Allow config.domains to exist in CSR mode

letsencrypt/cli.py

@@ -672,11 +672,6 @@ def run(config, plugins):  # pylint: disable=too-many-branches,too-many-locals
 def obtain_cert(config, plugins, lineage=None):
     """Implements "certonly": authenticate & obtain cert, but do not install it."""
 
-    if config.domains and config.csr is not None:
-        # TODO: --csr could have a priority, when --domains is
-        # supplied, check if CSR matches given domains?
-        return "--domains and --csr are mutually exclusive"
-
     try:
         # installers are used in auth mode to determine domain names
         installer, authenticator = choose_configurator_plugins(config, plugins, "certonly")

letsencrypt/client.py

@@ -244,13 +244,17 @@ class Client(object):
         #raise TypeError("About to call %r" % le_util.CSR)
         csr = le_util.CSR(file=self.config.csr[0], data=self.config.csr[1], form="der")
         # TODO: add CN to domains?
-        try:
-            domains = crypto_util.get_sans_from_csr(csr.data, OpenSSL.crypto.FILETYPE_ASN1)
-        except:
-            raise TypeError("Failed %r %r %r" % (self.config.csr, csr, csr.data))
+        domains = crypto_util.get_sans_from_csr(csr.data, OpenSSL.crypto.FILETYPE_ASN1)
         for d in domains:
             domain_callback(self.config, d)
 
+        csr_domains, config_domains = set(domains), set(self.config.domains)
+        if csr_domains != config_domains:
+            raise errors.ConfigurationError(
+                "Inconsistent domain requests:\ncsr:{0}\n:cli config{1}"
+                .format(", ".join(csr_domains), ", ".join(config_domains))
+            )
+
         return self._obtain_certificate(domains, csr)
 
     def obtain_certificate(self, domains):

letsencrypt/tests/client_test.py

@@ -115,13 +115,14 @@ class ClientTest(unittest.TestCase):
         test_csr = le_util.CSR(form="der", file=None, data=CSR_SAN)
         with mock.patch("letsencrypt.client.le_util.CSR") as mock_CSR:
             mock_CSR.return_value = test_csr
+            self.client.config.domains=self.eg_domains
             self.assertEqual(
                 (mock.sentinel.certr, mock.sentinel.chain),
                 self.client.obtain_certificate_from_csr(mock_process_domain))
 
             # make sure cli processing occurred
             cli_processed = (call[0][1] for call in mock_process_domain.call_args_list)
-            self.assertEqual(set(cli_processed), set(self.eg_domains))
+            self.assertEqual(set(cli_processed), set(("example.com", "www.example.com")))
 
             # and that the cert was obtained correctly
             self._check_obtain_certificate()