Infrastructure/caddy
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-02-17 23:45:41 -05:00
Code Issues Activity

caddypki: Add SignWithRoot option for ACME server

Browse source 
See https://caddy.community/t/setting-up-a-caddy-pki-based-on-a-windows-
root-ca-was-getting-pki-config/11616/7

Also improved a godoc comment in the caddytls package.
This commit is contained in:
Matthew Holt 2021-02-26 19:27:58 -07:00
parent ce5a0934a8
commit ec309c6d52
No known key found for this signature in database
GPG key ID: 2A349DD577D586A5
2 changed files with 16 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
modules/caddypki/acmeserver/acmeserver.go
View file

@ -66,6 +66,13 @@ type Handler struct {
// on this property long-term; check release notes. // on this property long-term; check release notes.
PathPrefix string `json:"path_prefix,omitempty"` PathPrefix string `json:"path_prefix,omitempty"`
// If true, the CA's root will be the issuer instead of
// the intermediate. This is NOT recommended and should
// only be used when devices/clients do not properly
// validate certificate chains. EXPERIMENTAL: Might be
// changed or removed in the future.
SignWithRoot bool `json:"sign_with_root,omitempty"`
acmeEndpoints http.Handler acmeEndpoints http.Handler
logger *zap.Logger logger *zap.Logger
} }
@ -109,6 +116,7 @@ func (ash *Handler) Provision(ctx caddy.Context) error {
} }
authorityConfig := caddypki.AuthorityConfig{ authorityConfig := caddypki.AuthorityConfig{
SignWithRoot: ash.SignWithRoot,
AuthConfig: &authority.AuthConfig{ AuthConfig: &authority.AuthConfig{
Provisioners: provisioner.List{ Provisioners: provisioner.List{
&provisioner.ACME{ &provisioner.ACME{

13
modules/caddytls/tls.go
View file

@ -478,11 +478,14 @@ type Certificate struct {
Tags []string Tags []string
} }
// AutomateLoader is a no-op certificate loader module // AutomateLoader will automatically manage certificates for the names
// that is treated as a special case: it uses this app's // in the list, including obtaining and renewing certificates. Automated
// automation features to load certificates for the // certificates are managed according to their matching automation policy,
// list of hostnames, rather than loading certificates // configured elsewhere in this app.
// manually. //
// This is a no-op certificate loader module that is treated as a special
// case: it uses this app's automation features to load certificates for the
// list of hostnames, rather than loading certificates manually.
type AutomateLoader []string type AutomateLoader []string
// CaddyModule returns the Caddy module information. // CaddyModule returns the Caddy module information.