-
+
@@ -406,6 +412,7 @@ const {
hasDNSIPv6,
sslSettings,
dnsChecking,
+ port,
dnsChallengeNotice,
waitDesc,
next,
diff --git a/server/res_init/init.go b/server/res_init/init.go
index cb20ac9..52d81e8 100644
--- a/server/res_init/init.go
+++ b/server/res_init/init.go
@@ -19,6 +19,7 @@ import (
"git.pcux.cn/xuans/Smail/listen/pop3_server"
"git.pcux.cn/xuans/Smail/listen/smtp_server"
"git.pcux.cn/xuans/Smail/services/adminreset"
+ "git.pcux.cn/xuans/Smail/services/auth"
"git.pcux.cn/xuans/Smail/services/credentials"
"git.pcux.cn/xuans/Smail/services/dbmigration"
"git.pcux.cn/xuans/Smail/services/externalemail"
@@ -160,6 +161,9 @@ func Init(serverVersion string) error {
// 等待 HTTP 服务就绪后再执行需要 HTTP 回调的 SSL 更新。
// ssl.Update(false)
+ if _, err := auth.DkimGen(); err != nil {
+ return err
+ }
if err := parsemail.Init(); err != nil {
return err
}
diff --git a/server/services/setup/ssl/ssl.go b/server/services/setup/ssl/ssl.go
index 3b03fda..8daf1ff 100644
--- a/server/services/setup/ssl/ssl.go
+++ b/server/services/setup/ssl/ssl.go
@@ -290,7 +290,7 @@ func writeCertificateFiles(cfg *config.Config, privateKey, certificate, issuer [
if cfg == nil {
return errors.New("SSL 配置不能为空")
}
- reference, err := config.ImportManagedSSL(config.ManagedSSLModeDefault, privateKey, certificate, issuer, wildcardCertificateDomains(cfg))
+ reference, err := config.ImportManagedSSL(config.ManagedSSLModeDefault, privateKey, certificate, issuer, certificateDomains(cfg))
if err != nil {
return err
}
@@ -343,6 +343,13 @@ func wildcardCertificateDomains(cfg *config.Config) []string {
return []string{"*." + domain}
}
+func certificateDomains(cfg *config.Config) []string {
+ if cfg != nil && cfg.SSLType == config.SSLTypeAutoDNS {
+ return wildcardCertificateDomains(cfg)
+ }
+ return sslDomains(cfg)
+}
+
func renewCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config) error {
myUser := MyUser{
@@ -387,7 +394,7 @@ func renewCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config) error {
myUser.Registration = reg
- domains := wildcardCertificateDomains(cfg)
+ domains := certificateDomains(cfg)
request := certificate.ObtainRequest{
Domains: domains,
@@ -451,7 +458,7 @@ func generateCertificate(privateKey *ecdsa.PrivateKey, cfg *config.Config, newAc
myUser.Registration = reg
- domains := wildcardCertificateDomains(cfg)
+ domains := certificateDomains(cfg)
request := certificate.ObtainRequest{
Domains: domains,
diff --git a/server/services/setup/ssl/wildcard_test.go b/server/services/setup/ssl/wildcard_test.go
index 9d0e449..4a3a721 100644
--- a/server/services/setup/ssl/wildcard_test.go
+++ b/server/services/setup/ssl/wildcard_test.go
@@ -50,6 +50,29 @@ func TestWildcardCertificateDomains(t *testing.T) {
}
}
+func TestCertificateDomainsFollowChallengeMode(t *testing.T) {
+ cfg := &config.Config{
+ Domain: "xuans.com",
+ WebDomain: "web.xuans.com",
+ Domains: []string{"xuans.com"},
+ }
+
+ cfg.SSLType = config.SSLTypeAutoHTTP
+ httpDomains := certificateDomains(cfg)
+ if len(httpDomains) != 5 {
+ t.Fatalf("got %d HTTP domains, want 5: %v", len(httpDomains), httpDomains)
+ }
+ if httpDomains[0] != "web.xuans.com" || httpDomains[1] != "xuans.com" {
+ t.Fatalf("unexpected HTTP domains: %v", httpDomains)
+ }
+
+ cfg.SSLType = config.SSLTypeAutoDNS
+ dnsDomains := certificateDomains(cfg)
+ if len(dnsDomains) != 1 || dnsDomains[0] != "*.xuans.com" {
+ t.Fatalf("unexpected DNS domains: %v", dnsDomains)
+ }
+}
+
func TestDNSChallengeWildcardProducesSingleRecord(t *testing.T) {
challenge := &DNSChallenge{authInfo: map[string]*authInfo{}}
if err := challenge.Present("*.xuans.com", "token", "key-auth"); err != nil {