Move code to pkg

pkg/provider/acme/account.go

@@ -0,0 +1,89 @@
+package acme
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/go-acme/lego/certcrypto"
+	"github.com/go-acme/lego/registration"
+)
+
+// Account is used to store lets encrypt registration info
+type Account struct {
+	Email        string
+	Registration *registration.Resource
+	PrivateKey   []byte
+	KeyType      certcrypto.KeyType
+}
+
+const (
+	// RegistrationURLPathV1Regexp is a regexp which match ACME registration URL in the V1 format
+	RegistrationURLPathV1Regexp = `^.*/acme/reg/\d+$`
+)
+
+// NewAccount creates an account
+func NewAccount(ctx context.Context, email string, keyTypeValue string) (*Account, error) {
+	keyType := GetKeyType(ctx, keyTypeValue)
+
+	// Create a user. New accounts need an email and private key to start
+	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Account{
+		Email:      email,
+		PrivateKey: x509.MarshalPKCS1PrivateKey(privateKey),
+		KeyType:    keyType,
+	}, nil
+}
+
+// GetEmail returns email
+func (a *Account) GetEmail() string {
+	return a.Email
+}
+
+// GetRegistration returns lets encrypt registration resource
+func (a *Account) GetRegistration() *registration.Resource {
+	return a.Registration
+}
+
+// GetPrivateKey returns private key
+func (a *Account) GetPrivateKey() crypto.PrivateKey {
+	privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey)
+	if err != nil {
+		log.WithoutContext().WithField(log.ProviderName, "acme").
+			Errorf("Cannot unmarshal private key %+v: %v", a.PrivateKey, err)
+		return nil
+	}
+
+	return privateKey
+}
+
+// GetKeyType used to determine which algo to used
+func GetKeyType(ctx context.Context, value string) certcrypto.KeyType {
+	logger := log.FromContext(ctx)
+
+	switch value {
+	case "EC256":
+		return certcrypto.EC256
+	case "EC384":
+		return certcrypto.EC384
+	case "RSA2048":
+		return certcrypto.RSA2048
+	case "RSA4096":
+		return certcrypto.RSA4096
+	case "RSA8192":
+		return certcrypto.RSA8192
+	case "":
+		logger.Infof("The key type is empty. Use default key type %v.", certcrypto.RSA4096)
+		return certcrypto.RSA4096
+	default:
+		logger.Infof("Unable to determine the key type value %q: falling back on %v.", value, certcrypto.RSA4096)
+		return certcrypto.RSA4096
+	}
+}

pkg/provider/acme/challenge_http.go

@@ -0,0 +1,94 @@
+package acme
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/mux"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/http01"
+)
+
+var _ challenge.ProviderTimeout = (*challengeHTTP)(nil)
+
+type challengeHTTP struct {
+	Store Store
+}
+
+// Present presents a challenge to obtain new ACME certificate.
+func (c *challengeHTTP) Present(domain, token, keyAuth string) error {
+	return c.Store.SetHTTPChallengeToken(token, domain, []byte(keyAuth))
+}
+
+// CleanUp cleans the challenges when certificate is obtained.
+func (c *challengeHTTP) CleanUp(domain, token, keyAuth string) error {
+	return c.Store.RemoveHTTPChallengeToken(token, domain)
+}
+
+// Timeout calculates the maximum of time allowed to resolved an ACME challenge.
+func (c *challengeHTTP) Timeout() (timeout, interval time.Duration) {
+	return 60 * time.Second, 5 * time.Second
+}
+
+// Append adds routes on internal router
+func (p *Provider) Append(router *mux.Router) {
+	router.Methods(http.MethodGet).
+		Path(http01.ChallengePath("{token}")).
+		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+			vars := mux.Vars(req)
+
+			ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+			logger := log.FromContext(ctx)
+
+			if token, ok := vars["token"]; ok {
+				domain, _, err := net.SplitHostPort(req.Host)
+				if err != nil {
+					logger.Debugf("Unable to split host and port: %v. Fallback to request host.", err)
+					domain = req.Host
+				}
+
+				tokenValue := getTokenValue(ctx, token, domain, p.Store)
+				if len(tokenValue) > 0 {
+					rw.WriteHeader(http.StatusOK)
+					_, err = rw.Write(tokenValue)
+					if err != nil {
+						logger.Errorf("Unable to write token: %v", err)
+					}
+					return
+				}
+			}
+			rw.WriteHeader(http.StatusNotFound)
+		}))
+}
+
+func getTokenValue(ctx context.Context, token, domain string, store Store) []byte {
+	logger := log.FromContext(ctx)
+	logger.Debugf("Retrieving the ACME challenge for token %v...", token)
+
+	var result []byte
+
+	operation := func() error {
+		var err error
+		result, err = store.GetHTTPChallengeToken(token, domain)
+		return err
+	}
+
+	notify := func(err error, time time.Duration) {
+		logger.Errorf("Error getting challenge for token retrying in %s", time)
+	}
+
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 60 * time.Second
+	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
+	if err != nil {
+		logger.Errorf("Cannot retrieve the ACME challenge for token %v: %v", token, err)
+		return []byte{}
+	}
+
+	return result
+}

pkg/provider/acme/challenge_tls.go

@@ -0,0 +1,55 @@
+package acme
+
+import (
+	"crypto/tls"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/tlsalpn01"
+)
+
+var _ challenge.Provider = (*challengeTLSALPN)(nil)
+
+type challengeTLSALPN struct {
+	Store Store
+}
+
+func (c *challengeTLSALPN) Present(domain, token, keyAuth string) error {
+	log.WithoutContext().WithField(log.ProviderName, "acme").
+		Debugf("TLS Challenge Present temp certificate for %s", domain)
+
+	certPEMBlock, keyPEMBlock, err := tlsalpn01.ChallengeBlocks(domain, keyAuth)
+	if err != nil {
+		return err
+	}
+
+	cert := &Certificate{Certificate: certPEMBlock, Key: keyPEMBlock, Domain: types.Domain{Main: "TEMP-" + domain}}
+	return c.Store.AddTLSChallenge(domain, cert)
+}
+
+func (c *challengeTLSALPN) CleanUp(domain, token, keyAuth string) error {
+	log.WithoutContext().WithField(log.ProviderName, "acme").
+		Debugf("TLS Challenge CleanUp temp certificate for %s", domain)
+
+	return c.Store.RemoveTLSChallenge(domain)
+}
+
+// GetTLSALPNCertificate Get the temp certificate for ACME TLS-ALPN-O1 challenge.
+func (p *Provider) GetTLSALPNCertificate(domain string) (*tls.Certificate, error) {
+	cert, err := p.Store.GetTLSChallenge(domain)
+	if err != nil {
+		return nil, err
+	}
+
+	if cert == nil {
+		return nil, nil
+	}
+
+	certificate, err := tls.X509KeyPair(cert.Certificate, cert.Key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &certificate, nil
+}

pkg/provider/acme/local_store.go

@@ -0,0 +1,252 @@
+package acme
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"regexp"
+	"sync"
+
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/safe"
+)
+
+var _ Store = (*LocalStore)(nil)
+
+// LocalStore Stores implementation for local file
+type LocalStore struct {
+	filename     string
+	storedData   *StoredData
+	SaveDataChan chan *StoredData `json:"-"`
+	lock         sync.RWMutex
+}
+
+// NewLocalStore initializes a new LocalStore with a file name
+func NewLocalStore(filename string) *LocalStore {
+	store := &LocalStore{filename: filename, SaveDataChan: make(chan *StoredData)}
+	store.listenSaveAction()
+	return store
+}
+
+func (s *LocalStore) get() (*StoredData, error) {
+	if s.storedData == nil {
+		s.storedData = &StoredData{
+			HTTPChallenges: make(map[string]map[string][]byte),
+			TLSChallenges:  make(map[string]*Certificate),
+		}
+
+		hasData, err := CheckFile(s.filename)
+		if err != nil {
+			return nil, err
+		}
+
+		if hasData {
+			logger := log.WithoutContext().WithField(log.ProviderName, "acme")
+
+			f, err := os.Open(s.filename)
+			if err != nil {
+				return nil, err
+			}
+			defer f.Close()
+
+			file, err := ioutil.ReadAll(f)
+			if err != nil {
+				return nil, err
+			}
+
+			if len(file) > 0 {
+				if err := json.Unmarshal(file, s.storedData); err != nil {
+					return nil, err
+				}
+			}
+
+			// Check if ACME Account is in ACME V1 format
+			if s.storedData.Account != nil && s.storedData.Account.Registration != nil {
+				isOldRegistration, err := regexp.MatchString(RegistrationURLPathV1Regexp, s.storedData.Account.Registration.URI)
+				if err != nil {
+					return nil, err
+				}
+				if isOldRegistration {
+					logger.Debug("Reseting ACME account.")
+					s.storedData.Account = nil
+					s.SaveDataChan <- s.storedData
+				}
+			}
+
+			// Delete all certificates with no value
+			var certificates []*Certificate
+			for _, certificate := range s.storedData.Certificates {
+				if len(certificate.Certificate) == 0 || len(certificate.Key) == 0 {
+					logger.Debugf("Deleting empty certificate %v for %v", certificate, certificate.Domain.ToStrArray())
+					continue
+				}
+				certificates = append(certificates, certificate)
+			}
+
+			if len(certificates) < len(s.storedData.Certificates) {
+				s.storedData.Certificates = certificates
+				s.SaveDataChan <- s.storedData
+			}
+		}
+	}
+
+	return s.storedData, nil
+}
+
+// listenSaveAction listens to a chan to store ACME data in json format into LocalStore.filename
+func (s *LocalStore) listenSaveAction() {
+	safe.Go(func() {
+		logger := log.WithoutContext().WithField(log.ProviderName, "acme")
+		for object := range s.SaveDataChan {
+			data, err := json.MarshalIndent(object, "", "  ")
+			if err != nil {
+				logger.Error(err)
+			}
+
+			err = ioutil.WriteFile(s.filename, data, 0600)
+			if err != nil {
+				logger.Error(err)
+			}
+		}
+	})
+}
+
+// GetAccount returns ACME Account
+func (s *LocalStore) GetAccount() (*Account, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Account, nil
+}
+
+// SaveAccount stores ACME Account
+func (s *LocalStore) SaveAccount(account *Account) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Account = account
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetCertificates returns ACME Certificates list
+func (s *LocalStore) GetCertificates() ([]*Certificate, error) {
+	storedData, err := s.get()
+	if err != nil {
+		return nil, err
+	}
+
+	return storedData.Certificates, nil
+}
+
+// SaveCertificates stores ACME Certificates list
+func (s *LocalStore) SaveCertificates(certificates []*Certificate) error {
+	storedData, err := s.get()
+	if err != nil {
+		return err
+	}
+
+	storedData.Certificates = certificates
+	s.SaveDataChan <- storedData
+
+	return nil
+}
+
+// GetHTTPChallengeToken Get the http challenge token from the store
+func (s *LocalStore) GetHTTPChallengeToken(token, domain string) ([]byte, error) {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		s.storedData.HTTPChallenges = map[string]map[string][]byte{}
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; !ok {
+		return nil, fmt.Errorf("cannot find challenge for token %v", token)
+	}
+
+	result, ok := s.storedData.HTTPChallenges[token][domain]
+	if !ok {
+		return nil, fmt.Errorf("cannot find challenge for token %v", token)
+	}
+	return result, nil
+}
+
+// SetHTTPChallengeToken Set the http challenge token in the store
+func (s *LocalStore) SetHTTPChallengeToken(token, domain string, keyAuth []byte) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		s.storedData.HTTPChallenges = map[string]map[string][]byte{}
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; !ok {
+		s.storedData.HTTPChallenges[token] = map[string][]byte{}
+	}
+
+	s.storedData.HTTPChallenges[token][domain] = keyAuth
+	return nil
+}
+
+// RemoveHTTPChallengeToken Remove the http challenge token in the store
+func (s *LocalStore) RemoveHTTPChallengeToken(token, domain string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.HTTPChallenges == nil {
+		return nil
+	}
+
+	if _, ok := s.storedData.HTTPChallenges[token]; ok {
+		delete(s.storedData.HTTPChallenges[token], domain)
+		if len(s.storedData.HTTPChallenges[token]) == 0 {
+			delete(s.storedData.HTTPChallenges, token)
+		}
+	}
+	return nil
+}
+
+// AddTLSChallenge Add a certificate to the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) AddTLSChallenge(domain string, cert *Certificate) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		s.storedData.TLSChallenges = make(map[string]*Certificate)
+	}
+
+	s.storedData.TLSChallenges[domain] = cert
+	return nil
+}
+
+// GetTLSChallenge Get a certificate from the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) GetTLSChallenge(domain string) (*Certificate, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		s.storedData.TLSChallenges = make(map[string]*Certificate)
+	}
+
+	return s.storedData.TLSChallenges[domain], nil
+}
+
+// RemoveTLSChallenge Remove a certificate from the ACME TLS-ALPN-01 certificates storage
+func (s *LocalStore) RemoveTLSChallenge(domain string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.storedData.TLSChallenges == nil {
+		return nil
+	}
+
+	delete(s.storedData.TLSChallenges, domain)
+	return nil
+}

pkg/provider/acme/local_store_unix.go

@@ -0,0 +1,35 @@
+// +build !windows
+
+package acme
+
+import (
+	"fmt"
+	"os"
+)
+
+// CheckFile checks file permissions and content size
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	if fi.Mode().Perm()&0077 != 0 {
+		return false, fmt.Errorf("permissions %o for %s are too open, please use 600", fi.Mode().Perm(), name)
+	}
+
+	return fi.Size() > 0, nil
+}

pkg/provider/acme/local_store_windows.go

@@ -0,0 +1,27 @@
+package acme
+
+import "os"
+
+// CheckFile checks file content size
+// Do not check file permissions on Windows right now
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	return fi.Size() > 0, nil
+}

pkg/provider/acme/provider.go

@@ -0,0 +1,825 @@
+package acme
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"io/ioutil"
+	fmtlog "log"
+	"net/url"
+	"reflect"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/flaeg/parse"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/rules"
+	"github.com/containous/traefik/pkg/safe"
+	traefiktls "github.com/containous/traefik/pkg/tls"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/containous/traefik/pkg/version"
+	"github.com/go-acme/lego/certificate"
+	"github.com/go-acme/lego/challenge"
+	"github.com/go-acme/lego/challenge/dns01"
+	"github.com/go-acme/lego/lego"
+	legolog "github.com/go-acme/lego/log"
+	"github.com/go-acme/lego/providers/dns"
+	"github.com/go-acme/lego/registration"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+var (
+	// oscpMustStaple enables OSCP stapling as from https://github.com/go-acme/lego/issues/270
+	oscpMustStaple = false
+)
+
+// Configuration holds ACME configuration provided by users
+type Configuration struct {
+	Email         string         `description:"Email address used for registration"`
+	ACMELogging   bool           `description:"Enable debug logging of ACME actions."`
+	CAServer      string         `description:"CA server to use."`
+	Storage       string         `description:"Storage to use."`
+	EntryPoint    string         `description:"EntryPoint to use."`
+	KeyType       string         `description:"KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. Default to 'RSA4096'"`
+	OnHostRule    bool           `description:"Enable certificate generation on frontends Host rules."`
+	DNSChallenge  *DNSChallenge  `description:"Activate DNS-01 Challenge"`
+	HTTPChallenge *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
+	TLSChallenge  *TLSChallenge  `description:"Activate TLS-ALPN-01 Challenge"`
+	Domains       []types.Domain `description:"CN and SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='*.main.net'. No SANs for wildcards domain. Wildcard domains only accepted with DNSChallenge"`
+}
+
+// Certificate is a struct which contains all data needed from an ACME certificate
+type Certificate struct {
+	Domain      types.Domain
+	Certificate []byte
+	Key         []byte
+}
+
+// DNSChallenge contains DNS challenge Configuration
+type DNSChallenge struct {
+	Provider                string             `description:"Use a DNS-01 based challenge provider rather than HTTPS."`
+	DelayBeforeCheck        parse.Duration     `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."`
+	Resolvers               types.DNSResolvers `description:"Use following DNS servers to resolve the FQDN authority."`
+	DisablePropagationCheck bool               `description:"Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready. [not recommended]"`
+
+	preCheckTimeout  time.Duration
+	preCheckInterval time.Duration
+}
+
+// HTTPChallenge contains HTTP challenge Configuration
+type HTTPChallenge struct {
+	EntryPoint string `description:"HTTP challenge EntryPoint"`
+}
+
+// TLSChallenge contains TLS challenge Configuration
+type TLSChallenge struct{}
+
+// Provider holds configurations of the provider.
+type Provider struct {
+	*Configuration
+	Store                  Store
+	certificates           []*Certificate
+	account                *Account
+	client                 *lego.Client
+	certsChan              chan *Certificate
+	configurationChan      chan<- config.Message
+	tlsManager             *traefiktls.Manager
+	clientMutex            sync.Mutex
+	configFromListenerChan chan config.Configuration
+	pool                   *safe.Pool
+	resolvingDomains       map[string]struct{}
+	resolvingDomainsMutex  sync.RWMutex
+}
+
+// SetTLSManager sets the tls manager to use
+func (p *Provider) SetTLSManager(tlsManager *traefiktls.Manager) {
+	p.tlsManager = tlsManager
+}
+
+// SetConfigListenerChan initializes the configFromListenerChan
+func (p *Provider) SetConfigListenerChan(configFromListenerChan chan config.Configuration) {
+	p.configFromListenerChan = configFromListenerChan
+}
+
+// ListenConfiguration sets a new Configuration into the configFromListenerChan
+func (p *Provider) ListenConfiguration(config config.Configuration) {
+	p.configFromListenerChan <- config
+}
+
+// ListenRequest resolves new certificates for a domain from an incoming request and return a valid Certificate to serve (onDemand option)
+func (p *Provider) ListenRequest(domain string) (*tls.Certificate, error) {
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+
+	acmeCert, err := p.resolveCertificate(ctx, types.Domain{Main: domain}, false)
+	if acmeCert == nil || err != nil {
+		return nil, err
+	}
+
+	cert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
+
+	return &cert, err
+}
+
+// Init for compatibility reason the BaseProvider implements an empty Init
+func (p *Provider) Init() error {
+
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+	logger := log.FromContext(ctx)
+
+	if p.ACMELogging {
+		legolog.Logger = fmtlog.New(logger.WriterLevel(logrus.InfoLevel), "legolog: ", 0)
+	} else {
+		legolog.Logger = fmtlog.New(ioutil.Discard, "", 0)
+	}
+
+	if len(p.Configuration.Storage) == 0 {
+		return errors.New("unable to initialize ACME provider with no storage location for the certificates")
+	}
+	p.Store = NewLocalStore(p.Configuration.Storage)
+
+	var err error
+	p.account, err = p.Store.GetAccount()
+	if err != nil {
+		return fmt.Errorf("unable to get ACME account : %v", err)
+	}
+
+	// Reset Account if caServer changed, thus registration URI can be updated
+	if p.account != nil && p.account.Registration != nil && !isAccountMatchingCaServer(ctx, p.account.Registration.URI, p.CAServer) {
+		logger.Info("Account URI does not match the current CAServer. The account will be reset.")
+		p.account = nil
+	}
+
+	p.certificates, err = p.Store.GetCertificates()
+	if err != nil {
+		return fmt.Errorf("unable to get ACME certificates : %v", err)
+	}
+
+	// Init the currently resolved domain map
+	p.resolvingDomains = make(map[string]struct{})
+
+	return nil
+}
+
+func isAccountMatchingCaServer(ctx context.Context, accountURI string, serverURI string) bool {
+	logger := log.FromContext(ctx)
+
+	aru, err := url.Parse(accountURI)
+	if err != nil {
+		logger.Infof("Unable to parse account.Registration URL: %v", err)
+		return false
+	}
+
+	cau, err := url.Parse(serverURI)
+	if err != nil {
+		logger.Infof("Unable to parse CAServer URL: %v", err)
+		return false
+	}
+
+	return cau.Hostname() == aru.Hostname()
+}
+
+// Provide allows the file provider to provide configurations to traefik
+// using the given Configuration channel.
+func (p *Provider) Provide(configurationChan chan<- config.Message, pool *safe.Pool) error {
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+
+	p.pool = pool
+
+	p.watchCertificate(ctx)
+	p.watchNewDomains(ctx)
+
+	p.configurationChan = configurationChan
+	p.refreshCertificates()
+
+	p.deleteUnnecessaryDomains(ctx)
+	for i := 0; i < len(p.Domains); i++ {
+		domain := p.Domains[i]
+		safe.Go(func() {
+			if _, err := p.resolveCertificate(ctx, domain, true); err != nil {
+				log.WithoutContext().WithField(log.ProviderName, "acme").
+					Errorf("Unable to obtain ACME certificate for domains %q : %v", strings.Join(domain.ToStrArray(), ","), err)
+			}
+		})
+	}
+
+	p.renewCertificates(ctx)
+
+	ticker := time.NewTicker(24 * time.Hour)
+	pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case <-ticker.C:
+				p.renewCertificates(ctx)
+			case <-stop:
+				ticker.Stop()
+				return
+			}
+		}
+	})
+
+	return nil
+}
+
+func (p *Provider) getClient() (*lego.Client, error) {
+	p.clientMutex.Lock()
+	defer p.clientMutex.Unlock()
+
+	ctx := log.With(context.Background(), log.Str(log.ProviderName, "acme"))
+	logger := log.FromContext(ctx)
+
+	if p.client != nil {
+		return p.client, nil
+	}
+
+	account, err := p.initAccount(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	logger.Debug("Building ACME client...")
+
+	caServer := "https://acme-v02.api.letsencrypt.org/directory"
+	if len(p.CAServer) > 0 {
+		caServer = p.CAServer
+	}
+	logger.Debug(caServer)
+
+	config := lego.NewConfig(account)
+	config.CADirURL = caServer
+	config.Certificate.KeyType = account.KeyType
+	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
+
+	client, err := lego.NewClient(config)
+	if err != nil {
+		return nil, err
+	}
+
+	// New users will need to register; be sure to save it
+	if account.GetRegistration() == nil {
+		logger.Info("Register...")
+
+		reg, errR := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
+		if errR != nil {
+			return nil, errR
+		}
+
+		account.Registration = reg
+	}
+
+	// Save the account once before all the certificates generation/storing
+	// No certificate can be generated if account is not initialized
+	err = p.Store.SaveAccount(account)
+	if err != nil {
+		return nil, err
+	}
+
+	switch {
+	case p.DNSChallenge != nil && len(p.DNSChallenge.Provider) > 0:
+		logger.Debugf("Using DNS Challenge provider: %s", p.DNSChallenge.Provider)
+
+		var provider challenge.Provider
+		provider, err = dns.NewDNSChallengeProviderByName(p.DNSChallenge.Provider)
+		if err != nil {
+			return nil, err
+		}
+
+		err = client.Challenge.SetDNS01Provider(provider,
+			dns01.CondOption(len(p.DNSChallenge.Resolvers) > 0, dns01.AddRecursiveNameservers(p.DNSChallenge.Resolvers)),
+			dns01.CondOption(p.DNSChallenge.DisablePropagationCheck || p.DNSChallenge.DelayBeforeCheck > 0,
+				dns01.AddPreCheck(func(_, _ string) (bool, error) {
+					if p.DNSChallenge.DelayBeforeCheck > 0 {
+						log.Debugf("Delaying %d rather than validating DNS propagation now.", p.DNSChallenge.DelayBeforeCheck)
+						time.Sleep(time.Duration(p.DNSChallenge.DelayBeforeCheck))
+					}
+					return true, nil
+				})),
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		// Same default values than LEGO
+		p.DNSChallenge.preCheckTimeout = 60 * time.Second
+		p.DNSChallenge.preCheckInterval = 2 * time.Second
+
+		// Set the precheck timeout into the DNSChallenge provider
+		if challengeProviderTimeout, ok := provider.(challenge.ProviderTimeout); ok {
+			p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval = challengeProviderTimeout.Timeout()
+		}
+
+	case p.HTTPChallenge != nil && len(p.HTTPChallenge.EntryPoint) > 0:
+		logger.Debug("Using HTTP Challenge provider.")
+
+		err = client.Challenge.SetHTTP01Provider(&challengeHTTP{Store: p.Store})
+		if err != nil {
+			return nil, err
+		}
+
+	case p.TLSChallenge != nil:
+		logger.Debug("Using TLS Challenge provider.")
+
+		err = client.Challenge.SetTLSALPN01Provider(&challengeTLSALPN{Store: p.Store})
+		if err != nil {
+			return nil, err
+		}
+
+	default:
+		return nil, errors.New("ACME challenge not specified, please select TLS or HTTP or DNS Challenge")
+	}
+
+	p.client = client
+	return p.client, nil
+}
+
+func (p *Provider) initAccount(ctx context.Context) (*Account, error) {
+	if p.account == nil || len(p.account.Email) == 0 {
+		var err error
+		p.account, err = NewAccount(ctx, p.Email, p.KeyType)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Set the KeyType if not already defined in the account
+	if len(p.account.KeyType) == 0 {
+		p.account.KeyType = GetKeyType(ctx, p.KeyType)
+	}
+
+	return p.account, nil
+}
+
+func (p *Provider) resolveDomains(ctx context.Context, domains []string) {
+	if len(domains) == 0 {
+		log.FromContext(ctx).Debug("No domain parsed in provider ACME")
+		return
+	}
+
+	log.FromContext(ctx).Debugf("Try to challenge certificate for domain %v founded in HostSNI rule", domains)
+
+	var domain types.Domain
+	if len(domains) > 0 {
+		domain = types.Domain{Main: domains[0]}
+		if len(domains) > 1 {
+			domain.SANs = domains[1:]
+		}
+
+		safe.Go(func() {
+			if _, err := p.resolveCertificate(ctx, domain, false); err != nil {
+				log.FromContext(ctx).Errorf("Unable to obtain ACME certificate for domains %q: %v", strings.Join(domains, ","), err)
+			}
+		})
+	}
+}
+
+func (p *Provider) watchNewDomains(ctx context.Context) {
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case config := <-p.configFromListenerChan:
+				if config.TCP != nil {
+					for routerName, route := range config.TCP.Routers {
+						ctxRouter := log.With(ctx, log.Str(log.RouterName, routerName), log.Str(log.Rule, route.Rule))
+
+						domains, err := rules.ParseHostSNI(route.Rule)
+						if err != nil {
+							log.FromContext(ctxRouter).Errorf("Error parsing domains in provider ACME: %v", err)
+							continue
+						}
+						p.resolveDomains(ctxRouter, domains)
+					}
+				}
+
+				for routerName, route := range config.HTTP.Routers {
+					ctxRouter := log.With(ctx, log.Str(log.RouterName, routerName), log.Str(log.Rule, route.Rule))
+
+					domains, err := rules.ParseDomains(route.Rule)
+					if err != nil {
+						log.FromContext(ctxRouter).Errorf("Error parsing domains in provider ACME: %v", err)
+						continue
+					}
+					p.resolveDomains(ctxRouter, domains)
+				}
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+func (p *Provider) resolveCertificate(ctx context.Context, domain types.Domain, domainFromConfigurationFile bool) (*certificate.Resource, error) {
+	domains, err := p.getValidDomains(ctx, domain, domainFromConfigurationFile)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check provided certificates
+	uncheckedDomains := p.getUncheckedDomains(ctx, domains, !domainFromConfigurationFile)
+	if len(uncheckedDomains) == 0 {
+		return nil, nil
+	}
+
+	p.addResolvingDomains(uncheckedDomains)
+	defer p.removeResolvingDomains(uncheckedDomains)
+
+	logger := log.FromContext(ctx)
+	logger.Debugf("Loading ACME certificates %+v...", uncheckedDomains)
+
+	client, err := p.getClient()
+	if err != nil {
+		return nil, fmt.Errorf("cannot get ACME client %v", err)
+	}
+
+	var cert *certificate.Resource
+	bundle := true
+	if p.useCertificateWithRetry(uncheckedDomains) {
+		cert, err = obtainCertificateWithRetry(ctx, domains, client, p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval, bundle)
+	} else {
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: oscpMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("unable to generate a certificate for the domains %v: %v", uncheckedDomains, err)
+	}
+	if cert == nil {
+		return nil, fmt.Errorf("domains %v do not generate a certificate", uncheckedDomains)
+	}
+	if len(cert.Certificate) == 0 || len(cert.PrivateKey) == 0 {
+		return nil, fmt.Errorf("domains %v generate certificate with no value: %v", uncheckedDomains, cert)
+	}
+
+	logger.Debugf("Certificates obtained for domains %+v", uncheckedDomains)
+
+	if len(uncheckedDomains) > 1 {
+		domain = types.Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
+	} else {
+		domain = types.Domain{Main: uncheckedDomains[0]}
+	}
+	p.addCertificateForDomain(domain, cert.Certificate, cert.PrivateKey)
+
+	return cert, nil
+}
+
+func (p *Provider) removeResolvingDomains(resolvingDomains []string) {
+	p.resolvingDomainsMutex.Lock()
+	defer p.resolvingDomainsMutex.Unlock()
+
+	for _, domain := range resolvingDomains {
+		delete(p.resolvingDomains, domain)
+	}
+}
+
+func (p *Provider) addResolvingDomains(resolvingDomains []string) {
+	p.resolvingDomainsMutex.Lock()
+	defer p.resolvingDomainsMutex.Unlock()
+
+	for _, domain := range resolvingDomains {
+		p.resolvingDomains[domain] = struct{}{}
+	}
+}
+
+func (p *Provider) useCertificateWithRetry(domains []string) bool {
+	// Check if we can use the retry mechanism only if we use the DNS Challenge and if is there are at least 2 domains to check
+	if p.DNSChallenge != nil && len(domains) > 1 {
+		rootDomain := ""
+		for _, searchWildcardDomain := range domains {
+			// Search a wildcard domain if not already found
+			if len(rootDomain) == 0 && strings.HasPrefix(searchWildcardDomain, "*.") {
+				rootDomain = strings.TrimPrefix(searchWildcardDomain, "*.")
+				if len(rootDomain) > 0 {
+					// Look for a root domain which matches the wildcard domain
+					for _, searchRootDomain := range domains {
+						if rootDomain == searchRootDomain {
+							// If the domains list contains a wildcard domain and its root domain, we can use the retry mechanism to obtain the certificate
+							return true
+						}
+					}
+				}
+				// There is only one wildcard domain in the slice, if its root domain has not been found, the retry mechanism does not have to be used
+				return false
+			}
+		}
+	}
+
+	return false
+}
+
+func obtainCertificateWithRetry(ctx context.Context, domains []string, client *lego.Client, timeout, interval time.Duration, bundle bool) (*certificate.Resource, error) {
+	logger := log.FromContext(ctx)
+
+	var cert *certificate.Resource
+	var err error
+
+	operation := func() error {
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: oscpMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
+		return err
+	}
+
+	notify := func(err error, time time.Duration) {
+		logger.Errorf("Error obtaining certificate retrying in %s", time)
+	}
+
+	// Define a retry backOff to let LEGO tries twice to obtain a certificate for both wildcard and root domain
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 2 * timeout
+	ebo.MaxInterval = interval
+	rbo := backoff.WithMaxRetries(ebo, 2)
+
+	err = backoff.RetryNotify(safe.OperationWithRecover(operation), rbo, notify)
+	if err != nil {
+		logger.Errorf("Error obtaining certificate: %v", err)
+		return nil, err
+	}
+
+	return cert, nil
+}
+
+func (p *Provider) addCertificateForDomain(domain types.Domain, certificate []byte, key []byte) {
+	p.certsChan <- &Certificate{Certificate: certificate, Key: key, Domain: domain}
+}
+
+// deleteUnnecessaryDomains deletes from the configuration :
+// - Duplicated domains
+// - Domains which are checked by wildcard domain
+func (p *Provider) deleteUnnecessaryDomains(ctx context.Context) {
+	var newDomains []types.Domain
+
+	logger := log.FromContext(ctx)
+
+	for idxDomainToCheck, domainToCheck := range p.Domains {
+		keepDomain := true
+
+		for idxDomain, domain := range p.Domains {
+			if idxDomainToCheck == idxDomain {
+				continue
+			}
+
+			if reflect.DeepEqual(domain, domainToCheck) {
+				if idxDomainToCheck > idxDomain {
+					logger.Warnf("The domain %v is duplicated in the configuration but will be process by ACME provider only once.", domainToCheck)
+					keepDomain = false
+				}
+				break
+			}
+
+			// Check if CN or SANS to check already exists
+			// or can not be checked by a wildcard
+			var newDomainsToCheck []string
+			for _, domainProcessed := range domainToCheck.ToStrArray() {
+				if idxDomain < idxDomainToCheck && isDomainAlreadyChecked(domainProcessed, domain.ToStrArray()) {
+					// The domain is duplicated in a CN
+					logger.Warnf("Domain %q is duplicated in the configuration or validated by the domain %v. It will be processed once.", domainProcessed, domain)
+					continue
+				} else if domain.Main != domainProcessed && strings.HasPrefix(domain.Main, "*") && isDomainAlreadyChecked(domainProcessed, []string{domain.Main}) {
+					// Check if a wildcard can validate the domain
+					logger.Warnf("Domain %q will not be processed by ACME provider because it is validated by the wildcard %q", domainProcessed, domain.Main)
+					continue
+				}
+				newDomainsToCheck = append(newDomainsToCheck, domainProcessed)
+			}
+
+			// Delete the domain if both Main and SANs can be validated by the wildcard domain
+			// otherwise keep the unchecked values
+			if newDomainsToCheck == nil {
+				keepDomain = false
+				break
+			}
+			domainToCheck.Set(newDomainsToCheck)
+		}
+
+		if keepDomain {
+			newDomains = append(newDomains, domainToCheck)
+		}
+	}
+
+	p.Domains = newDomains
+}
+
+func (p *Provider) watchCertificate(ctx context.Context) {
+	p.certsChan = make(chan *Certificate)
+
+	p.pool.Go(func(stop chan bool) {
+		for {
+			select {
+			case cert := <-p.certsChan:
+				certUpdated := false
+				for _, domainsCertificate := range p.certificates {
+					if reflect.DeepEqual(cert.Domain, domainsCertificate.Domain) {
+						domainsCertificate.Certificate = cert.Certificate
+						domainsCertificate.Key = cert.Key
+						certUpdated = true
+						break
+					}
+				}
+				if !certUpdated {
+					p.certificates = append(p.certificates, cert)
+				}
+
+				err := p.saveCertificates()
+				if err != nil {
+					log.FromContext(ctx).Error(err)
+				}
+			case <-stop:
+				return
+			}
+		}
+	})
+}
+
+func (p *Provider) saveCertificates() error {
+	err := p.Store.SaveCertificates(p.certificates)
+
+	p.refreshCertificates()
+
+	return err
+}
+
+func (p *Provider) refreshCertificates() {
+	conf := config.Message{
+		ProviderName: "ACME",
+		Configuration: &config.Configuration{
+			HTTP: &config.HTTPConfiguration{
+				Routers:     map[string]*config.Router{},
+				Middlewares: map[string]*config.Middleware{},
+				Services:    map[string]*config.Service{},
+			},
+			TLS: []*traefiktls.Configuration{},
+		},
+	}
+
+	for _, cert := range p.certificates {
+		cert := &traefiktls.Certificate{CertFile: traefiktls.FileOrContent(cert.Certificate), KeyFile: traefiktls.FileOrContent(cert.Key)}
+		conf.Configuration.TLS = append(conf.Configuration.TLS, &traefiktls.Configuration{Certificate: cert})
+	}
+	p.configurationChan <- conf
+}
+
+func (p *Provider) renewCertificates(ctx context.Context) {
+	logger := log.FromContext(ctx)
+
+	logger.Info("Testing certificate renew...")
+	for _, cert := range p.certificates {
+		crt, err := getX509Certificate(ctx, cert)
+		// If there's an error, we assume the cert is broken, and needs update
+		// <= 30 days left, renew certificate
+		if err != nil || crt == nil || crt.NotAfter.Before(time.Now().Add(24*30*time.Hour)) {
+			client, err := p.getClient()
+			if err != nil {
+				logger.Infof("Error renewing certificate from LE : %+v, %v", cert.Domain, err)
+				continue
+			}
+
+			logger.Infof("Renewing certificate from LE : %+v", cert.Domain)
+
+			renewedCert, err := client.Certificate.Renew(certificate.Resource{
+				Domain:      cert.Domain.Main,
+				PrivateKey:  cert.Key,
+				Certificate: cert.Certificate,
+			}, true, oscpMustStaple)
+
+			if err != nil {
+				logger.Errorf("Error renewing certificate from LE: %v, %v", cert.Domain, err)
+				continue
+			}
+
+			if len(renewedCert.Certificate) == 0 || len(renewedCert.PrivateKey) == 0 {
+				logger.Errorf("domains %v renew certificate with no value: %v", cert.Domain.ToStrArray(), cert)
+				continue
+			}
+
+			p.addCertificateForDomain(cert.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
+		}
+	}
+}
+
+// Get provided certificate which check a domains list (Main and SANs)
+// from static and dynamic provided certificates
+func (p *Provider) getUncheckedDomains(ctx context.Context, domainsToCheck []string, checkConfigurationDomains bool) []string {
+	p.resolvingDomainsMutex.RLock()
+	defer p.resolvingDomainsMutex.RUnlock()
+
+	log.FromContext(ctx).Debugf("Looking for provided certificate(s) to validate %q...", domainsToCheck)
+
+	allDomains := p.tlsManager.GetStore("default").GetAllDomains()
+
+	// Get ACME certificates
+	for _, cert := range p.certificates {
+		allDomains = append(allDomains, strings.Join(cert.Domain.ToStrArray(), ","))
+	}
+
+	// Get currently resolved domains
+	for domain := range p.resolvingDomains {
+		allDomains = append(allDomains, domain)
+	}
+
+	// Get Configuration Domains
+	if checkConfigurationDomains {
+		for i := 0; i < len(p.Domains); i++ {
+			allDomains = append(allDomains, strings.Join(p.Domains[i].ToStrArray(), ","))
+		}
+	}
+
+	return searchUncheckedDomains(ctx, domainsToCheck, allDomains)
+}
+
+func searchUncheckedDomains(ctx context.Context, domainsToCheck []string, existentDomains []string) []string {
+	var uncheckedDomains []string
+	for _, domainToCheck := range domainsToCheck {
+		if !isDomainAlreadyChecked(domainToCheck, existentDomains) {
+			uncheckedDomains = append(uncheckedDomains, domainToCheck)
+		}
+	}
+
+	logger := log.FromContext(ctx)
+	if len(uncheckedDomains) == 0 {
+		logger.Debugf("No ACME certificate generation required for domains %q.", domainsToCheck)
+	} else {
+		logger.Debugf("Domains %q need ACME certificates generation for domains %q.", domainsToCheck, strings.Join(uncheckedDomains, ","))
+	}
+	return uncheckedDomains
+}
+
+func getX509Certificate(ctx context.Context, cert *Certificate) (*x509.Certificate, error) {
+	logger := log.FromContext(ctx)
+
+	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.Key)
+	if err != nil {
+		logger.Errorf("Failed to load TLS key pair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
+		return nil, err
+	}
+
+	crt := tlsCert.Leaf
+	if crt == nil {
+		crt, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			logger.Errorf("Failed to parse TLS key pair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
+		}
+	}
+
+	return crt, err
+}
+
+// getValidDomains checks if given domain is allowed to generate a ACME certificate and return it
+func (p *Provider) getValidDomains(ctx context.Context, domain types.Domain, wildcardAllowed bool) ([]string, error) {
+	domains := domain.ToStrArray()
+	if len(domains) == 0 {
+		return nil, errors.New("unable to generate a certificate in ACME provider when no domain is given")
+	}
+
+	if strings.HasPrefix(domain.Main, "*") {
+		if !wildcardAllowed {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q from a 'Host' rule", strings.Join(domains, ","))
+		}
+
+		if p.DNSChallenge == nil {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q : ACME needs a DNSChallenge", strings.Join(domains, ","))
+		}
+
+		if strings.HasPrefix(domain.Main, "*.*") {
+			return nil, fmt.Errorf("unable to generate a wildcard certificate in ACME provider for domain %q : ACME does not allow '*.*' wildcard domain", strings.Join(domains, ","))
+		}
+	}
+
+	for _, san := range domain.SANs {
+		if strings.HasPrefix(san, "*") {
+			return nil, fmt.Errorf("unable to generate a certificate in ACME provider for domains %q: SAN %q can not be a wildcard domain", strings.Join(domains, ","), san)
+		}
+	}
+
+	var cleanDomains []string
+	for _, domain := range domains {
+		canonicalDomain := types.CanonicalDomain(domain)
+		cleanDomain := dns01.UnFqdn(canonicalDomain)
+		if canonicalDomain != cleanDomain {
+			log.FromContext(ctx).Warnf("FQDN detected, please remove the trailing dot: %s", canonicalDomain)
+		}
+		cleanDomains = append(cleanDomains, cleanDomain)
+	}
+
+	return cleanDomains, nil
+}
+
+func isDomainAlreadyChecked(domainToCheck string, existentDomains []string) bool {
+	for _, certDomains := range existentDomains {
+		for _, certDomain := range strings.Split(certDomains, ",") {
+			if types.MatchDomain(domainToCheck, certDomain) {
+				return true
+			}
+		}
+	}
+	return false
+}

pkg/provider/acme/provider_test.go

@@ -0,0 +1,660 @@
+package acme
+
+import (
+	"context"
+	"crypto/tls"
+	"testing"
+
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/go-acme/lego/certcrypto"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetUncheckedCertificates(t *testing.T) {
+	t.Skip("Needs TLS Manager")
+	wildcardMap := make(map[string]*tls.Certificate)
+	wildcardMap["*.traefik.wtf"] = &tls.Certificate{}
+
+	wildcardSafe := &safe.Safe{}
+	wildcardSafe.Set(wildcardMap)
+
+	domainMap := make(map[string]*tls.Certificate)
+	domainMap["traefik.wtf"] = &tls.Certificate{}
+
+	domainSafe := &safe.Safe{}
+	domainSafe.Set(domainMap)
+
+	// FIXME Add a test for DefaultCertificate
+	testCases := []struct {
+		desc             string
+		dynamicCerts     *safe.Safe
+		resolvingDomains map[string]struct{}
+		acmeCertificates []*Certificate
+		domains          []string
+		expectedDomains  []string
+	}{
+		{
+			desc:            "wildcard to generate",
+			domains:         []string{"*.traefik.wtf"},
+			expectedDomains: []string{"*.traefik.wtf"},
+		},
+		{
+			desc:            "wildcard already exists in dynamic certificates",
+			domains:         []string{"*.traefik.wtf"},
+			dynamicCerts:    wildcardSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "wildcard already exists in ACME certificates",
+			domains: []string{"*.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:            "domain CN and SANs to generate",
+			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
+			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
+		},
+		{
+			desc:            "domain CN already exists in dynamic certificates and SANs to generate",
+			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
+			dynamicCerts:    domainSafe,
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:    "domain CN already exists in ACME certificates and SANs to generate",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "traefik.wtf"},
+				},
+			},
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:            "domain already exists in dynamic certificates",
+			domains:         []string{"traefik.wtf"},
+			dynamicCerts:    domainSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "domain already exists in ACME certificates",
+			domains: []string{"traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:            "domain matched by wildcard in dynamic certificates",
+			domains:         []string{"who.traefik.wtf", "foo.traefik.wtf"},
+			dynamicCerts:    wildcardSafe,
+			expectedDomains: nil,
+		},
+		{
+			desc:    "domain matched by wildcard in ACME certificates",
+			domains: []string{"who.traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: nil,
+		},
+		{
+			desc:    "root domain with wildcard in ACME certificates",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			acmeCertificates: []*Certificate{
+				{
+					Domain: types.Domain{Main: "*.traefik.wtf"},
+				},
+			},
+			expectedDomains: []string{"traefik.wtf"},
+		},
+		{
+			desc:    "all domains already managed by ACME",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"traefik.wtf":     {},
+				"foo.traefik.wtf": {},
+			},
+			expectedDomains: []string{},
+		},
+		{
+			desc:    "one domain already managed by ACME",
+			domains: []string{"traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"traefik.wtf": {},
+			},
+			expectedDomains: []string{"foo.traefik.wtf"},
+		},
+		{
+			desc:    "wildcard domain already managed by ACME checks the domains",
+			domains: []string{"bar.traefik.wtf", "foo.traefik.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"*.traefik.wtf": {},
+			},
+			expectedDomains: []string{},
+		},
+		{
+			desc:    "wildcard domain already managed by ACME checks domains and another domain checks one other domain, one domain still unchecked",
+			domains: []string{"traefik.wtf", "bar.traefik.wtf", "foo.traefik.wtf", "acme.wtf"},
+			resolvingDomains: map[string]struct{}{
+				"*.traefik.wtf": {},
+				"traefik.wtf":   {},
+			},
+			expectedDomains: []string{"acme.wtf"},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			if test.resolvingDomains == nil {
+				test.resolvingDomains = make(map[string]struct{})
+			}
+
+			acmeProvider := Provider{
+				// certificateStore: &traefiktls.CertificateStore{
+				// 	DynamicCerts: test.dynamicCerts,
+				// },
+				certificates:     test.acmeCertificates,
+				resolvingDomains: test.resolvingDomains,
+			}
+
+			domains := acmeProvider.getUncheckedDomains(context.Background(), test.domains, false)
+			assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
+		})
+	}
+}
+
+func TestGetValidDomain(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		domains         types.Domain
+		wildcardAllowed bool
+		dnsChallenge    *DNSChallenge
+		expectedErr     string
+		expectedDomains []string
+	}{
+		{
+			desc:            "valid wildcard",
+			domains:         types.Domain{Main: "*.traefik.wtf"},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "",
+			expectedDomains: []string{"*.traefik.wtf"},
+		},
+		{
+			desc:            "no wildcard",
+			domains:         types.Domain{Main: "traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			expectedErr:     "",
+			wildcardAllowed: true,
+			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
+		},
+		{
+			desc:            "unauthorized wildcard",
+			domains:         types.Domain{Main: "*.traefik.wtf"},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: false,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.traefik.wtf\" from a 'Host' rule",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "no domain",
+			domains:         types.Domain{},
+			dnsChallenge:    nil,
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a certificate in ACME provider when no domain is given",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "no DNSChallenge",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    nil,
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.traefik.wtf,foo.traefik.wtf\" : ACME needs a DNSChallenge",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "unauthorized wildcard with SAN",
+			domains:         types.Domain{Main: "*.*.traefik.wtf", SANs: []string{"foo.traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a wildcard certificate in ACME provider for domain \"*.*.traefik.wtf,foo.traefik.wtf\" : ACME does not allow '*.*' wildcard domain",
+			expectedDomains: nil,
+		},
+		{
+			desc:            "wildcard and SANs",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"traefik.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "",
+			expectedDomains: []string{"*.traefik.wtf", "traefik.wtf"},
+		},
+		{
+			desc:            "unexpected SANs",
+			domains:         types.Domain{Main: "*.traefik.wtf", SANs: []string{"*.acme.wtf"}},
+			dnsChallenge:    &DNSChallenge{},
+			wildcardAllowed: true,
+			expectedErr:     "unable to generate a certificate in ACME provider for domains \"*.traefik.wtf,*.acme.wtf\": SAN \"*.acme.wtf\" can not be a wildcard domain",
+			expectedDomains: nil,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{DNSChallenge: test.dnsChallenge}}
+
+			domains, err := acmeProvider.getValidDomains(context.Background(), test.domains, test.wildcardAllowed)
+
+			if len(test.expectedErr) > 0 {
+				assert.EqualError(t, err, test.expectedErr, "Unexpected error.")
+			} else {
+				assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
+			}
+		})
+	}
+}
+
+func TestDeleteUnnecessaryDomains(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		domains         []types.Domain
+		expectedDomains []types.Domain
+	}{
+		{
+			desc: "no domain to delete",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.foo.acme.wtf",
+				},
+				{
+					Main: "acme02.wtf",
+					SANs: []string{"traefik.acme02.wtf", "bar.foo"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.foo.acme.wtf",
+					SANs: []string{},
+				},
+				{
+					Main: "acme02.wtf",
+					SANs: []string{"traefik.acme02.wtf", "bar.foo"},
+				},
+			},
+		},
+		{
+			desc: "wildcard and root domain",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{},
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "2 equals domains",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+		},
+		{
+			desc: "2 domains with same values",
+			domains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf"},
+				},
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "foo.bar"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"traefik.acme.wtf"},
+				},
+				{
+					Main: "foo.bar",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "domain totally checked by wildcard",
+			domains: []types.Domain{
+				{
+					Main: "who.acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "bar.acme.wtf"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+		{
+			desc: "duplicated wildcard",
+			domains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{"acme.wtf"},
+				},
+			},
+		},
+		{
+			desc: "domain partially checked by wildcard",
+			domains: []types.Domain{
+				{
+					Main: "traefik.acme.wtf",
+					SANs: []string{"acme.wtf", "foo.bar"},
+				},
+				{
+					Main: "*.acme.wtf",
+				},
+				{
+					Main: "who.acme.wtf",
+					SANs: []string{"traefik.acme.wtf", "bar.acme.wtf"},
+				},
+			},
+			expectedDomains: []types.Domain{
+				{
+					Main: "acme.wtf",
+					SANs: []string{"foo.bar"},
+				},
+				{
+					Main: "*.acme.wtf",
+					SANs: []string{},
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{Domains: test.domains}}
+
+			acmeProvider.deleteUnnecessaryDomains(context.Background())
+			assert.Equal(t, test.expectedDomains, acmeProvider.Domains, "unexpected domain")
+		})
+	}
+}
+
+func TestIsAccountMatchingCaServer(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		accountURI string
+		serverURI  string
+		expected   bool
+	}{
+		{
+			desc:       "acme staging with matching account",
+			accountURI: "https://acme-staging-v02.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "https://acme-staging-v02.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "acme production with matching account",
+			accountURI: "https://acme-v02.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "https://acme-v02.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "http only acme with matching account",
+			accountURI: "http://acme.api.letsencrypt.org/acme/acct/1234567",
+			serverURI:  "http://acme.api.letsencrypt.org/acme/directory",
+			expected:   true,
+		},
+		{
+			desc:       "different subdomains for account and server",
+			accountURI: "https://test1.example.org/acme/acct/1234567",
+			serverURI:  "https://test2.example.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "different domains for account and server",
+			accountURI: "https://test.example1.org/acme/acct/1234567",
+			serverURI:  "https://test.example2.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "different tld for account and server",
+			accountURI: "https://test.example.com/acme/acct/1234567",
+			serverURI:  "https://test.example.org/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed account url",
+			accountURI: "//|\\/test.example.com/acme/acct/1234567",
+			serverURI:  "https://test.example.com/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed server url",
+			accountURI: "https://test.example.com/acme/acct/1234567",
+			serverURI:  "//|\\/test.example.com/acme/directory",
+			expected:   false,
+		},
+		{
+			desc:       "malformed server and account url",
+			accountURI: "//|\\/test.example.com/acme/acct/1234567",
+			serverURI:  "//|\\/test.example.com/acme/directory",
+			expected:   false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			result := isAccountMatchingCaServer(context.Background(), test.accountURI, test.serverURI)
+
+			assert.Equal(t, test.expected, result)
+		})
+	}
+}
+
+func TestUseBackOffToObtainCertificate(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		domains          []string
+		dnsChallenge     *DNSChallenge
+		expectedResponse bool
+	}{
+		{
+			desc:             "only one single domain",
+			domains:          []string{"acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "only one wildcard domain",
+			domains:          []string{"*.acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "wildcard domain with no root domain",
+			domains:          []string{"*.acme.wtf", "foo.acme.wtf", "bar.acme.wtf", "foo.bar"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: false,
+		},
+		{
+			desc:             "wildcard and root domain",
+			domains:          []string{"*.acme.wtf", "foo.acme.wtf", "bar.acme.wtf", "acme.wtf"},
+			dnsChallenge:     &DNSChallenge{},
+			expectedResponse: true,
+		},
+		{
+			desc:             "wildcard and root domain but no DNS challenge",
+			domains:          []string{"*.acme.wtf", "acme.wtf"},
+			dnsChallenge:     nil,
+			expectedResponse: false,
+		},
+		{
+			desc:             "two wildcard domains (must never happen)",
+			domains:          []string{"*.acme.wtf", "*.bar.foo"},
+			dnsChallenge:     nil,
+			expectedResponse: false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{Configuration: &Configuration{DNSChallenge: test.dnsChallenge}}
+
+			actualResponse := acmeProvider.useCertificateWithRetry(test.domains)
+			assert.Equal(t, test.expectedResponse, actualResponse, "unexpected response to use backOff")
+		})
+	}
+}
+
+func TestInitAccount(t *testing.T) {
+	testCases := []struct {
+		desc            string
+		account         *Account
+		email           string
+		keyType         string
+		expectedAccount *Account
+	}{
+		{
+			desc: "Existing account with all information",
+			account: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc:    "Account nil",
+			email:   "foo@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account with no email",
+			account: &Account{
+				KeyType: certcrypto.RSA4096,
+			},
+			email:   "foo@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account with no key type",
+			account: &Account{
+				Email: "foo@foo.net",
+			},
+			email:   "bar@foo.net",
+			keyType: "EC256",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.EC256,
+			},
+		},
+		{
+			desc: "Existing account and provider with no key type",
+			account: &Account{
+				Email: "foo@foo.net",
+			},
+			email: "bar@foo.net",
+			expectedAccount: &Account{
+				Email:   "foo@foo.net",
+				KeyType: certcrypto.RSA4096,
+			},
+		},
+	}
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			acmeProvider := Provider{account: test.account, Configuration: &Configuration{Email: test.email, KeyType: test.keyType}}
+
+			actualAccount, err := acmeProvider.initAccount(context.Background())
+			assert.Nil(t, err, "Init account in error")
+			assert.Equal(t, test.expectedAccount.Email, actualAccount.Email, "unexpected email account")
+			assert.Equal(t, test.expectedAccount.KeyType, actualAccount.KeyType, "unexpected keyType account")
+		})
+	}
+}

pkg/provider/acme/store.go

@@ -0,0 +1,25 @@
+package acme
+
+// StoredData represents the data managed by Store
+type StoredData struct {
+	Account        *Account
+	Certificates   []*Certificate
+	HTTPChallenges map[string]map[string][]byte
+	TLSChallenges  map[string]*Certificate
+}
+
+// Store is a generic interface that represents a storage
+type Store interface {
+	GetAccount() (*Account, error)
+	SaveAccount(*Account) error
+	GetCertificates() ([]*Certificate, error)
+	SaveCertificates([]*Certificate) error
+
+	GetHTTPChallengeToken(token, domain string) ([]byte, error)
+	SetHTTPChallengeToken(token, domain string, keyAuth []byte) error
+	RemoveHTTPChallengeToken(token, domain string) error
+
+	AddTLSChallenge(domain string, cert *Certificate) error
+	GetTLSChallenge(domain string) (*Certificate, error)
+	RemoveTLSChallenge(domain string) error
+}