Repository: caddyserver/caddy
File: modules/caddypki/command.go (Go)

Code before:
		Short: "Untrusts a locally-trusted CA certificate",
		Long: `
Untrusts a root certificate from the local trust store(s).

This command uninstalls trust; it does not necessarily delete the
root certificate from trust stores entirely. Thus, repeatedly
trusting and untrusting new certificates can fill up trust databases.

This command does not delete or modify certificate files from Caddy's
configured storage.

This command can be used in one of two ways. Either by specifying
which certificate to untrust by a direct path to the certificate
file with the --cert flag, or by fetching the root certificate for
the CA from the admin API (default behaviour).

If the admin API is used, then the CA defaults to 'local'. You may
specify the ID of another CA with the --ca flag. By default, this
will attempt to connect to the Caddy's admin API running at
'` + caddy.DefaultAdminListen + `' to fetch the root certificate.
You may explicitly specify the --address, or use the --config flag
to load the admin address from your config, if not using the default.`,
		CobraFunc: func(cmd *cobra.Command) {
			cmd.Flags().StringP("cert", "p", "", "The path to the CA certificate to untrust")
			cmd.Flags().StringP("ca", "i", "", "The ID of the CA to untrust (defaults to 'local')")
			cmd.Flags().StringP("address", "d", "", "Address of the administration API listener (if --config is not used)")
			cmd.Flags().StringP("config", "c", "", "Configuration file (if --address is not used)")
			cmd.Flags().StringP("adapter", "a", "", "Name of config adapter to apply (if --config is used)")
			cmd.RunE = caddycmd.WrapCommandFuncForCobra(cmdUntrust)
		},
	})
}

func cmdTrust(fl caddycmd.Flags) (int, error) {
	caID := fl.String("ca")
	addrFlag := fl.String("address")
	configFlag := fl.String("config")
	configAdapterFlag := fl.String("adapter")

	// Prepare the URI to the admin endpoint
	if caID == "" {
		caID = DefaultCAID
	}

	// Determine where we're sending the request to get the CA info
	adminAddr, err := caddycmd.DetermineAdminAPIAddress(addrFlag, nil, configFlag, configAdapterFlag)
	if err != nil {
		return caddy.ExitCodeFailedStartup, fmt.Errorf("couldn't determine admin API address: %v", err)
	}

	// Fetch the root cert from the admin API

Review comment (suggestion):
```suggestion
			cmd.Flags().StringP("address", "", "", "Address of the administration API listener (if --config is not used)")
```

Code after:
		Short: "Untrusts a locally-trusted CA certificate",
		Long: `
Untrusts a root certificate from the local trust store(s).

This command uninstalls trust; it does not necessarily delete the
root certificate from trust stores entirely. Thus, repeatedly
trusting and untrusting new certificates can fill up trust databases.

This command does not delete or modify certificate files from Caddy's
configured storage.

This command can be used in one of two ways. Either by specifying
which certificate to untrust by a direct path to the certificate
file with the --cert flag, or by fetching the root certificate for
the CA from the admin API (default behaviour).

If the admin API is used, then the CA defaults to 'local'. You may
specify the ID of another CA with the --ca flag. By default, this
will attempt to connect to the Caddy's admin API running at
'` + caddy.DefaultAdminListen + `' to fetch the root certificate.
You may explicitly specify the --address, or use the --config flag
to load the admin address from your config, if not using the default.`,
		CobraFunc: func(cmd *cobra.Command) {
			cmd.Flags().StringP("cert", "p", "", "The path to the CA certificate to untrust")
			cmd.Flags().StringP("ca", "", "", "The ID of the CA to untrust (defaults to 'local')")
			cmd.Flags().StringP("address", "", "", "Address of the administration API listener (if --config is not used)")
			cmd.Flags().StringP("config", "c", "", "Configuration file (if --address is not used)")
			cmd.Flags().StringP("adapter", "a", "", "Name of config adapter to apply (if --config is used)")
			cmd.RunE = caddycmd.WrapCommandFuncForCobra(cmdUntrust)
		},
	})
}

func cmdTrust(fl caddycmd.Flags) (int, error) {
	caID := fl.String("ca")
	addrFlag := fl.String("address")
	configFlag := fl.String("config")
	configAdapterFlag := fl.String("adapter")

	// Prepare the URI to the admin endpoint
	if caID == "" {
		caID = DefaultCAID
	}

	// Determine where we're sending the request to get the CA info
	adminAddr, err := caddycmd.DetermineAdminAPIAddress(addrFlag, nil, configFlag, configAdapterFlag)
	if err != nil {
		return caddy.ExitCodeFailedStartup, fmt.Errorf("couldn't determine admin API address: %v", err)
	}

	// Fetch the root cert from the admin API