Report all certificate errors instead of stopping at the first. (#941)

fabiolb · Jan 23, 2025 · ef6ea89 · ef6ea89
1 parent 5d11339
commit ef6ea89
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/cert/load.go b/cert/load.go
@@ -4,6 +4,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -16,6 +17,7 @@ import (
 	"strings"
 )
 
+// MaxSize is the limit for individual certificate sizes.
 const MaxSize = 1 << 20 // 1MB
 
 func loadURL(listURL string) (pemBlocks map[string][]byte, err error) {
@@ -105,6 +107,7 @@ func loadPath(root string) (pemBlocks map[string][]byte, err error) {
 }
 
 func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
+	var errs []error
 	var n []string
 	x := map[string]tls.Certificate{}
 
@@ -127,12 +130,14 @@ func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
 
 		cert, key := pemBlocks[certFile], pemBlocks[keyFile]
 		if cert == nil || key == nil {
-			return nil, fmt.Errorf("cert: cannot load certificate %s", name)
+			errs = append(errs, fmt.Errorf("cert: cannot load certificate %s", name))
+			continue
 		}
 
 		c, err := tls.X509KeyPair(cert, key)
 		if err != nil {
-			return nil, fmt.Errorf("cert: invalid certificate %s. %s", name, err)
+			errs = append(errs, fmt.Errorf("cert: invalid certificate %s. %s", name, err))
+			continue
 		}
 
 		x[certFile] = c
@@ -148,7 +153,7 @@ func loadCertificates(pemBlocks map[string][]byte) ([]tls.Certificate, error) {
 		certs = append(certs, x[certFile])
 	}
 
-	return certs, nil
+	return certs, errors.Join(errs...)
 }
 
 // base returns the rawurl with the last element of the path

diff --git a/cert/load_test.go b/cert/load_test.go
@@ -42,7 +42,7 @@ func TestReplaceSuffix(t *testing.T) {
 func TestUpgradeCACertificate(t *testing.T) {
 	// generated at
 	// https://eu-west-1.console.aws.amazon.com/apigateway/home?region=eu-west-1#/client-certificates
-	const awsApiGWCert = `
+	const awsAPIGWCert = `
 -----BEGIN CERTIFICATE-----
 MIIC6DCCAdCgAwIBAgIIZAgycYqDRqQwDQYJKoZIhvcNAQELBQAwNDELMAkGA1UE
 BhMCVVMxEDAOBgNVBAcTB1NlYXR0bGUxEzARBgNVBAMTCkFwaUdhdGV3YXkwHhcN
@@ -62,7 +62,7 @@ kqBgtRrHux3BRxPRqS4jM4akdplFhejHExVatOxfS+DEXzFefi+aMb7qApB1YjV/
 n/iFVG4Y6zyXQY2RzTt+ZB2VPR72X4wqS9fBeQ==
 -----END CERTIFICATE-----`
 
-	p, rest := pem.Decode([]byte(awsApiGWCert))
+	p, rest := pem.Decode([]byte(awsAPIGWCert))
 	if len(rest) > 0 {
 		t.Fatal("want only one cert")
 	}