roster-server 2.2.0 → 2.2.1

package/index.js

@@ -3,6 +3,7 @@ const path = require('path');
 const http = require('http');
 const https = require('https');
 const tls = require('tls');
+const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const Greenlock = require('./vendor/greenlock-express/greenlock-express.js');
 const GreenlockShim = require('./vendor/greenlock-express/greenlock-shim.js');
@@ -89,6 +90,16 @@ function buildCertLookupCandidates(servername) {
     return candidates;
 }
 
+function certCoversName(certPem, name) {
+    try {
+        const x509 = new crypto.X509Certificate(certPem);
+        const san = (x509.subjectAltName || '').toLowerCase();
+        return san.split(',').some(entry => entry.trim() === `dns:${name.toLowerCase()}`);
+    } catch {
+        return false;
+    }
+}
+
 function parseBooleanFlag(value, fallback = false) {
     if (value === undefined || value === null || value === '') return fallback;
     const normalized = String(value).trim().toLowerCase();
@@ -909,10 +920,22 @@ class Roster {
                 };
                 const ensureBunDefaultPems = async (primaryDomain) => {
                     let pems = await issueAndReloadPemsForServername(primaryDomain);
+
+                    const needsWildcard = this.combineWildcardCerts
+                        && this.wildcardZones.has(primaryDomain)
+                        && this.dnsChallenge;
+
+                    if (pems && needsWildcard && !certCoversName(pems.cert, `*.${primaryDomain}`)) {
+                        log.warn(`⚠️  Existing cert for ${primaryDomain} lacks *.${primaryDomain} SAN — clearing stale cert for combined re-issuance`);
+                        const certDir = path.join(greenlockStorePath, 'live', primaryDomain);
+                        try { fs.rmSync(certDir, { recursive: true, force: true }); } catch {}
+                        pems = null;
+                    }
+
                     if (pems) return pems;
 
                     const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
-                    log.warn(`⚠️  Bun runtime detected and cert files missing for ${primaryDomain}; requesting certificate via Greenlock before HTTPS bind`);
+                    log.warn(`⚠️  Bun: requesting ${needsWildcard ? 'combined wildcard' : ''} certificate for ${certSubject} via Greenlock before HTTPS bind`);
                     try {
                         await greenlockRuntime.get({ servername: certSubject });
                     } catch (error) {
@@ -1074,4 +1097,5 @@ module.exports.isBunRuntime = isBunRuntime;
 module.exports.wildcardRoot = wildcardRoot;
 module.exports.hostMatchesWildcard = hostMatchesWildcard;
 module.exports.wildcardSubjectForHost = wildcardSubjectForHost;
-module.exports.buildCertLookupCandidates = buildCertLookupCandidates;
+module.exports.buildCertLookupCandidates = buildCertLookupCandidates;
+module.exports.certCoversName = certCoversName;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "roster-server",
-    "version": "2.2.0",
+    "version": "2.2.1",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {