Golang acmeapi.Client類代碼示例

// Using the given client and interactor (or interaction.Auto if nil), register
// the client account if it does not already exist.
//
// The interactor is used to prompt for terms of service agreement, if
// agreement has not already been obtained. An e. mail address is prompted for.
func AssistedUpsertRegistration(cl *acmeapi.Client, interactor interaction.Interactor, ctx context.Context) error {
	interactor = defaultInteraction(interactor)

	email := ""

	for {
		err := cl.AgreeRegistration(ctx)
		if err != nil {
			if e, ok := err.(*acmeapi.AgreementError); ok {
				res, err := interactor.Prompt(&interaction.Challenge{
					Title:        "Terms of Service Agreement Required",
					YesLabel:     "I Agree",
					NoLabel:      "Cancel",
					ResponseType: interaction.RTYesNo,
					UniqueID:     "acme-agreement:" + e.URI,
					Prompt:       "Do you agree to the Terms of Service?",
					Body: fmt.Sprintf(`You must agree to the terms of service at the following URL to continue:

%s

Do you agree to the terms of service set out in the above document?`, e.URI),
				})
				if err != nil {
					return err
				}
				if !res.Cancelled {
					if email == "" {
						email, err = getEmail(interactor)
						if err != nil {
							return err
						}
						if email == "-" {
							return fmt.Errorf("e. mail input cancelled")
						}
					}

					if cl.AccountInfo.AgreementURIs == nil {
						cl.AccountInfo.AgreementURIs = map[string]struct{}{}
					}
					cl.AccountInfo.AgreementURIs[e.URI] = struct{}{}
					if email != "" {
						cl.AccountInfo.ContactURIs = []string{"mailto:" + email}
					}
					continue
				}
			}
		}

		return err
	}
}

func (r *reconcile) revokeCertificateInner(c *storage.Certificate) error {
	if len(c.Certificates) == 0 {
		return fmt.Errorf("no certificates in certificate to revoke: %v", c)
	}

	endCertificate := c.Certificates[0]

	crt, err := x509.ParseCertificate(endCertificate)
	if err != nil {
		return err
	}

	// Get the endpoint which issued the certificate.
	endpoint, err := acmeendpoints.CertificateToEndpoint(r.getGenericClient(), crt, context.TODO())
	if err != nil {
		return fmt.Errorf("could not map certificate %v to endpoint: %v", c, err)
	}

	// In order to revoke a certificate, one needs either the private key of the
	// certificate, or the account key with authorizations for all names on the
	// certificate. Try and find the private key first.
	var client *acmeapi.Client
	var revocationKey crypto.PrivateKey
	if c.Key != nil {
		revocationKey = c.Key.PrivateKey
		client = r.getClientForDirectoryURL(endpoint.DirectoryURL)
	}

	if revocationKey == nil {
		acct, err := r.getAccountByDirectoryURL(endpoint.DirectoryURL)
		if err != nil {
			return err
		}

		client = r.getClientForAccount(acct)

		// If we have no private key for the certificate, obtain all necessary
		// authorizations.
		err = r.getRevocationAuthorizations(acct, crt)
		if err != nil {
			return err
		}
	}

	return client.Revoke(endCertificate, revocationKey, context.TODO())
}

// The Let's Encrypt state directory format keeps certificates but not their
// URLs. Since boulder uses the serial number to form the URL, we can
// reconstruct the URL. But since not even the provider association is stored,
// we have to guess.
func determineLECertificateURL(certFilename string) (string, error) {
	b, err := ioutil.ReadFile(certFilename)
	if err != nil {
		return "", err
	}

	certs, err := acmeutils.LoadCertificates(b)
	if err != nil {
		return "", err
	}

	if len(certs) == 0 {
		return "", fmt.Errorf("no certs")
	}

	c, err := x509.ParseCertificate(certs[0])
	if err != nil {
		return "", err
	}

	sn := fmt.Sprintf("%036x", c.SerialNumber)
	for u := range knownProviderURLs {
		certURL, err := convertBoulderProviderURLToCertificateURL(u, sn)
		if err != nil {
			continue
		}

		cl := acmeapi.Client{
			DirectoryURL: u,
		}

		crt := acmeapi.Certificate{
			URI: certURL,
		}
		err = cl.LoadCertificate(&crt, context.TODO())
		if err != nil {
			continue
		}

		return certURL, nil
	}

	return "", fmt.Errorf("cannot find certificate URL for %#v (serial %#v)", certFilename, sn)
}

// Given a certificate, tries to determine the certificate URL and definite endpoint.
func CertificateToEndpointURL(cl *acmeapi.Client, cert *x509.Certificate, ctx context.Context) (*Endpoint, string, error) {
	es, certain, err := CertificateToEndpoints(cert)
	if err != nil {
		return nil, "", err
	}

	for _, e := range es {
		if e.certificateURLTemplate == nil {
			continue
		}

		var b bytes.Buffer
		err = e.certificateURLTemplate.Execute(&b, map[string]interface{}{
			"Certificate": cert,
		})
		if err != nil {
			return nil, "", err
		}

		u := b.String()
		if !certain {
			// Check that this is the right endpoint via an HTTP request.
			acrt := acmeapi.Certificate{
				URI: u,
			}

			err := cl.LoadCertificate(&acrt, ctx)
			if err != nil {
				continue
			}

			// check that the certificate DER matches
			if !bytes.Equal(acrt.Certificate, cert.Raw) {
				continue
			}
		}

		return e, u, nil
	}

	return nil, "", ErrNotFound
}

// Completes a given challenge, polling it until it is complete. Can be
// cancelled using ctx.
//
// dnsName is the hostname which is being authorized. webPaths and priorKeyFunc
// are passed to responders.
//
// The return value indicates whether the whole authorization has been invalidated
// (set to "failed" status) as a result of an error. In this case a new authorization
// must be created.
func CompleteChallenge(c *acmeapi.Client, ch *acmeapi.Challenge, dnsName string, ccfg responder.ChallengeConfig, ctx context.Context) (invalidated bool, err error) {
	log.Debugf("attempting challenge type %s", ch.Type)

	var certs [][]byte
	for _, c := range ch.Certs {
		certs = append(certs, c)
	}

	r, err := responder.New(responder.Config{
		Type:                   ch.Type,
		Token:                  ch.Token,
		AccountKey:             c.AccountKey,
		Hostname:               dnsName,
		AcceptableCertificates: certs,
		ChallengeConfig:        ccfg,
	})

	if err != nil {
		log.Debuge(err, "challenge instantiation failed")
		return false, err
	}

	err = r.Start()
	if err != nil {
		log.Debuge(err, "challenge start failed")
		return false, err
	}

	defer r.Stop()

	err = c.RespondToChallenge(ch, r.Validation(), r.ValidationSigningKey(), ctx)
	if err != nil {
		return false /* ??? */, err
	}

	b := denet.Backoff{
		InitialDelay: 5 * time.Second,
		MaxDelay:     30 * time.Second,
	}

	for {
		log.Debug("waiting to poll challenge")
		select {
		case <-ctx.Done():
			return true, ctx.Err()
		case <-r.RequestDetectedChan():
			log.Debug("request detected")
		case <-time.After(b.NextDelay()):
		}

		log.Debug("querying challenge status")
		err := c.WaitLoadChallenge(ch, ctx)
		if err != nil {
			return false, err
		}

		if ch.Status.Final() {
			log.Debug("challenge now in final state")
			break
		}
	}

	if ch.Status != "valid" {
		return true, fmt.Errorf("challenge failed with status %#v", ch.Status)
	}

	return false, nil
}

func (s *Store) downloadCertificate(c *Certificate) error {
	log.Debugf("downloading certificate %v", c)

	col := s.db.Collection("certs/" + c.ID())
	if col == nil {
		return fmt.Errorf("cannot get collection")
	}

	cl := acmeapi.Client{}

	crt := acmeapi.Certificate{
		URI: c.URL,
	}

	err := cl.WaitForCertificate(&crt, context.TODO())
	if err != nil {
		return err
	}

	if len(crt.Certificate) == 0 {
		return fmt.Errorf("nil certificate?")
	}

	fcert, err := col.Create("cert")
	if err != nil {
		return err
	}
	defer fcert.CloseAbort()

	fchain, err := col.Create("chain")
	if err != nil {
		return err
	}
	defer fchain.CloseAbort()

	ffullchain, err := col.Create("fullchain")
	if err != nil {
		return err
	}
	defer ffullchain.CloseAbort()

	err = pem.Encode(io.MultiWriter(fcert, ffullchain), &pem.Block{
		Type:  "CERTIFICATE",
		Bytes: crt.Certificate,
	})
	if err != nil {
		return err
	}

	for _, ec := range crt.ExtraCertificates {
		err = pem.Encode(io.MultiWriter(fchain, ffullchain), &pem.Block{
			Type:  "CERTIFICATE",
			Bytes: ec,
		})
		if err != nil {
			return err
		}
	}

	fcert.Close()
	fchain.Close()
	ffullchain.Close()

	c.Certificates = nil
	c.Certificates = append(c.Certificates, crt.Certificate)
	c.Certificates = append(c.Certificates, crt.ExtraCertificates...)
	c.Cached = true

	return nil
}