Add FileKeyGenerator to support user-provided private keys #371
Open
pauloappbr wants to merge 1 commit intocaddyserver:masterfrom
Open
Add FileKeyGenerator to support user-provided private keys #371pauloappbr wants to merge 1 commit intocaddyserver:masterfrom
pauloappbr wants to merge 1 commit intocaddyserver:masterfrom
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces
FileKeyGenerator, a new implementation of theKeyGeneratorinterface that allows CertMagic to load a pre-existing private key from the filesystem instead of generating one at runtime.The generator reads and parses a PEM-encoded private key and returns it for CSR generation, preserving the existing CertMagic flow.
Motivation
Related to caddyserver/caddy#2854.
Some use cases require a stable and persistent public key across deployments, such as:
Currently, CertMagic always generates private keys internally. While this is appropriate for most cases, it makes it difficult to reuse an existing key when continuity is necessary.
This change enables that capability in a clean and explicit way without affecting the default behavior.
Changes
FileKeyGeneratorstruct incrypto.goGenerateKey()forFileKeyGenerator, which:crypto.PrivateKeyfor CSR generationNotes
key_filedirective.