恢复SSL自动验证并修正证书域名

fe/src/views/Setup/Setup.js

@@ -123,7 +123,8 @@ export function usePage() {
     records.some((record) => record.type === 'AAAA')
   ))
 
- const sslRuntime = ref({})
+  const port = ref(80)
+  const sslRuntime = ref({})
 
   const addDomain = () => {
     domainSettings.multi_domain.push([])
@@ -352,12 +353,14 @@ export function usePage() {
       sslSettings.type = res.data.type
       if (sslSettings.type === "2") {
         sslSettings.type = "0"
+        sslSettings.challenge = "dns"
       }
       if (sslSettings.type === "0") {
-        sslSettings.challenge = ""
+        sslSettings.challenge = sslSettings.challenge || "http"
       }
       sslRuntime.value = res.data || {}
-     return res
+      port.value = res.data?.port || res.data?.httpPort || 80
+      return res
     }).catch((error) => {
       showSetupError(error)
       return null
@@ -368,7 +371,7 @@ export function usePage() {
     fullscreenLoading.value = true;
 
     let sslType = sslSettings.type;
-    if (sslType === "0") {
+    if (sslType === "0" && sslSettings.challenge === "dns") {
       sslType = "2"
     }
 
@@ -718,9 +721,10 @@ export function usePage() {
     fullscreenLoading,
     dnsChecking,
     dnsChallengeNotice,
+    port,
     dnsInfos,
     hasDNSIPv6,
-   addDomain,
+    addDomain,
     setPassword,
     getPassword,
     getDbConfig,

fe/src/views/Setup/Setup.vue

@@ -278,6 +278,11 @@
       <div class="desc">
         <div class="ssl-title-row">
           <h2>{{ lang.setSSL }}</h2>
+          <div v-if="sslSettings.type === '0' && sslSettings.challenge === 'http' && port !== 80"
+               class="ssl-port-warning" role="alert">
+            <strong>{{ lang.warning }}</strong>
+            <span>{{ lang.autoSSLWarn }}</span>
+          </div>
         </div>
         <div class="ssl-title-description">{{ lang.setSSL }}</div>
       </div>
@@ -293,8 +298,9 @@
 
           <el-form-item :label="lang.ssl_challenge_type" v-if="sslSettings.type === '0'">
             <div class="ssl-challenge-select-row">
-              <el-select class="ssl-type-select" :placeholder="lang.ssl_auto_dns" v-model="sslSettings.challenge"
+              <el-select class="ssl-type-select" :placeholder="lang.ssl_challenge_type" v-model="sslSettings.challenge"
                          :disabled="fullscreenLoading" @change="handleSSLChallengeChange">
+                <el-option :label="lang.ssl_auto_http" value="http"/>
                 <el-option :label="lang.ssl_auto_dns" value="dns"/>
               </el-select>
 
@@ -406,6 +412,7 @@ const {
   hasDNSIPv6,
   sslSettings,
   dnsChecking,
+  port,
   dnsChallengeNotice,
   waitDesc,
   next,

server/res_init/init.go

@@ -19,6 +19,7 @@ import (
 	"git.pcux.cn/xuans/Smail/listen/pop3_server"
 	"git.pcux.cn/xuans/Smail/listen/smtp_server"
 	"git.pcux.cn/xuans/Smail/services/adminreset"
+	"git.pcux.cn/xuans/Smail/services/auth"
 	"git.pcux.cn/xuans/Smail/services/credentials"
 	"git.pcux.cn/xuans/Smail/services/dbmigration"
 	"git.pcux.cn/xuans/Smail/services/externalemail"
@@ -160,6 +161,9 @@ func Init(serverVersion string) error {
 		// 等待 HTTP 服务就绪后再执行需要 HTTP 回调的 SSL 更新。
 		// ssl.Update(false)
 
+		if _, err := auth.DkimGen(); err != nil {
+			return err
+		}
 		if err := parsemail.Init(); err != nil {
 			return err
 		}

server/services/setup/ssl/ssl.go

@@ -290,7 +290,7 @@ func writeCertificateFiles(cfg *config.Config, privateKey, certificate, issuer [
 	if cfg == nil {
 		return errors.New("SSL 配置不能为空")
 	}
-	reference, err := config.ImportManagedSSL(config.ManagedSSLModeDefault, privateKey, certificate, issuer, wildcardCertificateDomains(cfg))
+	reference, err := config.ImportManagedSSL(config.ManagedSSLModeDefault, privateKey, certificate, issuer, certificateDomains(cfg))
 	if err != nil {
 		return err
 	}
@@ -343,6 +343,13 @@ func wildcardCertificateDomains(cfg *config.Config) []string {
 	return []string{"*." + domain}
 }
 
+func certificateDomains(cfg *config.Config) []string {
+	if cfg != nil && cfg.SSLType == config.SSLTypeAutoDNS {
+		return wildcardCertificateDomains(cfg)
+	}
+	return sslDomains(cfg)
+}
+
 func renewCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config) error {
 
 	myUser := MyUser{
@@ -387,7 +394,7 @@ func renewCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config) error {
 
 	myUser.Registration = reg
 
-	domains := wildcardCertificateDomains(cfg)
+	domains := certificateDomains(cfg)
 
 	request := certificate.ObtainRequest{
 		Domains: domains,
@@ -451,7 +458,7 @@ func generateCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config, newAc
 
 	myUser.Registration = reg
 
-	domains := wildcardCertificateDomains(cfg)
+	domains := certificateDomains(cfg)
 
 	request := certificate.ObtainRequest{
 		Domains: domains,

server/services/setup/ssl/wildcard_test.go

@@ -50,6 +50,29 @@ func TestWildcardCertificateDomains(t *testing.T) {
 	}
 }
 
+func TestCertificateDomainsFollowChallengeMode(t *testing.T) {
+	cfg := &config.Config{
+		Domain:    "xuans.com",
+		WebDomain: "web.xuans.com",
+		Domains:   []string{"xuans.com"},
+	}
+
+	cfg.SSLType = config.SSLTypeAutoHTTP
+	httpDomains := certificateDomains(cfg)
+	if len(httpDomains) != 5 {
+		t.Fatalf("got %d HTTP domains, want 5: %v", len(httpDomains), httpDomains)
+	}
+	if httpDomains[0] != "web.xuans.com" || httpDomains[1] != "xuans.com" {
+		t.Fatalf("unexpected HTTP domains: %v", httpDomains)
+	}
+
+	cfg.SSLType = config.SSLTypeAutoDNS
+	dnsDomains := certificateDomains(cfg)
+	if len(dnsDomains) != 1 || dnsDomains[0] != "*.xuans.com" {
+		t.Fatalf("unexpected DNS domains: %v", dnsDomains)
+	}
+}
+
 func TestDNSChallengeWildcardProducesSingleRecord(t *testing.T) {
 	challenge := &DNSChallenge{authInfo: map[string]*authInfo{}}
 	if err := challenge.Present("*.xuans.com", "token", "key-auth"); err != nil {