Fixed issues with running multiple vhosts separately with upgrade from http vhost to https

trustify/client/CONFIG.py

@@ -27,8 +27,8 @@ NONCE_SIZE = 32
 difficulty = 23 
 
 # Trustify cert and chain files
-cert_file = CERT_DIR + "cert.pem"
-chain_file = CERT_DIR + "chain.pem"
+cert_file = CERT_DIR + "trustify-cert.pem"
+chain_file = CERT_DIR + "trustify-chain.pem"
 
 # Rewrite rule arguments used for redirections to https vhost
 REWRITE_HTTPS_ARGS = ["^.*$", "https://%{SERVER_NAME}%{REQUEST_URI}", "[L,R=permanent]"]

trustify/client/client.py

@@ -353,21 +353,22 @@ def handle_verification_response(r, dn, challenges, vhost, key_file, config):
         for chall in challenges:
             chall.cleanup()
         cert_chain_abspath = None
-        with open(cert_file, "w") as f:
-            f.write(r.success.certificate)
-
-        logger.info("Server issued certificate; certificate written to %s" % cert_file)
+        cert_fd, cert_fn = unique_file(cert_file, 644)
+        cert_fd.write(r.success.certificate)
+        cert_fd.close()
+        logger.info("Server issued certificate; certificate written to %s" % cert_fn)
         if r.success.chain:
-            with open(chain_file, "w") as f:
-                f.write(r.success.chain)
+            chain_fd, chain_fn = unique_file(chain_file, 644)
+            chain_fd.write(r.success.chain)
+            chain_fd.close()
  
-            logger.info("Cert chain written to %s" % chain_file)
+            logger.info("Cert chain written to %s" % chain_fn)
 
             # This expects a valid chain file
-            cert_chain_abspath = os.path.abspath(chain_file)
+            cert_chain_abspath = os.path.abspath(chain_fn)
 
         for host in vhost:
-            config.deploy_cert(host, os.path.abspath(cert_file), os.path.abspath(key_file), cert_chain_abspath)
+            config.deploy_cert(host, os.path.abspath(cert_fn), os.path.abspath(key_file), cert_chain_abspath)
             # Enable any vhost that was issued to, but not enabled
             if not host.enabled:
                 logger.info("Enabling Site " + host.file)

trustify/client/configurator.py

@@ -73,7 +73,7 @@ class Configurator(object):
         
         if len(path["cert_file"]) == 0 or len(path["cert_key"]) == 0:
             # Throw some "can't find all of the directives error"
-            logger.warn("Warn: cannot find a cert or key directive in ", vhost.path)
+            logger.warn("Warn: cannot find a cert or key directive in " + vhost.path)
             logger.warn("VirtualHost was not modified")
             # Presumably break here so that the virtualhost is not modified
             return False
@@ -659,8 +659,9 @@ LogLevel warn \n\
                             if test_tup[2] == "80" or test_tup[2] == "" or test_tup[2] == "*":
                                 found += 1
                                 break
-
-                if found == len(ssl_vhost.addrs):
+                # Check to make sure all addresses were found 
+                # and names are equal
+                if found == len(ssl_vhost.addrs) and set(vh.names) == set(ssl_vhost.names):
                     return vh
         return None
 

trustify/client/options-ssl.conf

@@ -1,6 +1,6 @@
 # Baseline setting to Include for SSL sites
 
-SSLEngine On
+SSLEngine on
 SSLProtocol -all +SSLv3 +TLSv1
 SSLCipherSuite HIGH:!aNULL:!ADH:!EXP:!SSLv2:!MD5:@STRENGTH
 SSLHonorCipherOrder on