Skip to content

Add FileKeyGenerator to support user-provided private keys #371

Open
pauloappbr wants to merge 1 commit intocaddyserver:masterfrom
pauloappbr:feat/file-key-generator
Open

Add FileKeyGenerator to support user-provided private keys #371
pauloappbr wants to merge 1 commit intocaddyserver:masterfrom
pauloappbr:feat/file-key-generator

Conversation

@pauloappbr
Copy link

Description

This PR introduces FileKeyGenerator, a new implementation of the KeyGenerator interface that allows CertMagic to load a pre-existing private key from the filesystem instead of generating one at runtime.

The generator reads and parses a PEM-encoded private key and returns it for CSR generation, preserving the existing CertMagic flow.

Motivation

Related to caddyserver/caddy#2854.

Some use cases require a stable and persistent public key across deployments, such as:

  • Infrastructure migrations
  • Environments with pre-provisioned keys
  • Scenarios where key continuity is required

Currently, CertMagic always generates private keys internally. While this is appropriate for most cases, it makes it difficult to reuse an existing key when continuity is necessary.

This change enables that capability in a clean and explicit way without affecting the default behavior.

Changes

  • Added FileKeyGenerator struct in crypto.go
  • Implemented GenerateKey() for FileKeyGenerator, which:
    • Reads a PEM-encoded private key from disk
    • Supports PKCS#1, PKCS#8, and EC private key formats
    • Returns the parsed crypto.PrivateKey for CSR generation

Notes

  • This change is fully backward-compatible.
  • The default key generation behavior remains unchanged.
  • This is intended to serve as the foundational support for Caddy's proposed key_file directive.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant