From 11696793bd15503006f44876c0f9f3b5d53e4d18 Mon Sep 17 00:00:00 2001 From: Matt Holt Date: Tue, 24 Sep 2019 15:46:39 -0700 Subject: tls/acme: Ability to customize trusted roots for ACME servers (#2756) Closes #2702 --- modules/caddytls/acmemanager.go | 41 ++++++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 11 deletions(-) (limited to 'modules/caddytls') diff --git a/modules/caddytls/acmemanager.go b/modules/caddytls/acmemanager.go index f9a6409..9df2e26 100644 --- a/modules/caddytls/acmemanager.go +++ b/modules/caddytls/acmemanager.go @@ -15,8 +15,10 @@ package caddytls import ( + "crypto/x509" "encoding/json" "fmt" + "io/ioutil" "net/url" "time" @@ -38,17 +40,19 @@ func init() { // after you have configured this struct // to your liking. type ACMEManagerMaker struct { - CA string `json:"ca,omitempty"` - Email string `json:"email,omitempty"` - RenewAhead caddy.Duration `json:"renew_ahead,omitempty"` - KeyType string `json:"key_type,omitempty"` - ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` - MustStaple bool `json:"must_staple,omitempty"` - Challenges ChallengesConfig `json:"challenges,omitempty"` - OnDemand bool `json:"on_demand,omitempty"` - Storage json.RawMessage `json:"storage,omitempty"` - - storage certmagic.Storage + CA string `json:"ca,omitempty"` + Email string `json:"email,omitempty"` + RenewAhead caddy.Duration `json:"renew_ahead,omitempty"` + KeyType string `json:"key_type,omitempty"` + ACMETimeout caddy.Duration `json:"acme_timeout,omitempty"` + MustStaple bool `json:"must_staple,omitempty"` + Challenges ChallengesConfig `json:"challenges,omitempty"` + OnDemand bool `json:"on_demand,omitempty"` + Storage json.RawMessage `json:"storage,omitempty"` + TrustedRootsPEMFiles []string `json:"trusted_roots_pem_files,omitempty"` + + storage certmagic.Storage + rootPool *x509.CertPool } // CaddyModule returns the Caddy module information. @@ -91,6 +95,20 @@ func (m *ACMEManagerMaker) Provision(ctx caddy.Context) error { m.Storage = nil // allow GC to deallocate } + // add any custom CAs to trust store + if len(m.TrustedRootsPEMFiles) > 0 { + m.rootPool = x509.NewCertPool() + for _, pemFile := range m.TrustedRootsPEMFiles { + pemData, err := ioutil.ReadFile(pemFile) + if err != nil { + return fmt.Errorf("loading trusted root CA's PEM file: %s: %v", pemFile, err) + } + if !m.rootPool.AppendCertsFromPEM(pemData) { + return fmt.Errorf("unable to add %s to trust pool: %v", pemFile, err) + } + } + } + return nil } @@ -150,6 +168,7 @@ func (m *ACMEManagerMaker) makeCertMagicConfig(ctx caddy.Context) certmagic.Conf OnDemand: ond, MustStaple: m.MustStaple, Storage: storage, + TrustedRoots: m.rootPool, // TODO: listenHost } } -- cgit v1.2.3