caddytls: Make peer certificate verification pluggable

[Gr33nbl00d]

Extension needed to fix #2341 by providing a plugin using this namespace to extend caddy with revocation checking
Needs review and will be discussed in #2341 before merge

[CLAassistant]

All committers have signed the CLA.

[francislavoie]

I like where this is going 👍

[Gr33nbl00d]

Regarding cla i have seen i accidently commited with wrong alias/git username :( So not sure how to sign cla. Or i need to rebase that branche changing author and create a new pull request?

[francislavoie]

You can amend your commits to change the authorship of the commits to match the email address that's on your github account (google it, there's instructions on rewriting commits).

Or, you can just add the email you committed with to your github account under https://github.com/settings/emails.

[mholt]

Will circle back around to this soon, thanks for maintaining it!

[Gr33nbl00d]

Hi Again,
i am back from vacation and will not cycle back to this :)

[mholt]

Overall, I like the idea and the implementation. I would like to review this in more detail when I have time, but overall I'm not opposed to this approach.

We should see how #4518 plays out before committing to this, though, since I want to make sure we get client auth right.

[mholt]

Thanks for keeping this updated. Still interested in this change, but need to see what the outcome / resulting consensus on #4518 is...

[mholt]

CI tests seem stuck on this so I'm going to try closing and reopening.

[mholt]

Finally getting back to this. I'll probably push a commit or three soon.

[mholt]

Thanks so much for the enhancement, @Gr33nbl00d -- sorry it took me a few months to get around to it. Happy to merge this in!

[francislavoie]

FYI @Gr33nbl00d I spotted in the Go 1.19 release notes (draft notes, it's not out yet) that they're adding a new function ParseRevocationList. Is that useful for you? Might perform better or well enough to obviate the need for your custom parser?

[Gr33nbl00d]

FYI @Gr33nbl00d I spotted in the Go 1.19 release notes (draft notes, it's not out yet) that they're adding a new function ParseRevocationList. Is that useful for you? Might perform better or well enough to obviate the need for your custom parser?

I see but according to the method signature they use a byte array as parameter and return a complete list.
This would still mean that the whole file is loaded into memory...