From f84d859924e5d2491b0d0df9b3d343fd546f3119 Mon Sep 17 00:00:00 2001
From: Matt Elek Harris <matt@elekharris.com>
Date: Wed, 6 Oct 2021 18:42:42 -0400
Subject: [PATCH] security/acme-client: added support for custom ACME CAs
 (#2529)

---
 .../OPNsense/AcmeClient/forms/dialogAccount.xml |  6 ++++++
 .../library/OPNsense/AcmeClient/LeCommon.php    | 17 ++++++++++++++++-
 .../models/OPNsense/AcmeClient/AcmeClient.xml   |  6 ++++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
index 33854114a..c19bff4f8 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
@@ -33,6 +33,12 @@
         <type>dropdown</type>
         <help><![CDATA[The ACME CA that should be used for this account and all associated certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
     </field>
+    <field>
+        <id>account.custom_ca</id>
+        <label>Custom ACME CA URL</label>
+        <type>text</type>
+        <help><![CDATA[The HTTPS URL of the custom ACME CA that should be used for this account and all associated certificates. If using your own CA, make sure the Root CA is added to OPNsense's trust store. For example: https://acme-v02.api.letsencrypt.org/directory or https://ca.internal/acme/directory]]></help>
+    </field>
     <field>
         <label>Optional EAB Credentials</label>
         <type>header</type>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
index d2097fe7a..5ea7b5c7d 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
@@ -84,6 +84,7 @@ abstract class LeCommon
     protected $config;              # AcmeClient config object
     protected $debug;               # Debug logging (bool)
     protected $ca;                  # ACME CA
+    protected $custom_ca;           # Custom ACME CA URL
     protected $ca_compat;           # ACME CA for compat with old LE CA names
     protected $force;               # Force operation
     protected $model;               # AcmeClient model object
@@ -154,8 +155,22 @@ abstract class LeCommon
         $acme_ca = (string)$obj->ca;
         $this->ca = $acme_ca;
 
+        // Extract custom ACME CA URL
+        $acme_custom_ca = (string)$obj->custom_ca;
+        $this->custom_ca = $acme_custom_ca;
+
         // Add CA to acme arguments
-        $this->acme_args[] = LeUtils::execSafe('--server %s', $acme_ca);
+        if ($acme_ca == "custom") {
+            // Custom CA
+            if (empty($acme_custom_ca) || ($acme_custom_ca == null)) {
+                LeUtils::log_error("custom CA must not be empty.");
+                return false;
+            }
+            $this->acme_args[] = LeUtils::execSafe('--server %s', $acme_custom_ca);
+        } else {
+            // Normal CAs
+            $this->acme_args[] = LeUtils::execSafe('--server %s', $acme_ca);
+        }
 
         // Evaluate how the CA should be represented in filenames.
         // This is a compatibility layer. It ensures that old files that
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 47d3ba221..0ec434d22 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -146,8 +146,14 @@
                         <letsencrypt_test>Let's Encrypt Test CA</letsencrypt_test>
                         <sslcom>SSL.com</sslcom>
                         <zerossl>ZeroSSL</zerossl>
+                        <custom>Custom CA URL</custom>
                     </OptionValues>
                 </ca>
+                <custom_ca type="TextField">
+                    <Required>N</Required>
+                    <mask>/^https?:\/\/.*[^\/]$/</mask>
+                    <ValidationMessage>The url must be a valid ACME endpoint without a trailing slash.</ValidationMessage>
+                </custom_ca>
                 <eab_kid type="TextField">
                     <Required>N</Required>
                     <mask>/^.{1,8192}$/u</mask>