rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove decrypt key by default

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-10-02 00:32:48 +02:00
parent 17ea259d8d
commit a2485ec6fa
6 changed files with 94 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/certmanager/cache_store.go
View File

@@ -99,15 +99,20 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
return fmt.Errorf("cannot load domain with decrypted values: %w", err)
}
if loadedDomain.SSLCertificate == nil {
return fmt.Errorf("domain has no parsed certificate")
if err := loadedDomain.ParseCertificate(w.encryptionKey); err != nil {
return fmt.Errorf("cannot parse certificate: %w", err)
}
if len(loadedDomain.SSLCertificatePEM) == 0 {
return fmt.Errorf("domain has no certificate PEM")
}
if len(loadedDomain.SSLPrivateKeyPEM) == 0 {
privateKeyPEM, err := loadedDomain.DecryptPrivateKey(w.encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt private key: %w", err)
}
if len(privateKeyPEM) == 0 {
return fmt.Errorf("domain has no private key PEM")
}
@@ -122,7 +127,7 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
cache := &coredata.CachedCertificate{
Domain: loadedDomain.Domain,
CertificatePEM: string(loadedDomain.SSLCertificatePEM),
PrivateKeyPEM: string(loadedDomain.SSLPrivateKeyPEM),
PrivateKeyPEM: string(privateKeyPEM),
CertificateChain: loadedDomain.SSLCertificateChain,
ExpiresAt: *loadedDomain.SSLExpiresAt,
CachedAt: time.Now(),

4
pkg/certmanager/provisioner.go
View File

@@ -188,7 +188,9 @@ func (p *Provisioner) provisionDomainCertificate(
}
fullDomain.SSLCertificatePEM = cert.CertPEM
fullDomain.SSLPrivateKeyPEM = cert.KeyPEM
if err := fullDomain.EncryptPrivateKey(cert.KeyPEM, p.encryptionKey); err != nil {
return fmt.Errorf("cannot encrypt private key: %w", err)
}
chainStr := string(cert.ChainPEM)
fullDomain.SSLCertificateChain = &chainStr
fullDomain.SSLExpiresAt = &cert.ExpiresAt

4
pkg/certmanager/renewer.go
View File

@@ -182,7 +182,9 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
)
lockedDomain.SSLCertificatePEM = cert.CertPEM
lockedDomain.SSLPrivateKeyPEM = cert.KeyPEM
if err := lockedDomain.EncryptPrivateKey(cert.KeyPEM, r.encryptionKey); err != nil {
return fmt.Errorf("cannot encrypt private key: %w", err)
}
chainStr := string(cert.ChainPEM)
lockedDomain.SSLCertificateChain = &chainStr
lockedDomain.SSLExpiresAt = &cert.ExpiresAt

15
pkg/certmanager/selector.go
View File

@@ -117,16 +117,21 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
return fmt.Errorf("domain does not have active SSL certificate")
}
if customDomain.SSLCertificate == nil {
return fmt.Errorf("domain has no parsed certificate")
if err := customDomain.ParseCertificate(s.encryptionKey); err != nil {
return fmt.Errorf("cannot parse certificate: %w", err)
}
if len(customDomain.SSLCertificatePEM) == 0 {
return fmt.Errorf("domain has no certificate PEM data")
}
if len(customDomain.SSLPrivateKeyPEM) == 0 {
return fmt.Errorf("domain has no private key PEM data")
if len(customDomain.EncryptedSSLPrivateKey) == 0 {
return fmt.Errorf("domain has no encrypted private key data")
}
privateKeyPEM, err := customDomain.DecryptPrivateKey(s.encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt private key: %w", err)
}
s.cache.Store(domain, customDomain.SSLCertificate)
@@ -134,7 +139,7 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
cache := &coredata.CachedCertificate{
Domain: customDomain.Domain,
CertificatePEM: string(customDomain.SSLCertificatePEM),
PrivateKeyPEM: string(customDomain.SSLPrivateKeyPEM),
PrivateKeyPEM: string(privateKeyPEM),
CertificateChain: customDomain.SSLCertificateChain,
ExpiresAt: *customDomain.SSLExpiresAt,
CachedAt: time.Now(),