prefetch cert

client/certificates.go

@@ -135,23 +135,31 @@ func CertificateFingerprint(certificate *x509.Certificate) string {
 	return fmt.Sprintf("%s-%s", algo, hex.EncodeToString(sum[:]))
 }
 
-func NewPinnedClient(store *CertificateStore) *http.Client {
+func PreFetchServerCertificate(store *CertificateStore, addr string) error {
-	config := &tls.Config{
+	conn, err := tls.DialWithDialer(&net.Dialer{
+		Timeout: 5 * time.Second,
+	}, "tcp", addr, &tls.Config{
 		InsecureSkipVerify: true,
+	})
+
+	if err != nil {
+		return err
 	}
 
-	config.VerifyConnection = func(cs tls.ConnectionState) error {
+	defer conn.Close()
-		if len(cs.PeerCertificates) == 0 {
+
-			return errors.New("missing certificate")
+	state := conn.ConnectionState()
+	if len(state.PeerCertificates) == 0 {
+		return fmt.Errorf("no peer certificates")
 	}
 
-		certificate := cs.PeerCertificates[0]
+	certificate := state.PeerCertificates[0]
 
 	if certificate.Subject.CommonName != "up" {
 		return errors.New("invalid certificate subject")
 	}
 
-		name := cs.ServerName
+	name := state.ServerName
 	fingerprint := CertificateFingerprint(certificate)
 
 	if store.IsPinned(name, fingerprint) {
@@ -172,6 +180,32 @@ func NewPinnedClient(store *CertificateStore) *http.Client {
 	return store.Pin(name, fingerprint)
 }
 
+func NewPinnedClient(store *CertificateStore) *http.Client {
+	config := &tls.Config{
+		InsecureSkipVerify: true,
+	}
+
+	config.VerifyConnection = func(cs tls.ConnectionState) error {
+		if len(cs.PeerCertificates) == 0 {
+			return errors.New("missing certificate")
+		}
+
+		certificate := cs.PeerCertificates[0]
+
+		if certificate.Subject.CommonName != "up" {
+			return errors.New("invalid certificate subject")
+		}
+
+		name := cs.ServerName
+		fingerprint := CertificateFingerprint(certificate)
+
+		if !store.IsPinned(name, fingerprint) {
+			return errors.New("unknown certificate")
+		}
+
+		return nil
+	}
+
 	return &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: config,

client/main.go

@@ -141,6 +141,10 @@ func run(_ context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("failed to load certificate store: %v", err)
 	}
 
+	if err = PreFetchServerCertificate(store, hostname); err != nil {
+		return err
+	}
+
 	client := NewPinnedClient(store)
 
 	log.Println("Requesting challenge...")