ACME: forbid specifying files in "acme_certificate key=...".

The ACME protocol assumes short-term certificates to ensure a regular
revalidation of ownership and to limit consequences of key compromise.
Allowing to request certificate renewals with the same key goes agains
the second goal and should not be supported without a good reason.

This was an oversight inherited from the proof-of-concept code and was
not supposed to be committed here.

Author: bavshin-f5

README.md

@@ -218,7 +218,7 @@ challenge data for all the configured certificate issuers.
 
 ### acme_certificate
 
-**Syntax:** acme_certificate `issuer` [`identifier` ...] [ `key` = `alg[:size]` | `file` ]
+**Syntax:** acme_certificate `issuer` [`identifier` ...] [ `key` = `alg[:size]` ]
 
 **Default:** -
 
@@ -234,17 +234,12 @@ regular expressions and wildcards are not supported.
 
 [server_name]: https://nginx.org/en/docs/http/ngx_http_core_module.html#server_name
 
-The `key` parameter sets the type of generated private key or a
-path to an existing file. Supported key algorithms and sizes:
+The `key` parameter sets the type of a generated private key. Supported key
+algorithms and sizes:
 `ecdsa:256` (default), `ecdsa:384`,
 `ecdsa:521`,
 `rsa:2048` .. `rsa:4096`.
 
-> Since 1.27.2, the `key` parameter supports the additional schemes implemented in the
-> [ssl_certificate_key](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate_key)
-> directive: `data:` , `engine:` and more recently `store:` ,
-> with a caveat that password-protected keys are not supported.
-
 ## Embedded Variables
 
 The `ngx_http_acme_module` module defines following embedded

src/conf.rs

@@ -284,6 +284,7 @@ extern "C" fn cmd_add_certificate(
     for value in &args[2..] {
         if let Some(key) = value.strip_prefix(b"key=") {
             order.key = match PrivateKey::try_from(key) {
+                Ok(PrivateKey::File(_)) => return c"invalid \"key\" value".as_ptr().cast_mut(),
                 Ok(val) => val,
                 Err(err) => return cf.error(args[0], &err),
             };