advancedtls: Add SNI logic to ServerOptions.GetCertificate

security/advancedtls/advancedtls.go

@@ -164,7 +164,7 @@ type ServerOptions struct {
 	// invoke this function every time asked to present certificates to the
 	// client when a new connection is established. This is known as peer
 	// certificate reloading.
-	GetCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)
+	GetCertificate func(*tls.ClientHelloInfo) (*[]tls.Certificate, error)
 	// VerifyPeer is a custom verification check after certificate signature
 	// check.
 	// If this is set, we will perform this customized check after doing the
@@ -211,10 +211,13 @@ func (o *ServerOptions) config() (*tls.Config, error) {
 		// buildVerifyFunc.
 		clientAuth = tls.RequireAnyClientCert
 	}
+	getCertificateWithSNI := func(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		return o.getCertificateWithSNI(clientHello)
+	}
 	config := &tls.Config{
 		ClientAuth:     clientAuth,
 		Certificates:   o.Certificates,
-		GetCertificate: o.GetCertificate,
+		GetCertificate: getCertificateWithSNI,
 	}
 	if o.RootCACerts != nil {
 		config.ClientCAs = o.RootCACerts
@@ -475,3 +478,28 @@ func cloneTLSConfig(cfg *tls.Config) *tls.Config {
 	}
 	return cfg.Clone()
 }
+
+// GetCertificateWithSNI is a helper function that returns the certificate
+// that matches the SNI field based on the given ClientHelloInfo
+// if GetCertificate returns a list of certificates
+func (o *ServerOptions) getCertificateWithSNI(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	certificates, err := o.GetCertificate(clientHello)
+	if err != nil {
+		return nil, err
+	}
+	if len(*certificates) == 0 {
+		return nil, fmt.Errorf("No certificates configured")
+	}
+	// If users pass in only one certificate, return that certificate
+	if len(*certificates) == 1 {
+		return &(*certificates)[0], nil
+	}
+	// Choose the SNI certificate using SupportsCertificate
+	for _, cert := range *certificates {
+		if err := clientHello.SupportsCertificate(&cert); err == nil {
+			return &cert, nil
+		}
+	}
+	// If nothing matches, return the first certificate.
+	return &(*certificates)[0], nil
+}