Remove decrypt key by default

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/cache_store.go

@@ -99,15 +99,20 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
 		return fmt.Errorf("cannot load domain with decrypted values: %w", err)
 	}
 
-	if loadedDomain.SSLCertificate == nil {
+	if err := loadedDomain.ParseCertificate(w.encryptionKey); err != nil {
-		return fmt.Errorf("domain has no parsed certificate")
+		return fmt.Errorf("cannot parse certificate: %w", err)
 	}
 
 	if len(loadedDomain.SSLCertificatePEM) == 0 {
 		return fmt.Errorf("domain has no certificate PEM")
 	}
 
-	if len(loadedDomain.SSLPrivateKeyPEM) == 0 {
+	privateKeyPEM, err := loadedDomain.DecryptPrivateKey(w.encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot decrypt private key: %w", err)
+	}
+
+	if len(privateKeyPEM) == 0 {
 		return fmt.Errorf("domain has no private key PEM")
 	}
 
@@ -122,7 +127,7 @@ func (w *CacheStore) warmDomain(ctx context.Context, conn pg.Conn, domain *cored
 	cache := &coredata.CachedCertificate{
 		Domain:           loadedDomain.Domain,
 		CertificatePEM:   string(loadedDomain.SSLCertificatePEM),
-		PrivateKeyPEM:    string(loadedDomain.SSLPrivateKeyPEM),
+		PrivateKeyPEM:    string(privateKeyPEM),
 		CertificateChain: loadedDomain.SSLCertificateChain,
 		ExpiresAt:        *loadedDomain.SSLExpiresAt,
 		CachedAt:         time.Now(),

pkg/certmanager/provisioner.go

@@ -188,7 +188,9 @@ func (p *Provisioner) provisionDomainCertificate(
 	}
 
 	fullDomain.SSLCertificatePEM = cert.CertPEM
-	fullDomain.SSLPrivateKeyPEM = cert.KeyPEM
+	if err := fullDomain.EncryptPrivateKey(cert.KeyPEM, p.encryptionKey); err != nil {
+		return fmt.Errorf("cannot encrypt private key: %w", err)
+	}
 	chainStr := string(cert.ChainPEM)
 	fullDomain.SSLCertificateChain = &chainStr
 	fullDomain.SSLExpiresAt = &cert.ExpiresAt

pkg/certmanager/renewer.go

@@ -182,7 +182,9 @@ func (r *Renewer) renewDomain(ctx context.Context, conn pg.Conn, domain *coredat
 	)
 
 	lockedDomain.SSLCertificatePEM = cert.CertPEM
-	lockedDomain.SSLPrivateKeyPEM = cert.KeyPEM
+	if err := lockedDomain.EncryptPrivateKey(cert.KeyPEM, r.encryptionKey); err != nil {
+		return fmt.Errorf("cannot encrypt private key: %w", err)
+	}
 	chainStr := string(cert.ChainPEM)
 	lockedDomain.SSLCertificateChain = &chainStr
 	lockedDomain.SSLExpiresAt = &cert.ExpiresAt

pkg/certmanager/selector.go

@@ -117,16 +117,21 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 		return fmt.Errorf("domain does not have active SSL certificate")
 	}
 
-	if customDomain.SSLCertificate == nil {
+	if err := customDomain.ParseCertificate(s.encryptionKey); err != nil {
-		return fmt.Errorf("domain has no parsed certificate")
+		return fmt.Errorf("cannot parse certificate: %w", err)
 	}
 
 	if len(customDomain.SSLCertificatePEM) == 0 {
 		return fmt.Errorf("domain has no certificate PEM data")
 	}
 
-	if len(customDomain.SSLPrivateKeyPEM) == 0 {
+	if len(customDomain.EncryptedSSLPrivateKey) == 0 {
-		return fmt.Errorf("domain has no private key PEM data")
+		return fmt.Errorf("domain has no encrypted private key data")
+	}
+
+	privateKeyPEM, err := customDomain.DecryptPrivateKey(s.encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot decrypt private key: %w", err)
 	}
 
 	s.cache.Store(domain, customDomain.SSLCertificate)
@@ -134,7 +139,7 @@ func (s *Selector) rebuildCacheEntry(ctx context.Context, conn pg.Conn, domain s
 	cache := &coredata.CachedCertificate{
 		Domain:           customDomain.Domain,
 		CertificatePEM:   string(customDomain.SSLCertificatePEM),
-		PrivateKeyPEM:    string(customDomain.SSLPrivateKeyPEM),
+		PrivateKeyPEM:    string(privateKeyPEM),
 		CertificateChain: customDomain.SSLCertificateChain,
 		ExpiresAt:        *customDomain.SSLExpiresAt,
 		CachedAt:         time.Now(),

pkg/coredata/cached_certificate.go

@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/getprobo/probo/pkg/crypto/cipher"
 	"github.com/getprobo/probo/pkg/gid"
 	"github.com/jackc/pgx/v5"
 	"go.gearno.de/kit/pg"
@@ -169,7 +170,7 @@ WHERE
 	return nil
 }
 
-func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn, domain *CustomDomain) error {
+func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn, domain *CustomDomain, encryptionKey cipher.EncryptionKey) error {
 	if domain.SSLCertificate == nil {
 		return fmt.Errorf("domain has no parsed certificate")
 	}
@@ -178,7 +179,12 @@ func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn
 		return fmt.Errorf("domain has no certificate PEM")
 	}
 
-	if len(domain.SSLPrivateKeyPEM) == 0 {
+	privateKeyPEM, err := domain.DecryptPrivateKey(encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot decrypt private key: %w", err)
+	}
+
+	if len(privateKeyPEM) == 0 {
 		return fmt.Errorf("domain has no private key PEM")
 	}
 
@@ -189,7 +195,7 @@ func (cc *CachedCertificate) RefreshFromDomain(ctx context.Context, conn pg.Conn
 	cache := &CachedCertificate{
 		Domain:           domain.Domain,
 		CertificatePEM:   string(domain.SSLCertificatePEM),
-		PrivateKeyPEM:    string(domain.SSLPrivateKeyPEM),
+		PrivateKeyPEM:    string(privateKeyPEM),
 		CertificateChain: domain.SSLCertificateChain,
 		ExpiresAt:        *domain.SSLExpiresAt,
 		CachedAt:         time.Now(),

pkg/coredata/custom_domain.go

@@ -38,7 +38,6 @@ type (
 		HTTPOrderURL           *string               `db:"http_order_url"`
 		SSLCertificate         *tls.Certificate      `db:"-"`
 		SSLCertificatePEM      []byte                `db:"ssl_certificate"`
-		SSLPrivateKeyPEM       []byte                `db:"-"`
 		EncryptedSSLPrivateKey []byte                `db:"encrypted_ssl_private_key"`
 		SSLCertificateChain    *string               `db:"ssl_certificate_chain"`
 		SSLStatus              CustomDomainSSLStatus `db:"ssl_status"`
@@ -74,6 +73,62 @@ func (cd *CustomDomain) CursorKey(field CustomDomainOrderField) page.CursorKey {
 	panic(fmt.Sprintf("unsupported order by: %s", field))
 }
 
+func (cd *CustomDomain) DecryptPrivateKey(encryptionKey cipher.EncryptionKey) ([]byte, error) {
+	if len(cd.EncryptedSSLPrivateKey) == 0 {
+		return nil, nil
+	}
+
+	decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
+	if err != nil {
+		return nil, fmt.Errorf("cannot decrypt SSL private key: %w", err)
+	}
+
+	return decrypted, nil
+}
+
+func (cd *CustomDomain) EncryptPrivateKey(privateKeyPEM []byte, encryptionKey cipher.EncryptionKey) error {
+	if len(privateKeyPEM) == 0 {
+		cd.EncryptedSSLPrivateKey = nil
+		return nil
+	}
+
+	encrypted, err := cipher.Encrypt(privateKeyPEM, encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot encrypt SSL private key: %w", err)
+	}
+
+	cd.EncryptedSSLPrivateKey = encrypted
+	return nil
+}
+
+func (cd *CustomDomain) ParseCertificate(encryptionKey cipher.EncryptionKey) error {
+	if len(cd.SSLCertificatePEM) == 0 {
+		return fmt.Errorf("no certificate PEM data")
+	}
+
+	privateKeyPEM, err := cd.DecryptPrivateKey(encryptionKey)
+	if err != nil {
+		return fmt.Errorf("cannot decrypt private key: %w", err)
+	}
+
+	if len(privateKeyPEM) == 0 {
+		return fmt.Errorf("no private key data")
+	}
+
+	fullCertPEM := string(cd.SSLCertificatePEM)
+	if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
+		fullCertPEM += "\n" + *cd.SSLCertificateChain
+	}
+
+	tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), privateKeyPEM)
+	if err != nil {
+		return fmt.Errorf("cannot parse certificate and key: %w", err)
+	}
+
+	cd.SSLCertificate = &tlsCert
+	return nil
+}
+
 func (cd *CustomDomain) LoadByID(
 	ctx context.Context,
 	conn pg.Conn,
@@ -121,29 +176,6 @@ LIMIT 1
 
 	*cd = customDomain
 
-	// Decrypt SSL private key
-	if len(cd.EncryptedSSLPrivateKey) > 0 {
-		decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot decrypt SSL private key: %w", err)
-		}
-		cd.SSLPrivateKeyPEM = decrypted
-	}
-
-	// Parse certificate and key into tls.Certificate if both are present
-	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
-		fullCertPEM := string(cd.SSLCertificatePEM)
-		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
-			fullCertPEM += "\n" + *cd.SSLCertificateChain
-		}
-
-		tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), cd.SSLPrivateKeyPEM)
-		if err != nil {
-			return fmt.Errorf("cannot parse certificate and key: %w", err)
-		}
-		cd.SSLCertificate = &tlsCert
-	}
-
 	return nil
 }
 
@@ -194,29 +226,6 @@ FOR UPDATE
 
 	*cd = customDomain
 
-	// Decrypt SSL private key
-	if len(cd.EncryptedSSLPrivateKey) > 0 {
-		decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot decrypt SSL private key: %w", err)
-		}
-		cd.SSLPrivateKeyPEM = decrypted
-	}
-
-	// Parse certificate and key into tls.Certificate if both are present
-	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
-		fullCertPEM := string(cd.SSLCertificatePEM)
-		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
-			fullCertPEM += "\n" + *cd.SSLCertificateChain
-		}
-
-		tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), cd.SSLPrivateKeyPEM)
-		if err != nil {
-			return fmt.Errorf("cannot parse certificate and key: %w", err)
-		}
-		cd.SSLCertificate = &tlsCert
-	}
-
 	return nil
 }
 
@@ -267,29 +276,6 @@ LIMIT 1
 
 	*cd = customDomain
 
-	// Decrypt SSL private key
-	if len(cd.EncryptedSSLPrivateKey) > 0 {
-		decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot decrypt SSL private key: %w", err)
-		}
-		cd.SSLPrivateKeyPEM = decrypted
-	}
-
-	// Parse certificate and key into tls.Certificate if both are present
-	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
-		fullCertPEM := string(cd.SSLCertificatePEM)
-		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
-			fullCertPEM += "\n" + *cd.SSLCertificateChain
-		}
-
-		tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), cd.SSLPrivateKeyPEM)
-		if err != nil {
-			return fmt.Errorf("cannot parse certificate and key: %w", err)
-		}
-		cd.SSLCertificate = &tlsCert
-	}
-
 	return nil
 }
 
@@ -300,12 +286,8 @@ func (cd *CustomDomain) Insert(
 	encryptionKey cipher.EncryptionKey,
 ) error {
 	var encryptedKey []byte
-	if len(cd.SSLPrivateKeyPEM) > 0 {
+	if len(cd.EncryptedSSLPrivateKey) > 0 {
-		var err error
+		encryptedKey = cd.EncryptedSSLPrivateKey
-		encryptedKey, err = cipher.Encrypt(cd.SSLPrivateKeyPEM, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot encrypt SSL private key: %w", err)
-		}
 	}
 
 	q := `
@@ -376,12 +358,8 @@ func (cd *CustomDomain) Update(
 	encryptionKey cipher.EncryptionKey,
 ) error {
 	var encryptedKey []byte
-	if len(cd.SSLPrivateKeyPEM) > 0 {
+	if len(cd.EncryptedSSLPrivateKey) > 0 {
-		var err error
+		encryptedKey = cd.EncryptedSSLPrivateKey
-		encryptedKey, err = cipher.Encrypt(cd.SSLPrivateKeyPEM, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot encrypt SSL private key: %w", err)
-		}
 	}
 
 	q := `
@@ -651,17 +629,6 @@ WHERE
 		return fmt.Errorf("cannot collect custom domains: %w", err)
 	}
 
-	for _, cd := range result {
-		// Decrypt SSL private key
-		if len(cd.EncryptedSSLPrivateKey) > 0 {
-			decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
-			if err != nil {
-				return fmt.Errorf("cannot decrypt SSL private key: %w", err)
-			}
-			cd.SSLPrivateKeyPEM = decrypted
-		}
-	}
-
 	*domains = result
 	return nil
 }