DNS challenge for letsencrypt #144
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Teifun2
commented
May 4, 2024
There was a problem hiding this comment.
This is just a helper file, that could be usefull in the future to update the supported list of dns providers. I can also remove it if it is not required.
Teifun2
commented
May 4, 2024
There was a problem hiding this comment.
All Port changes are not required if the challenge is dns based
Teifun2
commented
May 4, 2024
There was a problem hiding this comment.
This is porbably the most danegours line here. I am not sure if this will crash for existing certificates (it should not)
But backwards compatability would need to be checked!
In my current testing setup i had no existing certificates.
There was a problem hiding this comment.
I am not sure about this, but I guess the author for TLS certificate config was by daluntw.
Hi @daluntw , you mind validating if this change here will not cause any problems? Many thanks!
There was a problem hiding this comment.
I mainly do changes in src/mod/acme, the change on this files lgtm, but I do think handleListCertificate can be rewritten, it seems weird now.
I also agree that DNS bool can be more clarify
Teifun2
commented
May 4, 2024
There was a problem hiding this comment.
Many Many dependencies are added due to the different acme-lego providers that are supported
tobychui
reviewed
May 4, 2024
There was a problem hiding this comment.
Thanks for the good work!
I commented a few minor coding style and potential panic problems. Using the environment variable is a sub-optimal implementation, but if it works, it works. 👍🏻 .
As I am not the author of the ACME module, actual test has to be done by @yeungalan before I can merge this. After the merge, I will see if there are any way I could further optimize the UI (maybe an automatic generated form instead of a textarea) and figure out a way to not use the environment variable.
Again, thanks so much for your hard work and clean code!
| isForceHttpsRedirectEnabledOriginally = true | ||
| } | ||
| dnsPara, _ := utils.PostPara(r, "dns") | ||
| if dnsPara == "false" { |
There was a problem hiding this comment.
It would be better also check for if dnsPara == "" (and error), which might occurs if the dns post parameter is missing
There was a problem hiding this comment.
I am not sure about this, but I guess the author for TLS certificate config was by daluntw.
Hi @daluntw , you mind validating if this change here will not cause any problems? Many thanks!
| @@ -46,6 +47,7 @@ func handleListCertificate(w http.ResponseWriter, r *http.Request) { | |||
| LastModifiedDate string | |||
| ExpireDate string | |||
| RemainingDays int | |||
| DNS bool | |||
There was a problem hiding this comment.
Maybe change this to something like RequireDNSValidation or IsDNSCert so future contributor can better sure what this field is for?
| @@ -79,7 +80,7 @@ func NewACME(acmeServer string, port string, database *database.Database) *ACMEH | |||
| } | |||
|
|
|||
| // ObtainCert obtains a certificate for the specified domains. | |||
| func (a *ACMEHandler) ObtainCert(domains []string, certificateName string, email string, caName string, caUrl string, skipTLS bool) (bool, error) { | |||
| func (a *ACMEHandler) ObtainCert(domains []string, certificateName string, email string, caName string, caUrl string, skipTLS bool, dns bool) (bool, error) { | |||
There was a problem hiding this comment.
Same for this new parameter, something like useDNS bool will be better.
| return | ||
| } | ||
|
|
||
| if !a.AcmeHandler.Database.TableExists("acme") { |
There was a problem hiding this comment.
NewTable function will check for if table exists by default. You can directly use NewTable without the need to check if it exists.
| } | ||
|
|
||
| //Filename cannot contain wildcards, and wildcards are possible with DNS challenges | ||
| filename = filename.replace("*", "_"); |
There was a problem hiding this comment.
A backend replacement logic for * to _ is also needed. Only replacing & checking in front-end is a dangerous implementation.
| @@ -357,7 +361,8 @@ <h4 class="ui header" id="acmeAutoRenewer"> | |||
| <td>${entry.Domain}</td> | |||
| <td>${entry.LastModifiedDate}</td> | |||
| <td class="${isExpired?"expired":"valid"} certdate">${entry.ExpireDate} (${!isExpired?entry.RemainingDays+" days left":"Expired"})</td> | |||
| <td><button title="Renew Certificate" class="ui mini basic icon button renewButton" onclick="renewCertificate('${entry.Domain}', this);"><i class="ui green refresh icon"></i></button></td> | |||
| <td><i class="${entry.DNS?"green check": "red times"} circle outline icon"></i></td> | |||
| <td><button title="Renew Certificate" class="ui mini basic icon button renewButton" onclick="renewCertificate('${entry.Domain}', '${entry.DNS}', this);"><i class="ui green refresh icon"></i></button></td> | |||
There was a problem hiding this comment.
If you updated the backend struct field names, remember to change these as well.
I am also not a fan of doing it this way. However it was the only way i found that could support all Providers without any custom implementation. As you can see here there is an implementation that selects the correct DNSChallengeProvider by name: However this always uses the default DNSChallengeProvider constructor. The default constructor implementation always uses environment variables. Each provider also has a constructor with config: However this would require that every proivder we support has customer code to create the configuration, as there is no generic way to fill this sadly. This was my fist time using GO so maybe there is some language feature that could make this possible. But if there is, i am not aware of it! |
|
I build a docker image with your branch @Teifun2 and I can access the DNS challenge option.
Here are the logs: I check another domain where I already generated wildcard certificate with Nginx Proxy Manager + LE and OVH DNS and I don't have any TXT record at _acme-challenge.domain.tld. I directly used lego and I have the same issue so I will check what's the issue with lego/txt record: I tried with certbot dns challenge and it worked well: To verify if the wildcard certificate was valid I tried to import it into zoraxy, that cause a lots of issues terminating by shutting down Zoraxy :D : Crash logsgoroutine 187 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc00272e9a0}, 0xc0041fe900)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc00272e9a0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc00272e9a0}, 0xc0041fe900, 0xc00413fac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc00272e9a0?}, 0xc00413fb30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc00272e9a0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc00272e9a0}, 0xc0041fe900)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc00405af60?}, {0x4854708?, 0xc00272e9a0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc004028f30, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:17 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:17 http: panic serving 86.245.85.216:58614: runtime error: invalid memory address or nil pointer dereference
goroutine 113 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc0025977a0}, 0xc003fa3e60)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc0025977a0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc0025977a0}, 0xc003fa3e60, 0xc00444bac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc0025977a0?}, 0xc00444bb30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc0025977a0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc0025977a0}, 0xc003fa3e60)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003db0d20?}, {0x4854708?, 0xc0025977a0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003db62d0, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58627: runtime error: invalid memory address or nil pointer dereference
goroutine 195 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc00272eb60}, 0xc0041feea0)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc00272eb60?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc00272eb60}, 0xc0041feea0, 0xc004465ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc00272eb60?}, 0xc004465b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc00272eb60?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc00272eb60}, 0xc0041feea0)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc004111ad0?}, {0x4854708?, 0xc00272eb60?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc004029c20, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58616: runtime error: invalid memory address or nil pointer dereference
goroutine 132 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc00272f180}, 0xc0041ff200)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc00272f180?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc00272f180}, 0xc0041ff200, 0xc003f19ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc00272f180?}, 0xc003f19b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc00272f180?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc00272f180}, 0xc0041ff200)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e05d10?}, {0x4854708?, 0xc00272f180?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003e3cc60, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58617: runtime error: invalid memory address or nil pointer dereference
goroutine 110 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc002597960}, 0xc0027a2240)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc002597960?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc002597960}, 0xc0027a2240, 0xc003f1dac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc002597960?}, 0xc003f1db30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc002597960?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc002597960}, 0xc0027a2240)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e059b0?}, {0x4854708?, 0xc002597960?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003e3c5a0, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58619: runtime error: invalid memory address or nil pointer dereference
goroutine 109 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc002597ea0}, 0xc0027a25a0)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc002597ea0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc002597ea0}, 0xc0027a25a0, 0xc003d97ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc002597ea0?}, 0xc003d97b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc002597ea0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc002597ea0}, 0xc0027a25a0)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e05950?}, {0x4854708?, 0xc002597ea0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003e3c510, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58647: runtime error: invalid memory address or nil pointer dereference
goroutine 343 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc00272f6c0}, 0xc0041ff560)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc00272f6c0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc00272f6c0}, 0xc0041ff560, 0xc002107ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc00272f6c0?}, 0xc002107b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc00272f6c0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc00272f6c0}, 0xc0041ff560)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e7c1e0?}, {0x4854708?, 0xc00272f6c0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc0040e9950, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58615: runtime error: invalid memory address or nil pointer dereference
goroutine 112 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc00272fa40}, 0xc0041ff8c0)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc00272fa40?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc00272fa40}, 0xc0041ff8c0, 0xc004447ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc00272fa40?}, 0xc004447b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc00272fa40?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc00272fa40}, 0xc0041ff8c0)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e05800?}, {0x4854708?, 0xc00272fa40?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003e3c6c0, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58618: runtime error: invalid memory address or nil pointer dereference
goroutine 111 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc0027ca0e0}, 0xc0027a2900)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc0027ca0e0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc0027ca0e0}, 0xc0027a2900, 0xc004461ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc0027ca0e0?}, 0xc004461b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc0027ca0e0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc0027ca0e0}, 0xc0027a2900)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e05a40?}, {0x4854708?, 0xc0027ca0e0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc003e3c630, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58648: runtime error: invalid memory address or nil pointer dereference
goroutine 351 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc0027ca460}, 0xc0027a2c60)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc0027ca460?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc0027ca460}, 0xc0027a2c60, 0xc002103ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc0027ca460?}, 0xc002103b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc0027ca460?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc0027ca460}, 0xc0027a2c60)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc003e7de00?}, {0x4854708?, 0xc0027ca460?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc000b6e000, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58684: runtime error: invalid memory address or nil pointer dereference
goroutine 452 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc0027ca7e0}, 0xc0041ffc20)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc0027ca7e0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc0027ca7e0}, 0xc0041ffc20, 0xc004461ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc0027ca7e0?}, 0xc0028e1b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc0027ca7e0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc0027ca7e0}, 0xc0041ffc20)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc0028c4c00?}, {0x4854708?, 0xc0027ca7e0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc004146870, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:44:18 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:44:18 http: panic serving 86.245.85.216:58685: runtime error: invalid memory address or nil pointer dereference
goroutine 445 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc0027caa80}, 0xc0027a3200)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc0027caa80?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001035050, {0x4854708, 0xc0027caa80}, 0xc0027a3200, 0xc004461ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc0027caa80?}, 0xc0028e1b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc0027caa80?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc0027caa80}, 0xc0027a3200)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc00292c660?}, {0x4854708?, 0xc0027caa80?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc004028c60, {0x4858960, 0xc003e04270})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
- Shutting down Zoraxy
- Closing GeoDB
- Closing Netstats Listener
- Netstats listener stopped
- Closing Statistic Collector
- Stopping mDNS Discoverer (might take a few minutes)
- Closing Certificates Auto Renewer
- Cleaning up tmp files
- Closing system wide logger
- Stopping system databaseI started again the Zoraxy container and listing certificates was impossible: Crash logs2024/05/04 12:46:24 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:46:24 http: panic serving 86.245.85.216:58995: runtime error: invalid memory address or nil pointer dereference
goroutine 534 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc004fbd0a0}, 0xc005188a20)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc004fbd0a0?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001058960, {0x4854708, 0xc004fbd0a0}, 0xc005188a20, 0xc004a75ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc004fbd0a0?}, 0xc004a75b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc004fbd0a0?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc004fbd0a0}, 0xc005188a20)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc0050f2f90?}, {0x4854708?, 0xc004fbd0a0?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc004ee1dd0, {0x4858960, 0xc0042d5560})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:46:24 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:46:24 http: panic serving 86.245.85.216:59005: runtime error: invalid memory address or nil pointer dereference
goroutine 524 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc004fbd260}, 0xc00525e240)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc004fbd260?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001058960, {0x4854708, 0xc004fbd260}, 0xc00525e240, 0xc004a75ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc004fbd260?}, 0xc0037f1b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc004fbd260?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc004fbd260}, 0xc00525e240)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc005215710?}, {0x4854708?, 0xc004fbd260?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc005042f30, {0x4858960, 0xc0042d5560})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4
2024/05/04 12:46:24 [Could not Load CertInfoJson] conf/certs/*.plebes.ovh.json
2024/05/04 12:46:24 http: panic serving 86.245.85.216:59007: runtime error: invalid memory address or nil pointer dereference
goroutine 543 [running]:
net/http.(*conn).serve.func1()
/usr/local/go/src/net/http/server.go:1898 +0xbe
panic({0x27975c0?, 0x7250520?})
/usr/local/go/src/runtime/panic.go:770 +0x132
main.handleListCertificate({0x4854708, 0xc004fbd420}, 0xc005188fc0)
/opt/zoraxy/source/cert.go:97 +0x66a
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1.1({0x4854708?, 0xc004fbd420?}, 0x411c9b?)
/opt/zoraxy/source/mod/auth/router.go:42 +0x22
imuslab.com/zoraxy/mod/auth.(*AuthAgent).HandleCheckAuth(0xc001058960, {0x4854708, 0xc004fbd420}, 0xc005188fc0, 0xc004a75ac8)
/opt/zoraxy/source/mod/auth/auth.go:84 +0x4c
imuslab.com/zoraxy/mod/auth.(*RouterDef).HandleFunc.func1({0x4854708?, 0xc004fbd420?}, 0xc0037f1b30?)
/opt/zoraxy/source/mod/auth/router.go:41 +0x58
net/http.HandlerFunc.ServeHTTP(0x72f8b70?, {0x4854708?, 0xc004fbd420?}, 0x72961a?)
/usr/local/go/src/net/http/server.go:2166 +0x29
net/http.(*ServeMux).ServeHTTP(0x470ed9?, {0x4854708, 0xc004fbd420}, 0xc005188fc0)
/usr/local/go/src/net/http/server.go:2683 +0x1ad
net/http.serverHandler.ServeHTTP({0xc0051c2f90?}, {0x4854708?, 0xc004fbd420?}, 0x6?)
/usr/local/go/src/net/http/server.go:3137 +0x8e
net/http.(*conn).serve(0xc0051a6360, {0x4858960, 0xc0042d5560})
/usr/local/go/src/net/http/server.go:2039 +0x5e8
created by net/http.(*Server).Serve in goroutine 1
/usr/local/go/src/net/http/server.go:3285 +0x4b4So I started a new Zoraxy container from scratch and this time it was possible to request a wildcard SSL certificate: Certificate is visible from certificate list:
I created a new reverse proxy to code.plebes.ovh without generating a new SSL cert and it worked well, Zoraxy used the wildcard certificate by default. SSL Labs report: https://www.ssllabs.com/ssltest/analyze.html?d=code.plebes.ovh&latest So it seems everything was due to the fact that Lego doesn't or is not able to update the TXT record found at _acme-challenge from OVH domains. Certbot for its part is able to do it and after this dns update Lego was able to generate the wildcard cetificate. I don't know if this behavior concerns all the domains. Maybe @barto95100 could check this with his own OVH domain to confirm ;) Well deserved @Teifun2 🥇 Moral: don't import wildcard SSL certificate yet :) |
daluntw
reviewed
May 4, 2024
| // Iterate over each line | ||
| for _, line := range lines { | ||
| // Split the line by "=" character | ||
| parts := strings.Split(line, "=") |
There was a problem hiding this comment.
We might want to consider that some value might contain extra '=' such like base64, you can use strings.SplitN(line, "=", 1) to ensure only 2 parts
daluntw
reviewed
May 4, 2024
|
|
||
| // Add the key-value pair to the map | ||
| result[key] = value | ||
| } |
There was a problem hiding this comment.
maybe do some logging or return if extract failed ?
daluntw
reviewed
May 4, 2024
| @@ -391,8 +430,18 @@ func (a *ACMEHandler) HandleRenewCertificate(w http.ResponseWriter, r *http.Requ | |||
| skipTLS = true | |||
| } | |||
|
|
|||
| var dns bool | |||
|
|
|||
| if dnsString, err := utils.PostPara(r, "dns"); err != nil { | |||
There was a problem hiding this comment.
maybe something like
dns := false
if dnsString, err := utils.PostPara(r, "dns"); err == nil && dnsString == "true" {
dns = true
}
will be more easy to read?
There was a problem hiding this comment.
For your information, there is actually a function named PostBool in mod/utils/utils.go 😂
Line 63 in b4c771c
There was a problem hiding this comment.
ah, didn't notice that func exist
we should use PostBool then, it even consider the upper-case
|
@PastaGringo, I test the branch of @Teifun2 this is the log: and result of ssl report:
in browser :
|
|
WL CONF Couple things here
LGTM Ref: https://registry.terraform.io/providers/vancluever/acme/latest/docs/guides/dns-providers-cloudflare#CF_API_KEY
|
yeungalan
approved these changes
May 6, 2024
|
Hi @Teifun2 , you got time recently fixing those commented items above? If no, I can also do it for you after the merge. Updates@yeungalan suggest that these are minor issues and he can fix it himself. So I will just merge it into the main branch and wait for his fixes. Thanks so much for everyone involved! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I implemented the DNS challenge for SSL Certificates. #49
Some things to note:
I used a similar approach to setEAB. The Provider and Credentials are stored in the Database, with the filename of the certificate as key.
This was the only way i found how i could dynamically support all DNS providers without custom code for all of them.
If somone tells me how i can trigger the autorenew to kick in early then i can test this!