mirrors/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2024-11-22 23:13:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #589 from bhoppi/main

Browse Source 
Fix: new cert issuing is incorrectly delayed
This commit is contained in:
Arthur Morgan 2021-09-08 00:50:32 +08:00 committed by GitHub
commit 7a9e72b133
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
transport/internet/tls/config.go
View File

@ -121,7 +121,7 @@ func isCertificateExpired(c *tls.Certificate) bool {
} }
// If leaf is not there, the certificate is probably not used yet. We trust user to provide a valid certificate. // If leaf is not there, the certificate is probably not used yet. We trust user to provide a valid certificate.
return c.Leaf != nil && c.Leaf.NotAfter.Before(time.Now().Add(-time.Minute)) return c.Leaf != nil && c.Leaf.NotAfter.Before(time.Now().Add(time.Minute*2))
} }
func issueCertificate(rawCA *Certificate, domain string) (*tls.Certificate, error) { func issueCertificate(rawCA *Certificate, domain string) (*tls.Certificate, error) {
@ -173,6 +173,9 @@ func getGetCertificateFunc(c *tls.Config, ca []*Certificate) func(hello *tls.Cli
for _, certificate := range c.Certificates { for _, certificate := range c.Certificates {
if !isCertificateExpired(&certificate) { if !isCertificateExpired(&certificate) {
newCerts = append(newCerts, certificate) newCerts = append(newCerts, certificate)
} else if certificate.Leaf != nil {
expTime := certificate.Leaf.NotAfter.Format(time.RFC3339)
newError("old certificate for ", domain, " (expire on ", expTime, ") discarded").AtInfo().WriteToLog()
} }
} }
@ -190,6 +193,14 @@ func getGetCertificateFunc(c *tls.Config, ca []*Certificate) func(hello *tls.Cli
newError("failed to issue new certificate for ", domain).Base(err).WriteToLog() newError("failed to issue new certificate for ", domain).Base(err).WriteToLog()
continue continue
} }
parsed, err := x509.ParseCertificate(newCert.Certificate[0])
if err == nil {
newCert.Leaf = parsed
expTime := parsed.NotAfter.Format(time.RFC3339)
newError("new certificate for ", domain, " (expire on ", expTime, ") issued").AtInfo().WriteToLog()
} else {
newError("failed to parse new certificate for ", domain).Base(err).WriteToLog()
}
access.Lock() access.Lock()
c.Certificates = append(c.Certificates, *newCert) c.Certificates = append(c.Certificates, *newCert)