github.com/caddyserver/certmagic v0.23.0: NewDefault

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/caddyserver/certmagic.NewDefault in pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Demonstrate these symbols/APIs:
  - github.com/caddyserver/certmagic.NewDefault

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:fd7334cac1702f52ad45d0a6b2745ab3f61b8bdefe46638cb2aa1d671d729d2c","contract":["certmagic.NewDefault returns a non-nil Config instance initialized with default options","certmagic.NewDefault configures non-nil default Storage and KeySource","certmagic.NewDefault configures default Issuers containing an ACMEIssuer","certmagic.NewDefault TLSConfig provides GetCertificate hook and acme-tls/1 ALPN protocol","certmagic.NewDefault instances share the default certificate cache for caching and handshake lookup","certmagic.NewDefault adopts package-level Default configuration settings"],"goal":"verify github.com/caddyserver/certmagic.NewDefault in pkg:golang/github.com/caddyserver/certmagic@v0.23.0","kind":"HOW","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"symbols":["github.com/caddyserver/certmagic.NewDefault"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/caddyserver/certmagic@v0.23.0","symbols":["github.com/caddyserver/certmagic.NewDefault"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/caddyserver/certmagic v0.23.0

require (
	github.com/caddyserver/zerossl v0.1.3 // indirect
	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
	github.com/libdns/libdns v1.0.0-beta.1 // indirect
	github.com/mholt/acmez/v3 v3.1.2 // indirect
	github.com/miekg/dns v1.1.63 // indirect
	github.com/zeebo/blake3 v0.2.4 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	go.uber.org/zap v1.27.0 // indirect
	go.uber.org/zap/exp v0.3.0 // indirect
	golang.org/x/crypto v0.36.0 // indirect
	golang.org/x/mod v0.24.0 // indirect
	golang.org/x/net v0.37.0 // indirect
	golang.org/x/sync v0.12.0 // indirect
	golang.org/x/sys v0.31.0 // indirect
	golang.org/x/text v0.23.0 // indirect
	golang.org/x/tools v0.31.0 // indirect
)

github.com/caddyserver/certmagic v0.23.0 h1:CfpZ/50jMfG4+1J/u2LV6piJq4HOfO6ppOnOf7DkFEU=
github.com/caddyserver/certmagic v0.23.0/go.mod h1:9mEZIWqqWoI+Gf+4Trh04MOVPD0tGSxtqsxg87hAIH4=
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/libdns/libdns v1.0.0-beta.1 h1:KIf4wLfsrEpXpZ3vmc/poM8zCATXT2klbdPe6hyOBjQ=
github.com/libdns/libdns v1.0.0-beta.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"log"
	"math/big"
	"net"
	"time"

	"github.com/caddyserver/certmagic"
)

type dummyAddr struct{}
func (dummyAddr) Network() string { return "tcp" }
func (dummyAddr) String() string  { return "127.0.0.1:1234" }

type dummyConn struct {
	net.Conn
}
func (dummyConn) RemoteAddr() net.Addr { return dummyAddr{} }
func (dummyConn) LocalAddr() net.Addr  { return dummyAddr{} }

func generateSelfSignedCert(domain string) (tls.Certificate, error) {
	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, err
	}
	template := x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: domain,
		},
		DNSNames:              []string{domain},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}
	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		return tls.Certificate{}, err
	}
	return tls.Certificate{
		Certificate: [][]byte{certDER},
		PrivateKey:  priv,
	}, nil
}

func main() {
	// 1. Initialize default CertMagic configuration
	cfg := certmagic.NewDefault()
	fmt.Printf("Initialized default CertMagic Config: %p\n", cfg)

	// 2. Verify default storage, key generator, and issuers
	fmt.Printf("Default Storage: %T\n", cfg.Storage)
	fmt.Printf("Default KeySource: %T\n", cfg.KeySource)
	if len(cfg.Issuers) > 0 {
		fmt.Printf("Default Primary Issuer: %T\n", cfg.Issuers[0])
	}

	// 3. Generate crypto/tls Config
	tlsCfg := cfg.TLSConfig()
	fmt.Printf("Generated TLS Config: GetCertificate=%v, NextProtos=%v, MinVersion=%x\n",
		tlsCfg.GetCertificate != nil,
		tlsCfg.NextProtos,
		tlsCfg.MinVersion,
	)

	// 4. Cache an unmanaged certificate in the shared default cache
	domain := "example.com"
	tlsCert, err := generateSelfSignedCert(domain)
	if err != nil {
		log.Fatalf("Failed to generate cert: %v", err)
	}

	hash, err := cfg.CacheUnmanagedTLSCertificate(context.Background(), tlsCert, nil)
	if err != nil {
		log.Fatalf("Failed to cache certificate: %v", err)
	}
	fmt.Printf("Cached certificate for %s (hash: %s)\n", domain, hash)

	// 5. Query the certificate via GetCertificate during SNI handshake
	hello := &tls.ClientHelloInfo{
		ServerName: domain,
		Conn:       dummyConn{},
	}
	matchedCert, err := cfg.GetCertificate(hello)
	if err != nil {
		log.Fatalf("Failed to get certificate for %s: %v", domain, err)
	}
	fmt.Printf("Successfully retrieved certificate from cache for %s (Leaf Subject: %v)\n",
		domain, matchedCert.Leaf != nil || len(matchedCert.Certificate) > 0)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/caddyserver/certmagic.NewDefault in pkg:golang/github.com/caddyserver/certmagic@v0.23.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/caddyserver/certmagic@v0.23.0"
  ],
  "symbols": [
    "github.com/caddyserver/certmagic.NewDefault"
  ]
}

package main

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"os"
	"time"

	"github.com/caddyserver/certmagic"
)

type dummyAddr struct{}
func (dummyAddr) Network() string { return "tcp" }
func (dummyAddr) String() string  { return "127.0.0.1:1234" }

type dummyConn struct {
	net.Conn
}
func (dummyConn) RemoteAddr() net.Addr { return dummyAddr{} }
func (dummyConn) LocalAddr() net.Addr  { return dummyAddr{} }

func generateTestCert(domain string) (tls.Certificate, error) {
	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return tls.Certificate{}, err
	}
	template := x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: domain,
		},
		DNSNames:              []string{domain},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}
	certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		return tls.Certificate{}, err
	}
	return tls.Certificate{
		Certificate: [][]byte{certDER},
		PrivateKey:  priv,
	}, nil
}

func main() {
	// 1. certmagic.NewDefault returns a non-nil Config instance initialized with default options
	cfg1 := certmagic.NewDefault()
	if cfg1 == nil {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault returned nil\n")
		os.Exit(1)
	}

	// 2. certmagic.NewDefault configures non-nil default Storage and KeySource
	if cfg1.Storage == nil {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault Storage is nil\n")
		os.Exit(1)
	}
	if cfg1.KeySource == nil {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault KeySource is nil\n")
		os.Exit(1)
	}

	// 3. certmagic.NewDefault configures default Issuers containing an ACMEIssuer
	if len(cfg1.Issuers) == 0 {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault Issuers is empty\n")
		os.Exit(1)
	}
	if _, ok := cfg1.Issuers[0].(*certmagic.ACMEIssuer); !ok {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault first issuer is not ACMEIssuer: %T\n", cfg1.Issuers[0])
		os.Exit(1)
	}

	// 4. certmagic.NewDefault TLSConfig provides GetCertificate hook and acme-tls/1 ALPN protocol
	tlsCfg := cfg1.TLSConfig()
	if tlsCfg == nil || tlsCfg.GetCertificate == nil {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault TLSConfig or GetCertificate is nil\n")
		os.Exit(1)
	}
	var hasAcmeALPN bool
	for _, proto := range tlsCfg.NextProtos {
		if proto == "acme-tls/1" {
			hasAcmeALPN = true
			break
		}
	}
	if !hasAcmeALPN {
		fmt.Fprintf(os.Stderr, "certmagic.NewDefault TLSConfig missing acme-tls/1 ALPN protocol in NextProtos\n")
		os.Exit(1)
	}

	// 5. certmagic.NewDefault instances share the default certificate cache for caching and handshake lookup
	cfg2 := certmagic.NewDefault()
	testDomain := "contract.example.com"
	tlsCert, err := generateTestCert(testDomain)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate test cert: %v\n", err)
		os.Exit(1)
	}
	hash, err := cfg1.CacheUnmanagedTLSCertificate(context.Background(), tlsCert, nil)
	if err != nil || hash == "" {
		fmt.Fprintf(os.Stderr, "failed to cache unmanaged certificate in cfg1: %v\n", err)
		os.Exit(1)
	}

	hello := &tls.ClientHelloInfo{
		ServerName: testDomain,
		Conn:       dummyConn{},
	}
	retrievedCert, err := cfg2.GetCertificate(hello)
	if err != nil || retrievedCert == nil {
		fmt.Fprintf(os.Stderr, "cfg2 failed to retrieve certificate cached via cfg1 from shared cache: %v\n", err)
		os.Exit(1)
	}

	// 6. certmagic.NewDefault adopts package-level Default configuration settings
	origRatio := certmagic.Default.RenewalWindowRatio
	certmagic.Default.RenewalWindowRatio = 0.35
	defer func() { certmagic.Default.RenewalWindowRatio = origRatio }()

	cfg3 := certmagic.NewDefault()
	if cfg3.RenewalWindowRatio != 0.35 {
		fmt.Fprintf(os.Stderr, "cfg3 did not adopt modified Default.RenewalWindowRatio: got %f, want 0.35\n", cfg3.RenewalWindowRatio)
		os.Exit(1)
	}

	fmt.Println("All certmagic.NewDefault contract assertions passed.")
}