Skip to content

Commit 74862ff

Browse files
mholtmholt
committed
Upgrade acmez to v2 beta
Adds support for customizing NotBefore/NotAfter times of certs
1 parent 30e4f93 commit 74862ff

14 files changed

+54
-30
lines changed

‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ CertMagic - Automatic HTTPS using Let's Encrypt
9090
- Exponential backoff with carefully-tuned intervals
9191
- Retries with optional test/staging CA endpoint instead of production, to avoid rate limits
9292
- Written in Go, a language with memory-safety guarantees
93-
- Powered by [ACMEz](https://github.com/mholt/acmez), _the_ premier ACME client library for Go
93+
- Powered by [ACMEz](https://github.com/mholt/acmez/v2), _the_ premier ACME client library for Go
9494
- All [libdns](https://github.com/libdns) DNS providers work out-of-the-box
9595
- Pluggable storage backends (default: file system)
9696
- Pluggable key sources
@@ -566,7 +566,7 @@ We welcome your contributions! Please see our **[contributing guidelines](https:
566566

567567
## Project History
568568

569-
CertMagic is the core of Caddy's advanced TLS automation code, extracted into a library. The underlying ACME client implementation is [ACMEz](https://github.com/mholt/acmez). CertMagic's code was originally a central part of Caddy even before Let's Encrypt entered public beta in 2015.
569+
CertMagic is the core of Caddy's advanced TLS automation code, extracted into a library. The underlying ACME client implementation is [ACMEz](https://github.com/mholt/acmez/v2). CertMagic's code was originally a central part of Caddy even before Let's Encrypt entered public beta in 2015.
570570

571571
In the years since then, Caddy's TLS automation techniques have been widely adopted, tried and tested in production, and served millions of sites and secured trillions of connections.
572572

‎account.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import (
3232
"strings"
3333
"sync"
3434

35-
"github.com/mholt/acmez/acme"
35+
"github.com/mholt/acmez/v2/acme"
3636
)
3737

3838
// getAccount either loads or creates a new account, depending on if

‎acmeclient.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ import (
2626
"sync"
2727
"time"
2828

29-
"github.com/mholt/acmez"
30-
"github.com/mholt/acmez/acme"
29+
"github.com/mholt/acmez/v2"
30+
"github.com/mholt/acmez/v2/acme"
3131
"go.uber.org/zap"
3232
)
3333

‎acmeissuer.go

+27-3
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ import (
2828
"sync"
2929
"time"
3030

31-
"github.com/mholt/acmez"
32-
"github.com/mholt/acmez/acme"
31+
"github.com/mholt/acmez/v2"
32+
"github.com/mholt/acmez/v2/acme"
3333
"go.uber.org/zap"
3434
)
3535

@@ -69,6 +69,13 @@ type ACMEIssuer struct {
6969
// with this ACME account
7070
ExternalAccount *acme.EAB
7171

72+
// Optionally specify the validity period of
73+
// the certificate(s) here as offsets from the
74+
// approximate time of certificate issuance,
75+
// but note that not all CAs support this
76+
// (EXPERIMENTAL: Subject to change)
77+
NotBefore, NotAfter time.Duration
78+
7279
// Disable all HTTP challenges
7380
DisableHTTPChallenge bool
7481

@@ -183,6 +190,12 @@ func NewACMEIssuer(cfg *Config, template ACMEIssuer) *ACMEIssuer {
183190
if template.ExternalAccount == nil {
184191
template.ExternalAccount = DefaultACME.ExternalAccount
185192
}
193+
if template.NotBefore != 0 {
194+
template.NotBefore = DefaultACME.NotBefore
195+
}
196+
if template.NotAfter != 0 {
197+
template.NotAfter = DefaultACME.NotAfter
198+
}
186199
if !template.DisableHTTPChallenge {
187200
template.DisableHTTPChallenge = DefaultACME.DisableHTTPChallenge
188201
}
@@ -407,10 +420,21 @@ func (am *ACMEIssuer) doIssue(ctx context.Context, csr *x509.CertificateRequest,
407420
}
408421
}
409422

423+
params, err := acmez.OrderParametersFromCSR(client.account, csr)
424+
if err != nil {
425+
return nil, false, fmt.Errorf("generating order parameters from CSR: %v", err)
426+
}
427+
if am.NotBefore != 0 {
428+
params.NotBefore = time.Now().Add(am.NotBefore)
429+
}
430+
if am.NotAfter != 0 {
431+
params.NotAfter = time.Now().Add(am.NotAfter)
432+
}
433+
410434
// do this in a loop because there's an error case that may necessitate a retry, but not more than once
411435
var certChains []acme.Certificate
412436
for i := 0; i < 2; i++ {
413-
certChains, err = client.acmeClient.ObtainCertificateUsingCSR(ctx, client.account, csr)
437+
certChains, err = client.acmeClient.ObtainCertificate(ctx, params)
414438
if err != nil {
415439
var prob acme.Problem
416440
if errors.As(err, &prob) && prob.Type == acme.ProblemTypeAccountDoesNotExist {

‎config.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ import (
3434
"strings"
3535
"time"
3636

37-
"github.com/mholt/acmez"
38-
"github.com/mholt/acmez/acme"
37+
"github.com/mholt/acmez/v2"
38+
"github.com/mholt/acmez/v2/acme"
3939
"go.uber.org/zap"
4040
"golang.org/x/crypto/ocsp"
4141
"golang.org/x/net/idna"

‎config_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import (
2020
"reflect"
2121
"testing"
2222

23-
"github.com/mholt/acmez/acme"
23+
"github.com/mholt/acmez/v2/acme"
2424
)
2525

2626
func TestSaveCertResource(t *testing.T) {

‎go.mod

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@ require (
66
github.com/caddyserver/zerossl v0.1.1
77
github.com/klauspost/cpuid/v2 v2.2.7
88
github.com/libdns/libdns v0.2.2
9-
github.com/mholt/acmez v1.2.0
9+
github.com/mholt/acmez/v2 v2.0.0-beta.2
1010
github.com/miekg/dns v1.1.58
1111
github.com/zeebo/blake3 v0.2.3
1212
go.uber.org/zap v1.27.0
13-
golang.org/x/crypto v0.21.0
14-
golang.org/x/net v0.22.0
13+
golang.org/x/crypto v0.22.0
14+
golang.org/x/net v0.24.0
1515
)
1616

1717
require (
1818
go.uber.org/multierr v1.11.0 // indirect
1919
golang.org/x/mod v0.14.0 // indirect
20-
golang.org/x/sys v0.18.0 // indirect
20+
golang.org/x/sys v0.19.0 // indirect
2121
golang.org/x/text v0.14.0 // indirect
2222
golang.org/x/tools v0.17.0 // indirect
2323
)

‎go.sum

+8-8
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuV
77
github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
88
github.com/libdns/libdns v0.2.2 h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
99
github.com/libdns/libdns v0.2.2/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
10-
github.com/mholt/acmez v1.2.0 h1:1hhLxSgY5FvH5HCnGUuwbKY2VQVo8IU7rxXKSnZ7F30=
11-
github.com/mholt/acmez v1.2.0/go.mod h1:VT9YwH1xgNX1kmYY89gY8xPJC84BFAisjo8Egigt4kE=
10+
github.com/mholt/acmez/v2 v2.0.0-beta.2 h1:GIgGILx8AWN0ePyTd+bjs2WDgNiIWm0nBwDLWp59aHc=
11+
github.com/mholt/acmez/v2 v2.0.0-beta.2/go.mod h1:fX4c9r5jYwMyMsC+7tkYRxHibkOTgta5DIFGoe67e1U=
1212
github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
1313
github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
1414
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -27,17 +27,17 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
2727
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
2828
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
2929
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
30-
golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
31-
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
30+
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
31+
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
3232
golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
3333
golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
34-
golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
35-
golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
34+
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
35+
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
3636
golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
3737
golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
3838
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
39-
golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
40-
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
39+
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
40+
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
4141
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
4242
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
4343
golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=

‎handshake.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ import (
2525
"sync"
2626
"time"
2727

28-
"github.com/mholt/acmez"
28+
"github.com/mholt/acmez/v2"
2929
"go.uber.org/zap"
3030
"golang.org/x/crypto/ocsp"
3131
)

‎httphandler.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import (
1818
"net/http"
1919
"strings"
2020

21-
"github.com/mholt/acmez/acme"
21+
"github.com/mholt/acmez/v2/acme"
2222
"go.uber.org/zap"
2323
)
2424

‎maintain.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
"strings"
2828
"time"
2929

30-
"github.com/mholt/acmez/acme"
30+
"github.com/mholt/acmez/v2/acme"
3131
"go.uber.org/zap"
3232
"golang.org/x/crypto/ocsp"
3333
)

‎solvers.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ import (
3030
"time"
3131

3232
"github.com/libdns/libdns"
33-
"github.com/mholt/acmez"
34-
"github.com/mholt/acmez/acme"
33+
"github.com/mholt/acmez/v2"
34+
"github.com/mholt/acmez/v2/acme"
3535
"github.com/miekg/dns"
3636
"go.uber.org/zap"
3737
)

‎solvers_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ package certmagic
1717
import (
1818
"testing"
1919

20-
"github.com/mholt/acmez/acme"
20+
"github.com/mholt/acmez/v2/acme"
2121
)
2222

2323
func Test_challengeKey(t *testing.T) {

‎zerosslissuer.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
"time"
2727

2828
"github.com/caddyserver/zerossl"
29-
"github.com/mholt/acmez/acme"
29+
"github.com/mholt/acmez/v2/acme"
3030
"go.uber.org/zap"
3131
)
3232

0 commit comments

Comments
 (0)