mirror of
https://github.com/caddyserver/caddy.git
synced 2025-12-10 07:05:31 -05:00
11103bd8d6
Biggest change is no longer using standard library's tls.Config.getCertificate function to get a certificate during TLS handshake. Implemented our own cache which can be changed dynamically at runtime, even during TLS handshakes. As such, restarts are no longer required after certificate renewals or OCSP updates. We also allow loading multiple certificates and keys per host, even by specifying a directory (tls got a new 'load' command for that). Renamed the letsencrypt package to https in a gradual effort to become more generic; and https is more fitting for what the package does now. There are still some known bugs, e.g. reloading where a new certificate is required but port 80 isn't currently listening, will cause the challenge to fail. There's still plenty of cleanup to do and tests to write. It is especially confusing right now how we enable "on-demand" TLS during setup and keep track of that. But this change should basically work so far.
49 lines
1.2 KiB
Go
49 lines
1.2 KiB
Go
package https
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"log"
|
|
"net"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
const challengeBasePath = "/.well-known/acme-challenge"
|
|
|
|
// RequestCallback proxies challenge requests to ACME client if the
|
|
// request path starts with challengeBasePath. It returns true if it
|
|
// handled the request and no more needs to be done; it returns false
|
|
// if this call was a no-op and the request still needs handling.
|
|
func RequestCallback(w http.ResponseWriter, r *http.Request) bool {
|
|
if strings.HasPrefix(r.URL.Path, challengeBasePath) {
|
|
scheme := "http"
|
|
if r.TLS != nil {
|
|
scheme = "https"
|
|
}
|
|
|
|
hostname, _, err := net.SplitHostPort(r.URL.Host)
|
|
if err != nil {
|
|
hostname = r.URL.Host
|
|
}
|
|
|
|
upstream, err := url.Parse(scheme + "://" + hostname + ":" + AlternatePort)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
log.Printf("[ERROR] letsencrypt handler: %v", err)
|
|
return true
|
|
}
|
|
|
|
proxy := httputil.NewSingleHostReverseProxy(upstream)
|
|
proxy.Transport = &http.Transport{
|
|
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // client would use self-signed cert
|
|
}
|
|
proxy.ServeHTTP(w, r)
|
|
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|