From a9097cbb429a19e440deba263c7ebf38abdc0fbc Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Tue, 5 Sep 2023 20:28:21 -0700
Subject: [PATCH] Also support passing in the key ID and hmac for non-standard
 servers

---
 webmin/letsencrypt-lib.pl | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/webmin/letsencrypt-lib.pl b/webmin/letsencrypt-lib.pl
index 90361eedf..aea646e7b 100755
--- a/webmin/letsencrypt-lib.pl
+++ b/webmin/letsencrypt-lib.pl
@@ -58,14 +58,14 @@ return &software::missing_install_link(
 
 # request_letsencrypt_cert(domain|&domains, webroot, [email], [keysize],
 # 			   [request-mode], [use-staging], [account-email],
-# 			   [reuse-key], [server-url])
+# 			   [reuse-key], [server-url, server-key, server-hmac])
 # Attempt to request a cert using a generated key with the Let's Encrypt client
 # command, and write it to the given path. Returns a status flag, and either
 # an error message or the paths to cert, key and chain files.
 sub request_letsencrypt_cert
 {
 my ($dom, $webroot, $email, $size, $mode, $staging, $account_email,
-    $key_type, $reuse_key, $server) = @_;
+    $key_type, $reuse_key, $server, $server_key, $server_hmac) = @_;
 my @doms = ref($dom) ? @$dom : ($dom);
 $email ||= "root\@$doms[0]";
 $mode ||= "web";
@@ -80,6 +80,11 @@ foreach my $d (@doms) {
 		}
 	}
 
+if ($server && !$letsencrypt_cmd) {
+	return (0, "A non-standard server can only be used when the native ".
+		   "Let's Encrypt client is installed");
+	}
+
 if ($mode eq "web") {
 	# Create a challenges directory under the web root
 	if ($wildcard) {
@@ -186,6 +191,13 @@ if ($letsencrypt_cmd) {
 		}
 	if ($server) {
 		$server_flags = " --server ".quotemeta($server);
+		if ($server_key) {
+			$server_flags .= " --eab-kid ".quotemeta($server_key);
+			}
+		if ($server_hmac) {
+			$server_flags .= " --eab-hmac-key ".
+					 quotemeta($server_hmac);
+			}
 		}
 	$dir =~ s/\/[^\/]+$//;
 	$size ||= 2048;