Merge branch 'master' into ilabun/optimize-certificates-sql
This commit is contained in:
commit
a449cc2b15
|
@ -973,6 +973,41 @@ Will be the sender of all notifications, so ensure that it is verified with AWS.
|
||||||
SES if the default notification gateway and will be used unless SMTP settings are configured in the application configuration
|
SES if the default notification gateway and will be used unless SMTP settings are configured in the application configuration
|
||||||
settings.
|
settings.
|
||||||
|
|
||||||
|
PowerDNS ACME Plugin
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
The following configuration properties are required to use the PowerDNS ACME Plugin for domain validation.
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: ACME_POWERDNS_DOMAIN
|
||||||
|
:noindex:
|
||||||
|
|
||||||
|
This is the FQDN for the PowerDNS API (without path)
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: ACME_POWERDNS_SERVERID
|
||||||
|
:noindex:
|
||||||
|
|
||||||
|
This is the ServerID attribute of the PowerDNS API Server (i.e. "localhost")
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: ACME_POWERDNS_APIKEYNAME
|
||||||
|
:noindex:
|
||||||
|
|
||||||
|
This is the Key name to use for authentication (i.e. "X-API-Key")
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: ACME_POWERDNS_APIKEY
|
||||||
|
:noindex:
|
||||||
|
|
||||||
|
This is the API Key to use for authentication (i.e. "Password")
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: ACME_POWERDNS_RETRIES
|
||||||
|
:noindex:
|
||||||
|
|
||||||
|
This is the number of times DNS Verification should be attempted (i.e. 20)
|
||||||
|
|
||||||
.. _CommandLineInterface:
|
.. _CommandLineInterface:
|
||||||
|
|
||||||
Command Line Interface
|
Command Line Interface
|
||||||
|
@ -1071,6 +1106,15 @@ All commands default to `~/.lemur/lemur.conf.py` if a configuration is not speci
|
||||||
lemur notify
|
lemur notify
|
||||||
|
|
||||||
|
|
||||||
|
.. data:: acme
|
||||||
|
|
||||||
|
Handles all ACME related tasks, like ACME plugin testing.
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
lemur acme
|
||||||
|
|
||||||
|
|
||||||
Sub-commands
|
Sub-commands
|
||||||
------------
|
------------
|
||||||
|
|
||||||
|
@ -1172,11 +1216,12 @@ Acme
|
||||||
Kevin Glisson <kglisson@netflix.com>,
|
Kevin Glisson <kglisson@netflix.com>,
|
||||||
Curtis Castrapel <ccastrapel@netflix.com>,
|
Curtis Castrapel <ccastrapel@netflix.com>,
|
||||||
Hossein Shafagh <hshafagh@netflix.com>,
|
Hossein Shafagh <hshafagh@netflix.com>,
|
||||||
Mikhail Khodorovskiy <mikhail.khodorovskiy@jivesoftware.com>
|
Mikhail Khodorovskiy <mikhail.khodorovskiy@jivesoftware.com>,
|
||||||
|
Chad Sine <csine@netflix.com>
|
||||||
:Type:
|
:Type:
|
||||||
Issuer
|
Issuer
|
||||||
:Description:
|
:Description:
|
||||||
Adds support for the ACME protocol (including LetsEncrypt) with domain validation being handled Route53.
|
Adds support for the ACME protocol (including LetsEncrypt) with domain validation using several providers.
|
||||||
|
|
||||||
|
|
||||||
Atlas
|
Atlas
|
||||||
|
|
|
@ -254,8 +254,9 @@ class AcmeHandler(object):
|
||||||
|
|
||||||
domains = [options["common_name"]]
|
domains = [options["common_name"]]
|
||||||
if options.get("extensions"):
|
if options.get("extensions"):
|
||||||
for name in options["extensions"]["sub_alt_names"]["names"]:
|
for dns_name in options["extensions"]["sub_alt_names"]["names"]:
|
||||||
domains.append(name)
|
if dns_name.value not in domains:
|
||||||
|
domains.append(dns_name.value)
|
||||||
|
|
||||||
current_app.logger.debug("Got these domains: {0}".format(domains))
|
current_app.logger.debug("Got these domains: {0}".format(domains))
|
||||||
return domains
|
return domains
|
||||||
|
@ -640,15 +641,8 @@ class ACMEIssuerPlugin(IssuerPlugin):
|
||||||
domains = self.acme.get_domains(issuer_options)
|
domains = self.acme.get_domains(issuer_options)
|
||||||
if not create_immediately:
|
if not create_immediately:
|
||||||
# Create pending authorizations that we'll need to do the creation
|
# Create pending authorizations that we'll need to do the creation
|
||||||
authz_domains = []
|
|
||||||
for d in domains:
|
|
||||||
if type(d) == str:
|
|
||||||
authz_domains.append(d)
|
|
||||||
else:
|
|
||||||
authz_domains.append(d.value)
|
|
||||||
|
|
||||||
dns_authorization = authorization_service.create(
|
dns_authorization = authorization_service.create(
|
||||||
account_number, authz_domains, provider_type
|
account_number, domains, provider_type
|
||||||
)
|
)
|
||||||
# Return id of the DNS Authorization
|
# Return id of the DNS Authorization
|
||||||
return None, None, dns_authorization.id
|
return None, None, dns_authorization.id
|
||||||
|
|
|
@ -1,4 +1,6 @@
|
||||||
import unittest
|
import unittest
|
||||||
|
|
||||||
|
from cryptography.x509 import DNSName
|
||||||
from requests.models import Response
|
from requests.models import Response
|
||||||
|
|
||||||
from mock import MagicMock, Mock, patch
|
from mock import MagicMock, Mock, patch
|
||||||
|
@ -74,12 +76,14 @@ class TestAcme(unittest.TestCase):
|
||||||
@patch("acme.client.Client")
|
@patch("acme.client.Client")
|
||||||
@patch("lemur.plugins.lemur_acme.plugin.current_app")
|
@patch("lemur.plugins.lemur_acme.plugin.current_app")
|
||||||
@patch("lemur.plugins.lemur_acme.cloudflare.wait_for_dns_change")
|
@patch("lemur.plugins.lemur_acme.cloudflare.wait_for_dns_change")
|
||||||
|
@patch("time.sleep")
|
||||||
def test_complete_dns_challenge_success(
|
def test_complete_dns_challenge_success(
|
||||||
self, mock_wait_for_dns_change, mock_current_app, mock_acme
|
self, mock_sleep, mock_wait_for_dns_change, mock_current_app, mock_acme
|
||||||
):
|
):
|
||||||
mock_dns_provider = Mock()
|
mock_dns_provider = Mock()
|
||||||
mock_dns_provider.wait_for_dns_change = Mock(return_value=True)
|
mock_dns_provider.wait_for_dns_change = Mock(return_value=True)
|
||||||
mock_authz = Mock()
|
mock_authz = Mock()
|
||||||
|
mock_sleep.return_value = False
|
||||||
mock_authz.dns_challenge.response = Mock()
|
mock_authz.dns_challenge.response = Mock()
|
||||||
mock_authz.dns_challenge.response.simple_verify = Mock(return_value=True)
|
mock_authz.dns_challenge.response.simple_verify = Mock(return_value=True)
|
||||||
mock_authz.authz = []
|
mock_authz.authz = []
|
||||||
|
@ -179,7 +183,7 @@ class TestAcme(unittest.TestCase):
|
||||||
options = {
|
options = {
|
||||||
"common_name": "test.netflix.net",
|
"common_name": "test.netflix.net",
|
||||||
"extensions": {
|
"extensions": {
|
||||||
"sub_alt_names": {"names": ["test2.netflix.net", "test3.netflix.net"]}
|
"sub_alt_names": {"names": [DNSName("test2.netflix.net"), DNSName("test3.netflix.net")]}
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
result = self.acme.get_domains(options)
|
result = self.acme.get_domains(options)
|
||||||
|
@ -187,6 +191,19 @@ class TestAcme(unittest.TestCase):
|
||||||
result, [options["common_name"], "test2.netflix.net", "test3.netflix.net"]
|
result, [options["common_name"], "test2.netflix.net", "test3.netflix.net"]
|
||||||
)
|
)
|
||||||
|
|
||||||
|
@patch("lemur.plugins.lemur_acme.plugin.current_app")
|
||||||
|
def test_get_domains_san(self, mock_current_app):
|
||||||
|
options = {
|
||||||
|
"common_name": "test.netflix.net",
|
||||||
|
"extensions": {
|
||||||
|
"sub_alt_names": {"names": [DNSName("test.netflix.net"), DNSName("test2.netflix.net")]}
|
||||||
|
},
|
||||||
|
}
|
||||||
|
result = self.acme.get_domains(options)
|
||||||
|
self.assertEqual(
|
||||||
|
result, [options["common_name"], "test2.netflix.net"]
|
||||||
|
)
|
||||||
|
|
||||||
@patch(
|
@patch(
|
||||||
"lemur.plugins.lemur_acme.plugin.AcmeHandler.start_dns_challenge",
|
"lemur.plugins.lemur_acme.plugin.AcmeHandler.start_dns_challenge",
|
||||||
return_value="test",
|
return_value="test",
|
||||||
|
|
Loading…
Reference in New Issue