|
|
|
@ -16,6 +16,7 @@ import (
|
|
|
|
|
"github.com/smallstep/certificates/acme"
|
|
|
|
|
"github.com/smallstep/certificates/api"
|
|
|
|
|
"github.com/smallstep/certificates/api/render"
|
|
|
|
|
"github.com/smallstep/certificates/authority"
|
|
|
|
|
"github.com/smallstep/certificates/authority/provisioner"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
@ -39,38 +40,89 @@ type payloadInfo struct {
|
|
|
|
|
isEmptyJSON bool
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Handler is the ACME API request handler.
|
|
|
|
|
type Handler struct {
|
|
|
|
|
db acme.DB
|
|
|
|
|
backdate provisioner.Duration
|
|
|
|
|
ca acme.CertificateAuthority
|
|
|
|
|
linker Linker
|
|
|
|
|
validateChallengeOptions *acme.ValidateChallengeOptions
|
|
|
|
|
prerequisitesChecker func(ctx context.Context) (bool, error)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// HandlerOptions required to create a new ACME API request handler.
|
|
|
|
|
type HandlerOptions struct {
|
|
|
|
|
Backdate provisioner.Duration
|
|
|
|
|
// DB storage backend that impements the acme.DB interface.
|
|
|
|
|
//
|
|
|
|
|
// Deprecated: use acme.NewContex(context.Context, acme.DB)
|
|
|
|
|
DB acme.DB
|
|
|
|
|
|
|
|
|
|
// CA is the certificate authority interface.
|
|
|
|
|
//
|
|
|
|
|
// Deprecated: use authority.NewContext(context.Context, *authority.Authority)
|
|
|
|
|
CA acme.CertificateAuthority
|
|
|
|
|
|
|
|
|
|
// Backdate is the duration that the CA will substract from the current time
|
|
|
|
|
// to set the NotBefore in the certificate.
|
|
|
|
|
Backdate provisioner.Duration
|
|
|
|
|
|
|
|
|
|
// DNS the host used to generate accurate ACME links. By default the authority
|
|
|
|
|
// will use the Host from the request, so this value will only be used if
|
|
|
|
|
// request.Host is empty.
|
|
|
|
|
DNS string
|
|
|
|
|
|
|
|
|
|
// Prefix is a URL path prefix under which the ACME api is served. This
|
|
|
|
|
// prefix is required to generate accurate ACME links.
|
|
|
|
|
// E.g. https://ca.smallstep.com/acme/my-acme-provisioner/new-account --
|
|
|
|
|
// "acme" is the prefix from which the ACME api is accessed.
|
|
|
|
|
Prefix string
|
|
|
|
|
CA acme.CertificateAuthority
|
|
|
|
|
|
|
|
|
|
// PrerequisitesChecker checks if all prerequisites for serving ACME are
|
|
|
|
|
// met by the CA configuration.
|
|
|
|
|
PrerequisitesChecker func(ctx context.Context) (bool, error)
|
|
|
|
|
|
|
|
|
|
linker Linker
|
|
|
|
|
validateChallengeOptions *acme.ValidateChallengeOptions
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
type optionsKey struct{}
|
|
|
|
|
|
|
|
|
|
func newOptionsContext(ctx context.Context, o *HandlerOptions) context.Context {
|
|
|
|
|
return context.WithValue(ctx, optionsKey{}, o)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func optionsFromContext(ctx context.Context) *HandlerOptions {
|
|
|
|
|
o, ok := ctx.Value(optionsKey{}).(*HandlerOptions)
|
|
|
|
|
if !ok {
|
|
|
|
|
panic("handler options are not in the context")
|
|
|
|
|
}
|
|
|
|
|
return o
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var mustAuthority = func(ctx context.Context) acme.CertificateAuthority {
|
|
|
|
|
return authority.MustFromContext(ctx)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Handler is the ACME API request handler.
|
|
|
|
|
type Handler struct {
|
|
|
|
|
opts *HandlerOptions
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Route traffic and implement the Router interface.
|
|
|
|
|
//
|
|
|
|
|
// Deprecated: Use api.Route(r Router, opts *HandlerOptions)
|
|
|
|
|
func (h *Handler) Route(r api.Router) {
|
|
|
|
|
Route(r, h.opts)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// NewHandler returns a new ACME API handler.
|
|
|
|
|
//
|
|
|
|
|
// Deprecated: Use api.Route(r Router, opts *HandlerOptions)
|
|
|
|
|
func NewHandler(ops HandlerOptions) api.RouterHandler {
|
|
|
|
|
return &Handler{
|
|
|
|
|
opts: &ops,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Route traffic and implement the Router interface.
|
|
|
|
|
func Route(r api.Router, opts *HandlerOptions) {
|
|
|
|
|
// by default all prerequisites are met
|
|
|
|
|
if opts.PrerequisitesChecker == nil {
|
|
|
|
|
opts.PrerequisitesChecker = func(ctx context.Context) (bool, error) {
|
|
|
|
|
return true, nil
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
transport := &http.Transport{
|
|
|
|
|
TLSClientConfig: &tls.Config{
|
|
|
|
|
InsecureSkipVerify: true,
|
|
|
|
@ -83,67 +135,85 @@ func NewHandler(ops HandlerOptions) api.RouterHandler {
|
|
|
|
|
dialer := &net.Dialer{
|
|
|
|
|
Timeout: 30 * time.Second,
|
|
|
|
|
}
|
|
|
|
|
prerequisitesChecker := func(ctx context.Context) (bool, error) {
|
|
|
|
|
// by default all prerequisites are met
|
|
|
|
|
return true, nil
|
|
|
|
|
}
|
|
|
|
|
if ops.PrerequisitesChecker != nil {
|
|
|
|
|
prerequisitesChecker = ops.PrerequisitesChecker
|
|
|
|
|
}
|
|
|
|
|
return &Handler{
|
|
|
|
|
ca: ops.CA,
|
|
|
|
|
db: ops.DB,
|
|
|
|
|
backdate: ops.Backdate,
|
|
|
|
|
linker: NewLinker(ops.DNS, ops.Prefix),
|
|
|
|
|
validateChallengeOptions: &acme.ValidateChallengeOptions{
|
|
|
|
|
HTTPGet: client.Get,
|
|
|
|
|
LookupTxt: net.LookupTXT,
|
|
|
|
|
TLSDial: func(network, addr string, config *tls.Config) (*tls.Conn, error) {
|
|
|
|
|
return tls.DialWithDialer(dialer, network, addr, config)
|
|
|
|
|
},
|
|
|
|
|
|
|
|
|
|
opts.linker = NewLinker(opts.DNS, opts.Prefix)
|
|
|
|
|
opts.validateChallengeOptions = &acme.ValidateChallengeOptions{
|
|
|
|
|
HTTPGet: client.Get,
|
|
|
|
|
LookupTxt: net.LookupTXT,
|
|
|
|
|
TLSDial: func(network, addr string, config *tls.Config) (*tls.Conn, error) {
|
|
|
|
|
return tls.DialWithDialer(dialer, network, addr, config)
|
|
|
|
|
},
|
|
|
|
|
prerequisitesChecker: prerequisitesChecker,
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Route traffic and implement the Router interface.
|
|
|
|
|
func (h *Handler) Route(r api.Router) {
|
|
|
|
|
getPath := h.linker.GetUnescapedPathSuffix
|
|
|
|
|
// Standard ACME API
|
|
|
|
|
r.MethodFunc("GET", getPath(NewNonceLinkType, "{provisionerID}"), h.baseURLFromRequest(h.lookupProvisioner(h.checkPrerequisites(h.addNonce(h.addDirLink(h.GetNonce))))))
|
|
|
|
|
r.MethodFunc("HEAD", getPath(NewNonceLinkType, "{provisionerID}"), h.baseURLFromRequest(h.lookupProvisioner(h.checkPrerequisites(h.addNonce(h.addDirLink(h.GetNonce))))))
|
|
|
|
|
r.MethodFunc("GET", getPath(DirectoryLinkType, "{provisionerID}"), h.baseURLFromRequest(h.lookupProvisioner(h.checkPrerequisites(h.GetDirectory))))
|
|
|
|
|
r.MethodFunc("HEAD", getPath(DirectoryLinkType, "{provisionerID}"), h.baseURLFromRequest(h.lookupProvisioner(h.checkPrerequisites(h.GetDirectory))))
|
|
|
|
|
withOptions := func(next nextHTTP) nextHTTP {
|
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
ctx := r.Context()
|
|
|
|
|
|
|
|
|
|
// For backward compatibility with NewHandler.
|
|
|
|
|
if ca, ok := opts.CA.(*authority.Authority); ok && ca != nil {
|
|
|
|
|
ctx = authority.NewContext(ctx, ca)
|
|
|
|
|
}
|
|
|
|
|
if opts.DB != nil {
|
|
|
|
|
ctx = acme.NewContext(ctx, opts.DB)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ctx = newOptionsContext(ctx, opts)
|
|
|
|
|
next(w, r.WithContext(ctx))
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
validatingMiddleware := func(next nextHTTP) nextHTTP {
|
|
|
|
|
return h.baseURLFromRequest(h.lookupProvisioner(h.checkPrerequisites(h.addNonce(h.addDirLink(h.verifyContentType(h.parseJWS(h.validateJWS(next))))))))
|
|
|
|
|
return withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(verifyContentType(parseJWS(validateJWS(next)))))))))
|
|
|
|
|
}
|
|
|
|
|
extractPayloadByJWK := func(next nextHTTP) nextHTTP {
|
|
|
|
|
return validatingMiddleware(h.extractJWK(h.verifyAndExtractJWSPayload(next)))
|
|
|
|
|
return withOptions(validatingMiddleware(extractJWK(verifyAndExtractJWSPayload(next))))
|
|
|
|
|
}
|
|
|
|
|
extractPayloadByKid := func(next nextHTTP) nextHTTP {
|
|
|
|
|
return validatingMiddleware(h.lookupJWK(h.verifyAndExtractJWSPayload(next)))
|
|
|
|
|
return withOptions(validatingMiddleware(lookupJWK(verifyAndExtractJWSPayload(next))))
|
|
|
|
|
}
|
|
|
|
|
extractPayloadByKidOrJWK := func(next nextHTTP) nextHTTP {
|
|
|
|
|
return validatingMiddleware(h.extractOrLookupJWK(h.verifyAndExtractJWSPayload(next)))
|
|
|
|
|
return withOptions(validatingMiddleware(extractOrLookupJWK(verifyAndExtractJWSPayload(next))))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
r.MethodFunc("POST", getPath(NewAccountLinkType, "{provisionerID}"), extractPayloadByJWK(h.NewAccount))
|
|
|
|
|
r.MethodFunc("POST", getPath(AccountLinkType, "{provisionerID}", "{accID}"), extractPayloadByKid(h.GetOrUpdateAccount))
|
|
|
|
|
r.MethodFunc("POST", getPath(KeyChangeLinkType, "{provisionerID}", "{accID}"), extractPayloadByKid(h.NotImplemented))
|
|
|
|
|
r.MethodFunc("POST", getPath(NewOrderLinkType, "{provisionerID}"), extractPayloadByKid(h.NewOrder))
|
|
|
|
|
r.MethodFunc("POST", getPath(OrderLinkType, "{provisionerID}", "{ordID}"), extractPayloadByKid(h.isPostAsGet(h.GetOrder)))
|
|
|
|
|
r.MethodFunc("POST", getPath(OrdersByAccountLinkType, "{provisionerID}", "{accID}"), extractPayloadByKid(h.isPostAsGet(h.GetOrdersByAccountID)))
|
|
|
|
|
r.MethodFunc("POST", getPath(FinalizeLinkType, "{provisionerID}", "{ordID}"), extractPayloadByKid(h.FinalizeOrder))
|
|
|
|
|
r.MethodFunc("POST", getPath(AuthzLinkType, "{provisionerID}", "{authzID}"), extractPayloadByKid(h.isPostAsGet(h.GetAuthorization)))
|
|
|
|
|
r.MethodFunc("POST", getPath(ChallengeLinkType, "{provisionerID}", "{authzID}", "{chID}"), extractPayloadByKid(h.GetChallenge))
|
|
|
|
|
r.MethodFunc("POST", getPath(CertificateLinkType, "{provisionerID}", "{certID}"), extractPayloadByKid(h.isPostAsGet(h.GetCertificate)))
|
|
|
|
|
r.MethodFunc("POST", getPath(RevokeCertLinkType, "{provisionerID}"), extractPayloadByKidOrJWK(h.RevokeCert))
|
|
|
|
|
getPath := opts.linker.GetUnescapedPathSuffix
|
|
|
|
|
|
|
|
|
|
// Standard ACME API
|
|
|
|
|
r.MethodFunc("GET", getPath(NewNonceLinkType, "{provisionerID}"),
|
|
|
|
|
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(GetNonce)))))))
|
|
|
|
|
r.MethodFunc("HEAD", getPath(NewNonceLinkType, "{provisionerID}"),
|
|
|
|
|
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(addNonce(addDirLink(GetNonce)))))))
|
|
|
|
|
r.MethodFunc("GET", getPath(DirectoryLinkType, "{provisionerID}"),
|
|
|
|
|
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(GetDirectory)))))
|
|
|
|
|
r.MethodFunc("HEAD", getPath(DirectoryLinkType, "{provisionerID}"),
|
|
|
|
|
withOptions(baseURLFromRequest(lookupProvisioner(checkPrerequisites(GetDirectory)))))
|
|
|
|
|
|
|
|
|
|
r.MethodFunc("POST", getPath(NewAccountLinkType, "{provisionerID}"),
|
|
|
|
|
extractPayloadByJWK(NewAccount))
|
|
|
|
|
r.MethodFunc("POST", getPath(AccountLinkType, "{provisionerID}", "{accID}"),
|
|
|
|
|
extractPayloadByKid(GetOrUpdateAccount))
|
|
|
|
|
r.MethodFunc("POST", getPath(KeyChangeLinkType, "{provisionerID}", "{accID}"),
|
|
|
|
|
extractPayloadByKid(NotImplemented))
|
|
|
|
|
r.MethodFunc("POST", getPath(NewOrderLinkType, "{provisionerID}"),
|
|
|
|
|
extractPayloadByKid(NewOrder))
|
|
|
|
|
r.MethodFunc("POST", getPath(OrderLinkType, "{provisionerID}", "{ordID}"),
|
|
|
|
|
extractPayloadByKid(isPostAsGet(GetOrder)))
|
|
|
|
|
r.MethodFunc("POST", getPath(OrdersByAccountLinkType, "{provisionerID}", "{accID}"),
|
|
|
|
|
extractPayloadByKid(isPostAsGet(GetOrdersByAccountID)))
|
|
|
|
|
r.MethodFunc("POST", getPath(FinalizeLinkType, "{provisionerID}", "{ordID}"),
|
|
|
|
|
extractPayloadByKid(FinalizeOrder))
|
|
|
|
|
r.MethodFunc("POST", getPath(AuthzLinkType, "{provisionerID}", "{authzID}"),
|
|
|
|
|
extractPayloadByKid(isPostAsGet(GetAuthorization)))
|
|
|
|
|
r.MethodFunc("POST", getPath(ChallengeLinkType, "{provisionerID}", "{authzID}", "{chID}"),
|
|
|
|
|
extractPayloadByKid(GetChallenge))
|
|
|
|
|
r.MethodFunc("POST", getPath(CertificateLinkType, "{provisionerID}", "{certID}"),
|
|
|
|
|
extractPayloadByKid(isPostAsGet(GetCertificate)))
|
|
|
|
|
r.MethodFunc("POST", getPath(RevokeCertLinkType, "{provisionerID}"),
|
|
|
|
|
extractPayloadByKidOrJWK(RevokeCert))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// GetNonce just sets the right header since a Nonce is added to each response
|
|
|
|
|
// by middleware by default.
|
|
|
|
|
func (h *Handler) GetNonce(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func GetNonce(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
if r.Method == "HEAD" {
|
|
|
|
|
w.WriteHeader(http.StatusOK)
|
|
|
|
|
} else {
|
|
|
|
@ -179,8 +249,10 @@ func (d *Directory) ToLog() (interface{}, error) {
|
|
|
|
|
|
|
|
|
|
// GetDirectory is the ACME resource for returning a directory configuration
|
|
|
|
|
// for client configuration.
|
|
|
|
|
func (h *Handler) GetDirectory(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func GetDirectory(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
ctx := r.Context()
|
|
|
|
|
o := optionsFromContext(ctx)
|
|
|
|
|
|
|
|
|
|
acmeProv, err := acmeProvisionerFromContext(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, err)
|
|
|
|
@ -188,11 +260,11 @@ func (h *Handler) GetDirectory(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
render.JSON(w, &Directory{
|
|
|
|
|
NewNonce: h.linker.GetLink(ctx, NewNonceLinkType),
|
|
|
|
|
NewAccount: h.linker.GetLink(ctx, NewAccountLinkType),
|
|
|
|
|
NewOrder: h.linker.GetLink(ctx, NewOrderLinkType),
|
|
|
|
|
RevokeCert: h.linker.GetLink(ctx, RevokeCertLinkType),
|
|
|
|
|
KeyChange: h.linker.GetLink(ctx, KeyChangeLinkType),
|
|
|
|
|
NewNonce: o.linker.GetLink(ctx, NewNonceLinkType),
|
|
|
|
|
NewAccount: o.linker.GetLink(ctx, NewAccountLinkType),
|
|
|
|
|
NewOrder: o.linker.GetLink(ctx, NewOrderLinkType),
|
|
|
|
|
RevokeCert: o.linker.GetLink(ctx, RevokeCertLinkType),
|
|
|
|
|
KeyChange: o.linker.GetLink(ctx, KeyChangeLinkType),
|
|
|
|
|
Meta: Meta{
|
|
|
|
|
ExternalAccountRequired: acmeProv.RequireEAB,
|
|
|
|
|
},
|
|
|
|
@ -201,19 +273,22 @@ func (h *Handler) GetDirectory(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
|
|
|
|
|
// NotImplemented returns a 501 and is generally a placeholder for functionality which
|
|
|
|
|
// MAY be added at some point in the future but is not in any way a guarantee of such.
|
|
|
|
|
func (h *Handler) NotImplemented(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func NotImplemented(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
render.Error(w, acme.NewError(acme.ErrorNotImplementedType, "this API is not implemented"))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// GetAuthorization ACME api for retrieving an Authz.
|
|
|
|
|
func (h *Handler) GetAuthorization(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func GetAuthorization(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
ctx := r.Context()
|
|
|
|
|
o := optionsFromContext(ctx)
|
|
|
|
|
db := acme.MustFromContext(ctx)
|
|
|
|
|
|
|
|
|
|
acc, err := accountFromContext(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, err)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
az, err := h.db.GetAuthorization(ctx, chi.URLParam(r, "authzID"))
|
|
|
|
|
az, err := db.GetAuthorization(ctx, chi.URLParam(r, "authzID"))
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error retrieving authorization"))
|
|
|
|
|
return
|
|
|
|
@ -223,20 +298,23 @@ func (h *Handler) GetAuthorization(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
"account '%s' does not own authorization '%s'", acc.ID, az.ID))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
if err = az.UpdateStatus(ctx, h.db); err != nil {
|
|
|
|
|
if err = az.UpdateStatus(ctx, db); err != nil {
|
|
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error updating authorization status"))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
h.linker.LinkAuthorization(ctx, az)
|
|
|
|
|
o.linker.LinkAuthorization(ctx, az)
|
|
|
|
|
|
|
|
|
|
w.Header().Set("Location", h.linker.GetLink(ctx, AuthzLinkType, az.ID))
|
|
|
|
|
w.Header().Set("Location", o.linker.GetLink(ctx, AuthzLinkType, az.ID))
|
|
|
|
|
render.JSON(w, az)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// GetChallenge ACME api for retrieving a Challenge.
|
|
|
|
|
func (h *Handler) GetChallenge(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func GetChallenge(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
ctx := r.Context()
|
|
|
|
|
o := optionsFromContext(ctx)
|
|
|
|
|
db := acme.MustFromContext(ctx)
|
|
|
|
|
|
|
|
|
|
acc, err := accountFromContext(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, err)
|
|
|
|
@ -257,7 +335,7 @@ func (h *Handler) GetChallenge(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
// we'll just ignore the body.
|
|
|
|
|
|
|
|
|
|
azID := chi.URLParam(r, "authzID")
|
|
|
|
|
ch, err := h.db.GetChallenge(ctx, chi.URLParam(r, "chID"), azID)
|
|
|
|
|
ch, err := db.GetChallenge(ctx, chi.URLParam(r, "chID"), azID)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error retrieving challenge"))
|
|
|
|
|
return
|
|
|
|
@ -273,29 +351,31 @@ func (h *Handler) GetChallenge(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
render.Error(w, err)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
if err = ch.Validate(ctx, h.db, jwk, h.validateChallengeOptions); err != nil {
|
|
|
|
|
if err = ch.Validate(ctx, db, jwk, o.validateChallengeOptions); err != nil {
|
|
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error validating challenge"))
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
h.linker.LinkChallenge(ctx, ch, azID)
|
|
|
|
|
o.linker.LinkChallenge(ctx, ch, azID)
|
|
|
|
|
|
|
|
|
|
w.Header().Add("Link", link(h.linker.GetLink(ctx, AuthzLinkType, azID), "up"))
|
|
|
|
|
w.Header().Set("Location", h.linker.GetLink(ctx, ChallengeLinkType, azID, ch.ID))
|
|
|
|
|
w.Header().Add("Link", link(o.linker.GetLink(ctx, AuthzLinkType, azID), "up"))
|
|
|
|
|
w.Header().Set("Location", o.linker.GetLink(ctx, ChallengeLinkType, azID, ch.ID))
|
|
|
|
|
render.JSON(w, ch)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// GetCertificate ACME api for retrieving a Certificate.
|
|
|
|
|
func (h *Handler) GetCertificate(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
func GetCertificate(w http.ResponseWriter, r *http.Request) {
|
|
|
|
|
ctx := r.Context()
|
|
|
|
|
db := acme.MustFromContext(ctx)
|
|
|
|
|
|
|
|
|
|
acc, err := accountFromContext(ctx)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, err)
|
|
|
|
|
return
|
|
|
|
|
}
|
|
|
|
|
certID := chi.URLParam(r, "certID")
|
|
|
|
|
|
|
|
|
|
cert, err := h.db.GetCertificate(ctx, certID)
|
|
|
|
|
certID := chi.URLParam(r, "certID")
|
|
|
|
|
cert, err := db.GetCertificate(ctx, certID)
|
|
|
|
|
if err != nil {
|
|
|
|
|
render.Error(w, acme.WrapErrorISE(err, "error retrieving certificate"))
|
|
|
|
|
return
|
|
|
|
|