2 files changed, 63 insertions, 1 deletions
diff --git a/internal/config/validate.go b/internal/config/validate.go
index b9dab0f56..b2bdda960 100644
--- a/internal/config/validate.go
+++ b/internal/config/validate.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/miekg/dns"
 	"github.com/sirupsen/logrus"
 )
 
@@ -31,10 +32,23 @@ func Validate() error {
 	errs := []error{}
 
 	// host
-	if GetHost() == "" {
+	host := GetHost()
+	if host == "" {
 		errs = append(errs, fmt.Errorf("%s must be set", HostFlag()))
 	}
 
+	// accountDomain; only check if host was set, otherwise there's no point
+	if host != "" {
+		switch ad := GetAccountDomain(); ad {
+		case "":
+			SetAccountDomain(GetHost())
+		default:
+			if !dns.IsSubDomain(ad, host) {
+				errs = append(errs, fmt.Errorf("%s was %s and %s was %s, but %s is not a valid subdomain of %s", HostFlag(), host, AccountDomainFlag(), ad, host, ad))
+			}
+		}
+	}
+
 	// protocol
 	switch proto := GetProtocol(); proto {
 	case "https":
diff --git a/internal/config/validate_test.go b/internal/config/validate_test.go
index 066f1807b..6b832de36 100644
--- a/internal/config/validate_test.go
+++ b/internal/config/validate_test.go
@@ -46,6 +46,54 @@ func (suite *ConfigValidateTestSuite) TestValidateConfigNoHost() {
 	suite.EqualError(err, "host must be set")
 }
 
+func (suite *ConfigValidateTestSuite) TestValidateAccountDomainOK1() {
+	testrig.InitTestConfig()
+
+	err := config.Validate()
+	suite.NoError(err)
+
+	suite.Equal(config.GetHost(), config.GetAccountDomain())
+}
+
+func (suite *ConfigValidateTestSuite) TestValidateAccountDomainOK2() {
+	testrig.InitTestConfig()
+
+	config.SetAccountDomain("localhost:8080")
+
+	err := config.Validate()
+	suite.NoError(err)
+}
+
+func (suite *ConfigValidateTestSuite) TestValidateAccountDomainOK3() {
+	testrig.InitTestConfig()
+
+	config.SetHost("gts.example.org")
+	config.SetAccountDomain("example.org")
+
+	err := config.Validate()
+	suite.NoError(err)
+}
+
+func (suite *ConfigValidateTestSuite) TestValidateAccountDomainNotSubdomain1() {
+	testrig.InitTestConfig()
+
+	config.SetHost("gts.example.org")
+	config.SetAccountDomain("example.com")
+
+	err := config.Validate()
+	suite.EqualError(err, "host was gts.example.org and account-domain was example.com, but gts.example.org is not a valid subdomain of example.com")
+}
+
+func (suite *ConfigValidateTestSuite) TestValidateAccountDomainNotSubdomain2() {
+	testrig.InitTestConfig()
+
+	config.SetHost("example.org")
+	config.SetAccountDomain("gts.example.org")
+
+	err := config.Validate()
+	suite.EqualError(err, "host was example.org and account-domain was gts.example.org, but example.org is not a valid subdomain of gts.example.org")
+}
+
 func (suite *ConfigValidateTestSuite) TestValidateConfigNoProtocol() {
 	testrig.InitTestConfig()