sam/SafelineAPI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

jonne-test-no-http01 #3

Merged
sam merged 2 commits from jonne-test-no-http01 into master 2026-02-27 20:41:36 +00:00
Conversation 0 Commits 2 Files Changed 1 +112 -107
1 changed files with 112 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit da92e026f5 - Show all commits

127
pkg/services/ApplyCert.go
View File

@@ -6,13 +6,18 @@ import (
"crypto/ecdsa" "crypto/ecdsa"
"crypto/elliptic" "crypto/elliptic"
"crypto/rand" "crypto/rand"
"errors"
"os"
"path/filepath"
"strings"
"time"
"github.com/go-acme/lego/v4/certcrypto" "github.com/go-acme/lego/v4/certcrypto"
"github.com/go-acme/lego/v4/certificate" "github.com/go-acme/lego/v4/certificate"
"github.com/go-acme/lego/v4/challenge" "github.com/go-acme/lego/v4/challenge"
"github.com/go-acme/lego/v4/challenge/dns01"
"github.com/go-acme/lego/v4/lego" "github.com/go-acme/lego/v4/lego"
"github.com/go-acme/lego/v4/registration" "github.com/go-acme/lego/v4/registration"
"os"
"path/filepath"
) )
type MyUser struct { type MyUser struct {
@@ -21,25 +26,27 @@ type MyUser struct {
key crypto.PrivateKey key crypto.PrivateKey
} }
func (u *MyUser) GetEmail() string { func (u MyUser) GetEmail() string {
return u.Email return u.Email
} }
func (u *MyUser) GetRegistration() *registration.Resource { func (u MyUser) GetRegistration() *registration.Resource {
return u.Registration return u.Registration
} }
func (u *MyUser) GetPrivateKey() crypto.PrivateKey { func (u MyUser) GetPrivateKey() crypto.PrivateKey {
return u.key return u.key
} }
// ApplyCert requests a certificate using DNS-01.
// Your lego version doesn't have SetChallengePreference, so we enforce "DNS-01 only" by:
// 1) configuring ONLY the DNS-01 provider (no HTTP-01/TLS-ALPN-01 providers anywhere)
// 2) failing fast if the resulting error indicates an HTTP-01 attempt (so you notice another code path/version running).
func ApplyCert(domains []string, email, dir string, provider challenge.Provider) bool { func ApplyCert(domains []string, email, dir string, provider challenge.Provider) bool {
privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true return true
} }
@@ -53,41 +60,32 @@ func ApplyCert(domains []string, email, dir string, provider challenge.Provider)
client, err := lego.NewClient(config) client, err := lego.NewClient(config)
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true return true
} }
// ===================================================== // DNS-01 provider + force public resolvers (avoids internal/split-horizon DNS issues).
// 🔒 FORCE DNS-01 ONLY — DISABLE ALL OTHER CHALLENGES err = client.Challenge.SetDNS01Provider(
// ===================================================== provider,
client.Challenge.RemoveHTTP01Provider() dns01.AddRecursiveNameservers([]string{
client.Challenge.RemoveTLSALPN01Provider() "1.1.1.1:53",
"8.8.8.8:53",
err = client.Challenge.SetDNS01Provider(provider) }),
if err != nil { dns01.AddDNSTimeout(180*time.Second),
logger.Error.Printf(
"Error requesting certificate for %s%s%s: %s%s%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true
}
// =====================================================
reg, err := client.Registration.Register(
registration.RegisterOptions{TermsOfServiceAgreed: true},
) )
if err != nil { if err != nil {
logger.Error.Printf( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
"Error requesting certificate for %s%s%s: %s%s%s", logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true return true
} }
reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
if err != nil {
logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
return true
}
myUser.Registration = reg myUser.Registration = reg
request := certificate.ObtainRequest{ request := certificate.ObtainRequest{
@@ -95,40 +93,47 @@ func ApplyCert(domains []string, email, dir string, provider challenge.Provider)
Bundle: true, Bundle: true,
} }
certificates, err := client.Certificate.Obtain(request) certs, err := client.Certificate.Obtain(request)
if err != nil { if err != nil {
logger.Error.Printf( // If you see HTTP-01 URLs here, it means *somewhere* HTTP-01 is still being selected,
"Error requesting certificate for %s%s%s: %s%s%s", // or a different binary/container/version is doing the request.
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, if looksLikeHTTP01(err) {
) logger.Error.Printf("Certificate update failed for domain %v: %v", domains, err)
logger.Error.Printf("Detected HTTP-01 attempt. This should not happen when only DNS-01 is configured.")
logger.Error.Printf("Check for another process/binary calling lego with HTTP-01, or upgrade lego to a version that supports explicit challenge preference.")
return true return true
} }
err = os.WriteFile( logger.Error.Printf("Error requesting certificate for %s%v%s: %s%v%s",
filepath.Join(dir, domains[0]+".crt"), logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
certificates.Certificate,
os.ModePerm,
)
if err != nil {
logger.Error.Printf(
"Error saving certificate for %s%s%s: %s%s%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset,
)
return true return true
} }
err = os.WriteFile( if err := os.WriteFile(filepath.Join(dir, domains[0]+".crt"), certs.Certificate, 0600); err != nil {
filepath.Join(dir, domains[0]+".key"), logger.Error.Printf("Error saving certificate for %s%v%s: %s%v%s",
certificates.PrivateKey, logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
os.ModePerm, return true
) }
if err != nil {
logger.Error.Printf( if err := os.WriteFile(filepath.Join(dir, domains[0]+".key"), certs.PrivateKey, 0600); err != nil {
"Error saving certificate key for %s%s%s: %s%s%s", logger.Error.Printf("Error saving certificate key for %s%v%s: %s%v%s",
logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset, logger.Cyan, domains, logger.Reset, logger.Red, err, logger.Reset)
)
return true return true
} }
return false return false
} }
func looksLikeHTTP01(err error) bool {
if err == nil {
return false
}
s := err.Error()
return strings.Contains(s, "/.well-known/acme-challenge/") ||
strings.Contains(s, "http-01") ||
strings.Contains(s, "Invalid response from http://")
}
// If you *can* upgrade lego, do it. Then you can explicitly prefer DNS-01 (cleanest fix).
// In older versions, there is no SetChallengePreference on the solver manager.
var _ = errors.New