roster-server 2.1.12 → 2.1.14

package/index.js

@@ -853,8 +853,40 @@ class Roster {
                     }
                     return null;
                 };
+                const issueAndReloadPemsForServername = async (servername) => {
+                    const host = normalizeHostInput(servername).trim().toLowerCase();
+                    if (!host) return null;
+
+                    let pems = resolvePemsForServername(host);
+                    if (pems) return pems;
+
+                    try {
+                        await greenlockRuntime.get({ servername: host });
+                    } catch (error) {
+                        log.warn(`⚠️  Greenlock issuance failed for ${host}: ${error?.message || error}`);
+                    }
+
+                    pems = resolvePemsForServername(host);
+                    if (pems) return pems;
+
+                    // For wildcard zones, try a valid subdomain bootstrap host so Greenlock can
+                    // resolve the wildcard site without relying on invalid "*.domain" servername input.
+                    const wildcardSubject = wildcardSubjectForHost(host);
+                    const zone = wildcardSubject ? wildcardRoot(wildcardSubject) : null;
+                    if (zone) {
+                        const bootstrapHost = `bun-bootstrap.${zone}`;
+                        try {
+                            await greenlockRuntime.get({ servername: bootstrapHost });
+                        } catch (error) {
+                            log.warn(`⚠️  Greenlock wildcard bootstrap failed for ${bootstrapHost}: ${error?.message || error}`);
+                        }
+                        pems = resolvePemsForServername(host);
+                    }
+
+                    return pems;
+                };
                 const ensureBunDefaultPems = async (primaryDomain) => {
-                    let pems = resolvePemsForServername(primaryDomain);
+                    let pems = await issueAndReloadPemsForServername(primaryDomain);
                     if (pems) return pems;
 
                     const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
@@ -891,12 +923,12 @@ class Roster {
                             key: defaultPems.key,
                             cert: defaultPems.cert,
                             SNICallback: (servername, callback) => {
-                                try {
-                                    const pems = resolvePemsForServername(servername) || defaultPems;
-                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
-                                } catch (error) {
-                                    callback(error);
-                                }
+                                issueAndReloadPemsForServername(servername)
+                                    .then((pems) => {
+                                        const selected = pems || defaultPems;
+                                        callback(null, tls.createSecureContext({ key: selected.key, cert: selected.cert }));
+                                    })
+                                    .catch(callback);
                             }
                         }, dispatcher);
                         log.warn(`⚠️  Bun runtime detected: using file-based TLS with SNI for ${primaryDomain} on port ${portNum}`);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.1.12",
+    "version": "2.1.14",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {