starred/certbot-certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-30 18:04:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

Accept --csr PEMFILE

Browse Source 
* Closes: #1082 #1935
* Also produce better errors if SANs are missing, though not yet fixing #1076
This commit is contained in:
Peter Eckersley
2016-02-08 19:15:28 -08:00
parent 4831ec6ac0
commit 63c0718d86
2 changed files with 27 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
letsencrypt/cli.py
+23 -5
View File
@@ -684,7 +684,8 @@ def obtain_cert(config, plugins, lineage=None):
# This is a special case; cert and chain are simply saved # This is a special case; cert and chain are simply saved
if config.csr is not None: if config.csr is not None:
assert lineage is None, "Did not expect a CSR with a RenewableCert" assert lineage is None, "Did not expect a CSR with a RenewableCert"
certr, chain = le_client.obtain_certificate_from_csr(config.domains, config.actual_csr) csr, typ = config.actual_csr
certr, chain = le_client.obtain_certificate_from_csr(config.domains, csr, typ)
if config.dry_run: if config.dry_run:
logger.info( logger.info(
"Dry run: skipping saving certificate to %s", config.cert_path) "Dry run: skipping saving certificate to %s", config.cert_path)
@@ -1116,12 +1117,29 @@ class HelpfulArgumentParser(object):
Process a --csr flag. This needs to happen early enought that the Process a --csr flag. This needs to happen early enought that the
webroot plugin can know about the calls to _process_domain webroot plugin can know about the calls to _process_domain
""" """
csr = le_util.CSR(file=parsed_args.csr[0], data=parsed_args.csr[1], form="der") try:
# TODO: add CN to domains? csr = le_util.CSR(file=parsed_args.csr[0], data=parsed_args.csr[1], form="der")
domains = crypto_util.get_sans_from_csr(csr.data, OpenSSL.crypto.FILETYPE_ASN1) typ = OpenSSL.crypto.FILETYPE_ASN1
domains = crypto_util.get_sans_from_csr(csr.data, OpenSSL.crypto.FILETYPE_ASN1)
except:
try:
e1 = traceback.format_exc()
typ = OpenSSL.crypto.FILETYPE_PEM
csr = le_util.CSR(file=parsed_args.csr[0], data=parsed_args.csr[1], form="pem")
domains = crypto_util.get_sans_from_csr(csr.data, typ)
except:
logger.debug("DER CSR parse error %s", e1)
logger.debug("PEM CSR parse error %s", traceback.format_exc())
raise errors.Error("Failed to CSR file: %s", parsed_args.csr[0])
if not domains:
# TODO: add CN to domains instead:
raise errors.Error(
"Unfortunately, your CSR %s needs to have a SubjectAltName for every domain"
% parsed_args.csr[0])
for d in domains: for d in domains:
_process_domain(parsed_args, d) _process_domain(parsed_args, d)
parsed_args.actual_csr = csr parsed_args.actual_csr = (csr, typ)
csr_domains, config_domains = set(domains), set(parsed_args.domains) csr_domains, config_domains = set(domains), set(parsed_args.domains)
if csr_domains != config_domains: if csr_domains != config_domains:
raise errors.ConfigurationError( raise errors.ConfigurationError(
letsencrypt/client.py
+4 -3
View File
@@ -195,7 +195,8 @@ class Client(object):
else: else:
self.auth_handler = None self.auth_handler = None
def obtain_certificate_from_csr(self, domains, csr): def obtain_certificate_from_csr(self, domains, csr,
typ=OpenSSL.crypto.FILETYPE_ASN1):
"""Obtain certificate. """Obtain certificate.
Internal function with precondition that `domains` are Internal function with precondition that `domains` are
@@ -223,8 +224,8 @@ class Client(object):
authzr = self.auth_handler.get_authorizations(domains) authzr = self.auth_handler.get_authorizations(domains)
certr = self.acme.request_issuance( certr = self.acme.request_issuance(
jose.ComparableX509(OpenSSL.crypto.load_certificate_request( jose.ComparableX509(
OpenSSL.crypto.FILETYPE_ASN1, csr.data)), OpenSSL.crypto.load_certificate_request(typ, csr.data)),
authzr) authzr)
return certr, self.acme.fetch_chain(certr) return certr, self.acme.fetch_chain(certr)