1. 17 Mar, 2018 4 commits
  2. 16 Mar, 2018 2 commits
    • Matthew Holt's avatar
      3d01f46e
    • Matthew Holt's avatar
      tls: Support distributed solving of the HTTP-01 challenge · 3a6496c2
      Matthew Holt authored
      Caddy can now obtain certificates when behind load balancers and/or in
      fleet/cluster configurations, without needing any extra configuration.
      The only requirement is sharing the same $CADDYPATH/acme folder.
      This works with the HTTP challenge, whereas before the DNS challenge
      was required. This commit allows one Caddy instance to initiate the
      HTTP challenge and another to complete it.
      
      When sharing that folder, certificate management is synchronized and
      coordinated, without the Caddy instances needing to know about each
      other. No load balancer reconfiguration should be required, either.
      
      Currently, this is only supported when using FileStorage for TLS
      storage (which is ~99.999% of users).
      3a6496c2
  3. 15 Mar, 2018 5 commits
  4. 10 Mar, 2018 1 commit
  5. 21 Feb, 2018 2 commits
  6. 20 Feb, 2018 1 commit
  7. 18 Feb, 2018 2 commits
  8. 17 Feb, 2018 1 commit
  9. 16 Feb, 2018 4 commits
  10. 15 Feb, 2018 4 commits
  11. 14 Feb, 2018 1 commit
  12. 13 Feb, 2018 5 commits
  13. 11 Feb, 2018 2 commits
  14. 04 Feb, 2018 1 commit
    • Matthew Holt's avatar
      tls: Restructure and improve certificate management · fc2ff915
      Matthew Holt authored
      - Expose the list of Caddy instances through caddy.Instances()
      
      - Added arbitrary storage to caddy.Instance
      
      - The cache of loaded certificates is no longer global; now scoped
        per-instance, meaning upon reload (like SIGUSR1) the old cert cache
        will be discarded entirely, whereas before, aggressively reloading
        config that added and removed lots of sites would cause unnecessary
        build-up in the cache over time.
      
      - Key certificates in the cache by their SHA-256 hash instead of
        by their names. This means certificates will not be duplicated in
        memory (within each instance), making Caddy much more memory-efficient
        for large-scale deployments with thousands of sites sharing certs.
      
      - Perform name-to-certificate lookups scoped per caddytls.Config instead
        of a single global lookup. This prevents certificates from stepping on
        each other when they overlap in their names.
      
      - Do not allow TLS configurations keyed by the same hostname to be
        different; this now throws an error.
      
      - Updated relevant tests, with a stark awareness that more tests are
        needed.
      
      - Change the NewContext function signature to include an *Instance.
      
      - Strongly recommend (basically require) use of caddytls.NewConfig()
        to create a new *caddytls.Config, to ensure pointers to the instance
        certificate cache are initialized properly.
      
      - Update the TLS-SNI challenge solver (even though TLS-SNI is disabled
        currently on the CA side). Store temporary challenge cert in instance
        cache, but do so directly by the ACME challenge name, not the hash.
        Modified the getCertificate function to check the cache directly for
        a name match if one isn't found otherwise. This will allow any
        caddytls.Config to be able to help solve a TLS-SNI challenge, with one
        extra side-effect that might actually be kind of interesting (and
        useless): clients could send a certificate's hash as the SNI and
        Caddy would be able to serve that certificate for the handshake.
      
      - Do not attempt to match a "default" (random) certificate when SNI
        is present but unrecognized; return no certificate so a TLS alert
        happens instead.
      
      - Store an Instance in the list of instances even while the instance
        is still starting up (this allows access to the cert cache for
        performing renewals at startup, etc). Will be removed from list again
        if instance startup fails.
      
      - Laid groundwork for ACMEv2 and Let's Encrypt wildcard support.
      
      Server type plugins will need to be updated slightly to accommodate
      minor adjustments to their API (like passing in an Instance). This
      commit includes the changes for the HTTP server.
      
      Certain Caddyfile configurations might error out with this change, if
      they configured different TLS settings for the same hostname.
      
      This change trades some complexity for other complexity, but ultimately
      this new complexity is more correct and robust than earlier logic.
      
      Fixes #1991
      Fixes #1994
      Fixes #1303
      fc2ff915
  15. 03 Feb, 2018 5 commits