Method ObtainSSL

agent/utils/ssl/client.go:130–167

(ctx context.Context, domains []string, privateKey crypto.Signer)

}

func (c *AcmeClient) ObtainSSL(ctx context.Context, domains []string, privateKey crypto.Signer) (certificate.Resource, error) {
	unlockDNSChallenge := c.lockDNSChallenge()
	defer unlockDNSChallenge()

	// lego v5 disables Common Name by default; explicitly enable it to keep
	// the v4 behaviour, so legacy Java/router clients that still rely on the
	// CommonName field do not fail TLS handshake.
	request := certificate.ObtainRequest{
		Domains:          domains,
		Bundle:           true,
		PrivateKey:       privateKey,
		EnableCommonName: true,
	}

	var certificates *certificate.Resource
	var err error

	for attempt := 1; attempt <= maxRetryAttempts; attempt++ {
		certificates, err = c.Client.Certificate.Obtain(ctx, request)
		if err == nil {
			return *certificates, nil
		}

		if isHTTP503Error(err) && attempt < maxRetryAttempts {
			global.LOG.Warnf("ACME server returned 503, retrying in %v (attempt %d/%d)",
				retryDelayOn503, attempt, maxRetryAttempts)
			if err := waitForRetry(ctx, retryDelayOn503); err != nil {
				return certificate.Resource{}, err
			}
			continue
		}

		// Non-503 error or final attempt, return error
		return certificate.Resource{}, err
	}

	return certificate.Resource{}, err
}

func (c *AcmeClient) ObtainIPSSL(ctx context.Context, ipAddress string, privKey crypto.Signer) (certificate.Resource, error) {
	unlockDNSChallenge := c.lockDNSChallenge()