| 1342 | } |
| 1343 | |
| 1344 | static int md_answer_challenge(conn_rec *c, const char *servername, |
| 1345 | const char **pcert_pem, const char **pkey_pem) |
| 1346 | { |
| 1347 | const char *protocol; |
| 1348 | int hook_rv = DECLINED; |
| 1349 | md_srv_conf_t *sc; |
| 1350 | |
| 1351 | *pcert_pem = *pkey_pem = NULL; |
| 1352 | |
| 1353 | if (!servername |
| 1354 | || !(protocol = md_protocol_get(c)) |
| 1355 | || strcmp(PROTO_ACME_TLS_1, protocol)) { |
| 1356 | goto cleanup; |
| 1357 | } |
| 1358 | sc = md_config_get(c->base_server); |
| 1359 | if (!sc || !sc->mc->reg) goto cleanup; |
| 1360 | |
| 1361 | ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, c, |
| 1362 | "Answer challenge[tls-alpn-01] for %s", servername); |
| 1363 | |
| 1364 | /* A challenge for TLS-ALPN-01 used to have a single certificate, |
| 1365 | * overriding the single fallback certificate already installed in |
| 1366 | * the connections SSL* instance. |
| 1367 | * Since the addition of `MDPrivateKeys`, there can be more than one, |
| 1368 | * but the server API for a challenge cert can return only one. This |
| 1369 | * is a short coming of the API. |
| 1370 | * This means we cannot override all fallback certificates present, just |
| 1371 | * a single one. If there is an RSA cert in fallback, we need to override |
| 1372 | * that, because the ACME server has a preference for that (at least LE |
| 1373 | * has). So we look for an RSA challenge cert first. |
| 1374 | * The fallback is an EC cert and that works since without RSA challenges, |
| 1375 | * there should also be no RSA fallbacks. |
| 1376 | * Bit of a mess. */ |
| 1377 | hook_rv = md_get_challenge_cert(c, servername, sc, MD_PKEY_TYPE_DEFAULT, |
| 1378 | pcert_pem, pkey_pem); |
| 1379 | if (hook_rv == DECLINED) |
| 1380 | hook_rv = md_get_challenge_cert(c, servername, sc, MD_PKEY_TYPE_RSA, |
| 1381 | pcert_pem, pkey_pem); |
| 1382 | if (hook_rv == DECLINED) |
| 1383 | hook_rv = md_get_challenge_cert(c, servername, sc, MD_PKEY_TYPE_EC, |
| 1384 | pcert_pem, pkey_pem); |
| 1385 | |
| 1386 | if (DECLINED == hook_rv) { |
| 1387 | ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO(10080) |
| 1388 | "%s: unknown tls-alpn-01 challenge host", servername); |
| 1389 | } |
| 1390 | |
| 1391 | cleanup: |
| 1392 | return hook_rv; |
| 1393 | } |
| 1394 | |
| 1395 | |
| 1396 | /**************************************************************************************************/ |
nothing calls this directly
no test coverage detected