Implement session ticket keys; default STEK module with rotation

1 files changed, 13 insertions, 1 deletions

diff --git a/modules/caddytls/connpolicy.go b/modules/caddytls/connpolicy.go
index 3241d3c..006afe9 100644
--- a/modules/caddytls/connpolicy.go
+++ b/modules/caddytls/connpolicy.go
@@ -133,9 +133,21 @@ func (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy2.Context) error {
 		},
 		MinVersion: tls.VersionTLS12,
 		MaxVersion: tls.VersionTLS13,
-		// TODO: Session ticket key rotation (use Storage)
 	}
 
+	// session tickets support
+	cfg.SessionTicketsDisabled = tlsApp.SessionTickets.Disabled
+
+	// session ticket key rotation
+	tlsApp.SessionTickets.register(cfg)
+	ctx.OnCancel(func() {
+		// do cleanup when the context is cancelled because,
+		// though unlikely, it is possible that a context
+		// needing a TLS server config could exist for less
+		// than the lifetime of the whole app
+		tlsApp.SessionTickets.unregister(cfg)
+	})
+
 	// add all the cipher suites in order, without duplicates
 	cipherSuitesAdded := make(map[uint16]struct{})
 	for _, csName := range p.CipherSuites {