From 46984689ae95f637951a58a03f2a5aea265c18d4 Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Sat, 6 Feb 2016 13:19:55 -0800
Subject: [PATCH] Attempt to get --csr and -w to play together

---
 letsencrypt/cli.py               |  3 +--
 letsencrypt/client.py            | 23 ++++++++++++++++-------
 letsencrypt/tests/client_test.py | 23 ++++++++++++++++-------
 3 files changed, 33 insertions(+), 16 deletions(-)

diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index 838da4015..3b614d4b4 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -689,8 +689,7 @@ def obtain_cert(config, plugins, lineage=None):
     # This is a special case; cert and chain are simply saved
     if config.csr is not None:
         assert lineage is None, "Did not expect a CSR with a RenewableCert"
-        certr, chain = le_client.obtain_certificate_from_csr(le_util.CSR(
-            file=config.csr[0], data=config.csr[1], form="der"))
+        certr, chain = le_client.obtain_certificate_from_csr(_process_domain)
         if config.dry_run:
             logger.info(
                 "Dry run: skipping saving certificate to %s", config.cert_path)
diff --git a/letsencrypt/client.py b/letsencrypt/client.py
index 57b21a55f..b4d6c5b56 100644
--- a/letsencrypt/client.py
+++ b/letsencrypt/client.py
@@ -228,21 +228,30 @@ class Client(object):
             authzr)
         return certr, self.acme.fetch_chain(certr)
 
-    def obtain_certificate_from_csr(self, csr):
+    def obtain_certificate_from_csr(self, domain_callback):
         """Obtain certficiate from CSR.
 
-        :param .le_util.CSR csr: DER-encoded Certificate Signing
-            Request.
+        :param function(config, domains) domain_callback: callback for each
+        domain extracted from the CSR, to ensure that webroot-map and similar
+        housekeeping in cli.py is performed correctly
 
         :returns: `.CertificateResource` and certificate chain (as
             returned by `.fetch_chain`).
         :rtype: tuple
 
         """
-        return self._obtain_certificate(
-            # TODO: add CN to domains?
-            crypto_util.get_sans_from_csr(
-                csr.data, OpenSSL.crypto.FILETYPE_ASN1), csr)
+
+        #raise TypeError("About to call %r" % le_util.CSR)
+        csr = le_util.CSR(file=self.config.csr[0], data=self.config.csr[1], form="der")
+        # TODO: add CN to domains?
+        try:
+            domains = crypto_util.get_sans_from_csr(csr.data, OpenSSL.crypto.FILETYPE_ASN1)
+        except:
+            raise TypeError("Failed %r %r %r" % (self.config.csr, csr, csr.data))
+        for d in domains:
+            domain_callback(self.config, d)
+
+        return self._obtain_certificate(domains, csr)
 
     def obtain_certificate(self, domains):
         """Obtains a certificate from the ACME server.
diff --git a/letsencrypt/tests/client_test.py b/letsencrypt/tests/client_test.py
index 2f117f80c..f051b6618 100644
--- a/letsencrypt/tests/client_test.py
+++ b/letsencrypt/tests/client_test.py
@@ -82,6 +82,7 @@ class ClientTest(unittest.TestCase):
             no_verify_ssl=False, config_dir="/etc/letsencrypt")
         # pylint: disable=star-args
         self.account = mock.MagicMock(**{"key.pem": KEY})
+        self.eg_domains = ["example.com", "www.example.com"]
 
         from letsencrypt.client import Client
         with mock.patch("letsencrypt.client.acme_client.Client") as acme:
@@ -101,8 +102,7 @@ class ClientTest(unittest.TestCase):
         self.acme.fetch_chain.return_value = mock.sentinel.chain
 
     def _check_obtain_certificate(self):
-        self.client.auth_handler.get_authorizations.assert_called_once_with(
-            ["example.com", "www.example.com"])
+        self.client.auth_handler.get_authorizations.assert_called_once_with(self.eg_domains)
         self.acme.request_issuance.assert_called_once_with(
             jose.ComparableX509(OpenSSL.crypto.load_certificate_request(
                 OpenSSL.crypto.FILETYPE_ASN1, CSR_SAN)),
@@ -111,11 +111,20 @@ class ClientTest(unittest.TestCase):
 
     def test_obtain_certificate_from_csr(self):
         self._mock_obtain_certificate()
-        self.assertEqual(
-            (mock.sentinel.certr, mock.sentinel.chain),
-            self.client.obtain_certificate_from_csr(le_util.CSR(
-                form="der", file=None, data=CSR_SAN)))
-        self._check_obtain_certificate()
+        mock_process_domain = mock.MagicMock()
+        test_csr = le_util.CSR(form="der", file=None, data=CSR_SAN)
+        with mock.patch("letsencrypt.client.le_util.CSR") as mock_CSR:
+            mock_CSR.return_value = test_csr
+            self.assertEqual(
+                (mock.sentinel.certr, mock.sentinel.chain),
+                self.client.obtain_certificate_from_csr(mock_process_domain))
+
+            # make sure cli processing occurred
+            cli_processed = (call[0][1] for call in mock_process_domain.call_args_list)
+            self.assertEqual(set(cli_processed), set(self.eg_domains))
+
+            # and that the cert was obtained correctly
+            self._check_obtain_certificate()
 
     @mock.patch("letsencrypt.client.crypto_util")
     def test_obtain_certificate(self, mock_crypto_util):