mirror/stackexchange-dnscontrol
1
0
Fork 0
mirror of https://github.com/StackExchange/dnscontrol.git synced 2024-05-11 05:55:12 +00:00
Code Issues Releases Activity

allow ecc certs if desired (#411)

Browse Source
This commit is contained in:
Craig Peterson
2018-10-09 18:51:48 -04:00
committed by GitHub
parent 6764811c5f
commit cf7f199462
3 changed files with 29 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
pkg/acme/acme.go
View File

@ -21,6 +21,7 @@ import (
type CertConfig struct { type CertConfig struct {
CertName string `json:"cert_name"` CertName string `json:"cert_name"`
Names []string `json:"names"` Names []string `json:"names"`
UseECC bool `json:"use_ecc"`
} }
type Client interface { type Client interface {
@ -36,8 +37,8 @@ type certManager struct {
cfg *models.DNSConfig cfg *models.DNSConfig
domains map[string]*models.DomainConfig domains map[string]*models.DomainConfig
originalDomains []*models.DomainConfig originalDomains []*models.DomainConfig
client *acme.Client
account *Account
waitedOnce bool waitedOnce bool
} }
@ -64,13 +65,11 @@ func commonNew(cfg *models.DNSConfig, storage Storage, email string, server stri
domains: map[string]*models.DomainConfig{}, domains: map[string]*models.DomainConfig{},
} }
client, err := c.createAcmeClient() acct, err := c.getOrCreateAccount()
if err != nil { if err != nil {
return nil, err return nil, err
} }
client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSALPN01}) c.account = acct
client.SetChallengeProvider(acme.DNS01, c)
c.client = client
return c, nil return c, nil
} }
@ -97,8 +96,10 @@ func (c *certManager) IssueOrRenewCert(cfg *CertConfig, renewUnder int, verbose
return false, err return false, err
} }
var client *acme.Client
var action = func() (*acme.CertificateResource, error) { var action = func() (*acme.CertificateResource, error) {
return c.client.ObtainCertificate(cfg.Names, true, nil, true) return client.ObtainCertificate(cfg.Names, true, nil, true)
} }
if existing == nil { if existing == nil {
@ -120,11 +121,22 @@ func (c *certManager) IssueOrRenewCert(cfg *CertConfig, renewUnder int, verbose
} else { } else {
log.Println("Renewing cert") log.Println("Renewing cert")
action = func() (*acme.CertificateResource, error) { action = func() (*acme.CertificateResource, error) {
return c.client.RenewCertificate(*existing, true, true) return client.RenewCertificate(*existing, true, true)
} }
} }
} }
kt := acme.RSA2048
if cfg.UseECC {
kt = acme.EC256
}
client, err = acme.NewClient(c.acmeDirectory, c.account, kt)
if err != nil {
return false, err
}
client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSALPN01})
client.SetChallengeProvider(acme.DNS01, c)
acme.PreCheckDNS = c.preCheckDNS acme.PreCheckDNS = c.preCheckDNS
defer func() { acme.PreCheckDNS = acmePreCheck }() defer func() { acme.PreCheckDNS = acmePreCheck }()

21
pkg/acme/registration.go
View File

@ -9,26 +9,21 @@ import (
"github.com/xenolf/lego/acme" "github.com/xenolf/lego/acme"
) )
func (c *certManager) createAcmeClient() (*acme.Client, error) { func (c *certManager) getOrCreateAccount() (*Account, error) {
account, err := c.storage.GetAccount(c.acmeHost) account, err := c.storage.GetAccount(c.acmeHost)
if err != nil { if err != nil {
return nil, err return nil, err
} }
if account == nil { if account != nil {
return account, nil
}
// register new // register new
account, err = c.createAccount(c.email) account, err = c.createAccount(c.email)
if err != nil { if err != nil {
return nil, err return nil, err
} }
if err := c.storage.StoreAccount(c.acmeHost, account); err != nil { err = c.storage.StoreAccount(c.acmeHost, account)
return nil, err return account, err
}
}
client, err := acme.NewClient(c.acmeDirectory, account, acme.RSA2048) // TODO: possibly make configurable on a cert-by cert basis
if err != nil {
return nil, err
}
return client, nil
} }
func (c *certManager) createAccount(email string) (*Account, error) { func (c *certManager) createAccount(email string) (*Account, error) {
@ -40,11 +35,11 @@ func (c *certManager) createAccount(email string) (*Account, error) {
key: privateKey, key: privateKey,
Email: c.email, Email: c.email,
} }
c.client, err = acme.NewClient(c.acmeDirectory, acct, acme.EC384) client, err := acme.NewClient(c.acmeDirectory, acct, acme.EC384)
if err != nil { if err != nil {
return nil, err return nil, err
} }
reg, err := c.client.Register(true) reg, err := client.Register(true)
if err != nil { if err != nil {
return nil, err return nil, err
} }

1
pkg/acme/storage.go
View File

@ -2,6 +2,7 @@ package acme
import "github.com/xenolf/lego/acme" import "github.com/xenolf/lego/acme"
// Storage is an abstracrion around how certificates, keys, and account info are stored on disk or elsewhere.
type Storage interface { type Storage interface {
// Get Existing certificate, or return nil if it does not exist // Get Existing certificate, or return nil if it does not exist
GetCertificate(name string) (*acme.CertificateResource, error) GetCertificate(name string) (*acme.CertificateResource, error)