From d692d503a3d327d54c82bceab48bb1de07bb3c3d Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Fri, 20 Mar 2020 20:25:46 -0600 Subject: tls/http: Fix auto-HTTPS logic w/rt default issuers (fixes #3164) The comments in the code should explain the new logic thoroughly. The basic problem for the issue was that we were overriding a catch-all automation policy's explicitly-configured issuer with our own, for names that we thought looked like public names. In other words, one could configure an internal issuer for all names, but then our auto HTTPS would create a new policy for public-looking names that uses the default ACME issuer, because we assume public<==>ACME and nonpublic<==>Internal, but that is not always the case. The new logic still assumes nonpublic<==>Internal (on catch-all policies only), but no longer assumes that public-looking names always use an ACME issuer. Also fix a bug where HTTPPort and HTTPSPort from the HTTP app weren't being carried through to ACME issuers properly. It required a bit of refactoring. --- modules/caddytls/tls.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'modules/caddytls/tls.go') diff --git a/modules/caddytls/tls.go b/modules/caddytls/tls.go index 4fc0850..076e017 100644 --- a/modules/caddytls/tls.go +++ b/modules/caddytls/tls.go @@ -94,12 +94,12 @@ func (t *TLS) Provision(ctx caddy.Context) error { t.Automation = new(AutomationConfig) } t.Automation.defaultAutomationPolicy = new(AutomationPolicy) - err := t.Automation.defaultAutomationPolicy.provision(t) + err := t.Automation.defaultAutomationPolicy.Provision(t) if err != nil { return fmt.Errorf("provisioning default automation policy: %v", err) } for i, ap := range t.Automation.Policies { - err := ap.provision(t) + err := ap.Provision(t) if err != nil { return fmt.Errorf("provisioning automation policy %d: %v", i, err) } @@ -300,7 +300,7 @@ func (t *TLS) AddAutomationPolicy(ap *AutomationPolicy) error { if t.Automation == nil { t.Automation = new(AutomationConfig) } - err := ap.provision(t) + err := ap.Provision(t) if err != nil { return err } -- cgit v1.2.3