opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
832 stars 617 forks source link

www/caddy: Write and update issued certificates into the OPNsense Trust store #3908

Closed Monviech closed 4 months ago

Monviech commented 4 months ago

Important notices Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe. Caddy issues it's own certificates with Let's Encrypt and ZeroSSL. Just like Traefik, right now it is the most robust way to get automated certificates.

Articles like these imply that it is the way forward: https://www.eff.org/deeplinks/2024/03/should-caddy-and-traefik-replace-certbot

Since the OPNsense Trust store had an mvc rewrite, it would be interesting to integrate the certificates Caddy generates by using the new API, in order to make the certificates it issues usable in other parts of the system, or easily browsable and downloadable by the user.

The idea is not to cannibalize on the features of security/acme-client, but to have an additional solution "ready to go" for the future.

The scope would be to simply write and update the certificates over the API into the trust store, not to create any hooks that reload services etc...

Describe the solution you'd like I don't know yet, this one is for discussion. I will most likely need help for this.

Describe alternatives you've considered I don't know yet, this one is for discussion.

Additional context Why is it the most robust way? https://caddyserver.com/docs/automatic-https#errors

Monviech commented 4 months ago

This one is not a good idea and out of scope for the caddy plugin.