mirrors/hysteria
1
0
Fork 0
mirror of https://github.com/apernet/hysteria.git synced 2025-04-03 04:27:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

fix: check if cert-key is loadable on server start

Browse source 
close: #1040
This commit is contained in:
Haruue 2024-04-15 19:31:23 +08:00
parent 234dc4508b
commit 9752347073
No known key found for this signature in database
GPG key ID: F6083B28CBCBC148
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
app/cmd/server.go
View file

@ -10,6 +10,7 @@ import (
"net/http"
"net/http/httputil"
"net/url"
"os"
"strconv"
"strings"
"time"
@ -254,6 +255,19 @@ func (c *serverConfig) fillTLSConfig(hyConfig *server.Config) error {
if c.TLS.Cert == "" || c.TLS.Key == "" {
return configError{Field: "tls", Err: errors.New("empty cert or key path")}
}
// Load cert-key pair here for early error reporting (especially permission denied)
certPEMBlock, err := os.ReadFile(c.TLS.Cert)
if err != nil {
return configError{Field: "tls.cert", Err: err}
}
keyPEMBlock, err := os.ReadFile(c.TLS.Key)
if err != nil {
return configError{Field: "tls.key", Err: err}
}
_, err = tls.X509KeyPair(certPEMBlock, keyPEMBlock)
if err != nil {
return configError{Field: "tls", Err: fmt.Errorf("invalid cert-key pair: %w", err)}
}
// Use GetCertificate instead of Certificates so that
// users can update the cert without restarting the server.
hyConfig.TLSConfig.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {