lego/acme/tls_sni_challenge.go

66 lines
1.7 KiB
Go
Raw Permalink Normal View History

2015-11-19 14:26:23 +00:00
package acme
import (
"crypto/rsa"
2015-11-19 14:26:23 +00:00
"crypto/sha256"
"crypto/tls"
2015-11-19 14:26:23 +00:00
"encoding/hex"
"fmt"
"log"
2015-11-19 14:26:23 +00:00
)
type tlsSNIChallenge struct {
jws *jws
validate validateFunc
provider ChallengeProvider
2015-11-19 14:26:23 +00:00
}
func (t *tlsSNIChallenge) Solve(chlng challenge, domain string) error {
2015-12-15 20:13:40 +00:00
logf("[INFO][%s] acme: Trying to solve TLS-SNI-01", domain)
2015-11-19 14:26:23 +00:00
// Generate the Key Authorization for the challenge
keyAuth, err := getKeyAuthorization(chlng.Token, t.jws.privKey)
2015-11-19 14:26:23 +00:00
if err != nil {
return err
}
err = t.provider.Present(domain, chlng.Token, keyAuth)
if err != nil {
return fmt.Errorf("[%s] error presenting token: %v", domain, err)
2015-11-19 14:26:23 +00:00
}
defer func() {
err := t.provider.CleanUp(domain, chlng.Token, keyAuth)
if err != nil {
log.Printf("[%s] error cleaning up: %v", domain, err)
}
}()
return t.validate(t.jws, domain, chlng.URI, challenge{Resource: "challenge", Type: chlng.Type, Token: chlng.Token, KeyAuthorization: keyAuth})
2015-11-19 14:26:23 +00:00
}
// TLSSNI01ChallengeCert returns a certificate and target domain for the `tls-sni-01` challenge
func TLSSNI01ChallengeCert(keyAuth string) (tls.Certificate, string, error) {
// generate a new RSA key for the certificates
tempPrivKey, err := generatePrivateKey(RSA2048)
if err != nil {
return tls.Certificate{}, "", err
}
rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
rsaPrivPEM := pemEncode(rsaPrivKey)
zBytes := sha256.Sum256([]byte(keyAuth))
z := hex.EncodeToString(zBytes[:sha256.Size])
domain := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
tempCertPEM, err := generatePemCert(rsaPrivKey, domain)
if err != nil {
return tls.Certificate{}, "", err
}
certificate, err := tls.X509KeyPair(tempCertPEM, rsaPrivPEM)
if err != nil {
return tls.Certificate{}, "", err
}
return certificate, domain, nil
}