starred/certbot-certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-31 18:34:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

--preferred-chain: only match root name (#8596)

Browse Source 
* --preferred-chain: only match root name

Currently, when certbot is given the `--preferred-chain='Some Name'`
flag, it iterates through all alternate chains offered by the ACME
server until it finds any certificate which has `'Some Name'` as its
Issuer Common Name. Unfortunately, this means that if the desired
alternate chain is a strict subset of any earlier chain (e.g. the
default chain is 'EE <-- Int <-- Root1 <-- Root2', but the desired
chain is 'EE <-- Int <-- Root1'), there is no name which can be
provided by the user which will allow the client to select the desired
chain.

This change makes it so that the `find_chain_with_issuer` logic only
cares about the Issuer Common Name found in the last certificate in
each chain. In the example above, the user would then be able to get
their desired chain by specifying `--preferred-chain='Root1'`: although
that name appears in the default chain, it does not appear in the
highest certificate of that chain.

This change is technically backwards-incompatible. However, the only
advice that has been given to users of certbot (and the only usecase
that we believe has existed so far) involved setting the flag to a
value that is the name of a root, not an intermediate, so we don't
expect any real-world configurations or use-cases to be broken.

Fixes #8577

* Update interfaces.py
This commit is contained in:
Aaron Gable
2021-01-14 12:12:48 +11:00
committed by GitHub
parent c0917a0302
commit 2fca48caaa
5 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
certbot/tests/crypto_util_test.py
+13
View File
@@ -473,6 +473,19 @@ class FindChainWithIssuerTest(unittest.TestCase):
matched = self._call(fullchains, "Pebble Root CA 0cc6f0")
self.assertEqual(matched, fullchains[1])
@mock.patch('certbot.crypto_util.logger.info')
def test_intermediate_match(self, mock_info):
"""Don't pick a chain where only an intermediate matches"""
fullchains = self._all_fullchains()
# Make the second chain actually only contain "Pebble Root CA 0cc6f0"
# as an intermediate, not as the root. This wouldn't be a valid chain
# (the CERT_ISSUER cert didn't issue the CERT_ALT_ISSUER cert), but the
# function under test here doesn't care about that.
fullchains[1] = fullchains[1] + CERT_ISSUER.decode()
matched = self._call(fullchains, "Pebble Root CA 0cc6f0")
self.assertEqual(matched, fullchains[0])
mock_info.assert_not_called()
@mock.patch('certbot.crypto_util.logger.info')
def test_no_match(self, mock_info):
fullchains = self._all_fullchains()