mirror of
https://github.com/processone/ejabberd.git
synced 2024-12-22 17:28:25 +01:00
1162 lines
37 KiB
Erlang
1162 lines
37 KiB
Erlang
-module (ejabberd_acme).
|
|
-behaviour(gen_server).
|
|
|
|
%% ejabberdctl commands
|
|
-export([get_commands_spec/0,
|
|
get_certificates/1,
|
|
renew_certificates/0,
|
|
list_certificates/1,
|
|
revoke_certificate/1]).
|
|
%% Command Options Validity
|
|
-export([is_valid_account_opt/1,
|
|
is_valid_verbose_opt/1,
|
|
is_valid_domain_opt/1,
|
|
is_valid_revoke_cert/1]).
|
|
%% Key Related
|
|
-export([generate_key/0, to_public/1]).
|
|
%% gen_server callbacks
|
|
-export([init/1, handle_call/3, handle_cast/2, handle_info/2,
|
|
terminate/2, code_change/3]).
|
|
-export([start_link/0, register_certfiles/0]).
|
|
|
|
-include("logger.hrl").
|
|
-include("xmpp.hrl").
|
|
-include("ejabberd_commands.hrl").
|
|
-include("ejabberd_acme.hrl").
|
|
-include_lib("public_key/include/public_key.hrl").
|
|
-include("ejabberd_stacktrace.hrl").
|
|
|
|
-define(DEFAULT_CONFIG_CONTACT, <<"mailto:example-admin@example.com">>).
|
|
-define(DEFAULT_CONFIG_CA_URL, "https://acme-v01.api.letsencrypt.org").
|
|
|
|
-record(state, {}).
|
|
|
|
start_link() ->
|
|
gen_server:start_link({local, ?MODULE}, ?MODULE, [], []).
|
|
|
|
%%%===================================================================
|
|
%%% gen_server callbacks
|
|
%%%===================================================================
|
|
init([]) ->
|
|
case filelib:ensure_dir(filename:join(acme_certs_dir(), "foo")) of
|
|
ok ->
|
|
ejabberd_hooks:add(config_reloaded, ?MODULE, register_certfiles, 40),
|
|
ejabberd_commands:register_commands(get_commands_spec()),
|
|
register_certfiles(),
|
|
{ok, #state{}};
|
|
{error, Why} ->
|
|
?CRITICAL_MSG("Failed to create directory ~s: ~s",
|
|
[acme_certs_dir(), file:format_error(Why)]),
|
|
{stop, Why}
|
|
end.
|
|
|
|
handle_call(Request, From, State) ->
|
|
?WARNING_MSG("Unexpected call from ~p: ~p", [From, Request]),
|
|
{noreply, State}.
|
|
|
|
handle_cast(_Msg, State) ->
|
|
?WARNING_MSG("Unexpected cast: ~p", [_Msg]),
|
|
{noreply, State}.
|
|
|
|
handle_info(_Info, State) ->
|
|
?WARNING_MSG("Unexpected info: ~p", [_Info]),
|
|
{noreply, State}.
|
|
|
|
terminate(_Reason, _State) ->
|
|
ejabberd_hooks:delete(config_reloaded, ?MODULE, register_certfiles, 40),
|
|
ejabberd_commands:unregister_commands(get_commands_spec()).
|
|
|
|
code_change(_OldVsn, State, _Extra) ->
|
|
{ok, State}.
|
|
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%%
|
|
%% Command Functions
|
|
%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
%%
|
|
%% Check Validity of command options
|
|
%%
|
|
|
|
-spec is_valid_account_opt(string()) -> boolean().
|
|
is_valid_account_opt("old-account") -> true;
|
|
is_valid_account_opt("new-account") -> true;
|
|
is_valid_account_opt(_) -> false.
|
|
|
|
-spec is_valid_verbose_opt(string()) -> boolean().
|
|
is_valid_verbose_opt("plain") -> true;
|
|
is_valid_verbose_opt("verbose") -> true;
|
|
is_valid_verbose_opt(_) -> false.
|
|
|
|
%% TODO: Make this check more complicated
|
|
-spec is_valid_domain_opt(string()) -> boolean().
|
|
is_valid_domain_opt("all") -> true;
|
|
is_valid_domain_opt(DomainString) ->
|
|
case parse_domain_string(DomainString) of
|
|
[] ->
|
|
false;
|
|
_SeparatedDomains ->
|
|
true
|
|
end.
|
|
|
|
-spec is_valid_revoke_cert(string()) -> boolean().
|
|
is_valid_revoke_cert(DomainOrFile) ->
|
|
lists:prefix("file:", DomainOrFile) orelse
|
|
lists:prefix("domain:", DomainOrFile).
|
|
|
|
%% Commands
|
|
get_commands_spec() ->
|
|
[#ejabberd_commands{name = get_certificates, tags = [acme],
|
|
desc = "Gets certificates for all or the specified "
|
|
"domains {all|domain1;domain2;...}.",
|
|
module = ?MODULE, function = get_certificates,
|
|
args_desc = ["Domains for which to acquire a certificate"],
|
|
args_example = ["all | www.example.com;www.example1.net"],
|
|
args = [{domains, string}],
|
|
result = {certificates, string}},
|
|
#ejabberd_commands{name = renew_certificates, tags = [acme],
|
|
desc = "Renews all certificates that are close to expiring",
|
|
module = ?MODULE, function = renew_certificates,
|
|
args = [],
|
|
result = {certificates, string}},
|
|
#ejabberd_commands{name = list_certificates, tags = [acme],
|
|
desc = "Lists all currently handled certificates and "
|
|
"their respective domains in {plain|verbose} format",
|
|
module = ?MODULE, function = list_certificates,
|
|
args_desc = ["Whether to print the whole certificate "
|
|
"or just some metadata. "
|
|
"Possible values: plain | verbose"],
|
|
args = [{option, string}],
|
|
result = {certificates, {list, {certificate, string}}}},
|
|
#ejabberd_commands{name = revoke_certificate, tags = [acme],
|
|
desc = "Revokes the selected certificate",
|
|
module = ?MODULE, function = revoke_certificate,
|
|
args_desc = ["The domain or file (in pem format) of "
|
|
"the certificate in question "
|
|
"{domain:Domain | file:File}"],
|
|
args = [{domain_or_file, string}],
|
|
result = {res, restuple}}].
|
|
|
|
%%
|
|
%% Get Certificate
|
|
%%
|
|
-spec get_certificates(domains_opt()) -> string() | {'error', _}.
|
|
get_certificates(Domains) ->
|
|
case is_valid_domain_opt(Domains) of
|
|
true ->
|
|
try
|
|
CAUrl = get_config_ca_url(),
|
|
get_certificates0(CAUrl, Domains)
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, get_certificates}
|
|
end;
|
|
false ->
|
|
io_lib:format("Invalid domains: ~p", [Domains])
|
|
end.
|
|
|
|
-spec get_certificates0(url(), domains_opt()) -> string().
|
|
get_certificates0(CAUrl, Domains) ->
|
|
%% Check if an account exists or create another one
|
|
{ok, _AccId, PrivateKey} = retrieve_or_create_account(CAUrl),
|
|
|
|
get_certificates1(CAUrl, Domains, PrivateKey).
|
|
|
|
-spec retrieve_or_create_account(url()) -> {'ok', string(), jose_jwk:key()}.
|
|
retrieve_or_create_account(CAUrl) ->
|
|
case read_account_persistent() of
|
|
none ->
|
|
create_save_new_account(CAUrl);
|
|
|
|
{ok, AccId, CAUrl, PrivateKey} ->
|
|
{ok, AccId, PrivateKey};
|
|
{ok, _AccId, _, _PrivateKey} ->
|
|
create_save_new_account(CAUrl)
|
|
end.
|
|
|
|
|
|
-spec get_certificates1(url(), domains_opt(), jose_jwk:key()) -> string().
|
|
get_certificates1(CAUrl, "all", PrivateKey) ->
|
|
Hosts = get_config_hosts(),
|
|
get_certificates2(CAUrl, PrivateKey, Hosts);
|
|
get_certificates1(CAUrl, DomainString, PrivateKey) ->
|
|
Domains = parse_domain_string(DomainString),
|
|
Hosts = [list_to_bitstring(D) || D <- Domains],
|
|
get_certificates2(CAUrl, PrivateKey, Hosts).
|
|
|
|
-spec get_certificates2(url(), jose_jwk:key(), [binary()]) -> string().
|
|
get_certificates2(CAUrl, PrivateKey, Hosts) ->
|
|
%% Get a certificate for each host
|
|
PemCertKeys = [get_certificate(CAUrl, Host, PrivateKey) || Host <- Hosts],
|
|
|
|
%% Save Certificates
|
|
SavedCerts = [save_certificate(Cert) || Cert <- PemCertKeys],
|
|
|
|
%% Format the result to send back to ejabberdctl
|
|
format_get_certificates_result(SavedCerts).
|
|
|
|
-spec format_get_certificates_result([{'ok', binary(), _} |
|
|
{'error', binary(), _}]) ->
|
|
string().
|
|
format_get_certificates_result(Certs) ->
|
|
Cond = lists:all(fun(Cert) ->
|
|
not is_error(Cert)
|
|
end, Certs),
|
|
%% FormattedCerts = string:join([format_get_certificate(C) || C <- Certs], "\n"),
|
|
FormattedCerts = str:join([format_get_certificate(C) || C <- Certs], $\n),
|
|
case Cond of
|
|
true ->
|
|
Result = io_lib:format("Success:~n~s", [FormattedCerts]),
|
|
lists:flatten(Result);
|
|
_ ->
|
|
Result = io_lib:format("Error with one or more certificates~n~s", [FormattedCerts]),
|
|
lists:flatten(Result)
|
|
end.
|
|
|
|
-spec format_get_certificate({'ok', binary(), _} |
|
|
{'error', binary(), _}) ->
|
|
string().
|
|
format_get_certificate({ok, Domain, saved}) ->
|
|
io_lib:format(" Certificate for domain: \"~s\" acquired and saved", [Domain]);
|
|
format_get_certificate({error, Domain, not_found}) ->
|
|
io_lib:format(" Certificate for domain: \"~s\" not found, so it was not renewed", [Domain]);
|
|
format_get_certificate({ok, Domain, no_expire}) ->
|
|
io_lib:format(" Certificate for domain: \"~s\" is not close to expiring", [Domain]);
|
|
format_get_certificate({error, Domain, Reason}) ->
|
|
io_lib:format(" Error for domain: \"~s\", with reason: \'~s\'", [Domain, Reason]).
|
|
|
|
-spec get_certificate(url(), binary(), jose_jwk:key()) ->
|
|
{'ok', binary(), pem()} |
|
|
{'error', binary(), _}.
|
|
get_certificate(CAUrl, DomainName, PrivateKey) ->
|
|
try
|
|
AllSubDomains = find_all_sub_domains(DomainName),
|
|
lists:foreach(
|
|
fun(Domain) ->
|
|
{ok, _Authz} = create_new_authorization(CAUrl, Domain, PrivateKey)
|
|
end, [DomainName|AllSubDomains]),
|
|
create_new_certificate(CAUrl, {DomainName, AllSubDomains}, PrivateKey)
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, DomainName, get_certificate}
|
|
end.
|
|
|
|
-spec create_save_new_account(url()) -> {'ok', string(), jose_jwk:key()} | no_return().
|
|
create_save_new_account(CAUrl) ->
|
|
%% Get contact from configuration file
|
|
Contact = get_config_contact(),
|
|
|
|
%% Generate a Key
|
|
PrivateKey = generate_key(),
|
|
|
|
%% Create a new account
|
|
{ok, Id} = create_new_account(CAUrl, Contact, PrivateKey),
|
|
|
|
%% Write Persistent Data
|
|
ok = write_account_persistent({Id, CAUrl, PrivateKey}),
|
|
|
|
{ok, Id, PrivateKey}.
|
|
|
|
%% TODO:
|
|
%% Find a way to ask the user if he accepts the TOS
|
|
-spec create_new_account(url(), binary(), jose_jwk:key()) -> {'ok', string()} |
|
|
no_return().
|
|
create_new_account(CAUrl, Contact, PrivateKey) ->
|
|
try
|
|
{ok, Dirs, Nonce0} = ejabberd_acme_comm:directory(CAUrl),
|
|
Req0 = [{ <<"contact">>, [Contact]}],
|
|
{ok, {TOS, Account}, Nonce1} =
|
|
ejabberd_acme_comm:new_account(Dirs, PrivateKey, Req0, Nonce0),
|
|
{<<"id">>, AccIdInt} = lists:keyfind(<<"id">>, 1, Account),
|
|
AccId = integer_to_list(AccIdInt),
|
|
Req1 = [{ <<"agreement">>, list_to_bitstring(TOS)}],
|
|
{ok, _Account2, _Nonce2} =
|
|
ejabberd_acme_comm:update_account({CAUrl, AccId}, PrivateKey, Req1, Nonce1),
|
|
{ok, AccId}
|
|
catch
|
|
E:R ->
|
|
?ERROR_MSG("Error: ~p creating an account for contact: ~p",
|
|
[{E,R}, Contact]),
|
|
throw({error,create_new_account})
|
|
end.
|
|
|
|
-spec create_new_authorization(url(), binary(), jose_jwk:key()) ->
|
|
{'ok', proplist()} | no_return().
|
|
create_new_authorization(CAUrl, DomainName, PrivateKey) ->
|
|
acme_challenge:register_hooks(DomainName),
|
|
try
|
|
{ok, Dirs, Nonce0} = ejabberd_acme_comm:directory(CAUrl),
|
|
Req0 = [{<<"identifier">>,
|
|
{[{<<"type">>, <<"dns">>},
|
|
{<<"value">>, DomainName}]}},
|
|
{<<"existing">>, <<"accept">>}],
|
|
{ok, {AuthzUrl, Authz}, Nonce1} =
|
|
ejabberd_acme_comm:new_authz(Dirs, PrivateKey, Req0, Nonce0),
|
|
{ok, AuthzId} = location_to_id(AuthzUrl),
|
|
|
|
Challenges = get_challenges(Authz),
|
|
{ok, ChallengeUrl, KeyAuthz} =
|
|
acme_challenge:solve_challenge(<<"http-01">>, Challenges, PrivateKey),
|
|
{ok, ChallengeId} = location_to_id(ChallengeUrl),
|
|
Req3 = [{<<"type">>, <<"http-01">>},{<<"keyAuthorization">>, KeyAuthz}],
|
|
{ok, _SolvedChallenge, _Nonce2} = ejabberd_acme_comm:complete_challenge(
|
|
{CAUrl, AuthzId, ChallengeId}, PrivateKey, Req3, Nonce1),
|
|
|
|
{ok, AuthzValid, _Nonce} = ejabberd_acme_comm:get_authz_until_valid({CAUrl, AuthzId}),
|
|
{ok, AuthzValid}
|
|
catch
|
|
E:R ->
|
|
?ERROR_MSG("Error: ~p getting an authorization for domain: ~p~n",
|
|
[{E,R}, DomainName]),
|
|
throw({error, DomainName, authorization})
|
|
after
|
|
acme_challenge:unregister_hooks(DomainName)
|
|
end.
|
|
|
|
-spec create_new_certificate(url(), {binary(), [binary()]}, jose_jwk:key()) ->
|
|
{ok, binary(), pem()}.
|
|
create_new_certificate(CAUrl, {DomainName, AllSubDomains}, PrivateKey) ->
|
|
try
|
|
{ok, Dirs, Nonce0} = ejabberd_acme_comm:directory(CAUrl),
|
|
CSRSubject = [{?'id-at-commonName', bitstring_to_list(DomainName)}],
|
|
SANs = [{dNSName, SAN} || SAN <- AllSubDomains],
|
|
{CSR, CSRKey} = make_csr(CSRSubject, SANs),
|
|
{NotBefore, NotAfter} = not_before_not_after(),
|
|
Req =
|
|
[{<<"csr">>, CSR},
|
|
{<<"notBefore">>, NotBefore},
|
|
{<<"NotAfter">>, NotAfter}
|
|
],
|
|
{ok, {IssuerCertLink, Certificate}, _Nonce1} =
|
|
ejabberd_acme_comm:new_cert(Dirs, PrivateKey, Req, Nonce0),
|
|
|
|
DecodedCert = public_key:pkix_decode_cert(list_to_binary(Certificate), plain),
|
|
PemEntryCert = public_key:pem_entry_encode('Certificate', DecodedCert),
|
|
|
|
{ok, IssuerCert, _Nonce2} = ejabberd_acme_comm:get_issuer_cert(IssuerCertLink),
|
|
DecodedIssuerCert = public_key:pkix_decode_cert(list_to_binary(IssuerCert), plain),
|
|
PemEntryIssuerCert = public_key:pem_entry_encode('Certificate', DecodedIssuerCert),
|
|
|
|
{_, CSRKeyKey} = jose_jwk:to_key(CSRKey),
|
|
PemEntryKey = public_key:pem_entry_encode('ECPrivateKey', CSRKeyKey),
|
|
|
|
PemCertKey = public_key:pem_encode([PemEntryKey, PemEntryCert, PemEntryIssuerCert]),
|
|
|
|
{ok, DomainName, PemCertKey}
|
|
catch
|
|
E:R ->
|
|
?ERROR_MSG("Error: ~p getting an authorization for domain: ~p~n",
|
|
[{E,R}, DomainName]),
|
|
throw({error, DomainName, certificate})
|
|
end.
|
|
|
|
-spec ensure_account_exists(url()) -> {ok, string(), jose_jwk:key()}.
|
|
ensure_account_exists(CAUrl) ->
|
|
case read_account_persistent() of
|
|
none ->
|
|
?ERROR_MSG("No existing account", []),
|
|
throw({error, no_old_account});
|
|
{ok, AccId, CAUrl, PrivateKey} ->
|
|
{ok, AccId, PrivateKey};
|
|
{ok, _AccId, OtherCAUrl, _PrivateKey} ->
|
|
?ERROR_MSG("Account is connected to another CA: ~s", [OtherCAUrl]),
|
|
throw({error, account_in_other_CA})
|
|
end.
|
|
|
|
|
|
%%
|
|
%% Renew Certificates
|
|
%%
|
|
-spec renew_certificates() -> string() | {'error', _}.
|
|
renew_certificates() ->
|
|
try
|
|
CAUrl = get_config_ca_url(),
|
|
renew_certificates0(CAUrl)
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, get_certificates}
|
|
end.
|
|
|
|
-spec renew_certificates0(url()) -> string().
|
|
renew_certificates0(CAUrl) ->
|
|
%% Get the current account
|
|
{ok, _AccId, PrivateKey} = ensure_account_exists(CAUrl),
|
|
|
|
%% Find all hosts that we have certificates for
|
|
Certs = read_certificates_persistent(),
|
|
|
|
%% Get a certificate for each host
|
|
PemCertKeys = [renew_certificate(CAUrl, Cert, PrivateKey) || Cert <- Certs],
|
|
|
|
%% Save Certificates
|
|
SavedCerts = [save_renewed_certificate(Cert) || Cert <- PemCertKeys],
|
|
|
|
%% Format the result to send back to ejabberdctl
|
|
format_get_certificates_result(SavedCerts).
|
|
|
|
-spec renew_certificate(url(), {binary(), data_cert()}, jose_jwk:key()) ->
|
|
{'ok', binary(), _} |
|
|
{'error', binary(), _}.
|
|
renew_certificate(CAUrl, {DomainName, _} = Cert, PrivateKey) ->
|
|
case cert_to_expire(Cert) of
|
|
true ->
|
|
get_certificate(CAUrl, DomainName, PrivateKey);
|
|
false ->
|
|
{ok, DomainName, no_expire}
|
|
end.
|
|
|
|
|
|
-spec cert_to_expire({binary(), data_cert()}) -> boolean().
|
|
cert_to_expire({_DomainName, #data_cert{pem = Pem}}) ->
|
|
Certificate = pem_to_certificate(Pem),
|
|
Validity = get_utc_validity(Certificate),
|
|
|
|
%% 30 days before expiration
|
|
close_to_expire(Validity, 30).
|
|
|
|
-spec close_to_expire(string(), integer()) -> boolean().
|
|
close_to_expire(Validity, Days) ->
|
|
{ValidDate, _ValidTime} = utc_string_to_datetime(Validity),
|
|
ValidDays = calendar:date_to_gregorian_days(ValidDate),
|
|
|
|
{CurrentDate, _CurrentTime} = calendar:universal_time(),
|
|
CurrentDays = calendar:date_to_gregorian_days(CurrentDate),
|
|
CurrentDays > ValidDays - Days.
|
|
|
|
|
|
|
|
%%
|
|
%% List Certificates
|
|
%%
|
|
-spec list_certificates(verbose_opt()) -> [string()] | [any()] | {error, _}.
|
|
list_certificates(Verbose) ->
|
|
case is_valid_verbose_opt(Verbose) of
|
|
true ->
|
|
try
|
|
list_certificates0(Verbose)
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, list_certificates}
|
|
end;
|
|
false ->
|
|
String = io_lib:format("Invalid verbose option: ~p", [Verbose]),
|
|
{invalid_option, String}
|
|
end.
|
|
|
|
-spec list_certificates0(verbose_opt()) -> [string()] | [any()].
|
|
list_certificates0(Verbose) ->
|
|
Certs = read_certificates_persistent(),
|
|
[format_certificate(DataCert, Verbose) || {_Key, DataCert} <- Certs].
|
|
|
|
%% TODO: Make this cleaner and more robust
|
|
-spec format_certificate(data_cert(), verbose_opt()) -> string().
|
|
format_certificate(DataCert, Verbose) ->
|
|
#data_cert{
|
|
domain = DomainName,
|
|
pem = PemCert,
|
|
path = Path
|
|
} = DataCert,
|
|
|
|
try
|
|
Certificate = pem_to_certificate(PemCert),
|
|
|
|
%% Find the commonName
|
|
_CommonName = get_commonName(Certificate),
|
|
|
|
%% Find the notAfter date
|
|
NotAfter = get_notAfter(Certificate),
|
|
|
|
%% Find the subjectAltNames
|
|
SANs = get_subjectAltNames(Certificate),
|
|
|
|
case Verbose of
|
|
"plain" ->
|
|
format_certificate_plain(DomainName, SANs, NotAfter, Path);
|
|
"verbose" ->
|
|
format_certificate_verbose(DomainName, SANs, NotAfter, PemCert)
|
|
end
|
|
catch
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
fail_format_certificate(DomainName)
|
|
end.
|
|
|
|
-spec format_certificate_plain(binary(), [string()], {expired | ok, string()}, string())
|
|
-> string().
|
|
format_certificate_plain(DomainName, SANs, NotAfter, Path) ->
|
|
Result = lists:flatten(io_lib:format(
|
|
" Domain: ~s~n"
|
|
"~s"
|
|
" ~s~n"
|
|
" Path: ~s",
|
|
[DomainName,
|
|
lists:flatten([io_lib:format(" SAN: ~s~n", [SAN]) || SAN <- SANs]),
|
|
format_validity(NotAfter), Path])),
|
|
Result.
|
|
|
|
-spec format_certificate_verbose(binary(), [string()], {expired | ok, string()}, binary())
|
|
-> string().
|
|
format_certificate_verbose(DomainName, SANs, NotAfter, PemCert) ->
|
|
Result = lists:flatten(io_lib:format(
|
|
" Domain: ~s~n"
|
|
"~s"
|
|
" ~s~n"
|
|
" Certificate In PEM format: ~n~s",
|
|
[DomainName,
|
|
lists:flatten([io_lib:format(" SAN: ~s~n", [SAN]) || SAN <- SANs]),
|
|
format_validity(NotAfter), PemCert])),
|
|
Result.
|
|
|
|
-spec format_validity({'expired' | 'ok', string()}) -> string().
|
|
format_validity({expired, NotAfter}) ->
|
|
io_lib:format("Expired at: ~s UTC", [NotAfter]);
|
|
format_validity({ok, NotAfter}) ->
|
|
io_lib:format("Valid until: ~s UTC", [NotAfter]).
|
|
|
|
-spec fail_format_certificate(binary()) -> string().
|
|
fail_format_certificate(DomainName) ->
|
|
Result = lists:flatten(io_lib:format(
|
|
" Domain: ~s~n"
|
|
" Failed to format Certificate",
|
|
[DomainName])),
|
|
Result.
|
|
|
|
-spec get_commonName(#'Certificate'{}) -> string().
|
|
get_commonName(#'Certificate'{tbsCertificate = TbsCertificate}) ->
|
|
#'TBSCertificate'{
|
|
subject = {rdnSequence, SubjectList}
|
|
} = TbsCertificate,
|
|
|
|
%% TODO: Not the best way to find the commonName
|
|
ShallowSubjectList = [Attribute || [Attribute] <- SubjectList],
|
|
{_, _, CommonName} = lists:keyfind(?'id-at-commonName', 2, ShallowSubjectList),
|
|
|
|
%% TODO: Remove the length-encoding from the commonName before returning it
|
|
CommonName.
|
|
|
|
-spec get_notAfter(#'Certificate'{}) -> {expired | ok, string()}.
|
|
get_notAfter(Certificate) ->
|
|
UtcTime = get_utc_validity(Certificate),
|
|
%% TODO: Find a library function to decode utc time
|
|
[Y1,Y2,MO1,MO2,D1,D2,H1,H2,MI1,MI2,S1,S2,$Z] = UtcTime,
|
|
YEAR = case list_to_integer([Y1,Y2]) >= 50 of
|
|
true -> "19" ++ [Y1,Y2];
|
|
_ -> "20" ++ [Y1,Y2]
|
|
end,
|
|
NotAfter = lists:flatten(io_lib:format("~s-~s-~s ~s:~s:~s",
|
|
[YEAR, [MO1,MO2], [D1,D2],
|
|
[H1,H2], [MI1,MI2], [S1,S2]])),
|
|
|
|
case close_to_expire(UtcTime, 0) of
|
|
true ->
|
|
{expired, NotAfter};
|
|
false ->
|
|
{ok, NotAfter}
|
|
end.
|
|
|
|
-spec get_subjectAltNames(#'Certificate'{}) -> [string()].
|
|
get_subjectAltNames(#'Certificate'{tbsCertificate = TbsCertificate}) ->
|
|
#'TBSCertificate'{
|
|
extensions = Exts
|
|
} = TbsCertificate,
|
|
|
|
EncodedSANs = [Val || #'Extension'{extnID = Oid, extnValue = Val} <- Exts,
|
|
Oid == ?'id-ce-subjectAltName'],
|
|
|
|
lists:flatmap(
|
|
fun(EncSAN) ->
|
|
SANs0 = public_key:der_decode('SubjectAltName', EncSAN),
|
|
[Name || {dNSName, Name} <- SANs0]
|
|
end, EncodedSANs).
|
|
|
|
|
|
|
|
-spec get_utc_validity(#'Certificate'{}) -> string().
|
|
get_utc_validity(#'Certificate'{tbsCertificate = TbsCertificate}) ->
|
|
#'TBSCertificate'{
|
|
validity = Validity
|
|
} = TbsCertificate,
|
|
|
|
#'Validity'{notAfter = {utcTime, UtcTime}} = Validity,
|
|
UtcTime.
|
|
|
|
%%
|
|
%% Revoke Certificate
|
|
%%
|
|
|
|
revoke_certificate(DomainOrFile) ->
|
|
case is_valid_revoke_cert(DomainOrFile) of
|
|
true ->
|
|
revoke_certificates(DomainOrFile);
|
|
false ->
|
|
String = io_lib:format("Bad argument: ~s", [DomainOrFile]),
|
|
{invalid_argument, String}
|
|
end.
|
|
|
|
-spec revoke_certificates(string()) -> {ok, deleted} | {error, _}.
|
|
revoke_certificates(DomainOrFile) ->
|
|
try
|
|
CAUrl = get_config_ca_url(),
|
|
revoke_certificate0(CAUrl, DomainOrFile)
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, revoke_certificate}
|
|
end.
|
|
|
|
-spec revoke_certificate0(url(), string()) -> {ok, deleted}.
|
|
revoke_certificate0(CAUrl, DomainOrFile) ->
|
|
ParsedCert = parse_revoke_cert_argument(DomainOrFile),
|
|
revoke_certificate1(CAUrl, ParsedCert).
|
|
|
|
-spec revoke_certificate1(url(), {domain, binary()} | {file, file:filename()}) ->
|
|
{ok, deleted}.
|
|
revoke_certificate1(CAUrl, {domain, Domain}) ->
|
|
case domain_certificate_exists(Domain) of
|
|
{Domain, Cert = #data_cert{pem=PemCert}} ->
|
|
ok = revoke_certificate2(CAUrl, PemCert),
|
|
ok = remove_certificate_persistent(Cert),
|
|
{ok, deleted};
|
|
false ->
|
|
?ERROR_MSG("Certificate for domain: ~p not found", [Domain]),
|
|
throw({error, not_found})
|
|
end;
|
|
revoke_certificate1(CAUrl, {file, File}) ->
|
|
case file:read_file(File) of
|
|
{ok, Pem} ->
|
|
ok = revoke_certificate2(CAUrl, Pem),
|
|
{ok, deleted};
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p reading pem certificate-key file: ~p", [Reason, File]),
|
|
throw({error, Reason})
|
|
end.
|
|
|
|
|
|
-spec revoke_certificate2(url(), pem()) -> ok.
|
|
revoke_certificate2(CAUrl, PemEncodedCert) ->
|
|
{Certificate, CertPrivateKey} = prepare_certificate_revoke(PemEncodedCert),
|
|
|
|
{ok, Dirs, Nonce} = ejabberd_acme_comm:directory(CAUrl),
|
|
|
|
Req = [{<<"certificate">>, Certificate}],
|
|
{ok, [], _Nonce1} = ejabberd_acme_comm:revoke_cert(Dirs, CertPrivateKey, Req, Nonce),
|
|
ok.
|
|
|
|
-spec parse_revoke_cert_argument(string()) -> {domain, binary()} | {file, file:filename()}.
|
|
parse_revoke_cert_argument([$f, $i, $l, $e, $:|File]) ->
|
|
{file, File};
|
|
parse_revoke_cert_argument([$d, $o, $m, $a, $i, $n, $: | Domain]) ->
|
|
{domain, list_to_bitstring(Domain)}.
|
|
|
|
-spec prepare_certificate_revoke(pem()) -> {binary(), jose_jwk:key()}.
|
|
prepare_certificate_revoke(PemEncodedCert) ->
|
|
PemList = public_key:pem_decode(PemEncodedCert),
|
|
PemCertEnc = lists:keyfind('Certificate', 1, PemList),
|
|
PemCert = public_key:pem_entry_decode(PemCertEnc),
|
|
DerCert = public_key:der_encode('Certificate', PemCert),
|
|
Base64Cert = base64url:encode(DerCert),
|
|
|
|
{ok, Key} = find_private_key_in_pem(PemEncodedCert),
|
|
{Base64Cert, Key}.
|
|
|
|
-spec domain_certificate_exists(binary()) -> {binary(), data_cert()} | false.
|
|
domain_certificate_exists(Domain) ->
|
|
Certs = read_certificates_persistent(),
|
|
lists:keyfind(Domain, 1, Certs).
|
|
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%%
|
|
%% Certificate Request Functions
|
|
%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
%% For now we accept only generating a key of
|
|
%% specific type for signing the csr
|
|
|
|
-spec make_csr(proplist(), [{dNSName, binary()}])
|
|
-> {binary(), jose_jwk:key()}.
|
|
make_csr(Attributes, SANs) ->
|
|
Key = generate_key(),
|
|
{_, KeyKey} = jose_jwk:to_key(Key),
|
|
KeyPub = to_public(Key),
|
|
try
|
|
SubPKInfoAlgo = subject_pk_info_algo(KeyPub),
|
|
{ok, RawBinPubKey} = raw_binary_public_key(KeyPub),
|
|
SubPKInfo = subject_pk_info(SubPKInfoAlgo, RawBinPubKey),
|
|
Subject = attributes_from_list(Attributes),
|
|
ExtensionRequest = extension_request(SANs),
|
|
CRI = certificate_request_info(SubPKInfo, Subject, ExtensionRequest),
|
|
{ok, EncodedCRI} = der_encode(
|
|
'CertificationRequestInfo',
|
|
CRI),
|
|
SignedCRI = public_key:sign(EncodedCRI, 'sha256', KeyKey),
|
|
SignatureAlgo = signature_algo(Key, 'sha256'),
|
|
CSR = certification_request(CRI, SignatureAlgo, SignedCRI),
|
|
{ok, DerCSR} = der_encode(
|
|
'CertificationRequest',
|
|
CSR),
|
|
Result = base64url:encode(DerCSR),
|
|
{Result, Key}
|
|
catch
|
|
_:{badmatch, {error, bad_public_key}} ->
|
|
{error, bad_public_key};
|
|
_:{badmatch, {error, bad_attributes}} ->
|
|
{error, bad_public_key};
|
|
_:{badmatch, {error, der_encode}} ->
|
|
{error, der_encode}
|
|
end.
|
|
|
|
|
|
|
|
subject_pk_info_algo(_KeyPub) ->
|
|
#'SubjectPublicKeyInfoAlgorithm'{
|
|
algorithm = ?'id-ecPublicKey',
|
|
parameters = {asn1_OPENTYPE,<<6,8,42,134,72,206,61,3,1,7>>}
|
|
}.
|
|
|
|
subject_pk_info(Algo, RawBinPubKey) ->
|
|
#'SubjectPublicKeyInfo-PKCS-10'{
|
|
algorithm = Algo,
|
|
subjectPublicKey = RawBinPubKey
|
|
}.
|
|
|
|
extension(SANs) ->
|
|
#'Extension'{
|
|
extnID = ?'id-ce-subjectAltName',
|
|
critical = false,
|
|
extnValue = public_key:der_encode('SubjectAltName', SANs)}.
|
|
|
|
extension_request(SANs) ->
|
|
#'AttributePKCS-10'{
|
|
type = ?'pkcs-9-at-extensionRequest',
|
|
values = [{'asn1_OPENTYPE',
|
|
public_key:der_encode(
|
|
'ExtensionRequest',
|
|
[extension(SANs)])}]
|
|
}.
|
|
|
|
certificate_request_info(SubPKInfo, Subject, ExtensionRequest) ->
|
|
#'CertificationRequestInfo'{
|
|
version = 0,
|
|
subject = Subject,
|
|
subjectPKInfo = SubPKInfo,
|
|
attributes = [ExtensionRequest]
|
|
}.
|
|
|
|
signature_algo(_Key, _Hash) ->
|
|
#'CertificationRequest_signatureAlgorithm'{
|
|
algorithm = ?'ecdsa-with-SHA256',
|
|
parameters = asn1_NOVALUE
|
|
}.
|
|
|
|
certification_request(CRI, SignatureAlgo, SignedCRI) ->
|
|
#'CertificationRequest'{
|
|
certificationRequestInfo = CRI,
|
|
signatureAlgorithm = SignatureAlgo,
|
|
signature = SignedCRI
|
|
}.
|
|
|
|
raw_binary_public_key(KeyPub) ->
|
|
try
|
|
{_, RawPubKey} = jose_jwk:to_key(KeyPub),
|
|
{{_, RawBinPubKey}, _} = RawPubKey,
|
|
{ok, RawBinPubKey}
|
|
catch
|
|
_:_ ->
|
|
?ERROR_MSG("Bad public key: ~p~n", [KeyPub]),
|
|
{error, bad_public_key}
|
|
end.
|
|
|
|
der_encode(Type, Term) ->
|
|
try
|
|
{ok, public_key:der_encode(Type, Term)}
|
|
catch
|
|
_:_ ->
|
|
?ERROR_MSG("Cannot DER encode: ~p, with asn1type: ~p", [Term, Type]),
|
|
{error, der_encode}
|
|
end.
|
|
|
|
attributes_from_list(Attrs) ->
|
|
{rdnSequence,
|
|
[[#'AttributeTypeAndValue'{
|
|
type = AttrName,
|
|
value = public_key:der_encode('X520CommonName', {printableString, AttrVal})
|
|
}] || {AttrName, AttrVal} <- Attrs]}.
|
|
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%%
|
|
%% Useful funs
|
|
%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
-spec location_to_id(url()) -> {ok, string()} | {error, not_found}.
|
|
location_to_id(Url0) ->
|
|
Url = string:strip(Url0, right, $/),
|
|
case string:rchr(Url, $/) of
|
|
0 ->
|
|
?ERROR_MSG("Couldn't find id in url: ~p~n", [Url]),
|
|
{error, not_found};
|
|
Ind ->
|
|
{ok, string:sub_string(Url, Ind+1)}
|
|
end.
|
|
|
|
-spec get_challenges(proplist()) -> [{proplist()}].
|
|
get_challenges(Body) ->
|
|
{<<"challenges">>, Challenges} = proplists:lookup(<<"challenges">>, Body),
|
|
Challenges.
|
|
|
|
-spec not_before_not_after() -> {binary(), binary()}.
|
|
not_before_not_after() ->
|
|
{Date, Time} = calendar:universal_time(),
|
|
NotBefore = encode_calendar_datetime({Date, Time}),
|
|
%% The certificate will be valid for 90 Days after today
|
|
AfterDate = add_days_to_date(90, Date),
|
|
NotAfter = encode_calendar_datetime({AfterDate, Time}),
|
|
{NotBefore, NotAfter}.
|
|
|
|
-spec to_public(jose_jwk:key()) -> jose_jwk:key().
|
|
to_public(PrivateKey) ->
|
|
jose_jwk:to_public(PrivateKey).
|
|
|
|
-spec pem_to_certificate(pem()) -> #'Certificate'{}.
|
|
pem_to_certificate(Pem) ->
|
|
PemList = public_key:pem_decode(Pem),
|
|
PemEntryCert = lists:keyfind('Certificate', 1, PemList),
|
|
Certificate = public_key:pem_entry_decode(PemEntryCert),
|
|
Certificate.
|
|
|
|
-spec add_days_to_date(integer(), calendar:date()) -> calendar:date().
|
|
add_days_to_date(Days, Date) ->
|
|
Date1 = calendar:date_to_gregorian_days(Date),
|
|
calendar:gregorian_days_to_date(Date1 + Days).
|
|
|
|
-spec encode_calendar_datetime(calendar:datetime()) -> binary().
|
|
encode_calendar_datetime({{Year, Month, Day}, {Hour, Minute, Second}}) ->
|
|
list_to_binary(io_lib:format("~4..0B-~2..0B-~2..0BT"
|
|
"~2..0B:~2..0B:~2..0BZ",
|
|
[Year, Month, Day, Hour, Minute, Second])).
|
|
|
|
%% TODO: Find a better and more robust way to parse the utc string
|
|
-spec utc_string_to_datetime(string()) -> calendar:datetime().
|
|
utc_string_to_datetime(UtcString) ->
|
|
try
|
|
[Y1,Y2,MO1,MO2,D1,D2,H1,H2,MI1,MI2,S1,S2,$Z] = UtcString,
|
|
Year = list_to_integer("20" ++ [Y1,Y2]),
|
|
Month = list_to_integer([MO1, MO2]),
|
|
Day = list_to_integer([D1,D2]),
|
|
Hour = list_to_integer([H1,H2]),
|
|
Minute = list_to_integer([MI1,MI2]),
|
|
Second = list_to_integer([S1,S2]),
|
|
{{Year, Month, Day}, {Hour, Minute, Second}}
|
|
catch
|
|
_:_ ->
|
|
?ERROR_MSG("Unable to parse UTC string", []),
|
|
throw({error, utc_string_to_datetime})
|
|
end.
|
|
|
|
-spec find_private_key_in_pem(pem()) -> {ok, jose_jwk:key()} | false.
|
|
find_private_key_in_pem(Pem) ->
|
|
PemList = public_key:pem_decode(Pem),
|
|
case find_private_key_in_pem1(private_key_types(), PemList) of
|
|
false ->
|
|
false;
|
|
PemKey ->
|
|
Key = public_key:pem_entry_decode(PemKey),
|
|
JoseKey = jose_jwk:from_key(Key),
|
|
{ok, JoseKey}
|
|
end.
|
|
|
|
|
|
-spec find_private_key_in_pem1([public_key:pki_asn1_type()],
|
|
[public_key:pem_entry()]) ->
|
|
public_key:pem_entry() | false.
|
|
find_private_key_in_pem1([], _PemList) ->
|
|
false;
|
|
find_private_key_in_pem1([Type|Types], PemList) ->
|
|
case lists:keyfind(Type, 1, PemList) of
|
|
false ->
|
|
find_private_key_in_pem1(Types, PemList);
|
|
Key ->
|
|
Key
|
|
end.
|
|
|
|
|
|
-spec parse_domain_string(string()) -> [string()].
|
|
parse_domain_string(DomainString) ->
|
|
string:tokens(DomainString, ";").
|
|
|
|
-spec private_key_types() -> [public_key:pki_asn1_type()].
|
|
private_key_types() ->
|
|
['RSAPrivateKey',
|
|
'DSAPrivateKey',
|
|
'ECPrivateKey'].
|
|
|
|
-spec find_all_sub_domains(binary()) -> [binary()].
|
|
find_all_sub_domains(DomainName) ->
|
|
AllRoutes = ejabberd_router:get_all_routes(),
|
|
DomainLen = size(DomainName),
|
|
[Route || Route <- AllRoutes,
|
|
binary:longest_common_suffix([DomainName, Route])
|
|
=:= DomainLen].
|
|
|
|
|
|
-spec is_error(_) -> boolean().
|
|
is_error({error, _}) -> true;
|
|
is_error({error, _, _}) -> true;
|
|
is_error(_) -> false.
|
|
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%%
|
|
%% Handle the persistent data structure
|
|
%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
-spec data_empty() -> [].
|
|
data_empty() ->
|
|
[].
|
|
|
|
%%
|
|
%% Account
|
|
%%
|
|
|
|
-spec data_get_account(acme_data()) -> {ok, list(), url(), jose_jwk:key()} | none.
|
|
data_get_account(Data) ->
|
|
case lists:keyfind(account, 1, Data) of
|
|
{account, #data_acc{id = AccId, ca_url = CAUrl, key = PrivateKey}} ->
|
|
{ok, AccId, CAUrl, PrivateKey};
|
|
false ->
|
|
none
|
|
end.
|
|
|
|
-spec data_set_account(acme_data(), {list(), url(), jose_jwk:key()}) -> acme_data().
|
|
data_set_account(Data, {AccId, CAUrl, PrivateKey}) ->
|
|
NewAcc = {account, #data_acc{id = AccId, ca_url = CAUrl, key = PrivateKey}},
|
|
lists:keystore(account, 1, Data, NewAcc).
|
|
|
|
%%
|
|
%% Certificates
|
|
%%
|
|
|
|
-spec data_get_certificates(acme_data()) -> data_certs().
|
|
data_get_certificates(Data) ->
|
|
case lists:keyfind(certs, 1, Data) of
|
|
{certs, Certs} ->
|
|
Certs;
|
|
false ->
|
|
[]
|
|
end.
|
|
|
|
-spec data_set_certificates(acme_data(), data_certs()) -> acme_data().
|
|
data_set_certificates(Data, NewCerts) ->
|
|
lists:keystore(certs, 1, Data, {certs, NewCerts}).
|
|
|
|
%% ATM we preserve one certificate for each domain
|
|
-spec data_add_certificate(acme_data(), data_cert()) -> acme_data().
|
|
data_add_certificate(Data, DataCert = #data_cert{domain=Domain}) ->
|
|
Certs = data_get_certificates(Data),
|
|
NewCerts = lists:keystore(Domain, 1, Certs, {Domain, DataCert}),
|
|
data_set_certificates(Data, NewCerts).
|
|
|
|
-spec data_remove_certificate(acme_data(), data_cert()) -> acme_data().
|
|
data_remove_certificate(Data, _DataCert = #data_cert{domain=Domain}) ->
|
|
Certs = data_get_certificates(Data),
|
|
NewCerts = lists:keydelete(Domain, 1, Certs),
|
|
data_set_certificates(Data, NewCerts).
|
|
|
|
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
%%
|
|
%% Handle Config and Persistence Files
|
|
%%
|
|
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
|
|
|
-spec persistent_file() -> file:filename().
|
|
persistent_file() ->
|
|
AcmeDir = acme_certs_dir(),
|
|
filename:join(AcmeDir, "acme.DAT").
|
|
|
|
%% The persistent file should be read and written only by its owner
|
|
-spec file_mode() -> 384.
|
|
file_mode() ->
|
|
8#600.
|
|
|
|
-spec read_persistent() -> {ok, acme_data()} | no_return().
|
|
read_persistent() ->
|
|
case file:read_file(persistent_file()) of
|
|
{ok, Binary} ->
|
|
{ok, binary_to_term(Binary)};
|
|
{error, enoent} ->
|
|
create_persistent(),
|
|
{ok, data_empty()};
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p reading acme data file", [Reason]),
|
|
throw({error, Reason})
|
|
end.
|
|
|
|
-spec write_persistent(acme_data()) -> ok | no_return().
|
|
write_persistent(Data) ->
|
|
Binary = term_to_binary(Data),
|
|
case file:write_file(persistent_file(), Binary) of
|
|
ok -> ok;
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p writing acme data file", [Reason]),
|
|
throw({error, Reason})
|
|
end.
|
|
|
|
-spec create_persistent() -> ok | no_return().
|
|
create_persistent() ->
|
|
Binary = term_to_binary(data_empty()),
|
|
case file:write_file(persistent_file(), Binary) of
|
|
ok ->
|
|
case file:change_mode(persistent_file(), file_mode()) of
|
|
ok -> ok;
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p changing acme data file mode", [Reason]),
|
|
throw({error, Reason})
|
|
end;
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p creating acme data file", [Reason]),
|
|
throw({error, Reason})
|
|
end.
|
|
|
|
-spec write_account_persistent({list(), url(), jose_jwk:key()}) -> ok | no_return().
|
|
write_account_persistent({AccId, CAUrl, PrivateKey}) ->
|
|
{ok, Data} = read_persistent(),
|
|
NewData = data_set_account(Data, {AccId, CAUrl, PrivateKey}),
|
|
ok = write_persistent(NewData).
|
|
|
|
-spec read_account_persistent() -> {ok, list(), url(), jose_jwk:key()} | none.
|
|
read_account_persistent() ->
|
|
{ok, Data} = read_persistent(),
|
|
data_get_account(Data).
|
|
|
|
-spec read_certificates_persistent() -> data_certs().
|
|
read_certificates_persistent() ->
|
|
{ok, Data} = read_persistent(),
|
|
data_get_certificates(Data).
|
|
|
|
-spec add_certificate_persistent(data_cert()) -> ok.
|
|
add_certificate_persistent(DataCert) ->
|
|
{ok, Data} = read_persistent(),
|
|
NewData = data_add_certificate(Data, DataCert),
|
|
ok = write_persistent(NewData).
|
|
|
|
-spec remove_certificate_persistent(data_cert()) -> ok.
|
|
remove_certificate_persistent(DataCert) ->
|
|
{ok, Data} = read_persistent(),
|
|
NewData = data_remove_certificate(Data, DataCert),
|
|
ok = write_persistent(NewData).
|
|
|
|
-spec save_certificate({ok, binary(), binary()} | {error, _, _}) ->
|
|
{ok, binary(), saved} | {error, binary(), _}.
|
|
save_certificate({error, _, _} = Error) ->
|
|
Error;
|
|
save_certificate({ok, DomainName, Cert}) ->
|
|
try
|
|
CertDir = acme_certs_dir(),
|
|
DomainString = bitstring_to_list(DomainName),
|
|
CertificateFile = filename:join([CertDir, DomainString ++ ".pem"]),
|
|
%% TODO: At some point do the following using a Transaction so
|
|
%% that there is no certificate saved if it cannot be added in
|
|
%% certificate persistent storage
|
|
write_cert(CertificateFile, Cert, DomainName),
|
|
{ok, _} = ejabberd_pkix:add_certfile(CertificateFile),
|
|
DataCert = #data_cert{
|
|
domain = DomainName,
|
|
pem = Cert,
|
|
path = CertificateFile
|
|
},
|
|
add_certificate_persistent(DataCert),
|
|
{ok, DomainName, saved}
|
|
catch
|
|
throw:Throw ->
|
|
Throw;
|
|
?EX_RULE(E, R, St) ->
|
|
StackTrace = ?EX_STACK(St),
|
|
?ERROR_MSG("Unknown ~p:~p, ~p", [E, R, StackTrace]),
|
|
{error, DomainName, saving}
|
|
end.
|
|
|
|
-spec save_renewed_certificate({ok, binary(), _} | {error, _, _}) ->
|
|
{ok, binary(), _} | {error, binary(), _}.
|
|
save_renewed_certificate({error, _, _} = Error) ->
|
|
Error;
|
|
save_renewed_certificate({ok, _, no_expire} = Cert) ->
|
|
Cert;
|
|
save_renewed_certificate({ok, DomainName, Cert}) ->
|
|
save_certificate({ok, DomainName, Cert}).
|
|
|
|
-spec register_certfiles() -> ok.
|
|
register_certfiles() ->
|
|
Dir = acme_certs_dir(),
|
|
Paths = filelib:wildcard(filename:join(Dir, "*.pem")),
|
|
lists:foreach(
|
|
fun(Path) ->
|
|
ejabberd_pkix:add_certfile(Path)
|
|
end, Paths).
|
|
|
|
-spec write_cert(file:filename(), binary(), binary()) -> ok.
|
|
write_cert(CertificateFile, Cert, DomainName) ->
|
|
case file:write_file(CertificateFile, Cert) of
|
|
ok ->
|
|
case file:change_mode(CertificateFile, file_mode()) of
|
|
ok -> ok;
|
|
{error, Why} ->
|
|
?WARNING_MSG("Failed to change mode of file ~s: ~s",
|
|
[CertificateFile, file:format_error(Why)])
|
|
end;
|
|
{error, Reason} ->
|
|
?ERROR_MSG("Error: ~p saving certificate at file: ~p",
|
|
[Reason, CertificateFile]),
|
|
throw({error, DomainName, saving})
|
|
end.
|
|
|
|
-spec get_config_contact() -> binary().
|
|
get_config_contact() ->
|
|
Acme = ejabberd_option:acme(),
|
|
try maps:get(contact, Acme)
|
|
catch _:{badkey, _} ->
|
|
?WARNING_MSG("No contact has been specified in configuration", []),
|
|
?DEFAULT_CONFIG_CONTACT
|
|
end.
|
|
|
|
-spec get_config_ca_url() -> url().
|
|
get_config_ca_url() ->
|
|
Acme = ejabberd_option:acme(),
|
|
try maps:get(ca_url, Acme)
|
|
catch _:{badkey, _} ->
|
|
?ERROR_MSG("No CA url has been specified in configuration", []),
|
|
?DEFAULT_CONFIG_CA_URL
|
|
end.
|
|
|
|
-spec get_config_hosts() -> [binary()].
|
|
get_config_hosts() ->
|
|
ejabberd_option:hosts().
|
|
|
|
-spec acme_certs_dir() -> file:filename().
|
|
acme_certs_dir() ->
|
|
filename:join(ejabberd_pkix:certs_dir(), "acme").
|
|
|
|
generate_key() ->
|
|
jose_jwk:generate_key({ec, secp256r1}).
|