mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-28 08:16:28 -04:00
b553969b03
Use TLS-ALPN-01 for Funnel certificate renewals only when the node already has a cached certificate, and fall back to DNS-01 with a fresh order if the ALPN path is unavailable or fails. Dynamically advertise acme-tls/1 only while an ACME challenge certificate is pending, and add client metrics for DNS-01 and TLS-ALPN-01 start/success/failure paths. Updates tailscale/corp#41736 Fixes tailscale/corp#42320 Change-Id: I5adc6ea129237f9ef592f84fc1a8953c80bc9d5c Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
59 lines
1.3 KiB
Go
59 lines
1.3 KiB
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build js || ts_omit_acme
|
|
|
|
package ipnlocal
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
func init() {
|
|
RegisterC2N("GET /tls-cert-status", handleC2NTLSCertStatusDisabled)
|
|
}
|
|
|
|
var errNoCerts = errors.New("cert support not compiled in this build")
|
|
|
|
type TLSCertKeyPair struct {
|
|
CertPEM, KeyPEM []byte
|
|
}
|
|
|
|
func (b *LocalBackend) GetCertPEM(ctx context.Context, domain string) (*TLSCertKeyPair, error) {
|
|
return nil, errNoCerts
|
|
}
|
|
|
|
func serveTLSNextProtos() []string {
|
|
return []string{"h2", "http/1.1"}
|
|
}
|
|
|
|
func (b *LocalBackend) getACMETLSALPNCert(hi *tls.ClientHelloInfo) (*tls.Certificate, bool) {
|
|
return nil, false
|
|
}
|
|
|
|
func (b *LocalBackend) getACMETLSALPNProto(hi *tls.ClientHelloInfo) (string, bool) {
|
|
return "", false
|
|
}
|
|
|
|
var errCertExpired = errors.New("cert expired")
|
|
|
|
type certStore interface{}
|
|
|
|
func getCertPEMCached(cs certStore, domain string, now time.Time) (p *TLSCertKeyPair, err error) {
|
|
return nil, errNoCerts
|
|
}
|
|
|
|
func (b *LocalBackend) getCertStore() (certStore, error) {
|
|
return nil, errNoCerts
|
|
}
|
|
|
|
func handleC2NTLSCertStatusDisabled(b *LocalBackend, w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
io.WriteString(w, `{"Missing":true}`) // a minimal tailcfg.C2NTLSCertInfo
|
|
}
|