diff --git a/gui/apply-boulder b/gui/apply-boulder
index 92eba0a..dc43038 100755
--- a/gui/apply-boulder
+++ b/gui/apply-boulder
@@ -86,6 +86,15 @@ if [ "$PKI_DOMAIN_MODE" == "lockdown" ] && [ "$PKI_LOCKDOWN_DOMAINS" != "" ]; th
for d in $(echo $PKI_LOCKDOWN_DOMAINS | sed -e "s/\\\r/ /g" | sed -e "s/\\\n/ /g" | tr '\r' ' '); do
echo " - \"$d\"" >> hostname-policy.yaml
done
+
+ allow_public="false"
+ ld_public_contacts=$(grep ld_public_contacts $dataDir/config.json | grep true || echo "")
+ if [ "$ld_public_contacts" != "" ]; then
+ allow_public="true"
+ fi
+
+ echo >> hostname-policy.yaml
+ echo "LockdownAllowPublicContacts: $allow_public" >> hostname-policy.yaml
fi
if [ "$PKI_DOMAIN_MODE" == "whitelist" ] && [ "$PKI_WHITELIST_DOMAINS" != "" ]; then
echo >> hostname-policy.yaml
diff --git a/gui/main.go b/gui/main.go
index 8ca3982..d5213b3 100644
--- a/gui/main.go
+++ b/gui/main.go
@@ -176,6 +176,7 @@ type SetupConfig struct {
DomainMode string
LockdownDomains string
WhitelistDomains string
+ LDPublicContacts bool
ExtendedTimeout bool
RequestBase string
Errors map[string]string
@@ -666,6 +667,7 @@ func _configUpdateHandler(w http.ResponseWriter, r *http.Request) {
DomainMode: r.Form.Get("domain_mode"),
LockdownDomains: r.Form.Get("lockdown_domains"),
WhitelistDomains: r.Form.Get("whitelist_domains"),
+ LDPublicContacts: (r.Form.Get("ld_public_contacts") == "true"),
ExtendedTimeout: (r.Form.Get("extended_timeout") == "true"),
}
@@ -715,6 +717,11 @@ func _configUpdateHandler(w http.ResponseWriter, r *http.Request) {
delta = true
viper.Set("labca.lockdown", cfg.LockdownDomains)
}
+
+ if cfg.LDPublicContacts != viper.GetBool("labca.ld_public_contacts") {
+ delta = true
+ viper.Set("labca.ld_public_contacts", cfg.LDPublicContacts)
+ }
}
if domainMode == "whitelist" {
if cfg.WhitelistDomains != viper.GetString("labca.whitelist") {
@@ -1585,6 +1592,7 @@ func _manageGet(w http.ResponseWriter, r *http.Request) {
manageData["DomainMode"] = domainMode
if domainMode == "lockdown" {
manageData["LockdownDomains"] = viper.GetString("labca.lockdown")
+ manageData["LDPublicContacts"] = viper.GetBool("labca.ld_public_contacts")
}
if domainMode == "whitelist" {
manageData["WhitelistDomains"] = viper.GetString("labca.whitelist")
@@ -2536,6 +2544,7 @@ func _setupBaseConfig(w http.ResponseWriter, r *http.Request) bool {
DomainMode: "lockdown",
LockdownDomains: domain,
WhitelistDomains: domain,
+ LDPublicContacts: true,
RequestBase: r.Header.Get("X-Request-Base"),
}
@@ -2553,6 +2562,7 @@ func _setupBaseConfig(w http.ResponseWriter, r *http.Request) bool {
DomainMode: r.Form.Get("domain_mode"),
LockdownDomains: r.Form.Get("lockdown_domains"),
WhitelistDomains: r.Form.Get("whitelist_domains"),
+ LDPublicContacts: (r.Form.Get("ld_public_contacts") == "true"),
RequestBase: r.Header.Get("X-Request-Base"),
}
@@ -2571,6 +2581,7 @@ func _setupBaseConfig(w http.ResponseWriter, r *http.Request) bool {
viper.Set("labca.domain_mode", cfg.DomainMode)
if cfg.DomainMode == "lockdown" {
viper.Set("labca.lockdown", cfg.LockdownDomains)
+ viper.Set("labca.ld_public_contacts", cfg.LDPublicContacts)
}
if cfg.DomainMode == "whitelist" {
viper.Set("labca.whitelist", cfg.WhitelistDomains)
diff --git a/gui/static/js/labca.js b/gui/static/js/labca.js
index 326c0af..25f51de 100644
--- a/gui/static/js/labca.js
+++ b/gui/static/js/labca.js
@@ -165,8 +165,10 @@ $(function() {
if ($("input[type=radio]#whitelist").prop('checked') || $("input[type=radio]#standard").prop('checked') ) {
$("#domain_mode_warning").show();
+ $("#ld_options").hide();
} else {
$("#domain_mode_warning").hide();
+ $("#ld_options").show();
}
}
@@ -175,6 +177,7 @@ $(function() {
});
$("#domain_mode_warning").hide();
+ $("#ld_options").show();
radioDisable();
diff --git a/gui/templates/views/manage.tmpl b/gui/templates/views/manage.tmpl
index 04dd695..a4a0d18 100644
--- a/gui/templates/views/manage.tmpl
+++ b/gui/templates/views/manage.tmpl
@@ -295,17 +295,26 @@
- Standard - any official domains
+ Standard - any official domains
+
+
+
+
+ Still allow all public domain names in contact email addresses when creating new ACME accounts
+
+
If you see timeout related errors on the Dashboard / Audit Log, try checking this box.
+
+
Are you sure? This facilitates man-in-the-middle attacks!
+
{{ end }}
- Standard - any official domains
+ Standard - any official domains
+
+
+
+
+ Still allow all public domain names in contact email addresses when creating new ACME accounts
+
+
+
Are you sure? This facilitates man-in-the-middle attacks!