sam/SafelineAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

jonne-test-no-http01 #3

Merged
sam merged 2 commits from jonne-test-no-http01 into master 2026-02-27 20:41:36 +00:00
Conversation 0 Commits 2 Files Changed 1 +112 -107
1 changed files with 112 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit da92e026f5 - Show all commits

219
pkg/services/ApplyCert.go
View File

@@ -1,134 +1,139 @@
package services package services
import ( import (
"SafelineAPI/internal/app/logger" "SafelineAPI/internal/app/logger"
"crypto" "crypto"
"crypto/ecdsa" "crypto/ecdsa"
"crypto/elliptic" "crypto/elliptic"
"crypto/rand" "crypto/rand"
"github.com/go-acme/lego/v4/certcrypto" "errors"
"github.com/go-acme/lego/v4/certificate" "os"
"github.com/go-acme/lego/v4/challenge" "path/filepath"
"github.com/go-acme/lego/v4/lego" "strings"
"github.com/go-acme/lego/v4/registration" "time"
"os"
"path/filepath" "github.com/go-acme/lego/v4/certcrypto"
"github.com/go-acme/lego/v4/certificate"
"github.com/go-acme/lego/v4/challenge"
"github.com/go-acme/lego/v4/challenge/dns01"
"github.com/go-acme/lego/v4/lego"
"github.com/go-acme/lego/v4/registration"
) )
type MyUser struct { type MyUser struct {
Email string Email string
Registration *registration.Resource Registration *registration.Resource
key crypto.PrivateKey key crypto.PrivateKey
} }
func (u *MyUser) GetEmail() string { func (u MyUser) GetEmail() string {
return u.Email return u.Email
} }
func (u *MyUser) GetRegistration() *registration.Resource { func (u MyUser) GetRegistration() *registration.Resource {
return u.Registration return u.Registration
} }
func (u *MyUser) GetPrivateKey() crypto.PrivateKey { func (u MyUser) GetPrivateKey() crypto.PrivateKey {
return u.key return u.key
} }
// ApplyCert requests a certificate using DNS-01.
// Your lego version doesn't have SetChallengePreference, so we enforce "DNS-01 only" by:
// 1) configuring ONLY the DNS-01 provider (no HTTP-01/TLS-ALPN-01 providers anywhere)
// 2) failing fast if the resulting error indicates an HTTP-01 attempt (so you notice another code path/version running).
func ApplyCert(domains []string, email, dir string, provider challenge.Provider) bool { func ApplyCert(domains []string, email, dir string, provider challenge.Provider) bool {
privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, return true
) }
return true
}
myUser := MyUser{ myUser := MyUser{
Email: email, Email: email,
key: privateKey, key: privateKey,
} }
config := lego.NewConfig(&myUser) config := lego.NewConfig(&myUser)
config.Certificate.KeyType = certcrypto.RSA2048 config.Certificate.KeyType = certcrypto.RSA2048
client, err := lego.NewClient(config) client, err := lego.NewClient(config)
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, return true
) }
return true
}
// ===================================================== // DNS-01 provider + force public resolvers (avoids internal/split-horizon DNS issues).
// 🔒 FORCE DNS-01 ONLY — DISABLE ALL OTHER CHALLENGES err = client.Challenge.SetDNS01Provider(
// ===================================================== provider,
client.Challenge.RemoveHTTP01Provider() dns01.AddRecursiveNameservers([]string{
client.Challenge.RemoveTLSALPN01Provider() "1.1.1.1:53",
"8.8.8.8:53",
}),
dns01.AddDNSTimeout(180*time.Second),
)
if err != nil {
logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
return true
}
err = client.Challenge.SetDNS01Provider(provider) reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, return true
) }
return true myUser.Registration = reg
}
// ===================================================== request := certificate.ObtainRequest{
Domains: domains,
Bundle: true,
}
reg, err := client.Registration.Register( certs, err := client.Certificate.Obtain(request)
registration.RegisterOptions{TermsOfServiceAgreed: true}, if err != nil {
) // If you see HTTP-01 URLs here, it means *somewhere* HTTP-01 is still being selected,
if err != nil { // or a different binary/container/version is doing the request.
logger.Error.Printf( if looksLikeHTTP01(err) {
"Error requesting certificate for %s%s%s: %s%s%s", logger.Error.Printf("Certificate update failed for domain %v: %v", domains, err)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, logger.Error.Printf("Detected HTTP-01 attempt. This should not happen when only DNS-01 is configured.")
) logger.Error.Printf("Check for another process/binary calling lego with HTTP-01, or upgrade lego to a version that supports explicit challenge preference.")
return true return true
} }
myUser.Registration = reg logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
return true
}
request := certificate.ObtainRequest{ if err := os.WriteFile(filepath.Join(dir, domains[0]+".crt"), certs.Certificate, 0600); err != nil {
Domains: domains, logger.Error.Printf("Error saving certificate for %s%v%s: %s%v%s",
Bundle: true, logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
} return true
}
certificates, err := client.Certificate.Obtain(request) if err := os.WriteFile(filepath.Join(dir, domains[0]+".key"), certs.PrivateKey, 0600); err != nil {
if err != nil { logger.Error.Printf("Error saving certificate key for %s%v%s: %s%v%s",
logger.Error.Printf( logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
"Error requesting certificate for %s%s%s: %s%s%s", return true
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, }
)
return true
}
err = os.WriteFile( return false
filepath.Join(dir, domains[0]+".crt"),
certificates.Certificate,
os.ModePerm,
)
if err != nil {
logger.Error.Printf(
"Error saving certificate for %s%s%s: %s%s%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true
}
err = os.WriteFile(
filepath.Join(dir, domains[0]+".key"),
certificates.PrivateKey,
os.ModePerm,
)
if err != nil {
logger.Error.Printf(
"Error saving certificate key for %s%s%s: %s%s%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true
}
return false
} }
func looksLikeHTTP01(err error) bool {
if err == nil {
return false
}
s := err.Error()
return strings.Contains(s, "/.well-known/acme-challenge/") ||
strings.Contains(s, "http-01") ||
strings.Contains(s, "Invalid response from http://")
}
// If you *can* upgrade lego, do it. Then you can explicitly prefer DNS-01 (cleanest fix).
// In older versions, there is no SetChallengePreference on the solver manager.
var _ = errors.New