Create ACME Provider

provider/acme/account.go

@@ -0,0 +1,52 @@
+package acme
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+
+	"github.com/containous/traefik/log"
+	"github.com/xenolf/lego/acme"
+)
+
+// Account is used to store lets encrypt registration info
+type Account struct {
+	Email        string
+	Registration *acme.RegistrationResource
+	PrivateKey   []byte
+}
+
+// NewAccount creates an account
+func NewAccount(email string) (*Account, error) {
+	// Create a user. New accounts need an email and private key to start
+	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Account{
+		Email:      email,
+		PrivateKey: x509.MarshalPKCS1PrivateKey(privateKey),
+	}, nil
+}
+
+// GetEmail returns email
+func (a *Account) GetEmail() string {
+	return a.Email
+}
+
+// GetRegistration returns lets encrypt registration resource
+func (a *Account) GetRegistration() *acme.RegistrationResource {
+	return a.Registration
+}
+
+// GetPrivateKey returns private key
+func (a *Account) GetPrivateKey() crypto.PrivateKey {
+	if privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey); err == nil {
+		return privateKey
+	}
+
+	log.Errorf("Cannot unmarshal private key %+v", a.PrivateKey)
+	return nil
+}

provider/acme/challenge.go

@@ -0,0 +1,129 @@
+package acme
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"time"
+
+	"github.com/cenk/backoff"
+	"github.com/containous/flaeg"
+	"github.com/containous/traefik/log"
+	"github.com/containous/traefik/safe"
+	tlsgenerate "github.com/containous/traefik/tls/generate"
+	"github.com/xenolf/lego/acme"
+)
+
+func dnsOverrideDelay(delay flaeg.Duration) error {
+	if delay == 0 {
+		return nil
+	}
+
+	if delay > 0 {
+		log.Debugf("Delaying %d rather than validating DNS propagation now.", delay)
+
+		acme.PreCheckDNS = func(_, _ string) (bool, error) {
+			time.Sleep(time.Duration(delay))
+			return true, nil
+		}
+	} else {
+		return fmt.Errorf("delayBeforeCheck: %d cannot be less than 0", delay)
+	}
+	return nil
+}
+
+func presentTLSChallenge(domain, keyAuth string) ([]byte, []byte, error) {
+	log.Debugf("TLS Challenge Present temp certificate for %s", domain)
+
+	var tempPrivKey crypto.PrivateKey
+	tempPrivKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
+	rsaPrivPEM := tlsgenerate.PemEncode(rsaPrivKey)
+
+	zBytes := sha256.Sum256([]byte(keyAuth))
+	z := hex.EncodeToString(zBytes[:sha256.Size])
+	domainCert := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
+
+	tempCertPEM, err := tlsgenerate.PemCert(rsaPrivKey, domainCert, time.Time{})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return tempCertPEM, rsaPrivPEM, nil
+}
+
+func getTokenValue(token, domain string, store Store) []byte {
+	log.Debugf("Looking for an existing ACME challenge for token %v...", token)
+	var result []byte
+
+	operation := func() error {
+		var ok bool
+		httpChallenges, err := store.GetHTTPChallenges()
+		if err != nil {
+			return fmt.Errorf("HTTPChallenges not available : %s", err)
+		}
+		if result, ok = httpChallenges[token][domain]; !ok {
+			return fmt.Errorf("cannot find challenge for token %v", token)
+		}
+		return nil
+	}
+
+	notify := func(err error, time time.Duration) {
+		log.Errorf("Error getting challenge for token retrying in %s", time)
+	}
+
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 60 * time.Second
+	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
+	if err != nil {
+		log.Errorf("Error getting challenge for token: %v", err)
+		return []byte{}
+	}
+	return result
+}
+
+func presentHTTPChallenge(domain, token, keyAuth string, store Store) error {
+	httpChallenges, err := store.GetHTTPChallenges()
+	if err != nil {
+		return fmt.Errorf("unable to get HTTPChallenges : %s", err)
+	}
+
+	if httpChallenges == nil {
+		httpChallenges = map[string]map[string][]byte{}
+	}
+
+	if _, ok := httpChallenges[token]; !ok {
+		httpChallenges[token] = map[string][]byte{}
+	}
+
+	httpChallenges[token][domain] = []byte(keyAuth)
+
+	return store.SaveHTTPChallenges(httpChallenges)
+}
+
+func cleanUpHTTPChallenge(domain, token string, store Store) error {
+	httpChallenges, err := store.GetHTTPChallenges()
+	if err != nil {
+		return fmt.Errorf("unable to get HTTPChallenges : %s", err)
+	}
+
+	log.Debugf("Challenge CleanUp for domain %s", domain)
+
+	if _, ok := httpChallenges[token]; ok {
+		if _, domainOk := httpChallenges[token][domain]; domainOk {
+			delete(httpChallenges[token], domain)
+		}
+		if len(httpChallenges[token]) == 0 {
+			delete(httpChallenges, token)
+		}
+		return store.SaveHTTPChallenges(httpChallenges)
+	}
+	return nil
+}

provider/acme/local_store.go

@@ -0,0 +1,125 @@
+package acme
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"os"
+
+	"github.com/containous/traefik/log"
+	"github.com/containous/traefik/safe"
+)
+
+var _ Store = (*LocalStore)(nil)
+
+// LocalStore Store implementation for local file
+type LocalStore struct {
+	filename     string
+	storedData   *StoredData
+	SaveDataChan chan *StoredData
+}
+
+// NewLocalStore initializes a new LocalStore with a file name
+func NewLocalStore(filename string) LocalStore {
+	store := LocalStore{filename: filename, SaveDataChan: make(chan *StoredData)}
+	store.listenSaveAction()
+	return store
+}
+
+func (s *LocalStore) get() (*StoredData, error) {
+	if s.storedData == nil {
+		s.storedData = &StoredData{HTTPChallenges: make(map[string]map[string][]byte)}
+
+		f, err := os.Open(s.filename)
+		if err != nil {
+			return nil, err
+		}
+		defer f.Close()
+
+		file, err := ioutil.ReadAll(f)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(file) > 0 {
+			if err := json.Unmarshal(file, s.storedData); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return s.storedData, nil
+}
+
+// listenSaveAction listens to a chan to store ACME data in json format into LocalStore.filename
+func (s *LocalStore) listenSaveAction() {
+	safe.Go(func() {
+		for object := range s.SaveDataChan {
+			data, err := json.MarshalIndent(object, "", "  ")
+			if err != nil {
+				log.Error(err)
+			}
+
+			err = ioutil.WriteFile(s.filename, data, 0600)
+			if err != nil {
+				log.Error(err)
+			}
+		}
+	})
+}
+
+// GetAccount returns ACME Account
+func (s *LocalStore) GetAccount() (*Account, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Account, nil
+}
+
+// SaveAccount stores ACME Account
+func (s *LocalStore) SaveAccount(account *Account) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Account = account
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetCertificates returns ACME Certificates list
+func (s *LocalStore) GetCertificates() ([]*Certificate, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Certificates, nil
+}
+
+// SaveCertificates stores ACME Certificates list
+func (s *LocalStore) SaveCertificates(certificates []*Certificate) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Certificates = certificates
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetHTTPChallenges returns ACME HTTP Challenges list
+func (s *LocalStore) GetHTTPChallenges() (map[string]map[string][]byte, error) {
+	return s.storedData.HTTPChallenges, nil
+}
+
+// SaveHTTPChallenges stores ACME HTTP Challenges list
+func (s *LocalStore) SaveHTTPChallenges(httpChallenges map[string]map[string][]byte) error {
+	s.storedData.HTTPChallenges = httpChallenges
+	return nil
+}

provider/acme/provider.go

@@ -0,0 +1,565 @@
+package acme
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	fmtlog "log"
+	"net"
+	"net/http"
+	"os"
+	"reflect"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/BurntSushi/ty/fun"
+	"github.com/containous/flaeg"
+	"github.com/containous/mux"
+	"github.com/containous/traefik/log"
+	"github.com/containous/traefik/rules"
+	"github.com/containous/traefik/safe"
+	traefikTLS "github.com/containous/traefik/tls"
+	"github.com/containous/traefik/types"
+	"github.com/pkg/errors"
+	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/providers/dns"
+)
+
+var (
+	// OSCPMustStaple enables OSCP stapling as from https://github.com/xenolf/lego/issues/270
+	OSCPMustStaple = false
+	provider       = &Provider{}
+)
+
+// Configuration holds ACME configuration provided by users
+type Configuration struct {
+	Email         string         `description:"Email address used for registration"`
+	ACMELogging   bool           `description:"Enable debug logging of ACME actions."`
+	CAServer      string         `description:"CA server to use."`
+	Storage       string         `description:"Storage to use."`
+	EntryPoint    string         `description:"EntryPoint to use."`
+	OnHostRule    bool           `description:"Enable certificate generation on frontends Host rules."`
+	OnDemand      bool           `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` //deprecated
+	DNSChallenge  *DNSChallenge  `description:"Activate DNS-01 Challenge"`
+	HTTPChallenge *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
+	Domains       []types.Domain `description:"SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='main.net,san1.net,san2.net'"`
+}
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	*Configuration
+	Store                  Store
+	certificates           []*Certificate
+	account                *Account
+	client                 *acme.Client
+	certsChan              chan *Certificate
+	configurationChan      chan<- types.ConfigMessage
+	dynamicCerts           *safe.Safe
+	staticCerts            map[string]*tls.Certificate
+	clientMutex            sync.Mutex
+	configFromListenerChan chan types.Configuration
+	pool                   *safe.Pool
+}
+
+// Certificate is a struct which contains all data needed from an ACME certificate
+type Certificate struct {
+	Domain      types.Domain
+	Certificate []byte
+	Key         []byte
+}
+
+// DNSChallenge contains DNS challenge Configuration
+type DNSChallenge struct {
+	Provider         string         `description:"Use a DNS-01 based challenge provider rather than HTTPS."`
+	DelayBeforeCheck flaeg.Duration `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."`
+}
+
+// HTTPChallenge contains HTTP challenge Configuration
+type HTTPChallenge struct {
+	EntryPoint string `description:"HTTP challenge EntryPoint"`
+}
+
+// Get returns the provider instance
+func Get() *Provider {
+	return provider
+}
+
+// IsEnabled returns true if the provider instance and its configuration are not nil, otherwise false
+func IsEnabled() bool {
+	return provider != nil && provider.Configuration != nil
+}
+
+// SetConfigListenerChan initializes the configFromListenerChan
+func (p *Provider) SetConfigListenerChan(configFromListenerChan chan types.Configuration) {
+	p.configFromListenerChan = configFromListenerChan
+}
+
+func (p *Provider) init() error {
+	if p.ACMELogging {
+		acme.Logger = fmtlog.New(os.Stderr, "legolog: ", fmtlog.LstdFlags)
+	} else {
+		acme.Logger = fmtlog.New(ioutil.Discard, "", 0)
+	}
+
+	var err error
+	if p.Store == nil {
+		err = errors.New("no store found for the ACME provider")
+		return err
+	}
+
+	p.account, err = p.Store.GetAccount()
+	if err != nil {
+		return err
+	}
+
+	p.certificates, err = p.Store.GetCertificates()
+	if err != nil {
+		return err
+	}
+
+	p.watchCertificate()
+	p.watchNewDomains()
+
+	return nil
+}
+
+func (p *Provider) initAccount() (*Account, error) {
+	if p.account == nil || len(p.account.Email) == 0 {
+		var err error
+		p.account, err = NewAccount(p.Email)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return p.account, nil
+}
+
+// ListenConfiguration sets a new Configuration into the configFromListenerChan
+func (p *Provider) ListenConfiguration(config types.Configuration) {
+	p.configFromListenerChan <- config
+}
+
+// ListenRequest resolves new certificates for a domain from an incoming request and retrun a valid Certificate to serve (onDemand option)
+func (p *Provider) ListenRequest(domain string) (*tls.Certificate, error) {
+	acmeCert, err := p.resolveCertificate(types.Domain{Main: domain})
+	if acmeCert == nil || err != nil {
+		return nil, err
+	}
+
+	certificate, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
+
+	return &certificate, err
+}
+
+func (p *Provider) watchNewDomains() {
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case config := <-p.configFromListenerChan:
+				for _, frontend := range config.Frontends {
+					for _, route := range frontend.Routes {
+						domainRules := rules.Rules{}
+						domains, err := domainRules.ParseDomains(route.Rule)
+						if err != nil {
+							log.Errorf("Error parsing domains in provider ACME: %v", err)
+							continue
+						}
+
+						if len(domains) == 0 {
+							log.Debugf("No domain parsed in rule %q", route.Rule)
+							continue
+						}
+
+						log.Debugf("Try to challenge certificate for domain %v founded in Host rule", domains)
+
+						var domain types.Domain
+						if len(domains) > 0 {
+							domain = types.Domain{Main: domains[0]}
+							if len(domains) > 1 {
+								domain.SANs = domains[1:]
+							}
+
+							safe.Go(func() {
+								if _, err := p.resolveCertificate(domain); err != nil {
+									log.Errorf("Unable to obtain ACME certificate for domains %q detected thanks to rule %q : %v", strings.Join(domains, ","), route.Rule, err)
+								}
+							})
+						}
+					}
+				}
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+// SetDynamicCertificates allow to initialize dynamicCerts map
+func (p *Provider) SetDynamicCertificates(safe *safe.Safe) {
+	p.dynamicCerts = safe
+}
+
+// SetStaticCertificates allow to initialize staticCerts map
+func (p *Provider) SetStaticCertificates(staticCerts map[string]*tls.Certificate) {
+	p.staticCerts = staticCerts
+}
+
+func (p *Provider) resolveCertificate(domain types.Domain) (*acme.CertificateResource, error) {
+	domains := []string{domain.Main}
+	domains = append(domains, domain.SANs...)
+	if len(domains) == 0 {
+		return nil, nil
+	}
+	domains = fun.Map(types.CanonicalDomain, domains).([]string)
+
+	log.Debugf("Looking for provided certificate to validate %s...", domains)
+	cert := searchProvidedCertificateForDomains(domains, p.staticCerts)
+	if cert != nil {
+		return nil, nil
+	}
+	if p.dynamicCerts != nil && p.dynamicCerts.Get() != nil && p.dynamicCerts.Get().(*traefikTLS.DomainsCertificates).Get() != nil {
+		cert = searchProvidedCertificateForDomains(domains, p.dynamicCerts.Get().(*traefikTLS.DomainsCertificates).Get().(map[string]*tls.Certificate))
+	}
+	if cert != nil {
+		return nil, nil
+	}
+
+	log.Debugf("Loading ACME certificates %+v...", domains)
+	client, err := p.getClient()
+	if err != nil {
+		return nil, fmt.Errorf("cannot get ACME client %v", err)
+	}
+
+	bundle := true
+	certificate, failures := client.ObtainCertificate(domains, bundle, nil, OSCPMustStaple)
+	if len(failures) > 0 {
+		return nil, fmt.Errorf("cannot obtain certificates %+v", failures)
+	}
+	log.Debugf("Certificates obtained for domain %+v", domains)
+	p.addCertificateForDomain(domain, certificate.Certificate, certificate.PrivateKey)
+
+	return &certificate, nil
+}
+
+func (p *Provider) getClient() (*acme.Client, error) {
+	p.clientMutex.Lock()
+	defer p.clientMutex.Unlock()
+	var account *Account
+	if p.client == nil {
+		var err error
+		account, err = p.initAccount()
+		if err != nil {
+			return nil, err
+		}
+
+		log.Debug("Building ACME client...")
+		caServer := "https://acme-v01.api.letsencrypt.org/directory"
+		if len(p.CAServer) > 0 {
+			caServer = p.CAServer
+		}
+		log.Debugf(caServer)
+		client, err := acme.NewClient(caServer, account, acme.RSA4096)
+		if err != nil {
+			return nil, err
+		}
+		if account.GetRegistration() == nil {
+			// New users will need to register; be sure to save it
+			log.Info("Register...")
+			reg, err := client.Register()
+			if err != nil {
+				return nil, err
+			}
+			account.Registration = reg
+		}
+
+		log.Debug("AgreeToTOS...")
+		err = client.AgreeToTOS()
+		if err != nil {
+			// Let's Encrypt Subscriber Agreement renew ?
+			reg, err := client.QueryRegistration()
+			if err != nil {
+				return nil, err
+			}
+			account.Registration = reg
+			err = client.AgreeToTOS()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		// Save the account once before all the certificates generation/storing
+		// No certificate can be generated if account is not initialized
+		err = p.Store.SaveAccount(account)
+		if err != nil {
+			return nil, err
+		}
+
+		if p.DNSChallenge != nil && len(p.DNSChallenge.Provider) > 0 {
+			log.Debugf("Using DNS Challenge provider: %s", p.DNSChallenge.Provider)
+
+			err = dnsOverrideDelay(p.DNSChallenge.DelayBeforeCheck)
+			if err != nil {
+				return nil, err
+			}
+
+			var provider acme.ChallengeProvider
+			provider, err = dns.NewDNSChallengeProviderByName(p.DNSChallenge.Provider)
+			if err != nil {
+				return nil, err
+			}
+
+			client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSSNI01})
+			err = client.SetChallengeProvider(acme.DNS01, provider)
+			if err != nil {
+				return nil, err
+			}
+		} else if p.HTTPChallenge != nil && len(p.HTTPChallenge.EntryPoint) > 0 {
+			log.Debug("Using HTTP Challenge provider.")
+			client.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSSNI01})
+			err = client.SetChallengeProvider(acme.HTTP01, p)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			log.Debug("Using TLS Challenge provider.")
+			client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
+			err = client.SetChallengeProvider(acme.TLSSNI01, p)
+			if err != nil {
+				return nil, err
+			}
+		}
+		p.client = client
+	}
+
+	return p.client, nil
+}
+
+// Present presents a challenge to obtain new ACME certificate
+func (p *Provider) Present(domain, token, keyAuth string) error {
+	if p.HTTPChallenge != nil {
+		return presentHTTPChallenge(domain, token, keyAuth, p.Store)
+	} else if p.DNSChallenge == nil {
+		log.Debugf("TLS Challenge CleanUp temp certificate for %s", domain)
+		tempCertPEM, rsaPrivPEM, err := presentTLSChallenge(domain, keyAuth)
+		if err != nil {
+			return err
+		}
+		p.addCertificateForDomain(types.Domain{Main: "TEMP-" + domain}, tempCertPEM, rsaPrivPEM)
+	}
+
+	return nil
+}
+
+// CleanUp cleans the challenges when certificate is obtained
+func (p *Provider) CleanUp(domain, token, keyAuth string) error {
+	if p.HTTPChallenge != nil {
+		return cleanUpHTTPChallenge(domain, token, p.Store)
+	} else if p.DNSChallenge == nil {
+		log.Debugf("TLS Challenge CleanUp temp certificate for %s", domain)
+		p.deleteCertificateForDomain(types.Domain{Main: "TEMP-" + domain})
+	}
+	return nil
+}
+
+// Provide allows the file provider to provide configurations to traefik
+// using the given Configuration channel.
+func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *safe.Pool, constraints types.Constraints) error {
+	p.pool = pool
+	err := p.init()
+	if err != nil {
+		return err
+	}
+
+	p.configurationChan = configurationChan
+	p.refreshCertificates()
+
+	for _, domain := range p.Domains {
+		safe.Go(func() {
+			if _, err := p.resolveCertificate(domain); err != nil {
+				domains := []string{domain.Main}
+				domains = append(domains, domain.SANs...)
+				log.Errorf("Unable to obtain ACME certificate for domains %q : %v", domains, err)
+			}
+		})
+	}
+
+	p.renewCertificates()
+
+	ticker := time.NewTicker(24 * time.Hour)
+	pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case <-ticker.C:
+				p.renewCertificates()
+			case <-stop:
+				ticker.Stop()
+				return
+			}
+		}
+	})
+
+	return nil
+}
+
+func (p *Provider) addCertificateForDomain(domain types.Domain, certificate []byte, key []byte) {
+	p.certsChan <- &Certificate{Certificate: certificate, Key: key, Domain: domain}
+}
+
+func (p *Provider) watchCertificate() {
+	p.certsChan = make(chan *Certificate)
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case cert := <-p.certsChan:
+				certUpdated := false
+				for _, domainsCertificate := range p.certificates {
+					if reflect.DeepEqual(cert.Domain, domainsCertificate.Domain) {
+						domainsCertificate.Certificate = cert.Certificate
+						domainsCertificate.Key = cert.Key
+						certUpdated = true
+						break
+					}
+				}
+				if !certUpdated {
+					p.certificates = append(p.certificates, cert)
+				}
+				p.saveCertificates()
+
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+func (p *Provider) deleteCertificateForDomain(domain types.Domain) {
+	for k, cert := range p.certificates {
+		if reflect.DeepEqual(cert.Domain, domain) {
+			p.certificates = append(p.certificates[:k], p.certificates[k+1:]...)
+		}
+	}
+	p.saveCertificates()
+}
+
+func (p *Provider) saveCertificates() {
+	err := p.Store.SaveCertificates(p.certificates)
+	if err != nil {
+		log.Error(err)
+	}
+	p.refreshCertificates()
+}
+
+func (p *Provider) refreshCertificates() {
+	config := types.ConfigMessage{
+		ProviderName: "ACME",
+		Configuration: &types.Configuration{
+			Backends:  map[string]*types.Backend{},
+			Frontends: map[string]*types.Frontend{},
+			TLS:       []*traefikTLS.Configuration{},
+		},
+	}
+
+	for _, cert := range p.certificates {
+		certificate := &traefikTLS.Certificate{CertFile: traefikTLS.FileOrContent(cert.Certificate), KeyFile: traefikTLS.FileOrContent(cert.Key)}
+		config.Configuration.TLS = append(config.Configuration.TLS, &traefikTLS.Configuration{Certificate: certificate})
+	}
+	p.configurationChan <- config
+}
+
+// Timeout calculates the maximum of time allowed to resolved an ACME challenge
+func (p *Provider) Timeout() (timeout, interval time.Duration) {
+	return 60 * time.Second, 5 * time.Second
+}
+
+func (p *Provider) renewCertificates() {
+	log.Info("Testing certificate renew...")
+	for _, certificate := range p.certificates {
+		crt, err := getX509Certificate(certificate)
+		// If there's an error, we assume the cert is broken, and needs update
+		// <= 30 days left, renew certificate
+		if err != nil || crt == nil || crt.NotAfter.Before(time.Now().Add(24*30*time.Hour)) {
+			client, err := p.getClient()
+			if err != nil {
+				log.Infof("Error renewing certificate from LE : %+v, %v", certificate.Domain, err)
+				continue
+			}
+			log.Infof("Renewing certificate from LE : %+v", certificate.Domain)
+			renewedCert, err := client.RenewCertificate(acme.CertificateResource{
+				Domain:      certificate.Domain.Main,
+				PrivateKey:  certificate.Key,
+				Certificate: certificate.Certificate,
+			}, true, OSCPMustStaple)
+			if err != nil {
+				log.Errorf("Error renewing certificate from LE: %v, %v", certificate.Domain, err)
+				continue
+			}
+			p.addCertificateForDomain(certificate.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
+		}
+	}
+}
+
+// AddRoutes add routes on internal router
+func (p *Provider) AddRoutes(router *mux.Router) {
+	router.Methods(http.MethodGet).
+		Path(acme.HTTP01ChallengePath("{token}")).
+		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			vars := mux.Vars(req)
+			if token, ok := vars["token"]; ok {
+				domain, _, err := net.SplitHostPort(req.Host)
+				if err != nil {
+					log.Debugf("Unable to split host and port: %v. Fallback to request host.", err)
+					domain = req.Host
+				}
+				tokenValue := getTokenValue(token, domain, p.Store)
+				if len(tokenValue) > 0 {
+					rw.WriteHeader(http.StatusOK)
+					_, err = rw.Write(tokenValue)
+					if err != nil {
+						log.Errorf("Unable to write token : %v", err)
+					}
+					return
+				}
+			}
+			rw.WriteHeader(http.StatusNotFound)
+		}))
+}
+
+func searchProvidedCertificateForDomains(domains []string, certs map[string]*tls.Certificate) *tls.Certificate {
+	// Use regex to test for provided certs that might have been added into TLSConfig
+	providedCertMatch := false
+	for k := range certs {
+		selector := "^" + strings.Replace(k, "*.", "[^\\.]*\\.?", -1) + "$"
+		for _, domainToCheck := range domains {
+			providedCertMatch, _ = regexp.MatchString(selector, domainToCheck)
+			if !providedCertMatch {
+				break
+			}
+		}
+		if providedCertMatch {
+			log.Debugf("Got provided certificate for domains %s", domains)
+			return certs[k]
+
+		}
+	}
+	return nil
+}
+
+func getX509Certificate(certificate *Certificate) (*x509.Certificate, error) {
+	var crt *x509.Certificate
+	tlsCert, err := tls.X509KeyPair(certificate.Certificate, certificate.Key)
+	if err != nil {
+		log.Errorf("Failed to load TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", certificate.Domain.Main, strings.Join(certificate.Domain.SANs, ","), err)
+		return nil, err
+	}
+	crt = tlsCert.Leaf
+	if crt == nil {
+		crt, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			log.Errorf("Failed to parse TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", certificate.Domain.Main, strings.Join(certificate.Domain.SANs, ","), err)
+		}
+	}
+	return crt, err
+}

provider/acme/store.go

@@ -0,0 +1,18 @@
+package acme
+
+// StoredData represents the data managed by the Store
+type StoredData struct {
+	Account        *Account
+	Certificates   []*Certificate
+	HTTPChallenges map[string]map[string][]byte
+}
+
+// Store is a generic interface to represents a storage
+type Store interface {
+	GetAccount() (*Account, error)
+	SaveAccount(*Account) error
+	GetCertificates() ([]*Certificate, error)
+	SaveCertificates([]*Certificate) error
+	GetHTTPChallenges() (map[string]map[string][]byte, error)
+	SaveHTTPChallenges(map[string]map[string][]byte) error
+}