acme_server: Configurable default lifetime for issued certificates (#5232)

* acme_server: add certificate lifetime configuration option

Signed-off-by: Kyle McCullough <kylemcc@gmail.com>

* pki: allow intermediate cert lifetime to be configured

Signed-off-by: Kyle McCullough <kylemcc@gmail.com>

Signed-off-by: Kyle McCullough <kylemcc@gmail.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/modules/caddypki/acmeserver/caddyfile.go b/modules/caddypki/acmeserver/caddyfile.go
index fe12712..ae2d8ef 100644
--- a/modules/caddypki/acmeserver/caddyfile.go
+++ b/modules/caddypki/acmeserver/caddyfile.go
@@ -15,6 +15,9 @@
 package acmeserver
 
 import (
+	"time"
+
+	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddypki"
 )
@@ -27,6 +30,7 @@ func init() {
 //
 //	acme_server [<matcher>] {
 //	    ca <id>
+//	    lifetime <duration>
 //	}
 func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error) {
 	if !h.Next() {
@@ -55,6 +59,21 @@ func parseACMEServer(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error
 					ca = new(caddypki.CA)
 				}
 				ca.ID = acmeServer.CA
+			case "lifetime":
+				if !h.NextArg() {
+					return nil, h.ArgErr()
+				}
+
+				dur, err := caddy.ParseDuration(h.Val())
+				if err != nil {
+					return nil, err
+				}
+
+				if d := time.Duration(ca.IntermediateLifetime); d > 0 && dur > d {
+					return nil, h.Errf("certificate lifetime (%s) exceeds intermediate certificate lifetime (%s)", dur, d)
+				}
+
+				acmeServer.Lifetime = caddy.Duration(dur)
 			}
 		}
 	}