renewal.go 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124
  1. // Copyright 2016 The Go Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style
  3. // license that can be found in the LICENSE file.
  4. package autocert
  5. import (
  6. "context"
  7. "crypto"
  8. "sync"
  9. "time"
  10. )
  11. // renewJitter is the maximum deviation from Manager.RenewBefore.
  12. const renewJitter = time.Hour
  13. // domainRenewal tracks the state used by the periodic timers
  14. // renewing a single domain's cert.
  15. type domainRenewal struct {
  16. m *Manager
  17. domain string
  18. key crypto.Signer
  19. timerMu sync.Mutex
  20. timer *time.Timer
  21. }
  22. // start starts a cert renewal timer at the time
  23. // defined by the certificate expiration time exp.
  24. //
  25. // If the timer is already started, calling start is a noop.
  26. func (dr *domainRenewal) start(exp time.Time) {
  27. dr.timerMu.Lock()
  28. defer dr.timerMu.Unlock()
  29. if dr.timer != nil {
  30. return
  31. }
  32. dr.timer = time.AfterFunc(dr.next(exp), dr.renew)
  33. }
  34. // stop stops the cert renewal timer.
  35. // If the timer is already stopped, calling stop is a noop.
  36. func (dr *domainRenewal) stop() {
  37. dr.timerMu.Lock()
  38. defer dr.timerMu.Unlock()
  39. if dr.timer == nil {
  40. return
  41. }
  42. dr.timer.Stop()
  43. dr.timer = nil
  44. }
  45. // renew is called periodically by a timer.
  46. // The first renew call is kicked off by dr.start.
  47. func (dr *domainRenewal) renew() {
  48. dr.timerMu.Lock()
  49. defer dr.timerMu.Unlock()
  50. if dr.timer == nil {
  51. return
  52. }
  53. ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
  54. defer cancel()
  55. // TODO: rotate dr.key at some point?
  56. next, err := dr.do(ctx)
  57. if err != nil {
  58. next = renewJitter / 2
  59. next += time.Duration(pseudoRand.int63n(int64(next)))
  60. }
  61. dr.timer = time.AfterFunc(next, dr.renew)
  62. testDidRenewLoop(next, err)
  63. }
  64. // do is similar to Manager.createCert but it doesn't lock a Manager.state item.
  65. // Instead, it requests a new certificate independently and, upon success,
  66. // replaces dr.m.state item with a new one and updates cache for the given domain.
  67. //
  68. // It may return immediately if the expiration date of the currently cached cert
  69. // is far enough in the future.
  70. //
  71. // The returned value is a time interval after which the renewal should occur again.
  72. func (dr *domainRenewal) do(ctx context.Context) (time.Duration, error) {
  73. // a race is likely unavoidable in a distributed environment
  74. // but we try nonetheless
  75. if tlscert, err := dr.m.cacheGet(ctx, dr.domain); err == nil {
  76. next := dr.next(tlscert.Leaf.NotAfter)
  77. if next > dr.m.renewBefore()+renewJitter {
  78. return next, nil
  79. }
  80. }
  81. der, leaf, err := dr.m.authorizedCert(ctx, dr.key, dr.domain)
  82. if err != nil {
  83. return 0, err
  84. }
  85. state := &certState{
  86. key: dr.key,
  87. cert: der,
  88. leaf: leaf,
  89. }
  90. tlscert, err := state.tlscert()
  91. if err != nil {
  92. return 0, err
  93. }
  94. dr.m.cachePut(ctx, dr.domain, tlscert)
  95. dr.m.stateMu.Lock()
  96. defer dr.m.stateMu.Unlock()
  97. // m.state is guaranteed to be non-nil at this point
  98. dr.m.state[dr.domain] = state
  99. return dr.next(leaf.NotAfter), nil
  100. }
  101. func (dr *domainRenewal) next(expiry time.Time) time.Duration {
  102. d := expiry.Sub(timeNow()) - dr.m.renewBefore()
  103. // add a bit of randomness to renew deadline
  104. n := pseudoRand.int63n(int64(renewJitter))
  105. d -= time.Duration(n)
  106. if d < 0 {
  107. return 0
  108. }
  109. return d
  110. }
  111. var testDidRenewLoop = func(next time.Duration, err error) {}