|
|
|
@ -37,7 +37,7 @@ func TLSConfig(mainDomainSuffix string,
|
|
|
|
|
noDNS01 bool,
|
|
|
|
|
rawDomain string,
|
|
|
|
|
) *tls.Config {
|
|
|
|
|
keyCache, err := lru.New[string, tls.Certificate](32)
|
|
|
|
|
keyCache, err := lru.New[string, *tls.Certificate](32)
|
|
|
|
|
if err != nil {
|
|
|
|
|
panic(err) // This should only happen if 32 < 0 at the time of writing, which should be reason enough to panic.
|
|
|
|
|
}
|
|
|
|
@ -112,12 +112,12 @@ func TLSConfig(mainDomainSuffix string,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if tlsCertificate, ok := keyCache.Get(domain); ok {
|
|
|
|
|
if shouldRenewCert(&tlsCertificate, 7) {
|
|
|
|
|
if tlsCertificate.Leaf.NotAfter.Before(time.Now().Add(7 * 24 * time.Hour)) {
|
|
|
|
|
// if cert is up for renewal remove it from the cache
|
|
|
|
|
keyCache.Remove(domain)
|
|
|
|
|
} else {
|
|
|
|
|
// we can use an existing certificate object
|
|
|
|
|
return &tlsCertificate, nil
|
|
|
|
|
return tlsCertificate, nil
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -143,7 +143,9 @@ func TLSConfig(mainDomainSuffix string,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
keyCache.Add(domain, *tlsCertificate)
|
|
|
|
|
log.Error().Interface("cert", tlsCertificate).Msg("AAAAAAAAAAAAAAAAAAAAAAAAAAAAa")
|
|
|
|
|
keyCache.Add(domain, tlsCertificate)
|
|
|
|
|
|
|
|
|
|
return tlsCertificate, nil
|
|
|
|
|
},
|
|
|
|
|
NextProtos: []string{
|
|
|
|
@ -192,16 +194,15 @@ func (c *AcmeClient) retrieveCertFromDB(sni, mainDomainSuffix string, useDnsProv
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
tlsCertificate.Leaf, err = leaf(&tlsCertificate)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// TODO: document & put into own function
|
|
|
|
|
if !strings.EqualFold(sni, mainDomainSuffix) {
|
|
|
|
|
tlsCertificate.Leaf, err = x509.ParseCertificate(tlsCertificate.Certificate[0])
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, fmt.Errorf("error parsing leaf tlsCert: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// renew certificates 7 days before they expire
|
|
|
|
|
if shouldRenewCert(&tlsCertificate, 7) {
|
|
|
|
|
if tlsCertificate.Leaf.NotAfter.Before(time.Now().Add(7 * 24 * time.Hour)) {
|
|
|
|
|
// TODO: use ValidTill of custom cert struct
|
|
|
|
|
if res.CSR != nil && len(res.CSR) > 0 {
|
|
|
|
|
// CSR stores the time when the renewal shall be tried again
|
|
|
|
@ -237,6 +238,10 @@ func (c *AcmeClient) obtainCert(acmeClient *lego.Client, domains []string, renew
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, fmt.Errorf("certificate failed in synchronous request: %w", err)
|
|
|
|
|
}
|
|
|
|
|
cert.Leaf, err = leaf(cert)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
return cert, nil
|
|
|
|
|
}
|
|
|
|
|
defer c.obtainLocks.Delete(name)
|
|
|
|
@ -300,6 +305,7 @@ func (c *AcmeClient) obtainCert(acmeClient *lego.Client, domains []string, renew
|
|
|
|
|
}
|
|
|
|
|
leaf, err := leaf(&tlsCertificate)
|
|
|
|
|
if err == nil && leaf.NotAfter.After(time.Now()) {
|
|
|
|
|
tlsCertificate.Leaf = leaf
|
|
|
|
|
// avoid sending a mock cert instead of a still valid cert, instead abuse CSR field to store time to try again at
|
|
|
|
|
renew.CSR = []byte(strconv.FormatInt(time.Now().Add(6*time.Hour).Unix(), 10))
|
|
|
|
|
if err := keyDatabase.Put(name, renew); err != nil {
|
|
|
|
@ -323,6 +329,10 @@ func (c *AcmeClient) obtainCert(acmeClient *lego.Client, domains []string, renew
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
tlsCertificate.Leaf, err = leaf(&tlsCertificate)
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, err
|
|
|
|
|
}
|
|
|
|
|
return &tlsCertificate, nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -343,11 +353,6 @@ func SetupMainDomainCertificates(mainDomainSuffix string, acmeClient *AcmeClient
|
|
|
|
|
return nil
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// shouldRenewCert returns true if the validity date of the cert is less than the given number of days in the future
|
|
|
|
|
func shouldRenewCert(cert *tls.Certificate, days uint) bool {
|
|
|
|
|
return cert.Leaf.NotAfter.Before(time.Now().Add(time.Duration(days) * 24 * time.Hour))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func MaintainCertDB(ctx context.Context, interval time.Duration, acmeClient *AcmeClient, mainDomainSuffix string, certDB database.CertDB) {
|
|
|
|
|
for {
|
|
|
|
|
// delete expired certs that will be invalid until next clean up
|
|
|
|
@ -402,11 +407,20 @@ func MaintainCertDB(ctx context.Context, interval time.Duration, acmeClient *Acm
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// leaf returns the parsed leaf certificate, either from c.leaf or by parsing
|
|
|
|
|
// leaf returns the parsed leaf certificate, either from c.Leaf or by parsing
|
|
|
|
|
// the corresponding c.Certificate[0].
|
|
|
|
|
// After successfully parsing the cert c.Leaf gets set to the parsed cert.
|
|
|
|
|
func leaf(c *tls.Certificate) (*x509.Certificate, error) {
|
|
|
|
|
if c.Leaf != nil {
|
|
|
|
|
return c.Leaf, nil
|
|
|
|
|
}
|
|
|
|
|
return x509.ParseCertificate(c.Certificate[0])
|
|
|
|
|
|
|
|
|
|
leaf, err := x509.ParseCertificate(c.Certificate[0])
|
|
|
|
|
if err != nil {
|
|
|
|
|
return nil, fmt.Errorf("tlsCert - failed to parse leaf: %w", err)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
c.Leaf = leaf
|
|
|
|
|
|
|
|
|
|
return leaf, err
|
|
|
|
|
}
|
|
|
|
|