Adding --allow-subset-of-names flag

letsencrypt/cli.py

@@ -1603,6 +1603,10 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):
         "security", "--strict-permissions", action="store_true",
         help="Require that all configuration files are owned by the current "
              "user; only needed if your config is somewhere unsafe like /tmp/")
+    helpful.add(
+        "automation", "--allow-subset-of-names", dest="allow_subset_of_names",
+        action="store_true", default=False,
+        help="Allow subsets of domain names to fail validation without exiting.")
 
     helpful.add_group(
         "renew", description="The 'renew' subcommand will attempt to renew all"

letsencrypt/client.py

@@ -222,7 +222,7 @@ class Client(object):
 
         logger.debug("CSR: %s, domains: %s", csr, domains)
 
-        authzr = self.auth_handler.get_authorizations(domains)
+        authzr = self.auth_handler.get_authorizations(domains, self.config.allow_subset_of_names)
         certr = self.acme.request_issuance(
             jose.ComparableX509(
                 OpenSSL.crypto.load_certificate_request(typ, csr.data)),

letsencrypt/tests/client_test.py

@@ -79,7 +79,7 @@ class ClientTest(unittest.TestCase):
 
     def setUp(self):
         self.config = mock.MagicMock(
-            no_verify_ssl=False, config_dir="/etc/letsencrypt")
+            no_verify_ssl=False, config_dir="/etc/letsencrypt", allow_subset_of_names=False)
         # pylint: disable=star-args
         self.account = mock.MagicMock(**{"key.pem": KEY})
         self.eg_domains = ["example.com", "www.example.com"]
@@ -102,7 +102,9 @@ class ClientTest(unittest.TestCase):
         self.acme.fetch_chain.return_value = mock.sentinel.chain
 
     def _check_obtain_certificate(self):
-        self.client.auth_handler.get_authorizations.assert_called_once_with(self.eg_domains)
+        self.client.auth_handler.get_authorizations.assert_called_once_with(
+            self.eg_domains,
+            self.config.allow_subset_of_names)
         self.acme.request_issuance.assert_called_once_with(
             jose.ComparableX509(OpenSSL.crypto.load_certificate_request(
                 OpenSSL.crypto.FILETYPE_ASN1, CSR_SAN)),