From ad0938750258ed486663318e11de5ca59cd1f078 Mon Sep 17 00:00:00 2001 From: Maksim Kazantsev Date: Wed, 25 Feb 2026 15:50:12 +0000 Subject: [PATCH] Pull request 2588: AGDNS-3684-fix-tls-status Squashed commit of the following: commit 0aa099cd1fb3aa83ae72f9e7e3b4f2b00190baac Merge: 94ed08dcb 8c9756f32 Author: Maksim Kazantsev Date: Wed Feb 25 18:40:29 2026 +0300 Merge branch 'master' into AGDNS-3684-fix-tls-status commit 94ed08dcb3d4adfae25fcd0d2b3f60ebe222881c Merge: 229f678c8 4c1dcfee4 Author: Maksim Kazantsev Date: Wed Feb 25 18:20:38 2026 +0300 Merge branch 'master' into AGDNS-3684-fix-tls-status all: merge changes from master; commit 229f678c8f43a62b554d430646872e1e7185d3af Author: Maksim Kazantsev Date: Thu Feb 19 15:49:55 2026 +0300 home: add contracts; commit 079e9738eeff96ac0107742092f1abba5d505ac3 Author: Maksim Kazantsev Date: Wed Feb 18 13:28:26 2026 +0300 home: upd ValidCert and ValidKey fields value setting logic; rm unused functions params; --- internal/home/tls.go | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/internal/home/tls.go b/internal/home/tls.go index 7742b5770..0c38b49fe 100644 --- a/internal/home/tls.go +++ b/internal/home/tls.go @@ -326,13 +326,13 @@ func (m *tlsManager) loadTLSConfig( } }() - err = loadCertificateChainData(tlsConf, status) + err = loadCertificateChainData(tlsConf) if err != nil { // Don't wrap the error, because it's informative enough as is. return err } - err = loadPrivateKeyData(tlsConf, status) + err = loadPrivateKeyData(tlsConf) if err != nil { // Don't wrap the error, because it's informative enough as is. return err @@ -350,8 +350,10 @@ func (m *tlsManager) loadTLSConfig( } // loadCertificateChainData loads PEM-encoded certificates chain data to the -// TLS configuration. -func loadCertificateChainData(tlsConf *tlsConfigSettings, status *tlsConfigStatus) (err error) { +// TLS configuration. tlsConf must be not nil. tlsConf.CertificateChainData +// struct field will be modified in case tlsConfig.CertificatePath is not an +// empty string. +func loadCertificateChainData(tlsConf *tlsConfigSettings) (err error) { tlsConf.CertificateChainData = []byte(tlsConf.CertificateChain) if tlsConf.CertificatePath != "" { if tlsConf.CertificateChain != "" { @@ -362,18 +364,15 @@ func loadCertificateChainData(tlsConf *tlsConfigSettings, status *tlsConfigStatu if err != nil { return fmt.Errorf("reading cert file: %w", err) } - - // Set status.ValidCert to true to signal the frontend that the - // certificate opens successfully while the private key can't be opened. - status.ValidCert = true } return nil } // loadPrivateKeyData loads PEM-encoded private key data to the TLS -// configuration. -func loadPrivateKeyData(tlsConf *tlsConfigSettings, status *tlsConfigStatus) (err error) { +// configuration. tlsConf must be not nil. tlsConf.PrivateKeyData struct field +// will be modified in case tlsConfig.PrivateKeyPath is not an empty string. +func loadPrivateKeyData(tlsConf *tlsConfigSettings) (err error) { tlsConf.PrivateKeyData = []byte(tlsConf.PrivateKey) if tlsConf.PrivateKeyPath != "" { if tlsConf.PrivateKey != "" { @@ -384,8 +383,6 @@ func loadPrivateKeyData(tlsConf *tlsConfigSettings, status *tlsConfigStatus) (er if err != nil { return fmt.Errorf("reading key file: %w", err) } - - status.ValidKey = true } return nil @@ -954,6 +951,8 @@ func (m *tlsManager) validateCertificates( return keyErr } + // Set status.ValidKey to true to signal the frontend that the + // key is valid. status.ValidKey = true } @@ -982,6 +981,9 @@ func (m *tlsManager) validateCertificate( // parseErr is a non-critical parse warning. var parseErr error var certs []*x509.Certificate + + // Set status.ValidCert to true to signal the frontend that the + // certificate opens successfully and certificate chain is valid. certs, status.ValidCert, parseErr = m.parseCertChain(ctx, certChain) if !status.ValidCert { // Don't wrap the error, since it's informative enough as is.