lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: request individual certs per domain instead of SAN cert

Browse source
This commit is contained in:
Claus Lohmar 2026-07-07 17:53:48 +01:00
parent 93f853bd40
commit 8b2301f3a4
1 changed files with 27 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
tools/nextwks-tool/main.go
View file

@ -163,45 +163,39 @@ func obtainCertsLego(domains []string, email, backupDir, legoDir, legoPath strin
return fmt.Errorf("creating lego dir: %w", err)
}
// Build lego args (v5+: flags go after the command, use = syntax)
certDir := filepath.Join(legoDir, "certificates")
for _, domain := range domains {
log.Printf(" Requesting cert for %s...", domain)
args := []string{"run",
"--http",
"--http.address=:80",
"--path", legoDir,
"--accept-tos",
"-m", email,
}
for _, d := range domains {
args = append(args, "-d", d)
"-d", domain,
}
cmd := exec.Command(legoPath, args...)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
log.Printf(" Running: %s %s", legoPath, strings.Join(args, " "))
if err := cmd.Run(); err != nil {
return fmt.Errorf("lego run failed: %w", err)
log.Printf(" [WARN] lego failed for %s: %v", domain, err)
continue
}
// Copy certificates from lego output to backup
// Lego issues a SAN cert (single cert for all domains) named after the first domain
certDir := filepath.Join(legoDir, "certificates")
firstDomain := domains[0]
crtSrc := filepath.Join(certDir, firstDomain+".crt")
keySrc := filepath.Join(certDir, firstDomain+".key")
if !fileExists(crtSrc) || !fileExists(keySrc) {
return fmt.Errorf("lego did not produce expected cert files in %s", certDir)
}
for _, domain := range domains {
// Copy cert to per-domain backup
crtSrc := filepath.Join(certDir, domain+".crt")
keySrc := filepath.Join(certDir, domain+".key")
domainDir := filepath.Join(backupDir, domain)
os.MkdirAll(domainDir, 0755)
if fileExists(crtSrc) && fileExists(keySrc) {
copyFile(crtSrc, filepath.Join(domainDir, "fullchain.pem"))
copyFile(keySrc, filepath.Join(domainDir, "privkey.pem"))
log.Printf("[OK] Certificate obtained for %s", domain)
}
}
return nil
}