starred/certbot-certbot-2
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-28 08:05:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4560 from certbot/issue_4519

Browse Source 
update cert to certificate
This commit is contained in:
Noah Swartz
2017-05-31 13:48:43 -07:00
committed by GitHub
parent bbc7e9259f 7fde26a7b4
commit e02245a59f
3 changed files with 79 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot/cli.py
+44 -39
View File
@@ -57,30 +57,30 @@ SHORT_USAGE = """
Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,
it will attempt to use a webserver both for obtaining and installing the
cert. """.format(cli_command)
certificate. """.format(cli_command)
# This section is used for --help and --help all ; it needs information
# about installed plugins to be fully formatted
COMMAND_OVERVIEW = """The most common SUBCOMMANDS and flags are:
obtain, install, and renew certificates:
(default) run Obtain & install a cert in your current webserver
certonly Obtain or renew a cert, but do not install it
renew Renew all previously obtained certs that are near expiry
-d DOMAINS Comma-separated list of domains to obtain a cert for
(default) run Obtain & install a certificate in your current webserver
certonly Obtain or renew a certificate, but do not install it
renew Renew all previously obtained certificates that are near expiry
-d DOMAINS Comma-separated list of domains to obtain a certificate for
%s
--standalone Run a standalone webserver for authentication
%s
--webroot Place files in a server's webroot folder for authentication
--manual Obtain certs interactively, or using shell script hooks
--manual Obtain certificates interactively, or using shell script hooks
-n Run non-interactively
--test-cert Obtain a test cert from a staging server
--dry-run Test "renew" or "certonly" without saving any certs to disk
--test-cert Obtain a test certificate from a staging server
--dry-run Test "renew" or "certonly" without saving any certificates to disk
manage certificates:
certificates Display information about certs you have from Certbot
certificates Display information about certificates you have from Certbot
revoke Revoke a certificate (supply --cert-path)
delete Delete a certificate
@@ -324,13 +324,13 @@ class CustomHelpFormatter(argparse.HelpFormatter):
VERB_HELP = [
("run (default)", {
"short": "Obtain/renew a certificate, and install it",
"opts": "Options for obtaining & installing certs",
"opts": "Options for obtaining & installing certificates",
"usage": SHORT_USAGE.replace("[SUBCOMMAND]", ""),
"realname": "run"
}),
("certonly", {
"short": "Obtain or renew a certificate, but do not install it",
"opts": "Options for modifying how a cert is obtained",
"opts": "Options for modifying how a certificate is obtained",
"usage": ("\n\n certbot certonly [options] [-d DOMAIN] [-d DOMAIN] ...\n\n"
"This command obtains a TLS/SSL certificate without installing it anywhere.")
}),
@@ -361,7 +361,7 @@ VERB_HELP = [
}),
("revoke", {
"short": "Revoke a certificate specified with --cert-path",
"opts": "Options for revocation of certs",
"opts": "Options for revocation of certificates",
"usage": "\n\n certbot revoke --cert-path /path/to/fullchain.pem [options]\n\n"
}),
("register", {
@@ -373,15 +373,15 @@ VERB_HELP = [
"opts": "Options for account deactivation."
}),
("install", {
"short": "Install an arbitrary cert in a server",
"opts": "Options for modifying how a cert is deployed"
"short": "Install an arbitrary certificate in a server",
"opts": "Options for modifying how a certificate is deployed"
}),
("config_changes", {
"short": "Show changes that Certbot has made to server configurations",
"opts": "Options for controlling which changes are displayed"
}),
("rollback", {
"short": "Roll back server conf changes made during cert installation",
"short": "Roll back server conf changes made during certificate installation",
"opts": "Options for rolling back server configuration changes"
}),
("plugins", {
@@ -390,7 +390,7 @@ VERB_HELP = [
}),
("update_symlinks", {
"short": "Recreate symlinks in your /etc/letsencrypt/live/ directory",
"opts": ("Recreates cert and key symlinks in {0}, if you changed them by hand "
"opts": ("Recreates certificate and key symlinks in {0}, if you changed them by hand "
"or edited a renewal configuration file".format(
os.path.join(flag_default("config_dir"), "live")))
}),
@@ -869,13 +869,13 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis
helpful.add(
[None, "testing", "renew", "certonly"],
"--dry-run", action="store_true", dest="dry_run",
help="Perform a test run of the client, obtaining test (invalid) certs"
help="Perform a test run of the client, obtaining test (invalid) certificates"
" but not saving them to disk. This can currently only be used"
" with the 'certonly' and 'renew' subcommands. \nNote: Although --dry-run"
" tries to avoid making any persistent changes on a system, it "
" is not completely side-effect free: if used with webserver authenticator plugins"
" like apache and nginx, it makes and then reverts temporary config changes"
" in order to obtain test certs, and reloads webservers to deploy and then"
" in order to obtain test certificates, and reloads webservers to deploy and then"
" roll back those changes. It also calls --pre-hook and --post-hook commands"
" if they are defined because they may be necessary to accurately simulate"
" renewal. --renew-hook commands are not called.")
@@ -907,12 +907,12 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis
["automation", "certonly", "run"],
"--keep-until-expiring", "--keep", "--reinstall",
dest="reinstall", action="store_true",
help="If the requested cert matches an existing cert, always keep the "
help="If the requested certificate matches an existing certificate, always keep the "
"existing one until it is due for renewal (for the "
"'run' subcommand this means reinstall the existing cert). (default: Ask)")
"'run' subcommand this means reinstall the existing certificate). (default: Ask)")
helpful.add(
"automation", "--expand", action="store_true",
help="If an existing cert is a strict subset of the requested names, "
help="If an existing certificate is a strict subset of the requested names, "
"always expand and replace it with the additional names. (default: Ask)")
helpful.add(
"automation", "--version", action="version",
@@ -971,7 +971,7 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis
# overwrites server, handled in HelpfulArgumentParser.parse_args()
helpful.add(["testing", "revoke", "run"], "--test-cert", "--staging",
action='store_true', dest='staging',
help='Use the staging server to obtain or revoke test (invalid) certs; equivalent'
help='Use the staging server to obtain or revoke test (invalid) certificates; equivalent'
' to --server ' + constants.STAGING_URI)
helpful.add(
"testing", "--debug", action="store_true",
@@ -996,8 +996,8 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis
default=flag_default("http01_port"), help=config_help("http01_port"))
helpful.add(
"testing", "--break-my-certs", action="store_true",
help="Be willing to replace or renew valid certs with invalid "
"(testing/staging) certs")
help="Be willing to replace or renew valid certificates with invalid "
"(testing/staging) certificates")
helpful.add(
"security", "--rsa-key-size", type=int, metavar="N",
default=flag_default("rsa_key_size"), help=config_help("rsa_key_size"))
@@ -1073,9 +1073,9 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False): # pylint: dis
help="Command to be run in a shell once for each successfully renewed"
" certificate. For this command, the shell variable $RENEWED_LINEAGE"
" will point to the config live subdirectory (for example,"
" \"/etc/letsencrypt/live/example.com\") containing the new certs"
" \"/etc/letsencrypt/live/example.com\") containing the new certificates"
" and keys; the shell variable $RENEWED_DOMAINS will contain a"
" space-delimited list of renewed cert domains (for example,"
" space-delimited list of renewed certificate domains (for example,"
" \"example.com www.example.com\"")
helpful.add(
"renew", "--disable-hook-validation",
@@ -1159,7 +1159,7 @@ def _paths_parser(helpful):
if verb == "help":
verb = helpful.help_arg
cph = "Path to where cert is saved (with auth --csr), installed from, or revoked."
cph = "Path to where certificate is saved (with auth --csr), installed from, or revoked."
section = ["paths", "install", "revoke", "certonly", "manage"]
if verb == "certonly":
add(section, "--cert-path", type=os.path.abspath,
@@ -1176,14 +1176,14 @@ def _paths_parser(helpful):
# revoke --key-path reads a file, install --key-path takes a string
add(section, "--key-path", required=(verb == "install"),
type=((verb == "revoke" and read_file) or os.path.abspath),
help="Path to private key for cert installation "
help="Path to private key for certificate installation "
"or revocation (if account key is missing)")
default_cp = None
if verb == "certonly":
default_cp = flag_default("auth_chain_path")
add(["paths", "install"], "--fullchain-path", default=default_cp, type=os.path.abspath,
help="Accompanying path to a full certificate chain (cert plus chain).")
help="Accompanying path to a full certificate chain (certificate plus chain).")
add("paths", "--chain-path", default=default_cp, type=os.path.abspath,
help="Accompanying path to a certificate chain.")
add("paths", "--config-dir", default=flag_default("config_dir"),
@@ -1214,25 +1214,30 @@ def _plugins_parsing(helpful, plugins):
help="Installer plugin name (also used to find domains).")
helpful.add(["plugins", "certonly", "run", "install", "config_changes"],
"--apache", action="store_true",
help="Obtain and install certs using Apache")
help="Obtain and install certificates using Apache")
helpful.add(["plugins", "certonly", "run", "install", "config_changes"],
"--nginx", action="store_true", help="Obtain and install certs using Nginx")
"--nginx", action="store_true", help="Obtain and install certificates using Nginx")
helpful.add(["plugins", "certonly"], "--standalone", action="store_true",
help='Obtain certs using a "standalone" webserver.')
help='Obtain certificates using a "standalone" webserver.')
helpful.add(["plugins", "certonly"], "--manual", action="store_true",
help='Provide laborious manual instructions for obtaining a cert')
help='Provide laborious manual instructions for obtaining a certificate')
helpful.add(["plugins", "certonly"], "--webroot", action="store_true",
help='Obtain certs by placing files in a webroot directory.')
help='Obtain certificates by placing files in a webroot directory.')
helpful.add(["plugins", "certonly"], "--dns-cloudflare", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using Cloudflare for DNS).')
help=('Obtain certificates using a DNS TXT record (if you are '
'using Cloudflare for DNS).'))
helpful.add(["plugins", "certonly"], "--dns-cloudxns", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using CloudXNS for DNS).')
help=('Obtain certificates using a DNS TXT record (if you are '
'using CloudXNS for DNS).'))
helpful.add(["plugins", "certonly"], "--dns-digitalocean", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using DigitalOcean for DNS).')
help=('Obtain certificates using a DNS TXT record (if you are '
'using DigitalOcean for DNS).'))
helpful.add(["plugins", "certonly"], "--dns-dnsimple", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using DNSimple for DNS).')
help=('Obtain certificates using a DNS TXT record (if you are '
'using DNSimple for DNS).'))
helpful.add(["plugins", "certonly"], "--dns-google", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using Google Cloud DNS).')
help=('Obtain certificates using a DNS TXT record (if you are '
'using Google Cloud DNS).'))
helpful.add(["plugins", "certonly"], "--dns-nsone", action="store_true",
help='Obtain certs using a DNS TXT record (if you are using NS1 for DNS).')
certbot/tests/cli_test.py
+2 -2
View File
@@ -103,7 +103,7 @@ class ParseTest(unittest.TestCase):
self._help_output(['--help']) # assert SystemExit is raised here
out = self._help_output(['--help', 'all'])
self.assertTrue("--configurator" in out)
self.assertTrue("how a cert is deployed" in out)
self.assertTrue("how a certificate is deployed" in out)
self.assertTrue("--webroot-path" in out)
self.assertTrue("--text" not in out)
self.assertTrue("--dialog" not in out)
@@ -161,7 +161,7 @@ class ParseTest(unittest.TestCase):
out = self._help_output(['help', 'all'])
self.assertTrue("--configurator" in out)
self.assertTrue("how a cert is deployed" in out)
self.assertTrue("how a certificate is deployed" in out)
self.assertTrue("--webroot-path" in out)
self.assertTrue("--text" not in out)
self.assertTrue("--dialog" not in out)
docs/using.rst
+33 -33
View File
@@ -24,16 +24,16 @@ Getting certificates (and choosing plugins)
The Certbot client supports two types of plugins for
obtaining and installing certificates: authenticators and installers.
Authenticators are plugins used with the ``certonly`` command to obtain a cert.
Authenticators are plugins used with the ``certonly`` command to obtain a certificate.
The authenticator validates that you
control the domain(s) you are requesting a cert for, obtains a cert for the specified
domain(s), and places the cert in the ``/etc/letsencrypt`` directory on your
machine. The authenticator does not install the cert (it does not edit any of your server's configuration files to serve the
control the domain(s) you are requesting a certificate for, obtains a certificate for the specified
domain(s), and places the certificate in the ``/etc/letsencrypt`` directory on your
machine. The authenticator does not install the certificate (it does not edit any of your server's configuration files to serve the
obtained certificate). If you specify multiple domains to authenticate, they will
all be listed in a single certificate. To obtain multiple separate certificates
you will need to run Certbot multiple times.
Installers are Plugins used with the ``install`` command to install a cert.
Installers are Plugins used with the ``install`` command to install a certificate.
These plugins can modify your webserver's configuration to
serve your website over HTTPS using certificates obtained by certbot.
@@ -44,19 +44,19 @@ a combination of distinct authenticator and installer plugins.
=========== ==== ==== =============================================================== =============================
Plugin Auth Inst Notes Challenge types (and port)
=========== ==== ==== =============================================================== =============================
apache_ Y Y | Automates obtaining and installing a cert with Apache 2.4 on tls-sni-01_ (443)
| Debian-based distributions with ``libaugeas0`` 1.0+.
webroot_ Y N | Obtains a cert by writing to the webroot directory of an http-01_ (80)
| already running webserver.
nginx_ Y Y | Automates obtaining and installing a cert with Nginx. Alpha tls-sni-01_ (443)
| release shipped with Certbot 0.9.0.
standalone_ Y N | Uses a "standalone" webserver to obtain a cert. Requires http-01_ (80) or
| port 80 or 443 to be available. This is useful on systems tls-sni-01_ (443)
| with no webserver, or when direct integration with the local
| webserver is not supported or not desired.
manual_ Y N | Helps you obtain a cert by giving you instructions to perform http-01_ (80) or
| domain validation yourself. Additionally allows you to dns-01_ (53)
| specify scripts to automate the validation task in a
apache_ Y Y | Automates obtaining and installing a certificate with Apache tls-sni-01_ (443)
| 2.4 on Debian-based distributions with ``libaugeas0`` 1.0+.
webroot_ Y N | Obtains a certificate by writing to the webroot directory of http-01_ (80)
| an already running webserver.
nginx_ Y Y | Automates obtaining and installing a certificate with Nginx. tls-sni-01_ (443)
| Alpha release shipped with Certbot 0.9.0.
standalone_ Y N | Uses a "standalone" webserver to obtain a certificate. http-01_ (80) or
| Requires port 80 or 443 to be available. This is useful on tls-sni-01_ (443)
| systems with no webserver, or when direct integration with
| the local webserver is not supported or not desired.
manual_ Y N | Helps you obtain a certificate by giving you instructions to http-01_ (80) or
| perform domain validation yourself. Additionally allows you dns-01_ (53)
| to specify scripts to automate the validation task in a
| customized way.
=========== ==== ==== =============================================================== =============================
@@ -82,7 +82,7 @@ The Apache plugin currently requires an OS with augeas version 1.0; currently `i
supports
<https://github.com/certbot/certbot/blob/master/certbot-apache/certbot_apache/constants.py>`_
modern OSes based on Debian, Fedora, SUSE, Gentoo and Darwin.
This automates both obtaining *and* installing certs on an Apache
This automates both obtaining *and* installing certificates on an Apache
webserver. To specify this plugin on the command line, simply include
``--apache``.
@@ -92,7 +92,7 @@ Webroot
If you're running a local webserver for which you have the ability
to modify the content being served, and you'd prefer not to stop the
webserver during the certificate issuance process, you can use the webroot
plugin to obtain a cert by including ``certonly`` and ``--webroot`` on
plugin to obtain a certificate by including ``certonly`` and ``--webroot`` on
the command line. In addition, you'll need to specify ``--webroot-path``
or ``-w`` with the top-level directory ("web root") containing the files
served by your webserver. For example, ``--webroot-path /var/www/html``
@@ -144,11 +144,11 @@ the ``--nginx`` flag on the commandline.
Standalone
----------
Use standalone mode to obtain a cert if you don't want to use (or don't currently have)
Use standalone mode to obtain a certificate if you don't want to use (or don't currently have)
existing server software. The standalone plugin does not rely on any other server
software running on the machine where you obtain the cert.
software running on the machine where you obtain the certificate.
To obtain a cert using a "standalone" webserver, you can use the
To obtain a certificate using a "standalone" webserver, you can use the
standalone plugin by including ``certonly`` and ``--standalone``
on the command line. This plugin needs to bind to port 80 or 443 in
order to perform domain validation, so you may need to stop your
@@ -167,10 +167,10 @@ the Internet on the specified port using each requested domain name.
Manual
------
If you'd like to obtain a cert running ``certbot`` on a machine
If you'd like to obtain a certificate running ``certbot`` on a machine
other than your target webserver or perform the steps for domain
validation yourself, you can use the manual plugin. While hidden from
the UI, you can use the plugin to obtain a cert by specifying
the UI, you can use the plugin to obtain a certificate by specifying
``certonly`` and ``--manual`` on the command line. This requires you
to copy and paste commands into another terminal session, which may
be on a different computer.
@@ -213,11 +213,11 @@ plesk_ Y Y Integration with the Plesk web hosting tool
haproxy_ Y Y Integration with the HAProxy load balancer
s3front_ Y Y Integration with Amazon CloudFront distribution of S3 buckets
gandi_ Y Y Integration with Gandi's hosting products and API
varnish_ Y N Obtain certs via a Varnish server
varnish_ Y N Obtain certificates via a Varnish server
external_ Y N A plugin for convenient scripting (See also ticket 2782_)
icecast_ N Y Deploy certs to Icecast 2 streaming media servers
pritunl_ N Y Install certs in pritunl distributed OpenVPN servers
proxmox_ N Y Install certs in Proxmox Virtualization servers
icecast_ N Y Deploy certificates to Icecast 2 streaming media servers
pritunl_ N Y Install certificates in pritunl distributed OpenVPN servers
proxmox_ N Y Install certificates in Proxmox Virtualization servers
postfix_ N Y STARTTLS Everywhere is becoming a Certbot Postfix/Exim plugin
heroku_ Y Y Integration with Heroku SSL
=========== ==== ==== ===============================================================
@@ -336,9 +336,9 @@ use the ``revoke`` command to do so. Note that the ``revoke`` command takes the
certbot revoke --cert-path /etc/letsencrypt/live/CERTNAME/cert.pem
Additionally, if a certificate
is a test cert obtained via the ``--staging`` or ``--test-cert`` flag, that flag must be passed to the
is a test certificate obtained via the ``--staging`` or ``--test-cert`` flag, that flag must be passed to the
``revoke`` subcommand.
Once a certificate is revoked (or for other cert management tasks), all of a certificate's
Once a certificate is revoked (or for other certificate management tasks), all of a certificate's
relevant files can be removed from the system with the ``delete`` subcommand::
certbot delete --cert-name example.com
@@ -371,7 +371,7 @@ Since ``renew`` only renews certificates that are near expiry it can be
run as frequently as you want - since it will usually take no action.
The ``renew`` command includes hooks for running commands or scripts before or after a certificate is
renewed. For example, if you have a single cert obtained using
renewed. For example, if you have a single certificate obtained using
the standalone_ plugin, you might need to stop the webserver
before renewing so standalone can bind to the necessary ports, and
then restart it after the plugin is finished. Example::
@@ -497,7 +497,7 @@ renewal configuration file, located at ``/etc/letsencrypt/renewal/CERTNAME``.
For most tasks, it is safest to limit yourself to pointing symlinks at the files there, or using
``--renew-hook`` to copy / make new files based upon those files, if your operational situation requires it
(for instance, combining certs and keys in different way, or having copies of things with different
(for instance, combining certificates and keys in different way, or having copies of things with different
specific permissions that are demanded by other programs).
If the contents of ``/etc/letsencrypt/archive/CERTNAME`` are moved to a new folder, first specify