// Init initializes the CA with the given configuration.
Init initializes the CA with the given configuration.
// Init initializes the CA with the given configuration .
func (ca *CA) Init(config *authority.Config) (*CA, error) {
	if len(ca.opts.password) > 0 {
		ca.config.Password = string(ca.opts.password)
	}
	if len(ca.opts.issuerPassword) > 0 {
		if ca.config.AuthorityConfig != nil && ca.config.AuthorityConfig.CertificateIssuer != nil {
			ca.config.AuthorityConfig.CertificateIssuer.Password = string(ca.opts.issuerPassword)
		}
	}
	var opts []authority.Option
	if ca.opts.database != nil {
		opts = append(opts, authority.WithDatabase(ca.opts.database))
	}
	auth, err := authority.New(config, opts...)
	if err != nil {
		return nil, err
	}
	ca.auth = auth
	tlsConfig, err := ca.getTLSConfig(auth)
	if err != nil {
		return nil, err
	}
	mux := chi.NewRouter()
	handler := http.Handler(mux)
	insecureMux := chi.NewRouter()
	insecureHandler := http.Handler(insecureMux)
	routerHandler := api.New(auth)
	routerHandler.Route(mux)
	mux.Route("/1.0", func(r chi.Router) {
		routerHandler.Route(r)
	})
	dns := config.DNSNames[0]
	u, err := url.Parse("https://" + config.Address)
	if err != nil {
		return nil, err
	}
	port := u.Port()
	if port != "" && port != "443" {
		dns = fmt.Sprintf("%s:%s", dns, port)
	}
	prefix := "acme"
	var acmeDB acme.DB
	if config.DB == nil {
		acmeDB = nil
	} else {
		acmeDB, err = acmeNoSQL.New(auth.GetDatabase().(nosql.DB))
		if err != nil {
			return nil, errors.Wrap(err, "error configuring ACME DB interface")
		}
	}
	acmeHandler := acmeAPI.NewHandler(acmeAPI.HandlerOptions{
		Backdate: *config.AuthorityConfig.Backdate,
		DB:       acmeDB,
		DNS:      dns,
		Prefix:   prefix,
		CA:       auth,
	})
	mux.Route("/"+prefix, func(r chi.Router) {
		acmeHandler.Route(r)
	})
	mux.Route("/2.0/"+prefix, func(r chi.Router) {
		acmeHandler.Route(r)
	})
	if ca.shouldServeSCEPEndpoints() {
		scepPrefix := "scep"
		scepAuthority, err := scep.New(auth, scep.AuthorityOptions{
			Service: auth.GetSCEPService(),
			DNS:     dns,
			Prefix:  scepPrefix,
		})
		if err != nil {
			return nil, errors.Wrap(err, "error creating SCEP authority")
		}
		scepRouterHandler := scepAPI.New(scepAuthority)
		insecureMux.Route("/"+scepPrefix, func(r chi.Router) {
			scepRouterHandler.Route(r)
		})
		mux.Route("/"+scepPrefix, func(r chi.Router) {
			scepRouterHandler.Route(r)
		})
	}
	if len(config.Monitoring) > 0 {
		m, err := monitoring.New(config.Monitoring)
		if err != nil {
			return nil, err
		}
		handler = m.Middleware(handler)
		insecureHandler = m.Middleware(insecureHandler)
	}
	if len(config.Logger) > 0 {
		logger, err := logging.New("ca", config.Logger)
		if err != nil {
			return nil, err
		}
		handler = logger.Middleware(handler)
		insecureHandler = logger.Middleware(insecureHandler)
	}
	ca.srv = server.New(config.Address, handler, tlsConfig)
	if ca.shouldServeSCEPEndpoints() && config.InsecureAddress != "" {
		ca.insecureSrv = server.New(config.InsecureAddress, insecureHandler, nil)
	}
	return ca, nil
}
func ( ca * CA ) Init ( config * authority . Config ) ( * CA , error ) { if len ( ca . opts . password ) > 0 { ca . config . Password = string ( ca . opts . password ) } if len ( ca . opts . issuerPassword ) > 0 { if ca . config . AuthorityConfig != nil && ca . config . AuthorityConfig . CertificateIssuer != nil { ca . config . AuthorityConfig . CertificateIssuer . Password = string ( ca . opts . issuerPassword ) } } var opts [ ] authority . Option if ca . opts . database != nil { opts = append ( opts , authority . WithDatabase ( ca . opts . database ) ) } auth , err := authority . New ( config , opts ... ) if err != nil { return nil , err } ca . auth = auth tlsConfig , err := ca . getTLSConfig ( auth ) if err != nil { return nil , err } mux := chi . NewRouter ( ) handler := http . Handler ( mux ) insecureMux := chi . NewRouter ( ) insecureHandler := http . Handler ( insecureMux ) routerHandler := api . New ( auth ) routerHandler . Route ( mux ) mux . Route ( " " , func ( r chi . Router ) { routerHandler . Route ( r ) } ) dns := config . DNSNames [ 0 ] u , err := url . Parse ( " " + config . Address ) if err != nil { return nil , err } port := u . Port ( ) if port != " " && port != " " { dns = fmt . Sprintf ( " " , dns , port ) } prefix := " " var acmeDB acme . DB if config . DB == nil { acmeDB = nil } else { acmeDB , err = acmeNoSQL . New ( auth . GetDatabase ( ) . ( nosql . DB ) ) if err != nil { return nil , errors . Wrap ( err , " " ) } } acmeHandler := acmeAPI . NewHandler ( acmeAPI . HandlerOptions { Backdate : * config . AuthorityConfig . Backdate , DB : acmeDB , DNS : dns , Prefix : prefix , CA : auth , } ) mux . Route ( " " + prefix , func ( r chi . Router ) { acmeHandler . Route ( r ) } ) mux . Route ( " " + prefix , func ( r chi . Router ) { acmeHandler . Route ( r ) } ) if ca . shouldServeSCEPEndpoints ( ) { scepPrefix := " " scepAuthority , err := scep . New ( auth , scep . AuthorityOptions { Service : auth . GetSCEPService ( ) , DNS : dns , Prefix : scepPrefix , } ) if err != nil { return nil , errors . Wrap ( err , " " ) } scepRouterHandler := scepAPI . New ( scepAuthority ) insecureMux . Route ( " " + scepPrefix , func ( r chi . Router ) { scepRouterHandler . Route ( r ) } ) mux . Route ( " " + scepPrefix , func ( r chi . Router ) { scepRouterHandler . Route ( r ) } ) } if len ( config . Monitoring ) > 0 { m , err := monitoring . New ( config . Monitoring ) if err != nil { return nil , err } handler = m . Middleware ( handler ) insecureHandler = m . Middleware ( insecureHandler ) } if len ( config . Logger ) > 0 { logger , err := logging . New ( " " , config . Logger ) if err != nil { return nil , err } handler = logger . Middleware ( handler ) insecureHandler = logger . Middleware ( insecureHandler ) } ca . srv = server . New ( config . Address , handler , tlsConfig ) if ca . shouldServeSCEPEndpoints ( ) && config . InsecureAddress != " " { ca . insecureSrv = server . New ( config . InsecureAddress , insecureHandler , nil ) } return ca , nil }
Init initializes the CA with the given configuration.
Init initializes the CA with the given configuration .
// Intermediate Password. // Certificate issuer password for RA mode. // Using chi as the main router // Add regular CA api endpoints in / and /1.0 //Add ACME api endpoints in /acme and /1.0/acme // Use 2.0 because, at the moment, our ACME api is only compatible with v2.0 // of the ACME spec. // According to the RFC (https://tools.ietf.org/html/rfc8894#section-7.10), // SCEP operations are performed using HTTP, so that's why the API is mounted // to the insecure mux. // The RFC also mentions usage of HTTPS, but seems to advise // against it, because of potential interoperability issues. // Currently I think it's not bad to use HTTPS also, so that's // why I've kept the API endpoints in both muxes and both HTTP // as well as HTTPS can be used to request certificates // using SCEP. // helpful routine for logging all routes //dumpRoutes(mux) // Add monitoring if configured // Add logger if configured // only start the insecure server if the insecure address is configured // and, currently, also only when it should serve SCEP endpoints. // TODO: instead opt for having a single server.Server but two // http.Servers handling the HTTP and HTTPS handler? The latter // will probably introduce more complexity in terms of graceful // reload.