starred/certbot-certbot-1
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-08-02 19:42:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Handle unexpected key type migration. (#8435)

Browse Source 
Fixes #8365

This PR adds a control when `certbot certonly` or `certbot run` are called for a certificate that already exists and would eventually be replaced. As described in #8365, this control is here to ensure that the user will not modify the key type of their certificate (eg. ECDSA to RSA) without an explicit approval (set explicitly `--cert-name` and `--key-type`), since RSA is the default if not specified.

* Handle unexpected key type migration.

* Update certbot-ci/certbot_integration_tests/certbot_tests/test_main.py

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
This commit is contained in:
Adrien Ferrand
2020-11-11 12:36:16 -08:00
committed by GitHub
co-authored by Brad Warren
parent 198f5a99bc
commit 8f5787008d
3 changed files with 102 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot-ci/certbot_integration_tests/certbot_tests/test_main.py
+10
View File
@@ -499,6 +499,16 @@ def test_renew_with_ec_keys(context):
assert_elliptic_key(key2, SECP384R1)
assert 280 < os.stat(key2).st_size < 320 # ec keys of 384 bits are ~310 bytes
# We expect here that the command will fail because without --key-type specified,
# Certbot must error out to prevent changing an existing certificate key type,
# without explicit user consent (by specifying both --cert-name and --key-type).
with pytest.raises(subprocess.CalledProcessError):
context.certbot([
'certonly',
'--force-renewal',
'-d', certname
])
def test_ocsp_must_staple(context):
"""Test that OCSP Must-Staple is correctly set in the generated certificate."""