improve config validity checks.

Ref: https://caddy.community/t/error-obtaining-certificate-after-caddy-restart/11335/8
This commit is contained in:
Matthew Holt 2021-02-02 16:17:26 -07:00
parent 2772ede43c
commit 90284e8017
No known key found for this signature in database
GPG key ID: 2A349DD577D586A5
4 changed files with 71 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/caddyhttp/autohttps.go
View file

@ -444,7 +444,7 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
// what the HTTP and HTTPS ports are)
if ap.Issuers == nil {
var err error
ap.Issuers, err = caddytls.DefaultIssuers(ctx)
ap.Issuers, err = caddytls.DefaultIssuersProvisioned(ctx)
if err != nil {
return err
}
@ -499,7 +499,7 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
// never overwrite any other issuer that might already be configured
if basePolicy.Issuers == nil {
var err error
basePolicy.Issuers, err = caddytls.DefaultIssuers(ctx)
basePolicy.Issuers, err = caddytls.DefaultIssuersProvisioned(ctx)
if err != nil {
return err
}

33
modules/caddytls/automation.go
View file

@ -187,7 +187,7 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
issuers := ap.Issuers
if len(issuers) == 0 {
var err error
issuers, err = DefaultIssuers(tlsApp.ctx)
issuers, err = DefaultIssuersProvisioned(tlsApp.ctx)
if err != nil {
return err
}
@ -242,21 +242,28 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
return nil
}
// DefaultIssuers returns empty but provisioned default Issuers.
// DefaultIssuers returns empty Issuers (not provisioned) to be used as defaults.
// This function is experimental and has no compatibility promises.
func DefaultIssuers(ctx caddy.Context) ([]certmagic.Issuer, error) {
acme := new(ACMEIssuer)
err := acme.Provision(ctx)
if err != nil {
return nil, err
func DefaultIssuers() []certmagic.Issuer {
return []certmagic.Issuer{
new(ACMEIssuer),
&ZeroSSLIssuer{ACMEIssuer: new(ACMEIssuer)},
}
zerossl := new(ZeroSSLIssuer)
err = zerossl.Provision(ctx)
if err != nil {
return nil, err
}
// DefaultIssuersProvisioned returns empty but provisioned default Issuers from
// DefaultIssuers(). This function is experimental and has no compatibility promises.
func DefaultIssuersProvisioned(ctx caddy.Context) ([]certmagic.Issuer, error) {
issuers := DefaultIssuers()
for i, iss := range issuers {
if prov, ok := iss.(caddy.Provisioner); ok {
err := prov.Provision(ctx)
if err != nil {
return nil, fmt.Errorf("provisioning default issuer %d: %T: %v", i, iss, err)
}
}
}
// TODO: eventually, insert ZeroSSL into first position in the slice -- see also httpcaddyfile/tlsapp.go for where similar defaults are configured
return []certmagic.Issuer{acme, zerossl}, nil
return issuers, nil
}
// ChallengesConfig configures the ACME challenges.