Method selectCert

handshake.go:186–226

selectCert uses hello to select a certificate from the cache for name. If cfg.CertSelection is set, it will be used to make the decision. Otherwise, the first matching unexpired cert is returned. As a special case, if no certificates match name and cfg.CertSelection is set, then all certificates in

(hello *tls.ClientHelloInfo, name string)

// then all certificates in the cache will be passed in
// for the cfg.CertSelection to make the final decision.
func (cfg *Config) selectCert(hello *tls.ClientHelloInfo, name string) (Certificate, bool) {
	logger := cfg.Logger.Named("handshake")
	choices := cfg.certCache.getAllMatchingCerts(name)

	if len(choices) == 0 {
		if cfg.CertSelection == nil {
			logger.Debug("no matching certificates and no custom selection logic", zap.String("identifier", name))
			return Certificate{}, false
		}
		logger.Debug("no matching certificate; will choose from all certificates", zap.String("identifier", name))
		choices = cfg.certCache.getAllCerts()
	}

	logger.Debug("choosing certificate",
		zap.String("identifier", name),
		zap.Int("num_choices", len(choices)))

	if cfg.CertSelection == nil {
		cert, err := DefaultCertificateSelector(hello, choices)
		logger.Debug("default certificate selection results",
			zap.Error(err),
			zap.String("identifier", name),
			zap.Strings("subjects", cert.Names),
			zap.Bool("managed", cert.managed),
			zap.String("issuer_key", cert.issuerKey),
			zap.String("hash", cert.hash))
		return cert, err == nil
	}

	cert, err := cfg.CertSelection.SelectCertificate(hello, choices)

	logger.Debug("custom certificate selection results",
		zap.Error(err),
		zap.String("identifier", name),
		zap.Strings("subjects", cert.Names),
		zap.Bool("managed", cert.managed),
		zap.String("issuer_key", cert.issuerKey),
		zap.String("hash", cert.hash))

	return cert, err == nil
}

// DefaultCertificateSelector is the default certificate selection logic
// given a choice of certificates. If there is at least one certificate in