Gnous/mailcow
2
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

[ACME] Skip subdomains covered by wildcards (DNS-01 challenge only)

Browse Source
This commit is contained in:
FreddleSpl0it 2026-03-13 13:08:18 +01:00
parent 018e292854
commit 7817dda43f
No known key found for this signature in database
GPG Key ID: 00E14E7634F4BEC5
2 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
data/Dockerfiles/acme/acme.sh
View File

@ -323,11 +323,9 @@ while true; do
# Check if MAILCOW_HOSTNAME is covered by a wildcard in ADDITIONAL_SAN # Check if MAILCOW_HOSTNAME is covered by a wildcard in ADDITIONAL_SAN
MAILCOW_HOSTNAME_COVERED=0 MAILCOW_HOSTNAME_COVERED=0
if [[ ! -z ${VALIDATED_MAILCOW_HOSTNAME} && ! -z ${ADDITIONAL_SAN} ]]; then if [[ ! -z ${VALIDATED_MAILCOW_HOSTNAME} ]]; then
# Extract parent domain from MAILCOW_HOSTNAME (e.g., mail.example.com -> example.com) if is_covered_by_wildcard "${VALIDATED_MAILCOW_HOSTNAME}"; then
MAILCOW_PARENT_DOMAIN=$(echo ${VALIDATED_MAILCOW_HOSTNAME} | cut -d. -f2-) MAILCOW_PARENT_DOMAIN=$(echo ${VALIDATED_MAILCOW_HOSTNAME} | cut -d. -f2-)
# Check if ADDITIONAL_SAN contains a wildcard for this parent domain
if [[ "${ADDITIONAL_SAN}" == *"*.${MAILCOW_PARENT_DOMAIN}"* ]]; then
log_f "MAILCOW_HOSTNAME '${VALIDATED_MAILCOW_HOSTNAME}' is covered by wildcard '*.${MAILCOW_PARENT_DOMAIN}' - skipping explicit hostname" log_f "MAILCOW_HOSTNAME '${VALIDATED_MAILCOW_HOSTNAME}' is covered by wildcard '*.${MAILCOW_PARENT_DOMAIN}' - skipping explicit hostname"
MAILCOW_HOSTNAME_COVERED=1 MAILCOW_HOSTNAME_COVERED=1
fi fi

9
data/Dockerfiles/acme/functions.sh
View File

@ -136,12 +136,19 @@ verify_challenge_path(){
fi fi
} }
# Check if a domain is covered by a wildcard in ADDITIONAL_SAN # Check if a domain is covered by a wildcard (*.example.com) in ADDITIONAL_SAN
# Usage: is_covered_by_wildcard "subdomain.example.com" # Usage: is_covered_by_wildcard "subdomain.example.com"
# Returns: 0 if covered, 1 if not covered # Returns: 0 if covered, 1 if not covered
# Note: Only returns 0 (covered) when DNS-01 challenge is enabled,
# as wildcards cannot be validated with HTTP-01 challenge
is_covered_by_wildcard() { is_covered_by_wildcard() {
local DOMAIN=$1 local DOMAIN=$1
# Only skip if DNS challenge is enabled (wildcards require DNS-01)
if [[ ${ACME_DNS_CHALLENGE} != "y" ]]; then
return 1
fi
# Return early if no ADDITIONAL_SAN is set # Return early if no ADDITIONAL_SAN is set
if [[ -z ${ADDITIONAL_SAN} ]]; then if [[ -z ${ADDITIONAL_SAN} ]]; then
return 1 return 1