Software / code / prosody
Changeset
7122:89c51ee23122
core.certmanager: Look for certificate and key in a few different places
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Wed, 03 Feb 2016 22:44:29 +0100 |
| parents | 7118:dacc07833b86 |
| children | 7123:a7ace4f32080 7125:631c47a65519 |
| files | core/certmanager.lua |
| diffstat | 1 files changed, 28 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/core/certmanager.lua Wed Feb 03 02:07:03 2016 +0100 +++ b/core/certmanager.lua Wed Feb 03 22:44:29 2016 +0100 @@ -23,6 +23,7 @@ local ssl_x509 = ssl.x509 or softreq"ssl.x509"; local ssl_newcontext = ssl.newcontext; local new_config = require"util.sslconfig".new; +local stat = require "lfs".attributes; local tostring = tostring; local pairs = pairs; @@ -50,6 +51,32 @@ -- Global SSL options if not overridden per-host local global_ssl_config = configmanager.get("*", "ssl"); +local global_certificates = configmanager.get("*", "certificates") or "certs"; + +local crt_try = { "", "/%s.crt", "/%s/fullchain.pem", "/%s.pem", }; +local key_try = { "", "/%s.key", "/%s/privkey.pem", "/%s.pem", }; + +local function find_cert(host) + local certs = configmanager.get(host, "certificate") or global_certificates; + certs = resolve_path(config_path, certs); + for i = 1, #crt_try do + local crt_path = certs .. crt_try[i]:format(host); + local key_path = certs .. key_try[i]:format(host); + + if stat(crt_path, "mode") == "file" then + if stat(key_path, "mode") == "file" then + return { certificate = crt_path, key = key_path }; + end + if key_path:sub(-4) == ".crt" then + key_path = key_path:sub(1, -4) .. "key"; + if stat(key_path, "mode") == "file" then + return { certificate = crt_path, key = key_path }; + end + end + end + end +end + -- Built-in defaults local core_defaults = { capath = "/etc/ssl/certs"; @@ -82,6 +109,7 @@ local cfg = new_config(); cfg:apply(core_defaults); cfg:apply(global_ssl_config); + cfg:apply(find_cert(host) or find_cert(host:match("%.(.*)"))); cfg:apply({ mode = mode, -- We can't read the password interactively when daemonized
