ca.crt restore endpoint

2026-07-17 13:24:41 +02:00
parent 88f97496be
commit 4d1deeb773
4 changed files with 94 additions and 18 deletions
@@ -2,6 +2,7 @@ package main

 import (
 	"fmt"
+	"io"
 	"time"

 	"github.com/cloudflare/cfssl/helpers"
@@ -50,23 +51,37 @@ func getUsableClusterCA(cluster, name string) (ca CA, err error) {
 	if checkErr != nil {
 		log.Infof("cluster %s: CA %s: regenerating certificate: %v", cluster, name, checkErr)

-		prevCerts, _ := helpers.ParseCertificatesPEM(ca.Cert)
-
-		err = ca.RenewCert()
-		if err != nil {
-			err = fmt.Errorf("renew: %w", err)
-		}
-
-		now := time.Now()
-		for _, cert := range prevCerts {
-			if cert.NotAfter.After(now) {
-				continue
+		ca, err = opMutex("renew-ca:"+key, func() (CA, error) {
+			ca, found, err := clusterCAs.Get(key)
+			if err != nil {
+				return ca, err
+			}
+			if !found {
+				return ca, fmt.Errorf("CA not found")
 			}
-			certPEM := helpers.EncodeCertificatePEM(cert)
-			ca.Cert = append(ca.Cert, certPEM...)
-		}

-		err = clusterCAs.Put(key, ca)
+			prevCerts, _ := helpers.ParseCertificatesPEM(ca.Cert)
+
+			err = ca.RenewCert()
+			if err != nil {
+				return ca, fmt.Errorf("renew: %w", err)
+			}
+
+			now := time.Now()
+			for _, cert := range prevCerts {
+				if cert.NotAfter.Before(now) {
+					continue
+				}
+				certPEM := helpers.EncodeCertificatePEM(cert)
+				ca.Cert = append(ca.Cert, certPEM...)
+			}
+
+			err = clusterCAs.Put(key, ca)
+			return ca, err
+		})
+		if err != nil {
+			return ca, err
+		}
 	}

 	return
@@ -98,3 +113,51 @@ func wsClusterCASignedKey(req *restful.Request, resp *restful.Response) {

 	clusterCASignedKeys.WsGet(resp, clusterName+"/"+caName+"/"+name)
 }
+
+func wsClusterCACertPut(req *restful.Request, resp *restful.Response) {
+	clusterName := req.PathParameter("cluster-name")
+	caName := req.PathParameter("ca-name")
+	key := clusterName + "/" + caName
+
+	body, err := io.ReadAll(req.Request.Body)
+	if err != nil {
+		wsError(resp, fmt.Errorf("read body: %w", err))
+		return
+	}
+
+	certs, err := helpers.ParseCertificatesPEM(body)
+	if err != nil {
+		wsError(resp, fmt.Errorf("invalid certificate(s): %w", err))
+		return
+	}
+
+	ca, found, err := clusterCAs.Get(key)
+	if err != nil {
+		wsError(resp, err)
+		return
+	}
+	if !found {
+		wsNotFound(resp)
+		return
+	}
+
+	caCert, err := ca.ParseCert()
+	if err != nil {
+		wsError(resp, fmt.Errorf("parse CA cert: %w", err))
+		return
+	}
+
+	for _, c := range certs {
+		if err := c.CheckSignatureFrom(caCert); err != nil {
+			wsError(resp, fmt.Errorf("certificate not signed by this CA: %w", err))
+			return
+		}
+	}
+
+	ca.Cert = body
+
+	if err := clusterCAs.Put(key, ca); err != nil {
+		wsError(resp, err)
+		return
+	}
+}