feat(caddy): CLI command to list certificates stored in the Uncloud cluster storage for Caddy

pkg/api/caddy_certificate.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"crypto/sha256"
 	"crypto/x509"
 	"encoding/json"
 	"encoding/pem"
@@ -23,6 +24,11 @@ type IssuedCertificate struct {
 	IssuerData CertificateIssuerData
 }
 
+// Fingerprint returns the SHA-256 fingerprint of the leaf certificate.
+func (c IssuedCertificate) Fingerprint() [sha256.Size]byte {
+	return sha256.Sum256(c.Chain[0].Raw)
+}
+
 // CertificateIssuerData preserves issuer-specific metadata and provides a best-effort typed view of ACME records.
 type CertificateIssuerData struct {
 	// Raw is the original issuer_data JSON, including unrecognized formats and fields.

pkg/api/caddy_certificate_test.go

@@ -4,6 +4,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rand"
 	"crypto/x509"
+	"encoding/hex"
 	"encoding/pem"
 	"math/big"
 	"testing"
@@ -45,6 +46,17 @@ func TestIssuedCertificateFromProto(t *testing.T) {
 	}
 }
 
+func TestIssuedCertificateFingerprint(t *testing.T) {
+	cert := IssuedCertificate{Chain: []*x509.Certificate{
+		{Raw: []byte("abc")},
+		{Raw: []byte("issuer")},
+	}}
+	want, err := hex.DecodeString("ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
+	require.NoError(t, err)
+	fingerprint := cert.Fingerprint()
+	assert.Equal(t, want, fingerprint[:])
+}
+
 func TestIssuedCertificateFromProto_InvalidCertificate(t *testing.T) {
 	valid := testCertificatePEM(t, 1)
 	invalidDER := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: []byte("invalid")})