Link things together with new version of pebble

certbot-ci/certbot_integration_tests/utils/acme_server.py

@@ -132,16 +132,33 @@ def _prepare_acme_server(workspace, acme_type, acme_xdist):
             os.rename(join(instance_path, 'test/rate-limit-policies-b.yml'),
                       join(instance_path, 'test/rate-limit-policies.yml'))
         if acme_type == 'pebble':
-            # Configure Pebble at full speed (PEBBLE_VA_NOSLEEP=1) and not randomly refusing valid
-            # nonce (PEBBLE_WFE_NONCEREJECT=0) to have a stable test environment.
             with open(os.path.join(instance_path, 'docker-compose.yml'), 'r') as file_handler:
                 config = yaml.load(file_handler.read())
 
+            # Configure Pebble at full speed (PEBBLE_VA_NOSLEEP=1) and not randomly refusing valid
+            # nonce (PEBBLE_WFE_NONCEREJECT=0) to have a stable test environment.
             config['services']['pebble'].setdefault('environment', [])\
                 .extend(['PEBBLE_VA_NOSLEEP=1', 'PEBBLE_WFE_NONCEREJECT=0'])
+
+            # Also disable strict mode for now, since Pebble v2.1.0 added specs in
+            # strict mode for which Certbot is not compliant for now.
+            # See https://github.com/certbot/certbot/pull/7175
+            # TODO: Add back -strict mode once Certbot is compliant with Pebble v2.1.0+
+            config['services']['pebble']['command'] = config['services']['pebble']['command']\
+                .replace('-strict', '')
+
             with open(os.path.join(instance_path, 'docker-compose.yml'), 'w') as file_handler:
                 file_handler.write(yaml.dump(config))
 
+            with open(os.path.join(instance_path, 'test', 'pebble-config.json'), 'r') as file_handler:
+                config = yaml.load(file_handler.read())
+
+            # Setup the OCSP Responder URL for Pebble to local mock
+            config['ocspResponderURL'] = 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT)
+
+            with open(os.path.join(instance_path, 'test', 'pebble-config.json'), 'w') as file_handler:
+                file_handler.write(yaml.dump(config))
+
         # Launch the ACME CA server.
         _launch_command(['docker-compose', 'up', '--force-recreate', '-d'], cwd=instance_path)
 

certbot-ci/certbot_integration_tests/utils/constants.py

@@ -5,3 +5,4 @@ CHALLTESTSRV_PORT = 8055
 BOULDER_V1_DIRECTORY_URL = 'http://localhost:4000/directory'
 BOULDER_V2_DIRECTORY_URL = 'http://localhost:4001/directory'
 PEBBLE_DIRECTORY_URL = 'https://localhost:14000/dir'
+MOCK_OCSP_SERVER_PORT = 4002

certbot-ci/certbot_integration_tests/utils/misc.py

@@ -25,6 +25,7 @@ from six.moves import socketserver, SimpleHTTPServer
 
 
 from certbot_integration_tests.utils import ocsp_server
+from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT
 
 try:
     import urllib3
@@ -306,11 +307,10 @@ def mock_ocsp_server(directory_url, workspace):
     environ = os.environ.copy()
     environ['ISSUER_KEY_PATH'] = key_path
     environ['ISSUER_CERT_PATH'] = cert_path
-    environ['OCSP_PORT'] = '4002'
 
     process = subprocess.Popen([sys.executable, ocsp_server.__file__], env=environ)
     try:
-        yield 'http://127.0.0.1:4002'
+        yield 'http://127.0.0.1:{0}'.format(MOCK_OCSP_SERVER_PORT)
     finally:
         process.terminate()
         process.wait()

certbot-ci/certbot_integration_tests/utils/ocsp_server.py

@@ -8,6 +8,8 @@ from cryptography import x509
 from cryptography.x509 import ocsp
 from flask import Flask, request
 
+from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT
+
 app = Flask(__name__)
 app.debug = False
 
@@ -69,4 +71,4 @@ def status_certificate():
 
 
 if __name__ == '__main__':
-    app.run(host='0.0.0.0', port=int(os.environ.get('OCSP_PORT', 4002)))
+    app.run(host='0.0.0.0', port=int(os.environ.get('OCSP_PORT', MOCK_OCSP_SERVER_PORT)))