580 lines
19 KiB
Go
580 lines
19 KiB
Go
package certificate
|
||
|
||
import (
|
||
"bytes"
|
||
"context"
|
||
"crypto/sha256"
|
||
"crypto/tls"
|
||
"crypto/x509"
|
||
"encoding/json"
|
||
"encoding/pem"
|
||
"errors"
|
||
"fmt"
|
||
"os"
|
||
"path/filepath"
|
||
"runtime"
|
||
"sort"
|
||
"strings"
|
||
"time"
|
||
)
|
||
|
||
type Issuer interface {
|
||
Obtain(ctx context.Context, request ObtainRequest) (Resource, error)
|
||
}
|
||
|
||
type ObtainRequest struct {
|
||
Domains []string
|
||
AccountEmail string
|
||
Environment string
|
||
PreferredChain string
|
||
}
|
||
|
||
type Resource struct {
|
||
Domains []string
|
||
Certificate []byte
|
||
IssuerCertificate []byte
|
||
PrivateKey []byte
|
||
NotBefore time.Time
|
||
NotAfter time.Time
|
||
}
|
||
|
||
type SavedResource struct {
|
||
Domain string `json:"domain"`
|
||
CertificateType string `json:"certificate_type,omitempty"`
|
||
Version string `json:"version,omitempty"`
|
||
SANs []string `json:"sans,omitempty"`
|
||
SerialNumber string `json:"serial_number,omitempty"`
|
||
FingerprintSHA256 string `json:"fingerprint_sha256,omitempty"`
|
||
ChainLength int `json:"chain_length,omitempty"`
|
||
Directory string `json:"directory"`
|
||
CertificatePath string `json:"certificate_path"`
|
||
FullChainPath string `json:"fullchain_path"`
|
||
PrivateKeyPath string `json:"private_key_path"`
|
||
NotBefore time.Time `json:"not_before"`
|
||
NotAfter time.Time `json:"not_after"`
|
||
BackupDirectory string `json:"backup_directory,omitempty"`
|
||
}
|
||
|
||
type FileStore struct {
|
||
Root string
|
||
BackupRoot string
|
||
Now func() time.Time
|
||
}
|
||
|
||
func NormalizeDomains(domains []string) ([]string, error) {
|
||
seen := make(map[string]struct{}, len(domains))
|
||
result := make([]string, 0, len(domains))
|
||
for _, value := range domains {
|
||
value = strings.ToLower(strings.TrimSuffix(strings.TrimSpace(value), "."))
|
||
if value == "" {
|
||
continue
|
||
}
|
||
if strings.HasPrefix(value, "*.") {
|
||
value = "*." + strings.TrimPrefix(value, "*.")
|
||
}
|
||
if !validDomain(value) {
|
||
return nil, fmt.Errorf("证书域名无效：%s", value)
|
||
}
|
||
if _, exists := seen[value]; exists {
|
||
continue
|
||
}
|
||
seen[value] = struct{}{}
|
||
result = append(result, value)
|
||
}
|
||
if len(result) == 0 {
|
||
return nil, errors.New("证书域名不能为空")
|
||
}
|
||
sort.Strings(result)
|
||
return result, nil
|
||
}
|
||
|
||
func ValidateResource(resource Resource) (Resource, error) {
|
||
if len(resource.Certificate) == 0 || len(resource.PrivateKey) == 0 {
|
||
return Resource{}, errors.New("证书和私钥不能为空")
|
||
}
|
||
certificate, err := parseLeafCertificate(resource.Certificate)
|
||
if err != nil {
|
||
return Resource{}, fmt.Errorf("解析证书失败：%w", err)
|
||
}
|
||
if _, err := tls.X509KeyPair(resource.Certificate, resource.PrivateKey); err != nil {
|
||
return Resource{}, fmt.Errorf("证书与私钥不匹配：%w", err)
|
||
}
|
||
domains, err := NormalizeDomains(resource.Domains)
|
||
if err != nil {
|
||
return Resource{}, err
|
||
}
|
||
if resource.NotBefore.IsZero() {
|
||
resource.NotBefore = certificate.NotBefore
|
||
}
|
||
if resource.NotAfter.IsZero() {
|
||
resource.NotAfter = certificate.NotAfter
|
||
}
|
||
if !resource.NotAfter.After(resource.NotBefore) {
|
||
return Resource{}, errors.New("证书有效期无效")
|
||
}
|
||
resource.Domains = domains
|
||
if len(resource.IssuerCertificate) > 0 {
|
||
if _, err := parseLeafCertificate(resource.IssuerCertificate); err != nil {
|
||
return Resource{}, fmt.Errorf("解析签发者证书失败：%w", err)
|
||
}
|
||
}
|
||
return resource, nil
|
||
}
|
||
|
||
// ValidateResourceForDomains 校验证书内容，并确认叶子证书覆盖全部申请域名。
|
||
func ValidateResourceForDomains(resource Resource, expected []string) (Resource, error) {
|
||
resource, err := ValidateResource(resource)
|
||
if err != nil {
|
||
return Resource{}, err
|
||
}
|
||
wanted, err := NormalizeDomains(expected)
|
||
if err != nil {
|
||
return Resource{}, err
|
||
}
|
||
leaf, err := parseLeafCertificate(resource.Certificate)
|
||
if err != nil {
|
||
return Resource{}, fmt.Errorf("解析证书失败：%w", err)
|
||
}
|
||
now := time.Now().UTC()
|
||
if now.Before(leaf.NotBefore) {
|
||
return Resource{}, fmt.Errorf("证书尚未生效：%s", leaf.NotBefore.UTC().Format(time.RFC3339))
|
||
}
|
||
if !now.Before(leaf.NotAfter) {
|
||
return Resource{}, fmt.Errorf("证书已经过期：%s", leaf.NotAfter.UTC().Format(time.RFC3339))
|
||
}
|
||
for _, name := range wanted {
|
||
probe := name
|
||
if strings.HasPrefix(probe, "*.") {
|
||
probe = "scert-wildcard-probe." + strings.TrimPrefix(probe, "*.")
|
||
}
|
||
if err := leaf.VerifyHostname(probe); err != nil {
|
||
return Resource{}, fmt.Errorf("证书不覆盖域名 %s：%w", name, err)
|
||
}
|
||
}
|
||
return resource, nil
|
||
}
|
||
|
||
func (s FileStore) Save(ctx context.Context, domain string, resource Resource) (SavedResource, error) {
|
||
return s.save(ctx, domain, "", resource)
|
||
}
|
||
|
||
// SaveForType 按证书类型保存当前证书和历史版本。
|
||
func (s FileStore) SaveForType(ctx context.Context, domain, certificateType string, resource Resource) (SavedResource, error) {
|
||
return s.save(ctx, domain, certificateType, resource)
|
||
}
|
||
|
||
func (s FileStore) save(ctx context.Context, domain, certificateType string, resource Resource) (SavedResource, error) {
|
||
if err := ctx.Err(); err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
resource, err := ValidateResource(resource)
|
||
if err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
primary := strings.TrimSpace(domain)
|
||
if primary == "" {
|
||
primary = resource.Domains[0]
|
||
}
|
||
if _, err := NormalizeDomains([]string{primary}); err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
root := filepath.Clean(strings.TrimSpace(s.Root))
|
||
if root == "." || root == "" {
|
||
return SavedResource{}, errors.New("证书存储根目录不能为空")
|
||
}
|
||
baseDirectory := filepath.Join(root, directoryName(primary))
|
||
directory := baseDirectory
|
||
if certificateType != "" {
|
||
certificateType = strings.ToLower(strings.TrimSpace(certificateType))
|
||
if certificateType != "single" && certificateType != "wildcard" && certificateType != "san" {
|
||
return SavedResource{}, fmt.Errorf("证书类型无效：%s", certificateType)
|
||
}
|
||
directory = filepath.Join(baseDirectory, certificateType)
|
||
}
|
||
currentDirectory := directory
|
||
if certificateType != "" {
|
||
currentDirectory = filepath.Join(directory, "current")
|
||
}
|
||
if err := os.MkdirAll(currentDirectory, 0o700); err != nil {
|
||
return SavedResource{}, fmt.Errorf("创建证书目录失败：%w", err)
|
||
}
|
||
backupDirectory, err := s.backupExisting(currentDirectory, primary)
|
||
if err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
fullChain := resource.Certificate
|
||
if len(resource.IssuerCertificate) > 0 && !bytes.Contains(resource.Certificate, resource.IssuerCertificate) {
|
||
fullChain = append(append([]byte(nil), resource.Certificate...), resource.IssuerCertificate...)
|
||
}
|
||
version := ""
|
||
if certificateType != "" {
|
||
now := time.Now
|
||
if s.Now != nil {
|
||
now = s.Now
|
||
}
|
||
version = now().UTC().Format("20060102-150405.000000000")
|
||
versionDirectory := filepath.Join(directory, "versions", version)
|
||
for suffix := 1; ; suffix++ {
|
||
if _, statErr := os.Stat(versionDirectory); errors.Is(statErr, os.ErrNotExist) {
|
||
break
|
||
} else if statErr != nil {
|
||
return SavedResource{}, fmt.Errorf("读取证书版本目录失败：%w", statErr)
|
||
}
|
||
version = fmt.Sprintf("%s-%02d", now().UTC().Format("20060102-150405.000000000"), suffix)
|
||
versionDirectory = filepath.Join(directory, "versions", version)
|
||
}
|
||
if err := os.MkdirAll(versionDirectory, 0o700); err != nil {
|
||
return SavedResource{}, fmt.Errorf("创建证书版本目录失败：%w", err)
|
||
}
|
||
if err := writeCertificateFiles(versionDirectory, resource.Certificate, fullChain, resource.PrivateKey); err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
}
|
||
if err := writeCertificateFiles(currentDirectory, resource.Certificate, fullChain, resource.PrivateKey); err != nil {
|
||
return SavedResource{}, err
|
||
}
|
||
leaf, _ := parseLeafCertificate(resource.Certificate)
|
||
result := SavedResource{
|
||
Domain: primary, CertificateType: certificateType, Version: version, SANs: append([]string(nil), resource.Domains...),
|
||
Directory: currentDirectory, CertificatePath: filepath.Join(currentDirectory, "cert.pem"),
|
||
FullChainPath: filepath.Join(currentDirectory, "fullchain.pem"), PrivateKeyPath: filepath.Join(currentDirectory, "key.pem"),
|
||
NotBefore: resource.NotBefore, NotAfter: resource.NotAfter, BackupDirectory: backupDirectory,
|
||
ChainLength: certificateChainLength(fullChain),
|
||
}
|
||
if leaf != nil {
|
||
result.SerialNumber = leaf.SerialNumber.Text(16)
|
||
result.FingerprintSHA256 = fmt.Sprintf("%X", sha256.Sum256(leaf.Raw))
|
||
}
|
||
metadata, err := json.MarshalIndent(result, "", " ")
|
||
if err != nil {
|
||
return SavedResource{}, fmt.Errorf("生成证书元数据失败：%w", err)
|
||
}
|
||
if err := atomicWrite(filepath.Join(currentDirectory, "metadata.json"), metadata, 0o600); err != nil {
|
||
return SavedResource{}, fmt.Errorf("写入证书元数据失败：%w", err)
|
||
}
|
||
if certificateType != "" {
|
||
versionMetadata := filepath.Join(directory, "versions", version, "metadata.json")
|
||
if err := atomicWrite(versionMetadata, metadata, 0o600); err != nil {
|
||
return SavedResource{}, fmt.Errorf("写入历史证书元数据失败：%w", err)
|
||
}
|
||
}
|
||
return result, nil
|
||
}
|
||
|
||
func writeCertificateFiles(directory string, certificate, fullChain, privateKey []byte) error {
|
||
if err := atomicWrite(filepath.Join(directory, "cert.pem"), certificate, 0o644); err != nil {
|
||
return fmt.Errorf("写入证书文件失败：%w", err)
|
||
}
|
||
if err := atomicWrite(filepath.Join(directory, "fullchain.pem"), fullChain, 0o644); err != nil {
|
||
return fmt.Errorf("写入完整证书链失败：%w", err)
|
||
}
|
||
if err := atomicWrite(filepath.Join(directory, "key.pem"), privateKey, 0o600); err != nil {
|
||
return fmt.Errorf("写入私钥文件失败：%w", err)
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func certificateChainLength(data []byte) int {
|
||
count := 0
|
||
remaining := data
|
||
for len(remaining) > 0 {
|
||
block, rest := pem.Decode(remaining)
|
||
if block == nil {
|
||
break
|
||
}
|
||
remaining = rest
|
||
if block.Type == "CERTIFICATE" {
|
||
count++
|
||
}
|
||
}
|
||
return count
|
||
}
|
||
|
||
func (s FileStore) backupExisting(directory, domain string) (string, error) {
|
||
entries, err := os.ReadDir(directory)
|
||
if err != nil {
|
||
if errors.Is(err, os.ErrNotExist) {
|
||
return "", nil
|
||
}
|
||
return "", fmt.Errorf("读取原证书目录失败：%w", err)
|
||
}
|
||
if len(entries) == 0 {
|
||
return "", nil
|
||
}
|
||
backupRoot := filepath.Clean(strings.TrimSpace(s.BackupRoot))
|
||
if backupRoot == "." || backupRoot == "" {
|
||
return "", errors.New("证书备份根目录不能为空")
|
||
}
|
||
now := time.Now
|
||
if s.Now != nil {
|
||
now = s.Now
|
||
}
|
||
backupDirectory := filepath.Join(backupRoot, directoryName(domain), now().UTC().Format("20060102-150405.000000000"))
|
||
if err := os.MkdirAll(filepath.Dir(backupDirectory), 0o700); err != nil {
|
||
return "", fmt.Errorf("创建证书备份目录失败：%w", err)
|
||
}
|
||
if err := copyDirectory(directory, backupDirectory); err != nil {
|
||
return "", fmt.Errorf("备份原证书失败：%w", err)
|
||
}
|
||
return backupDirectory, nil
|
||
}
|
||
|
||
func atomicWrite(path string, data []byte, mode os.FileMode) error {
|
||
temporary, err := os.CreateTemp(filepath.Dir(path), ".scert-*")
|
||
if err != nil {
|
||
return err
|
||
}
|
||
temporaryName := temporary.Name()
|
||
defer os.Remove(temporaryName)
|
||
if err := temporary.Chmod(mode); err != nil {
|
||
_ = temporary.Close()
|
||
return err
|
||
}
|
||
if _, err := temporary.Write(data); err != nil {
|
||
_ = temporary.Close()
|
||
return err
|
||
}
|
||
if err := temporary.Sync(); err != nil {
|
||
_ = temporary.Close()
|
||
return err
|
||
}
|
||
if err := temporary.Close(); err != nil {
|
||
return err
|
||
}
|
||
if runtime.GOOS == "windows" {
|
||
if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
|
||
return err
|
||
}
|
||
}
|
||
return os.Rename(temporaryName, path)
|
||
}
|
||
|
||
func copyDirectory(source, target string) error {
|
||
entries, err := os.ReadDir(source)
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if err := os.MkdirAll(target, 0o700); err != nil {
|
||
return err
|
||
}
|
||
for _, entry := range entries {
|
||
if entry.IsDir() {
|
||
continue
|
||
}
|
||
data, err := os.ReadFile(filepath.Join(source, entry.Name()))
|
||
if err != nil {
|
||
return err
|
||
}
|
||
if err := atomicWrite(filepath.Join(target, entry.Name()), data, 0o600); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func parseLeafCertificate(data []byte) (*x509.Certificate, error) {
|
||
remaining := data
|
||
for len(remaining) > 0 {
|
||
block, rest := pem.Decode(remaining)
|
||
if block == nil {
|
||
break
|
||
}
|
||
remaining = rest
|
||
if block.Type != "CERTIFICATE" {
|
||
continue
|
||
}
|
||
return x509.ParseCertificate(block.Bytes)
|
||
}
|
||
return nil, errors.New("未找到 PEM 证书")
|
||
}
|
||
|
||
func directoryName(domain string) string {
|
||
name := strings.ToLower(strings.TrimSpace(domain))
|
||
name = strings.ReplaceAll(name, "*.", "_wildcard.")
|
||
name = strings.ReplaceAll(name, string(filepath.Separator), "_")
|
||
return name
|
||
}
|
||
|
||
func validDomain(value string) bool {
|
||
value = strings.TrimPrefix(value, "*.")
|
||
if len(value) < 3 || len(value) > 253 || !strings.Contains(value, ".") {
|
||
return false
|
||
}
|
||
for _, label := range strings.Split(value, ".") {
|
||
if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
|
||
return false
|
||
}
|
||
for _, r := range label {
|
||
if !(r == '-' || r >= 'a' && r <= 'z' || r >= '0' && r <= '9') {
|
||
return false
|
||
}
|
||
}
|
||
}
|
||
return true
|
||
}
|
||
|
||
// CurrentDirectory returns the active certificate directory for a domain and certificate type.
|
||
func (s FileStore) CurrentDirectory(domain, certificateType string) (string, error) {
|
||
primary := strings.TrimSpace(domain)
|
||
if _, err := NormalizeDomains([]string{primary}); err != nil {
|
||
return "", err
|
||
}
|
||
certificateType = strings.ToLower(strings.TrimSpace(certificateType))
|
||
if certificateType != "single" && certificateType != "wildcard" && certificateType != "san" {
|
||
return "", fmt.Errorf("证书类型无效：%s", certificateType)
|
||
}
|
||
root := filepath.Clean(strings.TrimSpace(s.Root))
|
||
if root == "." || root == "" {
|
||
return "", errors.New("证书存储根目录不能为空")
|
||
}
|
||
return filepath.Join(root, directoryName(primary), certificateType, "current"), nil
|
||
}
|
||
|
||
// LoadCurrent reads the active certificate files and metadata.
|
||
func (s FileStore) LoadCurrent(ctx context.Context, domain, certificateType string) (SavedResource, Resource, error) {
|
||
if err := ctx.Err(); err != nil {
|
||
return SavedResource{}, Resource{}, err
|
||
}
|
||
directory, err := s.CurrentDirectory(domain, certificateType)
|
||
if err != nil {
|
||
return SavedResource{}, Resource{}, err
|
||
}
|
||
certificateData, err := os.ReadFile(filepath.Join(directory, "cert.pem"))
|
||
if err != nil {
|
||
return SavedResource{}, Resource{}, fmt.Errorf("读取证书文件失败：%w", err)
|
||
}
|
||
fullChainData, err := os.ReadFile(filepath.Join(directory, "fullchain.pem"))
|
||
if err != nil {
|
||
return SavedResource{}, Resource{}, fmt.Errorf("读取完整证书链失败：%w", err)
|
||
}
|
||
privateKeyData, err := os.ReadFile(filepath.Join(directory, "key.pem"))
|
||
if err != nil {
|
||
return SavedResource{}, Resource{}, fmt.Errorf("读取私钥文件失败：%w", err)
|
||
}
|
||
resource, err := ValidateResourceForDomains(Resource{
|
||
Domains: []string{domain},
|
||
Certificate: certificateData,
|
||
IssuerCertificate: fullChainData,
|
||
PrivateKey: privateKeyData,
|
||
}, []string{domain})
|
||
if err != nil {
|
||
return SavedResource{}, Resource{}, err
|
||
}
|
||
resource.IssuerCertificate = nil
|
||
var saved SavedResource
|
||
metadata, metadataErr := os.ReadFile(filepath.Join(directory, "metadata.json"))
|
||
if metadataErr == nil {
|
||
if err := json.Unmarshal(metadata, &saved); err != nil {
|
||
return SavedResource{}, Resource{}, fmt.Errorf("解析证书元数据失败：%w", err)
|
||
}
|
||
}
|
||
if saved.Domain == "" {
|
||
saved = SavedResource{
|
||
Domain: domain,
|
||
CertificateType: certificateType,
|
||
Directory: directory,
|
||
CertificatePath: filepath.Join(directory, "cert.pem"),
|
||
FullChainPath: filepath.Join(directory, "fullchain.pem"),
|
||
PrivateKeyPath: filepath.Join(directory, "key.pem"),
|
||
NotBefore: resource.NotBefore,
|
||
NotAfter: resource.NotAfter,
|
||
SANs: resource.Domains,
|
||
ChainLength: certificateChainLength(fullChainData),
|
||
}
|
||
}
|
||
return saved, resource, nil
|
||
}
|
||
|
||
// ListVersions returns all stored certificate versions in descending order.
|
||
func (s FileStore) ListVersions(ctx context.Context, domain, certificateType string) ([]SavedResource, error) {
|
||
if err := ctx.Err(); err != nil {
|
||
return nil, err
|
||
}
|
||
current, err := s.CurrentDirectory(domain, certificateType)
|
||
if err != nil {
|
||
return nil, err
|
||
}
|
||
certificateDirectory := filepath.Dir(current)
|
||
versionsDirectory := filepath.Join(certificateDirectory, "versions")
|
||
entries, err := os.ReadDir(versionsDirectory)
|
||
if err != nil {
|
||
if errors.Is(err, os.ErrNotExist) {
|
||
return []SavedResource{}, nil
|
||
}
|
||
return nil, fmt.Errorf("读取证书版本失败：%w", err)
|
||
}
|
||
versions := make([]SavedResource, 0, len(entries))
|
||
for _, entry := range entries {
|
||
if !entry.IsDir() {
|
||
continue
|
||
}
|
||
metadata, readErr := os.ReadFile(filepath.Join(versionsDirectory, entry.Name(), "metadata.json"))
|
||
if readErr != nil {
|
||
return nil, fmt.Errorf("读取证书版本元数据失败：%w", readErr)
|
||
}
|
||
var item SavedResource
|
||
if err := json.Unmarshal(metadata, &item); err != nil {
|
||
return nil, fmt.Errorf("解析证书版本元数据失败：%w", err)
|
||
}
|
||
versions = append(versions, item)
|
||
}
|
||
sort.SliceStable(versions, func(i, j int) bool { return versions[i].Version > versions[j].Version })
|
||
return versions, nil
|
||
}
|
||
|
||
// RollbackSavedResource 在初始化后续阶段失败时恢复证书目录。
|
||
// 如果保存前存在旧证书，则从备份目录恢复；否则仅清理本次写入的固定证书文件。
|
||
func RollbackSavedResource(ctx context.Context, saved SavedResource) error {
|
||
if err := ctx.Err(); err != nil {
|
||
return err
|
||
}
|
||
directory := filepath.Clean(strings.TrimSpace(saved.Directory))
|
||
if directory == "." || directory == "" {
|
||
return errors.New("证书回滚目录不能为空")
|
||
}
|
||
if strings.TrimSpace(saved.BackupDirectory) != "" {
|
||
backupDirectory := filepath.Clean(strings.TrimSpace(saved.BackupDirectory))
|
||
if backupDirectory == "." || backupDirectory == "" {
|
||
return errors.New("证书备份目录无效")
|
||
}
|
||
if _, err := os.Stat(backupDirectory); err != nil {
|
||
return fmt.Errorf("读取证书备份目录失败：%w", err)
|
||
}
|
||
if err := restoreCertificateFiles(directory, backupDirectory); err != nil {
|
||
return fmt.Errorf("恢复原证书失败：%w", err)
|
||
}
|
||
return nil
|
||
}
|
||
for _, name := range []string{"cert.pem", "fullchain.pem", "key.pem", "metadata.json"} {
|
||
path := filepath.Join(directory, name)
|
||
if err := os.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
|
||
return fmt.Errorf("清理失败证书文件 %s 失败：%w", name, err)
|
||
}
|
||
}
|
||
return nil
|
||
}
|
||
|
||
func restoreCertificateFiles(directory, backupDirectory string) error {
|
||
if err := os.MkdirAll(directory, 0o700); err != nil {
|
||
return err
|
||
}
|
||
for _, name := range []string{"cert.pem", "fullchain.pem", "key.pem", "metadata.json"} {
|
||
source := filepath.Join(backupDirectory, name)
|
||
data, err := os.ReadFile(source)
|
||
if err != nil {
|
||
if errors.Is(err, os.ErrNotExist) {
|
||
continue
|
||
}
|
||
return err
|
||
}
|
||
mode := os.FileMode(0o600)
|
||
if name == "cert.pem" || name == "fullchain.pem" {
|
||
mode = 0o644
|
||
}
|
||
if err := atomicWrite(filepath.Join(directory, name), data, mode); err != nil {
|
||
return err
|
||
}
|
||
}
|
||
return nil
|
||
}
|