wild-cloud/wild-central
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: Normalize wildcard domain paths for certbot cert storage

Browse Source 
Certbot stores wildcard certs under the base domain (e.g.,
*.example.com → /etc/letsencrypt/live/example.com/), but the path
helpers were using the raw wildcard domain. This caused deploy hooks
to reference nonexistent paths, silently failing and leaving certs
unrenewable.
This commit is contained in:
Paul Payne
2026-09-10 22:23:05 +00:00
parent a90af10932
commit d5457ae2dc
2 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
internal/certbot/manager.go
View File

@@ -164,19 +164,26 @@ func parseCertOutput(output string, status *CertStatus) {
}
}
// certName returns the name certbot uses to store a certificate.
// Certbot strips the "*." prefix from wildcard domains, so
// *.example.com is stored under "example.com".
func certName(domain string) string {
return strings.TrimPrefix(domain, "*.")
}
// CertPath returns the fullchain.pem path for a domain.
func CertPath(domain string) string {
return fmt.Sprintf("/etc/letsencrypt/live/%s/fullchain.pem", domain)
return fmt.Sprintf("/etc/letsencrypt/live/%s/fullchain.pem", certName(domain))
}
// KeyPath returns the privkey.pem path for a domain.
func KeyPath(domain string) string {
return fmt.Sprintf("/etc/letsencrypt/live/%s/privkey.pem", domain)
return fmt.Sprintf("/etc/letsencrypt/live/%s/privkey.pem", certName(domain))
}
// HAProxyCertPath returns the combined PEM path for HAProxy TLS termination.
func HAProxyCertPath(domain string) string {
return fmt.Sprintf("/etc/haproxy/certs/%s.pem", domain)
return fmt.Sprintf("/etc/haproxy/certs/%s.pem", certName(domain))
}
// BuildHAProxyCert concatenates fullchain.pem + privkey.pem into a single PEM