A way to add a manual cert to the cache, replacing others immediately

And also providing control over which SANs it applies to (i.e. which names it is indexed by in the cache).

Author: mholt

certificates.go

@@ -375,6 +375,37 @@ func (cfg *Config) CacheUnmanagedCertificatePEMBytes(ctx context.Context, certBy
 	return cert.hash, nil
 }
 
+// CacheUnmanagedCertificatePEMBytesAsReplacement is the same as CacheUnmanagedCertificatePEMBytes,
+// but it also removes any other loaded certificates for the SANs on the certificate being cached.
+// This has the effect of using this certificate exclusively and immediately for its SANs. The SANs
+// for which the certificate should apply may optionally be passed in as well. By default, a cert
+// is used for any of its SANs.
+//
+// This method is safe for concurrent use.
+//
+// EXPERIMENTAL: Subject to change/removal.
+func (cfg *Config) CacheUnmanagedCertificatePEMBytesAsReplacement(ctx context.Context, certBytes, keyBytes []byte, tags, sans []string) (string, error) {
+	cert, err := cfg.makeCertificateWithOCSP(ctx, certBytes, keyBytes)
+	if err != nil {
+		return "", err
+	}
+	cert.Tags = tags
+	if len(sans) > 0 {
+		cert.Names = sans
+	}
+	cfg.certCache.mu.Lock()
+	for _, san := range cert.Names {
+		existingCerts := cfg.certCache.getAllMatchingCerts(san)
+		for _, existingCert := range existingCerts {
+			cfg.certCache.removeCertificate(existingCert)
+		}
+	}
+	cfg.certCache.unsyncedCacheCertificate(cert)
+	cfg.certCache.mu.Unlock()
+	cfg.emit(ctx, "cached_unmanaged_cert", map[string]any{"sans": cert.Names, "replacement": true})
+	return cert.hash, nil
+}
+
 // makeCertificateFromDiskWithOCSP makes a Certificate by loading the
 // certificate and key files. It fills out all the fields in
 // the certificate except for the Managed and OnDemand flags.

maintain.go

@@ -111,7 +111,7 @@ func (certCache *Cache) RenewManagedCertificates(ctx context.Context) error {
 		}
 
 		// the list of names on this cert should never be empty... programmer error?
-		if cert.Names == nil || len(cert.Names) == 0 {
+		if len(cert.Names) == 0 {
 			log.Warn("certificate has no names; removing from cache", zap.String("cert_key", certKey))
 			deleteQueue = append(deleteQueue, cert)
 			continue