public inbox for pmg-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Stoiko Ivanov <s.ivanov@proxmox.com>
To: pmg-devel@lists.proxmox.com
Subject: [pmg-devel] [PATCH pmg-api v3 2/3] acme: check plugin for wildcard certificates
Date: Thu, 15 Apr 2021 21:46:19 +0200	[thread overview]
Message-ID: <20210415194622.25632-3-s.ivanov@proxmox.com> (raw)
In-Reply-To: <20210415194622.25632-1-s.ivanov@proxmox.com>

Let's Encrypt currently only issues wildcard certificates if the
domain ownership is validated via a dns-01 type plugin.

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/NodeConfig.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/PMG/NodeConfig.pm b/src/PMG/NodeConfig.pm
index 5f96e62..029b903 100644
--- a/src/PMG/NodeConfig.pm
+++ b/src/PMG/NodeConfig.pm
@@ -209,9 +209,9 @@ sub get_acme_conf {
 	}
 	$parsed->{plugin} //= 'standalone';
 
+	my $plugins = PMG::API2::ACMEPlugin::load_config();
 	my $plugin_id = $parsed->{plugin};
 	if ($plugin_id ne 'standalone') {
-	    my $plugins = PMG::API2::ACMEPlugin::load_config();
 	    die "plugin '$plugin_id' for domain '$domain' not found!\n"
 		if !$plugins->{ids}->{$plugin_id};
 	}
@@ -220,6 +220,9 @@ sub get_acme_conf {
 	# wildcard - see https://tools.ietf.org/html/rfc8555#section-7.1.3
 	if ($domain =~ /^\*\.(.*)$/ ) {
 	    $res->{validationtarget}->{$1} = $domain;
+	    die "wildcard domain validation for '$domain' needs a dns-01 plugin.\n"
+		if $plugins->{ids}->{$plugin_id}->{type} ne 'dns';
+
 	}
 
 	$parsed->{_configkey} = "acmedomain$index";
-- 
2.20.1





  parent reply	other threads:[~2021-04-15 19:47 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-15 19:46 [pmg-devel] [PATCH pmg-api/pwt/pmg-docs v3] Stoiko Ivanov
2021-04-15 19:46 ` [pmg-devel] [PATCH pmg-api v3 1/3] acme: handle wildcard dns validation Stoiko Ivanov
2021-04-15 19:46 ` Stoiko Ivanov [this message]
2021-04-15 19:46 ` [pmg-devel] [PATCH pmg-api v3 3/3] nodeconfig: parse acme config before writing Stoiko Ivanov
2021-04-15 19:46 ` [pmg-devel] [PATCH v3 1/1] acme: allow wildcards as domain Stoiko Ivanov
2021-04-15 19:46 ` [pmg-devel] [PATCH pmg-docs v3 1/1] certs: add wildcard certificate support Stoiko Ivanov
2021-07-13  8:03 ` [pmg-devel] applied-series: [PATCH pmg-api/pwt/pmg-docs v3] Thomas Lamprecht

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210415194622.25632-3-s.ivanov@proxmox.com \
    --to=s.ivanov@proxmox.com \
    --cc=pmg-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal