pages/pages-server
1
0
Fork 0
mirror of https://codeberg.org/Codeberg/pages-server.git synced 2025-04-24 13:56:57 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

remove domain from cache when scheduled for renewal

Browse source
This commit is contained in:
crapStone 2024-04-29 23:05:24 +02:00 • committed by crapStone
parent 50221cf531
commit 3566fd62b8
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
server/certificates/certificates.go
View file

@ -10,12 +10,11 @@ import (
"strings" "strings"
"time" "time"
lru "github.com/hashicorp/golang-lru/v2"
"github.com/go-acme/lego/v4/certcrypto" "github.com/go-acme/lego/v4/certcrypto"
"github.com/go-acme/lego/v4/certificate" "github.com/go-acme/lego/v4/certificate"
"github.com/go-acme/lego/v4/challenge/tlsalpn01" "github.com/go-acme/lego/v4/challenge/tlsalpn01"
"github.com/go-acme/lego/v4/lego" "github.com/go-acme/lego/v4/lego"
lru "github.com/hashicorp/golang-lru/v2"
"github.com/reugn/equalizer" "github.com/reugn/equalizer"
"github.com/rs/zerolog/log" "github.com/rs/zerolog/log"
@ -113,8 +112,13 @@ func TLSConfig(mainDomainSuffix string,
} }
if tlsCertificate, ok := keyCache.Get(domain); ok { if tlsCertificate, ok := keyCache.Get(domain); ok {
// we can use an existing certificate object if shouldRenewCert(&tlsCertificate, 7) {
return &tlsCertificate, nil // if cert is up for renewal remove it from the cache
keyCache.Remove(domain)
} else {
// we can use an existing certificate object
return &tlsCertificate, nil
}
} }
var tlsCertificate *tls.Certificate var tlsCertificate *tls.Certificate
@ -197,7 +201,7 @@ func (c *AcmeClient) retrieveCertFromDB(sni, mainDomainSuffix string, useDnsProv
} }
// renew certificates 7 days before they expire // renew certificates 7 days before they expire
if tlsCertificate.Leaf.NotAfter.Before(time.Now().Add(7 * 24 * time.Hour)) { if shouldRenewCert(&tlsCertificate, 7) {
// TODO: use ValidTill of custom cert struct // TODO: use ValidTill of custom cert struct
if res.CSR != nil && len(res.CSR) > 0 { if res.CSR != nil && len(res.CSR) > 0 {
// CSR stores the time when the renewal shall be tried again // CSR stores the time when the renewal shall be tried again
@ -339,6 +343,11 @@ func SetupMainDomainCertificates(mainDomainSuffix string, acmeClient *AcmeClient
return nil return nil
} }
// shouldRenewCert returns true if the validity date of the cert is less than the given number of days in the future
func shouldRenewCert(cert *tls.Certificate, days uint) bool {
return cert.Leaf.NotAfter.Before(time.Now().Add(time.Duration(days) * 24 * time.Hour))
}
func MaintainCertDB(ctx context.Context, interval time.Duration, acmeClient *AcmeClient, mainDomainSuffix string, certDB database.CertDB) { func MaintainCertDB(ctx context.Context, interval time.Duration, acmeClient *AcmeClient, mainDomainSuffix string, certDB database.CertDB) {
for { for {
// delete expired certs that will be invalid until next clean up // delete expired certs that will be invalid until next clean up