Merge remote-tracking branch 'github/letsencrypt/master' into pylint

letsencrypt/client/CONFIG.py

@@ -2,8 +2,8 @@
 import os.path
 
 
-ACME_SERVER = "letsencrypt-demo.org"
-"""CA hostname.
+ACME_SERVER = "letsencrypt-demo.org:443"
+"""CA hostname (and optionally :port).
 
 If you create your own server... change this line
 

letsencrypt/client/client.py

@@ -59,7 +59,6 @@ class Client(object):
         :type dv_auth: :class:`letsencrypt.client.interfaces.IAuthenticator`
 
         """
-        sanity_check_names([server])
         self.network = network.Network(server)
         self.authkey = authkey
 
@@ -330,7 +329,7 @@ def validate_key_csr(privkey, csr=None):
                     "The key and CSR do not match")
 
 
-def init_key():
+def init_key(key_size):
     """Initializes privkey.
 
     Inits key and CSR using provided files or generating new files
@@ -339,7 +338,12 @@ def init_key():
     the namedtuple to easily work with the protocol.
 
     """
-    key_pem = crypto_util.make_key(CONFIG.RSA_KEY_SIZE)
+    try:
+        key_pem = crypto_util.make_key(key_size)
+    except ValueError as err:
+        logging.fatal(str(err))
+        logging.info("Note: The default RSA key size is %d bits.", CONFIG.RSA_KEY_SIZE)
+        sys.exit(1)
 
     # Save file
     le_util.make_or_verify_dir(CONFIG.KEY_DIR, 0o700)
@@ -348,7 +352,7 @@ def init_key():
     key_f.write(key_pem)
     key_f.close()
 
-    logging.info("Generating key: %s", key_filename)
+    logging.info("Generating key (%d bits): %s", key_size, key_filename)
 
     return Client.Key(key_filename, key_pem)
 

letsencrypt/client/crypto_util.py

@@ -145,7 +145,7 @@ def csr_matches_pubkey(csr, privkey):
 
 
 # based on M2Crypto unit test written by Toby Allsopp
-def make_key(bits=CONFIG.RSA_KEY_SIZE):
+def make_key(bits):
     """Generate PEM encoded RSA key.
 
     :param int bits: Number of bits, at least 1024.

letsencrypt/client/network.py

@@ -17,13 +17,16 @@ logging.getLogger("requests").setLevel(logging.WARNING)
 class Network(object):
     """Class for communicating with ACME servers.
 
-    :ivar str server: Certificate authority server
-    :ivar str server_url: Full URL of the CSR server
+    :ivar str server_url: Full URL of the ACME service
 
     """
     def __init__(self, server):
-        self.server = server
-        self.server_url = "https://%s/acme/" % self.server
+        """Initialize Network instance.
+
+        :param str server: ACME (CA) server[:port]
+
+        """
+        self.server_url = "https://%s/acme/" % server
 
     def send(self, msg):
         """Send ACME message to server.

letsencrypt/client/tests/crypto_util_test.py

@@ -101,6 +101,8 @@ class MakeKeyTest(unittest.TestCase):
     def test_it(self):  # pylint: disable=no-self-use
         from letsencrypt.client.crypto_util import make_key
         M2Crypto.RSA.load_key_string(make_key(1024))
+        M2Crypto.RSA.load_key_string(make_key(2048))
+        M2Crypto.RSA.load_key_string(make_key(4096))
 
 
 class ValidPrivkeyTest(unittest.TestCase):

letsencrypt/scripts/main.py

@@ -30,13 +30,17 @@ def main():  # pylint: disable=too-many-statements
     parser.add_argument("-d", "--domains", dest="domains", metavar="DOMAIN",
                         nargs="+")
     parser.add_argument("-s", "--server", dest="server",
-                        help="The ACME CA server address.")
+                        default=CONFIG.ACME_SERVER,
+                        help="The ACME CA server. [%(default)s]")
     parser.add_argument("-p", "--privkey", dest="privkey", type=read_file,
                         help="Path to the private key file for certificate "
                              "generation.")
     parser.add_argument("-b", "--rollback", dest="rollback", type=int,
                         default=0, metavar="N",
                         help="Revert configuration N number of checkpoints.")
+    parser.add_argument("-B", "--keysize", dest="key_size", type=int,
+                        default=CONFIG.RSA_KEY_SIZE, metavar="N",
+                        help="RSA key shall be sized N bits. [%d]" % CONFIG.RSA_KEY_SIZE)
     parser.add_argument("-k", "--revoke", dest="revoke", action="store_true",
                         help="Revoke a certificate.")
     parser.add_argument("-v", "--view-config-changes",
@@ -72,10 +76,9 @@ def main():  # pylint: disable=too-many-statements
     zope.component.provideUtility(displayer)
 
     installer = determine_installer()
-    server = CONFIG.ACME_SERVER if args.server is None else args.server
 
     if args.revoke:
-        revoc = revoker.Revoker(server, installer)
+        revoc = revoker.Revoker(args.server, installer)
         revoc.list_certs_keys()
         sys.exit()
 
@@ -100,11 +103,11 @@ def main():  # pylint: disable=too-many-statements
 
     # Prepare for init of Client
     if args.privkey is None:
-        privkey = client.init_key()
+        privkey = client.init_key(args.key_size)
     else:
         privkey = client.Client.Key(args.privkey[0], args.privkey[1])
 
-    acme = client.Client(server, privkey, auth, installer)
+    acme = client.Client(args.server, privkey, auth, installer)
 
     # Validate the key and csr
     client.validate_key_csr(privkey)