修改证书配置

config/sys-dev.config

@@ -8,12 +8,16 @@
       {backlog, 10240}
     ]},
 
+    %% 证书配置
+    {certificate, [
+      {certfile, "/usr/local/code/erl/sdlan/priv/ssl/server.crt"},
+      {keyfile, "/usr/local/code/erl/sdlan/priv/ssl/server.key"}
+    ]},
+
     {quic_server, [
       {port, 443},
       {acceptors, 10},
       {alpn, ["punchnet/1.0"]},
-      {certfile, "cert.pem"},
-      {keyfile, "key.pem"},
       {limits, [
         {max_packet_size, 16384},
         {stream_active_n, 100},
@@ -27,8 +31,6 @@
       {acceptors, 500},
       {max_connections, 10240},
       {backlog, 10240},
-      {certfile, "server.crt"},
-      {keyfile, "server.key"},
       {limits, [
         {max_packet_size, 16384},
         %% 单位为秒

config/sys-prod.config

@@ -8,12 +8,16 @@
       {backlog, 10240}
     ]},
 
+    %% 证书配置
+    {certificate, [
+      {certfile, "fullchain.cer"},
+      {keyfile, "root.punchsky.com.key"}
+    ]},
+
     {quic_server, [
       {port, 443},
       {acceptors, 10},
       {alpn, ["punchnet/1.0"]},
-      {certfile, "fullchain.cer"},
-      {keyfile, "root.punchsky.com.key"},
       {limits, [
         {max_packet_size, 16384},
         {stream_active_n, 100},
@@ -27,8 +31,6 @@
       {acceptors, 500},
       {max_connections, 10240},
       {backlog, 10240},
-      {certfile, "server.crt"},
-      {keyfile, "server.key"},
       {limits, [
         {max_packet_size, 16384},
         %% 单位为秒

priv/quic/cert.pem

@@ -1,21 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDazCCAlOgAwIBAgIUEhYvMYhAARHRpKd1EOTR7HiRIVkwDQYJKoZIhvcNAQEL
-BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
-GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yNjAyMTEwOTMyMjlaFw0yNzAy
-MTEwOTMyMjlaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
-HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQDWKHFkwDMH/XjY3joBwT3zzgh5WkqG7dKuj7YV7WdX
-JjOc46iqNsvyieHTfuJBuPirLDAX2hGzU0OheeQBg/a9pFQxxyRBN2UZUFwTHPTG
-TBBvdQGcC2vMQ3HnJwUoPzJRCYPBXQZ3JSmlq+y1uJzpLQfYeiRtowfGrRrd0jHJ
-Xt5amitoN7m9VshG7KCg2K8AVriP/X5oiyNJ0s8kVdMFclUNekvWbuxik98VLWbF
-dcB+kTaFUQkMj7y2ks6b6gWhw1wxPU4kWDEBaQMIICM2nZ+sTSUisKPBqpqlvC8N
-NFFUhA+QW5SQuTa8t4iUxWsfIeuvPSrb1E1QzPwvld8PAgMBAAGjUzBRMB0GA1Ud
-DgQWBBRKr5Ulk3xjskqncFCS22VxK2tCmTAfBgNVHSMEGDAWgBRKr5Ulk3xjskqn
-cFCS22VxK2tCmTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAc
-p/59bzORWJCKGJJ/GFrBIKKB9F1T1GoKy5rajxZeUCbCL22FaZ6VDmi8uUb4dYBU
-5bwKOea76+J/cM1/Irt7n8c0d5nhIXm/ZdqERYjtv3F/MPi/X8Q4TP8uY6bA+dJr
-enDaATGg+Jy2Iq6A6EGhYSmyxabgDkN2MNPtIwyekXoUMrA8D4jBGCQznjS3f1OW
-9DMpVyb1qoz7WyAftyZkhIcwrBoTZ+C7e7ys9L8Q9uu7dKvdsYoJ73JQn4Rsgk6Y
-jMGbxn6Td+z9m7aI6oPtY6UlxeA4scepX5Cx610cP0xnGJhf/o13e7jCxnr2/pTD
-TTtahnT+G0FeQmlUswb9
------END CERTIFICATE-----

priv/quic/key.pem

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDWKHFkwDMH/XjY
-3joBwT3zzgh5WkqG7dKuj7YV7WdXJjOc46iqNsvyieHTfuJBuPirLDAX2hGzU0Oh
-eeQBg/a9pFQxxyRBN2UZUFwTHPTGTBBvdQGcC2vMQ3HnJwUoPzJRCYPBXQZ3JSml
-q+y1uJzpLQfYeiRtowfGrRrd0jHJXt5amitoN7m9VshG7KCg2K8AVriP/X5oiyNJ
-0s8kVdMFclUNekvWbuxik98VLWbFdcB+kTaFUQkMj7y2ks6b6gWhw1wxPU4kWDEB
-aQMIICM2nZ+sTSUisKPBqpqlvC8NNFFUhA+QW5SQuTa8t4iUxWsfIeuvPSrb1E1Q
-zPwvld8PAgMBAAECggEAQ5DB6cP7ta8iI+XEzk3t4lAj+0lhzv0UZa+Ahp1+Z4/t
-Y7etvHoKUUxwG35iGtMlXTfVOok54WZJJZZjuZitTXqdd5D5Hrw/4MMqMXuGvFM+
-MjPrnJQ739d9hayZY2/Ay7FhSK21PvzSDWtXBKQomSZ0Xbd3a8GuT9/IZKiOvZVl
-Caf9IpWsfBCTJQCO0IpNrktTzxEHPNHZLKBd7HmpRmb7SNdPPaDM5Sl9B5N8pV1j
-VafAsJjOcv2L0kTEc4Kq/VWO4fc625JTb7Zn3Q4VmQGdq/o+3Or1ojLME3GNz1YF
-j+5cKjJf+ezAdvXYLCYqRaWS8UuxhxR++S0B8tGI/QKBgQD84U+YRKB+bURUjKz3
-6OsSY6q78OeGiQjLZBBLoA/724xIPElstpy4j3wylmhV+AW696Dp8+PMMqSpdhS8
-ts9QAtvrqFchu5aIhs5ZltYrNioinRri7F/FrFeDpdmt+YcNnY5p2QNI+5Tt01oG
-i67qtxuVE+UOlUxDSaW+XpG2KwKBgQDYzNVKSX+IgB3aQV5SyRZJmEUsB8bxAnQ8
-K4vFBXtmAtOZibaJvokHe1Rp48NZHE4xlDKm4nfKx46XBW1EEPtaoyzL4gxwlSQN
-LL80PhZM0wQBhL6Ya6TZPYPLSqv+KMuIGL9OFmavrlDroQMJbiUy9UJS+xFaouHt
-EoaRq5tMrQKBgDErgjWCSo6qolmqTMubf3HA7WbDzdDr/kjF+SErS1BWfS1ig4he
-7ZQ5WhXgBwOISVz0X1Z+NLH0uu20Zw3WofLVy3tD7UVC219Kjv7+hEA8tO6sC5lK
-Csk93HpdmjjoxujP1Owh5TCgsnGX4e5Z5LYAyp0vFB/EyeJfhJnCe6SnAoGAfU5O
-zSQUAVpDZt23XdP5/Ml02ZEZLD3F3u0wWMzlWL2zfZ+6EH0/CEMBND6/ruaMT12f
-tRNaN6sFwEYTtG64SNfdUW4y0HNzJeZCETj9fKPOQe5ulvxIiINkhICBTmJX2S6s
-i76o1UvEW5xxe+bcu0pEbl/M1P0l5fd6LgHovfUCgYADQHISMiW1JqCnM/Mu0WhD
-i++BWMnUCb9BqFk/IPnKJUZUPLNKQ3izuvrNKpvd5HwSm7278h6SX2LaU+1D+Pcw
-vvQGMhK7FDhO0E7qOu/pNDRtaNnKIeG76GoYAkGdm2dc3kY8mxlLIgegL/ateuf0
-AXBDlbmJJZgDYNioytFKnw==
------END PRIVATE KEY-----

src/quic/sdlan_quic_server.erl

@@ -23,17 +23,15 @@ init() ->
     Port = proplists:get_value(port, Props),
     Alpn = proplists:get_value(alpn, Props),
     Limits = proplists:get_value(limits, Props),
-    CertFile = proplists:get_value(certfile, Props),
-    KeyFile = proplists:get_value(keyfile, Props),
     AcceptorCount = proplists:get_value(acceptors, Props, 10),
 
-    %% 获取环境变量
+    %% 证书配置
-    Path = os:getenv("QUIC_CERT_PATH"),
+    {CertFile, KeyFile} = sdlan_util:certificate_config(),
 
     LOptions = #{
         % 必选：QUIC/TLS证书配置
-        certfile => Path ++ "/" ++ CertFile,
+        certfile => CertFile,
-        keyfile =>  Path ++ "/" ++  KeyFile,
+        keyfile => KeyFile,
         alpn => Alpn,
         peer_bidi_stream_count => 1,
         conn_acceptors => AcceptorCount

src/sdlan_util.erl

@@ -16,6 +16,7 @@
 -export([ipv4_to_int/1, int_to_ipv4/1, ips/2, format_ip/1]).
 -export([ipv6_to_bytes/1, ipv6_bytes_to_binary/1, ipv6_assist_info/0]).
 -export([hmac/2, term_to_binary/1]).
+-export([certificate_config/0]).
 
 -spec format_mac(Mac :: binary()) -> binary().
 format_mac(Mac) when is_binary(Mac) ->
@@ -166,3 +167,13 @@ hmac(Key, Data) when is_binary(Key), is_binary(Data) ->
 -spec term_to_binary(Term :: term()) -> binary().
 term_to_binary(Term) ->
     iolist_to_binary(io_lib:format("~p", [Term])).
+
+-spec certificate_config() -> {CertFile :: string(), KeyFile :: string()}.
+certificate_config() ->
+    {ok, Props} = application:get_env(sdlan, certificate),
+    CertFile = proplists:get_value(certfile, Props),
+    KeyFile = proplists:get_value(keyfile, Props),
+    %% 获取环境变量
+    Path = os:getenv("QUIC_CERT_PATH"),
+    % 必选：QUIC/TLS证书配置
+    {Path ++ "/" ++ CertFile, Path ++ "/" ++  KeyFile}.

src/ssl/sdlan_ssl_server.erl

@@ -22,14 +22,13 @@ start() ->
     Port = proplists:get_value(port, Props),
     Limits = proplists:get_value(limits, Props, []),
 
-    PrivDir = code:priv_dir(sdlan),
+    %% 证书配置
-    CertFile = filename:join([PrivDir, "ssl", proplists:get_value(certfile, Props, "server.crt")]),
+    {CertFile, KeyFile} = sdlan_util:certificate_config(),
-    KeyFile = filename:join([PrivDir, "ssl", proplists:get_value(keyfile, Props, "server.key")]),
 
     TransOpts = #{
         max_connections => MaxConnections,
         num_acceptors => Acceptors,
-        shutdown => brutal_kill,
+        shutdown => 2000,
         socket_opts => [
             binary,
             {nodelay, true},