rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove decrypt key by default

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-10-02 00:32:48 +02:00
parent 17ea259d8d
commit a2485ec6fa
6 changed files with 94 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/certmanager/cache_store.go
View File

@@ -99,15 +99,20 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
return fmt.Errorf("cannot load domain with decrypted values: %w", err)
}
if loadedDomain.SSLCertificate == nil {
return fmt.Errorf("domain has no parsed certificate")
if err := loadedDomain.ParseCertificate(w.encryptionKey); err != nil {
return fmt.Errorf("cannot parse certificate: %w", err)
}
if len(loadedDomain.SSLCertificatePEM) == 0 {
return fmt.Errorf("domain has no certificate PEM")
}
if len(loadedDomain.SSLPrivateKeyPEM) == 0 {
privateKeyPEM, err := loadedDomain.DecryptPrivateKey(w.encryptionKey)
if err != nil {
return fmt.Errorf("cannot decrypt private key: %w", err)
}
if len(privateKeyPEM) == 0 {
return fmt.Errorf("domain has no private key PEM")
}
@@ -122,7 +127,7 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
cache := &coredata.CachedCertificate{
Domain: loadedDomain.Domain,
CertificatePEM: string(loadedDomain.SSLCertificatePEM),
PrivateKeyPEM: string(loadedDomain.SSLPrivateKeyPEM),
PrivateKeyPEM: string(privateKeyPEM),
CertificateChain: loadedDomain.SSLCertificateChain,
ExpiresAt: *loadedDomain.SSLExpiresAt,
CachedAt: time.Now(),