3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-03 00:40:25 +02:00
Code Issues Projects Releases Packages Wiki Activity

config: generate derived certificates instead of self-signed certificates (#3860)

Browse source
This commit is contained in:
Caleb Doxsey 2023-01-06 12:50:40 -07:00 • committed by GitHub
parent 488bcd6f72
commit 3f1a87727f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 151 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

22
pkg/cryptutil/tls.go
View file

@ -44,27 +44,10 @@ func GetCertPool(ca, caFile string) (*x509.CertPool, error) {
return rootCAs, nil
}
// GetCertificateForServerName returns the tls Certificate which matches the given server name.
// It should handle both exact matches and wildcard matches. If none of those match, the first certificate will be used.
// Finally if there are no matching certificates one will be generated.
func GetCertificateForServerName(certificates []tls.Certificate, serverName string) (*tls.Certificate, error) {
// first try a direct name match
for i := range certificates {
if matchesServerName(&certificates[i], serverName) {
return &certificates[i], nil
}
}
log.WarnNoTLSCertificate(serverName)
// finally fall back to a generated, self-signed certificate
return GenerateSelfSignedCertificate(serverName)
}
// HasCertificateForServerName returns true if a TLS certificate matches the given server name.
func HasCertificateForServerName(certificates []tls.Certificate, serverName string) bool {
for i := range certificates {
if matchesServerName(&certificates[i], serverName) {
if MatchesServerName(&certificates[i], serverName) {
return true
}
}
@ -95,7 +78,8 @@ func GetCertificateServerNames(cert *tls.Certificate) []string {
return serverNames
}
func matchesServerName(cert *tls.Certificate, serverName string) bool {
// MatchesServerName returns true if the certificate matches the server name.
func MatchesServerName(cert *tls.Certificate, serverName string) bool {
if cert == nil || len(cert.Certificate) == 0 {
return false
}