Repository: traefik/traefik
File: pkg/provider/acme/provider.go (Go)

Code before:
func (p *Provider) createHTTPClient() (*http.Client, error) {
	tlsConfig, err := p.createClientTLSConfig()
	if err != nil {
		return nil, err
	}

	return &http.Client{
		Timeout: 2 * time.Minute,
		Transport: &http.Transport{
			Proxy: http.ProxyFromEnvironment,
			DialContext: (&net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
			}).DialContext,
			TLSHandshakeTimeout:   30 * time.Second,
			ResponseHeaderTimeout: 30 * time.Second,
			TLSClientConfig:       tlsConfig,
		},
	}, nil
}

func (p *Provider) createClientTLSConfig() (*tls.Config, error) {
	if len(p.CACertificates) > 0 {
		certPool, err := lego.CreateCertPool(p.CACertificates, p.CAUseSystemCertPool)
		if err != nil {
			return nil, err
		}

		return &tls.Config{
			ServerName: p.CATLSServerName,
			RootCAs:    certPool,
		}, nil
	}

	// Compatibility layer with the lego.
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L24-L34
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L97-L113

	customCACertsPath := os.Getenv("LEGO_CA_CERTIFICATES")
	if customCACertsPath == "" {
		return nil, nil
	}

	useSystemCertPool, _ := strconv.ParseBool(os.Getenv("LEGO_CA_SYSTEM_CERT_POOL"))

	certPool, err := lego.CreateCertPool(strings.Split(customCACertsPath, string(os.PathListSeparator)), useSystemCertPool)
	if err != nil {
		return nil, err
	}

	return &tls.Config{

Review comment (suggestion):
```suggestion
			return nil, fmt.Errorf("creating cert pool with custom certificates: %w, err)
```

Code after:
	}

	return &http.Client{
		Timeout: 2 * time.Minute,
		Transport: &http.Transport{
			Proxy: http.ProxyFromEnvironment,
			DialContext: (&net.Dialer{
				Timeout:   30 * time.Second,
				KeepAlive: 30 * time.Second,
			}).DialContext,
			TLSHandshakeTimeout:   30 * time.Second,
			ResponseHeaderTimeout: 30 * time.Second,
			TLSClientConfig:       tlsConfig,
		},
	}, nil
}

func (p *Provider) createClientTLSConfig() (*tls.Config, error) {
	if len(p.CACertificates) > 0 || p.CAServerName != "" {
		certPool, err := lego.CreateCertPool(p.CACertificates, p.CASystemCertPool)
		if err != nil {
			return nil, fmt.Errorf("creating cert pool with custom certificates: %w", err)
		}

		return &tls.Config{
			ServerName: p.CAServerName,
			RootCAs:    certPool,
		}, nil
	}

	// Compatibility layer with the lego.
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L24-L34
	// https://github.com/go-acme/lego/blob/834a9089f143e3407b3f5c8b93a0e285ba231fe2/lego/client_config.go#L97-L113

	serverName := os.Getenv("LEGO_CA_SERVER_NAME")
	customCACertsPath := os.Getenv("LEGO_CA_CERTIFICATES")

	if customCACertsPath == "" && serverName == "" {
		return nil, nil
	}

	useSystemCertPool, _ := strconv.ParseBool(os.Getenv("LEGO_CA_SYSTEM_CERT_POOL"))

	certPool, err := lego.CreateCertPool(strings.Split(customCACertsPath, string(os.PathListSeparator)), useSystemCertPool)
	if err != nil {
		return nil, fmt.Errorf("creating cert pool: %w", err)
	}

	return &tls.Config{
		ServerName: serverName,
		RootCAs:    certPool,