starred/certbot-certbot-1
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-01 02:54:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

[Windows|Unix] Avoid to re-execute challenges already validated (#6551)

Browse Source 
In response to #5342.

Currently, certbot will execute the operations necessary to validate a challenge even if the challenge has already been validated before against the acme ca server. This can occur for instance if a certificate is asked and issue correctly, then deleted locally, then asked again.

It is a corner case, but it will lead to some heavy operations (like updating a DNS zone, or creating an HTTP server) that are not needed.

This PR corrects this behavior by not executing challenges already validated, and use them directly instead to issue the certificate.

Fixes #5342

* Avoid to execute a given challenge that have been already validated by acme ca server.

* Execute tls challenge on a separate dns name, to avoid reusing the existing valid http challenge.

* Align with master

* Improve log

* Simplify the implementation

* Update changelog

* Add a unit test to ensure that validated challenges are not rerun
This commit is contained in:
Adrien Ferrand
2019-01-09 12:52:53 -08:00
committed by Brad Warren
parent 130c29e333
commit 8cf3bcd3f3
5 changed files with 45 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot-nginx/tests/boulder-integration.conf.sh
+2 -1
View File
@@ -1,3 +1,4 @@
#!/usr/bin/env bash
# Based on
# https://www.exratione.com/2014/03/running-nginx-as-a-non-root-user/
# https://github.com/exratione/non-root-nginx/blob/9a77f62e5d5cb9c9026fd62eece76b9514011019/nginx.conf
@@ -52,7 +53,7 @@ http {
listen 5002 $default_server;
# IPv6.
listen [::]:5002 $default_server;
server_name nginx.wtf nginx2.wtf;
server_name nginx.wtf nginx-tls.wtf nginx2.wtf;
root $root/webroot;
certbot-nginx/tests/boulder-integration.sh
+2 -2
View File
@@ -39,8 +39,8 @@ nginx -v
reload_nginx
certbot_test_nginx --domains nginx.wtf run
test_deployment_and_rollback nginx.wtf
certbot_test_nginx --domains nginx.wtf run --preferred-challenges tls-sni
test_deployment_and_rollback nginx.wtf
certbot_test_nginx --domains nginx-tls.wtf run --preferred-challenges tls-sni
test_deployment_and_rollback nginx-tls.wtf
certbot_test_nginx --domains nginx2.wtf --preferred-challenges http
test_deployment_and_rollback nginx2.wtf
# Overlapping location block and server-block-level return 301