mirror of
https://github.com/traefik/traefik.git
synced 2025-09-20 21:31:14 +02:00
Add new certificatesresolvers options
This commit is contained in:
Ludovic Fernandez
GitHub
parent
02443545e7
commit
a090452807
@ -201,6 +201,36 @@ when using the `TLS-ALPN-01` challenge, Traefik must be reachable by Let's Encry
|
||||
--certificatesresolvers.myresolver.acme.tlschallenge=true
|
||||
```
|
||||
|
||||
#### `Delay`
|
||||
|
||||
_Optional, Default=0_
|
||||
|
||||
The delay between the creation of the challenge and the validation.
|
||||
A value lower than or equal to zero means no delay.
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
certificatesResolvers:
|
||||
myresolver:
|
||||
acme:
|
||||
# ...
|
||||
tlsChallenge:
|
||||
# ...
|
||||
delay: 12
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[certificatesResolvers.myresolver.acme]
|
||||
# ...
|
||||
[certificatesResolvers.myresolver.acme.tlsChallenge]
|
||||
# ...
|
||||
delay = 12
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
# ...
|
||||
--certificatesresolvers.myresolver.acme.tlschallenge.delay=12
|
||||
```
|
||||
|
||||
### `httpChallenge`
|
||||
|
||||
Use the `HTTP-01` challenge to generate and renew ACME certificates by provisioning an HTTP resource under a well-known URI.
|
||||
@ -252,6 +282,8 @@ when using the `HTTP-01` challenge, `certificatesresolvers.myresolver.acme.httpc
|
||||
|
||||
#### `Delay`
|
||||
|
||||
_Optional, Default=0_
|
||||
|
||||
The delay between the creation of the challenge and the validation.
|
||||
A value lower than or equal to zero means no delay.
|
||||
|
||||
@ -998,6 +1030,39 @@ certificatesResolvers:
|
||||
# ...
|
||||
```
|
||||
|
||||
### `disableCommonName`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
||||
Disable common name inside CSR and certificates.
|
||||
|
||||
It's recommended to disable the common name and required to get a certificate for IP.
|
||||
|
||||
- https://letsencrypt.org/docs/profiles/#certificate-common-name
|
||||
- https://community.letsencrypt.org/t/ip-san-error-csr-contains-ip-address-in-common-name/239012/7
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
certificatesResolvers:
|
||||
myresolver:
|
||||
acme:
|
||||
# ...
|
||||
disableCommonName: true
|
||||
# ...
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[certificatesResolvers.myresolver.acme]
|
||||
# ...
|
||||
disableCommonName = true
|
||||
# ...
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
# ...
|
||||
--certificatesresolvers.myresolver.acme.disableCommonName=true
|
||||
# ...
|
||||
```
|
||||
|
||||
### `keyType`
|
||||
|
||||
_Optional, Default="RSA4096"_
|
||||
|
||||
@ -73,30 +73,32 @@ certificatesResolvers:
|
||||
|
||||
ACME certificate resolvers have the following configuration options:
|
||||
|
||||
| Field | Description | Default | Required |
|
||||
|:--------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------|:---------|
|
||||
| `acme.email` | Email address used for registration. | "" | Yes |
|
||||
| `acme.caServer` | CA server to use. | https://acme-v02.api.letsencrypt.org/directory | No |
|
||||
| `acme.preferredChain` | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used. | "" | No |
|
||||
| `acme.keyType` | KeyType to use. | "RSA4096" | No |
|
||||
| `acme.eab` | Enable external account binding. | | No |
|
||||
| `acme.eab.kid` | Key identifier from External CA. | "" | No |
|
||||
| `acme.eab.hmacEncoded` | HMAC key from External CA, should be in Base64 URL Encoding without padding format. | "" | No |
|
||||
| `acme.certificatesDuration` | The certificates' duration in hours, exclusively used to determine renewal dates. | 2160 | No |
|
||||
| `acme.clientTimeout` | Timeout for HTTP Client used to communicate with the ACME server. | 2m | No |
|
||||
| `acme.clientResponseHeaderTimeout` | Timeout for response headers for HTTP Client used to communicate with the ACME server. | 30s | No |
|
||||
| `acme.dnsChallenge` | Enable DNS-01 challenge. More information [here](#dnschallenge). | - | No |
|
||||
| `acme.dnsChallenge.provider` | DNS provider to use. | "" | No |
|
||||
| `acme.dnsChallenge.resolvers` | DNS servers to resolve the FQDN authority. | [] | No |
|
||||
| `acme.dnsChallenge.propagation.delayBeforeChecks` | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries. | 0s | No |
|
||||
| `acme.dnsChallenge.propagation.disableChecks` | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding. | false | No |
|
||||
| `acme.dnsChallenge.propagation.requireAllRNS` | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead. | false | No |
|
||||
| `acme.dnsChallenge.propagation.disableANSChecks` | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable. | false | No |
|
||||
| `acme.httpChallenge` | Enable HTTP-01 challenge. More information [here](#httpchallenge). | | No |
|
||||
| `acme.httpChallenge.entryPoint` | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80 | "" | Yes |
|
||||
| `acme.httpChallenge.delay` | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay. | 0 | No |
|
||||
| `acme.tlsChallenge` | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge). | - | No |
|
||||
| `acme.storage` | File path used for certificates storage. | "acme.json" | Yes |
|
||||
| Field | Description | Default | Required |
|
||||
|:--------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------|:---------|
|
||||
| `acme.email` | Email address used for registration. | "" | Yes |
|
||||
| `acme.caServer` | CA server to use. | https://acme-v02.api.letsencrypt.org/directory | No |
|
||||
| `acme.preferredChain` | Preferred chain to use. If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used. | "" | No |
|
||||
| `acme.keyType` | KeyType to use. | "RSA4096" | No |
|
||||
| `acme.disableCommonName` | Disable common name inside CSR and certificates. | false | No |
|
||||
| `acme.eab` | Enable external account binding. | | No |
|
||||
| `acme.eab.kid` | Key identifier from External CA. | "" | No |
|
||||
| `acme.eab.hmacEncoded` | HMAC key from External CA, should be in Base64 URL Encoding without padding format. | "" | No |
|
||||
| `acme.certificatesDuration` | The certificates' duration in hours, exclusively used to determine renewal dates. | 2160 | No |
|
||||
| `acme.clientTimeout` | Timeout for HTTP Client used to communicate with the ACME server. | 2m | No |
|
||||
| `acme.clientResponseHeaderTimeout` | Timeout for response headers for HTTP Client used to communicate with the ACME server. | 30s | No |
|
||||
| `acme.dnsChallenge` | Enable DNS-01 challenge. More information [here](#dnschallenge). | - | No |
|
||||
| `acme.dnsChallenge.provider` | DNS provider to use. | "" | No |
|
||||
| `acme.dnsChallenge.resolvers` | DNS servers to resolve the FQDN authority. | [] | No |
|
||||
| `acme.dnsChallenge.propagation.delayBeforeChecks` | By default, the provider will verify the TXT DNS challenge record before letting ACME verify. If `delayBeforeCheck` is greater than zero, this check is delayed for the configured duration in seconds. This is Useful if internal networks block external DNS queries. | 0s | No |
|
||||
| `acme.dnsChallenge.propagation.disableChecks` | Disables the challenge TXT record propagation checks, before notifying ACME that the DNS challenge is ready. Please note that disabling checks can prevent the challenge from succeeding. | false | No |
|
||||
| `acme.dnsChallenge.propagation.requireAllRNS` | Enables the challenge TXT record to be propagated to all recursive nameservers. If you have disabled authoritative nameservers checks (with `propagation.disableANSChecks`), it is recommended to check all recursive nameservers instead. | false | No |
|
||||
| `acme.dnsChallenge.propagation.disableANSChecks` | Disables the challenge TXT record propagation checks against authoritative nameservers. This option will skip the propagation check against the nameservers of the authority (SOA). It should be used only if the nameservers of the authority are not reachable. | false | No |
|
||||
| `acme.httpChallenge` | Enable HTTP-01 challenge. More information [here](#httpchallenge). | | No |
|
||||
| `acme.httpChallenge.entryPoint` | EntryPoint to use for the HTTP-01 challenges. Must be reachable by Let's Encrypt through port 80 | "" | Yes |
|
||||
| `acme.httpChallenge.delay` | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay. | 0 | No |
|
||||
| `acme.tlsChallenge` | Enable TLS-ALPN-01 challenge. Traefik must be reachable by Let's Encrypt through port 443. More information [here](#tlschallenge). | - | No |
|
||||
| `acme.tlschallenge.delay` | The delay between the creation of the challenge and the validation. A value lower than or equal to zero means no delay. | 0 | No |
|
||||
| `acme.storage` | File path used for certificates storage. | "acme.json" | Yes |
|
||||
|
||||
## Automatic Certificate Renewal
|
||||
|
||||
|
||||
@ -135,6 +135,9 @@ Timeout for receiving the response headers when communicating with the ACME serv
|
||||
`--certificatesresolvers.<name>.acme.clienttimeout`:
|
||||
Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
|
||||
|
||||
`--certificatesresolvers.<name>.acme.disablecommonname`:
|
||||
Disable the common name in the CSR. (Default: ```false```)
|
||||
|
||||
`--certificatesresolvers.<name>.acme.dnschallenge`:
|
||||
Activate DNS-01 Challenge. (Default: ```false```)
|
||||
|
||||
@ -199,7 +202,10 @@ Certificate profile to use.
|
||||
Storage to use. (Default: ```acme.json```)
|
||||
|
||||
`--certificatesresolvers.<name>.acme.tlschallenge`:
|
||||
Activate TLS-ALPN-01 Challenge. (Default: ```true```)
|
||||
Activate TLS-ALPN-01 Challenge. (Default: ```false```)
|
||||
|
||||
`--certificatesresolvers.<name>.acme.tlschallenge.delay`:
|
||||
Delay between the creation of the challenge and the validation. (Default: ```0```)
|
||||
|
||||
`--certificatesresolvers.<name>.tailscale`:
|
||||
Enables Tailscale certificate resolution. (Default: ```true```)
|
||||
|
||||
@ -135,6 +135,9 @@ Timeout for receiving the response headers when communicating with the ACME serv
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_CLIENTTIMEOUT`:
|
||||
Timeout for a complete HTTP transaction with the ACME server. (Default: ```120```)
|
||||
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_DISABLECOMMONNAME`:
|
||||
Disable the common name in the CSR. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_DNSCHALLENGE`:
|
||||
Activate DNS-01 Challenge. (Default: ```false```)
|
||||
|
||||
@ -199,7 +202,10 @@ Certificate profile to use.
|
||||
Storage to use. (Default: ```acme.json```)
|
||||
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_TLSCHALLENGE`:
|
||||
Activate TLS-ALPN-01 Challenge. (Default: ```true```)
|
||||
Activate TLS-ALPN-01 Challenge. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_ACME_TLSCHALLENGE_DELAY`:
|
||||
Delay between the creation of the challenge and the validation. (Default: ```0```)
|
||||
|
||||
`TRAEFIK_CERTIFICATESRESOLVERS_<NAME>_TAILSCALE`:
|
||||
Enables Tailscale certificate resolution. (Default: ```true```)
|
||||
|
||||
@ -528,6 +528,7 @@
|
||||
preferredChain = "foobar"
|
||||
profile = "foobar"
|
||||
emailAddresses = ["foobar", "foobar"]
|
||||
disableCommonName = true
|
||||
storage = "foobar"
|
||||
keyType = "foobar"
|
||||
certificatesDuration = 42
|
||||
@ -553,6 +554,7 @@
|
||||
entryPoint = "foobar"
|
||||
delay = "42s"
|
||||
[certificatesResolvers.CertificateResolver0.acme.tlsChallenge]
|
||||
delay = "42s"
|
||||
[certificatesResolvers.CertificateResolver0.tailscale]
|
||||
[certificatesResolvers.CertificateResolver1]
|
||||
[certificatesResolvers.CertificateResolver1.acme]
|
||||
@ -561,6 +563,7 @@
|
||||
preferredChain = "foobar"
|
||||
profile = "foobar"
|
||||
emailAddresses = ["foobar", "foobar"]
|
||||
disableCommonName = true
|
||||
storage = "foobar"
|
||||
keyType = "foobar"
|
||||
certificatesDuration = 42
|
||||
@ -586,6 +589,7 @@
|
||||
entryPoint = "foobar"
|
||||
delay = "42s"
|
||||
[certificatesResolvers.CertificateResolver1.acme.tlsChallenge]
|
||||
delay = "42s"
|
||||
[certificatesResolvers.CertificateResolver1.tailscale]
|
||||
|
||||
[experimental]
|
||||
|
||||
@ -573,6 +573,7 @@ certificatesResolvers:
|
||||
emailAddresses:
|
||||
- foobar
|
||||
- foobar
|
||||
disableCommonName: true
|
||||
storage: foobar
|
||||
keyType: foobar
|
||||
eab:
|
||||
@ -601,7 +602,8 @@ certificatesResolvers:
|
||||
httpChallenge:
|
||||
entryPoint: foobar
|
||||
delay: 42s
|
||||
tlsChallenge: {}
|
||||
tlsChallenge:
|
||||
delay: 42s
|
||||
tailscale: {}
|
||||
CertificateResolver1:
|
||||
acme:
|
||||
@ -612,6 +614,7 @@ certificatesResolvers:
|
||||
emailAddresses:
|
||||
- foobar
|
||||
- foobar
|
||||
disableCommonName: true
|
||||
storage: foobar
|
||||
keyType: foobar
|
||||
eab:
|
||||
@ -640,7 +643,8 @@ certificatesResolvers:
|
||||
httpChallenge:
|
||||
entryPoint: foobar
|
||||
delay: 42s
|
||||
tlsChallenge: {}
|
||||
tlsChallenge:
|
||||
delay: 42s
|
||||
tailscale: {}
|
||||
experimental:
|
||||
plugins:
|
||||
|
||||
@ -21,6 +21,7 @@ import (
|
||||
"github.com/go-acme/lego/v4/challenge"
|
||||
"github.com/go-acme/lego/v4/challenge/dns01"
|
||||
"github.com/go-acme/lego/v4/challenge/http01"
|
||||
"github.com/go-acme/lego/v4/challenge/tlsalpn01"
|
||||
"github.com/go-acme/lego/v4/lego"
|
||||
"github.com/go-acme/lego/v4/providers/dns"
|
||||
"github.com/go-acme/lego/v4/registration"
|
||||
@ -45,6 +46,7 @@ type Configuration struct {
|
||||
PreferredChain string `description:"Preferred chain to use." json:"preferredChain,omitempty" toml:"preferredChain,omitempty" yaml:"preferredChain,omitempty" export:"true"`
|
||||
Profile string `description:"Certificate profile to use." json:"profile,omitempty" toml:"profile,omitempty" yaml:"profile,omitempty" export:"true"`
|
||||
EmailAddresses []string `description:"CSR email addresses to use." json:"emailAddresses,omitempty" toml:"emailAddresses,omitempty" yaml:"emailAddresses,omitempty"`
|
||||
DisableCommonName bool `description:"Disable the common name in the CSR." json:"disableCommonName,omitempty" toml:"disableCommonName,omitempty" yaml:"disableCommonName,omitempty" export:"true"`
|
||||
Storage string `description:"Storage to use." json:"storage,omitempty" toml:"storage,omitempty" yaml:"storage,omitempty" export:"true"`
|
||||
KeyType string `description:"KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'." json:"keyType,omitempty" toml:"keyType,omitempty" yaml:"keyType,omitempty" export:"true"`
|
||||
EAB *EAB `description:"External Account Binding to use." json:"eab,omitempty" toml:"eab,omitempty" yaml:"eab,omitempty"`
|
||||
@ -117,7 +119,9 @@ type HTTPChallenge struct {
|
||||
}
|
||||
|
||||
// TLSChallenge contains TLS challenge configuration.
|
||||
type TLSChallenge struct{}
|
||||
type TLSChallenge struct {
|
||||
Delay ptypes.Duration `description:"Delay between the creation of the challenge and the validation." json:"delay,omitempty" toml:"delay,omitempty" yaml:"delay,omitempty" export:"true"`
|
||||
}
|
||||
|
||||
// Provider holds configurations of the provider.
|
||||
type Provider struct {
|
||||
@ -292,6 +296,7 @@ func (p *Provider) getClient() (*lego.Client, error) {
|
||||
config.CADirURL = caServer
|
||||
config.Certificate.KeyType = GetKeyType(ctx, p.KeyType)
|
||||
config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
|
||||
config.Certificate.DisableCommonName = p.DisableCommonName
|
||||
|
||||
config.HTTPClient, err = p.createHTTPClient()
|
||||
if err != nil {
|
||||
@ -371,7 +376,7 @@ func (p *Provider) getClient() (*lego.Client, error) {
|
||||
if p.TLSChallenge != nil {
|
||||
logger.Debug().Msg("Using TLS Challenge provider.")
|
||||
|
||||
err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider)
|
||||
err = client.Challenge.SetTLSALPN01Provider(p.TLSChallengeProvider, tlsalpn01.SetDelay(time.Duration(p.TLSChallenge.Delay)))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user