1515use OCP \Security \ISecureRandom ;
1616use Psr \Log \LoggerInterface ;
1717
18- /**
19- * Manage trusted certificates and the effective CA bundle used by Nextcloud.
20- *
21- * Uploaded PEM certificates are merged with the shipped default CA bundle to
22- * produce the effective bundle consumed by HTTP clients and external storage
23- * integrations.
24- *
25- * The uploaded certificates and generated bundle are stored under the
26- * files_external path for historical reasons, maintaining compatibility
27- * with pre-existing deployments.
28- */
2918class CertificateManager implements ICertificateManager {
3019 private ?string $ bundlePath = null ;
3120
@@ -37,11 +26,6 @@ public function __construct(
3726 ) {
3827 }
3928
40- /**
41- * Return the certificates stored in the internal upload area.
42- *
43- * @return ICertificate[]
44- */
4529 #[\Override]
4630 public function listCertificates (): array {
4731 if (!$ this ->config ->getSystemValueBool ('installed ' , false )) {
@@ -158,14 +142,6 @@ private function createCertificateBundle(): void {
158142 $ this ->view ->rename ($ tmpPath , $ certPath );
159143 }
160144
161- /**
162- * Store a certificate and regenerate the effective bundle.
163- *
164- * @param string $certificate Certificate data in PEM format
165- * @param string $name File name to store the certificate under
166- * @return ICertificate
167- * @throws \Exception If the certificate cannot be stored or the bundle cannot be rebuilt
168- */
169145 #[\Override]
170146 public function addCertificate (string $ certificate , string $ name ): ICertificate {
171147 $ path = $ this ->getPathToCertificates () . 'uploads/ ' . $ name ;
@@ -188,12 +164,6 @@ public function addCertificate(string $certificate, string $name): ICertificate
188164 }
189165 }
190166
191- /**
192- * Remove a stored certificate and regenerate the effective bundle.
193- *
194- * @param string $name File name of the certificate to remove
195- * @return bool False if the path is invalid, true otherwise
196- */
197167 #[\Override]
198168 public function removeCertificate (string $ name ): bool {
199169 $ path = $ this ->getPathToCertificates () . 'uploads/ ' . $ name ;
@@ -212,25 +182,11 @@ public function removeCertificate(string $name): bool {
212182 return true ;
213183 }
214184
215- /**
216- * Get the relative path to the generated certificate bundle.
217- */
218185 #[\Override]
219186 public function getCertificateBundle (): string {
220187 return $ this ->getPathToCertificates () . 'rootcerts.crt ' ;
221188 }
222189
223- /**
224- * Get the local filesystem path to the effective certificate bundle.
225- *
226- * Returns the generated bundle when uploaded certificates exist, otherwise
227- * falls back to the shipped default CA bundle.
228- *
229- * If resolving the generated bundle fails, the default bundle is returned as
230- * a safe fallback.
231- *
232- * @throws \Exception If unable to retrieve/confirm the bundle path for any reason.
233- */
234190 #[\Override]
235191 public function getAbsoluteBundlePath (): string {
236192 try {
@@ -260,9 +216,10 @@ public function getAbsoluteBundlePath(): string {
260216 /**
261217 * Get the base path used to store uploaded certificates and the generated bundle.
262218 *
263- * Kept under the files_external namespace for compatibility with existing
264- * deployments.
265- */
219+ * The uploaded certificates and generated bundle are stored under the
220+ * files_external path for historical reasons, maintaining compatibility
221+ * with pre-existing deployments.
222+ */
266223 private function getPathToCertificates (): string {
267224 return '/files_external/ ' ;
268225 }
@@ -288,9 +245,6 @@ protected function getFilemtimeOfCaBundle(): int {
288245 return filemtime ($ this ->getDefaultCertificatesBundlePath ());
289246 }
290247
291- /**
292- * Return the configured path to the shipped default CA bundle.
293- */
294248 #[\Override]
295249 public function getDefaultCertificatesBundlePath (): string {
296250 return $ this ->config ->getSystemValueString ('default_certificates_bundle_path ' , \OC ::$ SERVERROOT . '/resources/config/ca-bundle.crt ' );
0 commit comments