96fbcdaf70
Fix test_finalize_authorizations, dont reuse cleanup_dns_challenges in finalize_authorizations
2020-10-27 11:27:44 +01:00
103e107668
Fix patches for test_create_certificate
2020-10-27 11:16:29 +01:00
82bf8e2ac6
Remove unnecessary code from dnsChallenge, Fix patches in dns tests
2020-10-27 11:09:30 +01:00
2d98e71977
Replace deprecated assertRaisesRegexp with assertRaisesRegex
2020-10-27 10:44:04 +01:00
30c10b93f8
Fix patches for acme_handler tests
2020-10-27 10:37:30 +01:00
3b20a47603
Fix patches for acme_http tests, apparently isinstance is considered evil in python
2020-10-27 10:37:30 +01:00
4464c5890d
Flake8
2020-10-27 10:37:30 +01:00
812e1dee92
Refactor Acme plugin into AcmeChallenge objects, dns01
2020-10-27 10:37:27 +01:00
b91cebf245
Refactor Acme plugin into AcmeChallenge objects, http01
2020-10-27 10:36:06 +01:00
6c1be02bfa
Remove destination_list from AcmeHttpIssuer
2020-10-27 10:28:34 +01:00
ef0fce2661
Set timeout for finalize to 90s
2020-10-27 10:28:34 +01:00
235653b558
Refactor destination selection for acme-http authorities, to load destinations dynamically
2020-10-27 10:28:34 +01:00
81b078604c
Implement revoke certificate for ACME
2020-10-27 10:28:34 +01:00
215070b327
Fix create_certificate tests
2020-10-27 10:28:34 +01:00
41ea59d7e3
Remove unneeded polling
2020-10-27 10:28:33 +01:00
d24fae0bac
Fix permissions on acme token upload, dont append well-known automatically
2020-10-27 10:28:33 +01:00
66cab6abd3
Make http-01 challenge work for SAN certificates
2020-10-27 10:28:33 +01:00
e3e5ef7d66
Refactor AcmeHandler, Move DNS stuff into AcmeDnsHandler
2020-10-27 10:28:33 +01:00
76dcfbd528
Add more tests
2020-10-27 10:28:33 +01:00
d6719b729c
Implement some test for AcmeHttpIssuerPlugin
2020-10-27 10:28:33 +01:00
b2de986652
Split tests into handler, and dns specifics
2020-10-27 10:28:30 +01:00
b93d271f31
Fix flake8
2020-10-27 10:25:31 +01:00
e06bdcf2a3
Implement create_certificate for HTTP-01 challenge
2020-10-27 10:25:31 +01:00
3012995c76
Improve naming, make it possible to create directories recursively with SFTP
2020-10-27 10:25:31 +01:00
348d8477dd
Refactor destination plugin, to allow upload of ACME http-challenge tokens
2020-10-27 10:25:31 +01:00
d00dd9d295
Initial structure for ACME http challenge
2020-10-27 10:25:31 +01:00
749aa772ba
First change to get CNAME redirection working
2020-10-26 11:57:33 -07:00
f6554a9a1e
typo, fixing abstract class complaints
2020-10-23 18:03:55 -07:00
0e02abbb37
Entrust just looks into CSR for RSA/EC key type
2020-10-23 18:03:27 -07:00
9957120a7f
adding missing import
2020-10-23 18:03:07 -07:00
7e573d6d51
fixing typo
2020-10-23 18:02:54 -07:00
6891077501
readability
2020-10-23 18:02:35 -07:00
75bc3a5b20
refactoring and adding retry
2020-10-23 18:02:05 -07:00
d233490c8a
simple retry
2020-10-23 18:01:14 -07:00
2c1e7b19a2
10x 10s delay might be too long for the load balancer request
2020-10-23 17:59:58 -07:00
3d83db6f8f
Merge branch 'master' into expanding-S3-plugin
2020-10-23 14:13:30 -07:00
01bd357b1c
Merge branch 'master' into sns
2020-10-23 11:38:35 -07:00
1495fb3595
now fixing the month to minute bug
2020-10-23 10:18:24 -07:00
bc6fb02fc2
fixing testing
2020-10-23 10:16:38 -07:00
e01863097b
fixing the time bug, sub-second to second, and month to minute!
2020-10-23 10:16:23 -07:00
233f9768e8
Fix error handling
2020-10-23 09:35:46 -07:00
98962ae5f5
Merge branch 'master' into sns
2020-10-23 08:50:26 -07:00
2b274f723a
Merge branch 'master' into improved-logging
2020-10-23 07:59:30 -07:00
8610af8b83
more precise language
2020-10-22 17:54:46 -07:00
820106e333
Merge branch 'master' into expanding-S3-plugin
2020-10-22 17:35:20 -07:00
9ce0010bf1
handle_respone can also handle the no data response
2020-10-22 17:33:39 -07:00
97f80b79dc
adjusting digicert test to support seconds
2020-10-22 17:23:33 -07:00
9acd974b74
fixing the test to support seconds
2020-10-22 17:20:47 -07:00
ae1e9d120b
consistent messaging
2020-10-22 17:13:58 -07:00
2e7652962c
refactoring of the error handling
2020-10-22 17:11:02 -07:00
1c96ea9ab1
better messaging of exceptions
2020-10-22 17:10:32 -07:00
02c040865d
more meaningful message
2020-10-22 16:05:29 -07:00
8fa90a2ce5
digicert expects also seconds, though not yet honoring it
2020-10-22 16:01:09 -07:00
c60645bec4
improved logging for all responses
2020-10-22 16:00:26 -07:00
c2fe2b5e03
improved logging for all responses
2020-10-22 15:59:59 -07:00
906b3b2337
better handling of status code
2020-10-21 19:52:25 -07:00
4f552cb636
Code cleanup
2020-10-20 12:02:36 -07:00
d6075ebc11
Merge
2020-10-20 11:48:54 -07:00
669a4273c2
Merge branch 'master' of github.com:jtschladen/lemur into sns
2020-10-19 16:29:33 -07:00
e90b08b363
Correct typo and enable Slack notification test
2020-10-16 17:08:44 -07:00
60bb0037f0
Miscellaneous notification fixes and tests
2020-10-16 15:13:12 -07:00
a04cce6044
Initial implementation
2020-10-16 10:40:11 -07:00
503530e935
the test requires region param for sts
2020-10-16 10:32:10 -07:00
11ce540246
formatting
2020-10-16 10:31:19 -07:00
9c04a888d8
adjusting the S3 test
2020-10-16 09:52:04 -07:00
17e528b5dd
adding testing for acme_upload method
2020-10-16 09:50:35 -07:00
d705e3ae3b
expanding the S3 destination plugin to support the acme token upload inteface
2020-10-16 09:49:56 -07:00
7d8eb1c61e
improving test
2020-10-16 09:49:26 -07:00
6aad37e1f9
cleaning up code
2020-10-16 09:49:00 -07:00
d73db59d23
revsering removing region
2020-10-16 09:48:47 -07:00
bfe89e131e
adding delete and put interfaces for the S3 plugin
2020-10-15 18:13:50 -07:00
28381737dc
Removed OU from digicert plugin
2020-10-13 19:40:15 -07:00
817fc3f0fe
Merge branch 'master' into feature/store-acme-account-details
2020-10-11 14:37:31 +02:00
0fc050e17b
Merge branch 'master' into dymanic-digicert-ICAs
2020-10-09 17:53:54 -07:00
42e9b8b627
removing the intermediary from being optional
2020-10-09 15:40:25 -07:00
5a968ffe63
Lint errors
2020-10-09 12:05:57 +02:00
d43e240a2a
dded ELIF at determine_end_date, becuase of error.
2020-10-09 11:41:44 +02:00
a6a4f458e0
added Tests and removed problems in test-setup
2020-10-09 11:35:04 +02:00
1a270cd315
switching from static DigiCert ICAs to dynamic ones to support:
...
https://knowledge.digicert.com/alerts/DigiCert-ICA-Update.html
2020-10-07 20:06:20 -07:00
57534d86cd
Disable account saving by default
2020-10-07 12:28:22 +02:00
8353396940
Improve tests
2020-10-07 12:28:22 +02:00
9abd3e97e7
Add test loading acme account from authority
2020-10-07 12:28:22 +02:00
bf66de0bfd
Add Test for saving the accound details
2020-10-07 12:28:22 +02:00
e0708410d0
Add store_account value to options in test_setup_acme_client_success
2020-10-07 12:28:22 +02:00
eed628dbab
Implement storage of acme account
2020-10-07 12:28:22 +02:00
898b5da661
Add store_account option to acme plugin
2020-10-07 12:28:22 +02:00
e5961146b9
session hook complains about metadata
...
+ consistent language.
2020-09-23 14:22:58 -06:00
cc855e2758
modern python style
2020-09-18 17:16:07 -07:00
416f39222a
testing
2020-09-18 17:02:19 -07:00
fae3793255
entrrust plugin revised
2020-09-18 11:09:32 -07:00
02c7a5ca7c
another round of lint errors
2020-09-14 16:34:56 +02:00
e011cc9251
added several enhancements following advice from peer
2020-09-14 16:24:53 +02:00
9778eb7b25
fixed lint errors
2020-09-14 15:56:02 +02:00
5bb0143da4
lint errors and removed _path from the API-Cert variables
2020-09-14 15:42:36 +02:00
84496b0f55
fixed a few problems
2020-09-14 15:18:46 +02:00
b8e3162c5f
added revoke functionality
2020-09-14 14:20:11 +02:00
b337b27146
added response handler
2020-09-14 12:23:58 +02:00
01678a714f
added required vars check
2020-09-14 09:50:55 +02:00
8adca442e1
Merge branch 'master' into entrust-plugin
2020-09-11 17:11:57 -07:00
09a2a8fc76
Log message change
...
PR comments
2020-09-11 15:53:34 -07:00
1c9c377751
Lint errors
2020-09-11 12:31:15 +02:00
fd52438d61
yet lint errors
2020-09-11 12:30:53 +02:00
de9ad82011
Fixed Lint complaints
2020-09-11 12:24:33 +02:00
a99a84b0b2
entrust plugin inital edit
2020-09-10 16:04:31 +02:00
f47f108f43
ientrust plgin - first version
2020-09-10 16:03:29 +02:00
8ad4448c85
Match date format for comparison + expected new lines
2020-09-01 12:44:49 -07:00
db4f68f0ed
Logs during cert validity truncate for digicert
2020-08-31 18:20:32 -07:00
1b73b1d080
Merge branch 'master' into master
2020-08-19 12:29:02 +02:00
c2116df652
Extended ADCS_TEMPLATE_ Variable
...
If there is a config variable ADCS_TEMPLATE_<upper(authority.name)> take the value as Cert template else default to ADCS_TEMPLATE to be compatible with former versions
2020-08-19 12:25:52 +02:00
6ff8910f87
mention 397 for digicert plugin
2020-08-11 18:53:19 -07:00
d7ca1570be
maximum 1 year validity for digicert
2020-08-11 18:02:42 -07:00
bde2829e72
Modify unit test test_determine_end_date to match new config
2020-08-11 17:10:29 -07:00
7a83799bcd
Cert validity should not exceed 397 days for publicly trusted issuers
2020-08-10 17:30:34 -07:00
3c1d6998fb
Merge branch 'master' into pinning-to-cross-signed-LE-ICA
2020-07-24 10:25:11 -07:00
0fd83d13ae
Fix intermediate CA creation on cryptography plugin
2020-07-23 13:58:32 -07:00
2317967802
lack of an empty config file was resulting into this error
...
```
Traceback (most recent call last):
File "/home/travis/build/Netflix/lemur/lemur/plugins/lemur_acme/tests/test_acme.py", line 159, in test_request_certificate
self.acme.request_certificate(mock_acme, [], mock_order)
File "/home/travis/build/Netflix/lemur/lemur/plugins/lemur_acme/plugin.py", line 211, in request_certificate
current_app.config.get("IDENTRUST_CROSS_SIGNED_LE_ICA_EXPIRATION_DATE", "17/03/21"), '%d/%m/%y'):
TypeError: strptime() argument 1 must be str, not MagicMock
```
2020-07-15 17:04:49 -07:00
d5ae45a0d0
Let's Encrypt has been using a cross-signed intermediate CA by DST Root CA X3, which is included in any older devices' TrustStore.
...
https://letsencrypt.org/certificates/
Let's Encrypt is transitioning to use the intermediate CA issued by their own root (ISRG X1) starting from September 29th 2020. This is in preparation of concluding the initial bootstrapping of their CA, by having it cross-signed by an older CA.
https://letsencrypt.org/2019/04/15/transitioning-to-isrg-root.html
This PR allows Lemur to pin to the cross-signed ICA (same public/private key pair as the ICA signed by ISRG X1). This will prolong support for incompatible systems.
2020-07-14 17:35:13 -07:00
aa11088944
Remove f from non-f string
2020-07-02 16:48:41 +02:00
a7a309136f
fixing whitespace and imports
2020-06-11 14:15:40 -07:00
f834d10f9a
moving ultradns tests to separate file
2020-06-11 14:04:17 -07:00
c3b36d697f
clarification
2020-06-08 15:17:45 -07:00
904bc9d8b6
Merge branch 'master' into improve-expiry-email
2020-05-27 15:28:41 -07:00
8861cc70cb
rewordin
2020-05-26 17:12:47 -07:00
34e3f7c049
improved messaging
2020-05-26 16:38:12 -07:00
cc4fc66c93
Merge branch 'master' into master
2020-05-22 09:57:46 -07:00
8d0007b9c0
fixing the private DNS zone issue.
...
Private hosted zones will never be visible to third-parties like LetsEncrypt, and Lemur should not consider them as authoritative zones.
This fix, make sure they are not added to the dns_provider table.
2020-04-24 15:48:06 -07:00
cee81bd693
updated requirements, fixed unittests, pytest, and distinguidedName ordering
2020-04-09 18:17:05 -07:00
1360d846fd
Improve error logging for a couple of use cases
2020-04-08 11:50:42 -07:00
46e0d1953b
Merge branch 'master' of github.com:Netflix/lemur into powerdnsplugin_02
2020-04-05 21:47:24 -07:00
f82ec24dfa
updating _get_txt_records return values and docstrings
2020-04-05 21:46:33 -07:00
d825616ea6
No need to retry 25 times on DeleteConflict errors
2020-04-01 10:53:17 -07:00
6f3ba23fa0
updating sinlge line of comments
2020-03-30 13:34:24 -07:00
9d9bf9d7ba
Merge branch 'powerdnsplugin_02' of github.com:Netflix/lemur into powerdnsplugin_02
2020-03-30 09:02:56 -07:00
d6cc8a8a9a
fixing whitespace
2020-03-30 09:01:28 -07:00
2b7e60399c
Merge branch 'master' into powerdnsplugin_02
2020-03-27 10:27:33 -07:00
0e314d0028
adding documentation and final cleanup
2020-03-27 10:18:38 -07:00
0149f8b0d3
add support for wildcard and naked domains to PowerDNS module
2020-03-26 22:15:10 -07:00
88c40aa93c
Merge branch 'master' into master
2020-03-23 20:31:16 -07:00
697215f8bc
better handling of destination plugin errors, and also checking cert expiration before upload
2020-03-21 20:05:35 -07:00
7bd5173da4
Merge with Netflix/lemur master
2020-03-20 20:52:33 +03:00
07dc31bed7
cleaning up whitespace changes
2020-03-16 11:41:05 -07:00
1a19e250bb
updating and cleaning up tests
2020-03-16 11:24:17 -07:00
921d52b360
fixing get_dns_challenge() logic so duplicate domains (such as wildcard and not wildcard) do not match the wrong authorziations
2020-03-13 00:03:31 -07:00
be722fb1b3
Fix lint
2020-03-11 20:51:10 +03:00
92a8942727
Fix lint
2020-03-11 15:37:11 +03:00
a6c3b85fe1
Fix lint
2020-03-11 15:15:56 +03:00
ba8e315eed
Fix typo
2020-03-11 14:22:04 +03:00
729ed3843d
Fix bug wth get_options and slash in name
2020-03-11 14:16:29 +03:00
d3cb0b517a
Add format support
2020-03-11 02:27:31 +03:00
ad86cf1fd9
Merge remote-tracking branch 'upstream/master'
2020-03-11 00:29:07 +03:00
e1e7efc96e
Merge branch 'master' into powerdnsplugin_01
2020-03-05 15:25:40 -08:00
771e72187a
updates based on feedback
2020-03-05 15:24:56 -08:00
5dfb6acb17
adding support for ACME_POWERDNS_VERIFY option to support CA Bundles and disabling Server validation
2020-03-05 14:59:21 -08:00
4a4b3b932e
Merge branch 'master' into master
2020-03-04 10:32:10 -08:00
1e81d47793
Merge branch 'renewal_validity_01' of github.com:Netflix/lemur into renewal_validity_01
2020-03-03 17:28:58 -08:00
fdc1e20c23
updating config_mock defaults
2020-03-03 17:27:15 -08:00
38b7d6e5e3
Merge branch 'master' into renewal_validity_01
2020-03-03 14:44:33 -08:00
6c46481ffd
simplifying return statement for validity years
2020-03-03 14:40:50 -08:00
318292704d
fixing default/max DigiCert validity values
2020-03-03 14:29:17 -08:00
fe67ff2146
Update plugin.py
...
Fix lint
2020-03-02 09:18:02 +03:00
a8c0adaa4d
Merge remote-tracking branch 'upstream/master'
2020-02-27 17:08:35 +03:00
9612d291ed
Add path suffix options
2020-02-18 19:16:27 +03:00
2ee60bcdb6
Merge branch 'master' into le_Log_orderurl
2020-02-17 10:30:58 -08:00
e75df1ddc9
Update plugin.py
2020-02-17 19:04:20 +01:00
d29edabefe
Merge branch 'master' into le_Log_orderurl
2020-02-17 09:24:51 -08:00
ed3472d029
Update plugin.py
2020-02-17 15:21:29 +01:00
3fd0d3e141
Added VERISIGN_INTERMEDIATE_<authority> parameter
...
When using the VERISIGN_PRODUCT_<authority> Parameter one also has to add this parameter:
VERISIGN_INTERMEDIATE_<authority> = """ <PEM-String of Issuing CA for this certificate Type>"""
While doing this, I also added code, so the external_id field is filled with data from CA-Answer
2020-02-17 12:40:36 +01:00
1815c89970
Made the change more elegant
...
As suggested by @hosseinsh. This is of course more elegant.
2020-02-16 09:28:52 +01:00
a70a49e4e9
Update plugin.py
2020-02-15 16:11:58 +01:00
3693bc2d8b
removed whitespaces inserted by online editor
2020-02-15 16:09:25 +01:00
bfa953270d
Fixed whitespace error
2020-02-15 16:04:44 +01:00
fabcad1e46
New variable VERISIGN_PRODUCT_(authority.name)
...
If there is a config variable with VERISIGN_PRODUCT_<upper(authority.name)> take the value as Cert product-type
else default to "Server", to be compatoible with former versions.
This enables the use of different Verisign authorities for differnt cert-products eg. EV or Standard Certs
2020-02-15 15:52:24 +01:00
a8e8924e2a
Merge branch 'master' into le_Log_orderurl
2020-02-14 17:10:38 -08:00
8e3cc93d6a
Whitespaces in empty line 113 removed
2020-02-14 07:50:18 +01:00
b521aaf579
Merge branch 'master' into le_Log_orderurl
2020-02-13 16:41:14 -08:00
af21225918
adding logging on sucess and metric submission of URL for certificate issuance
2020-02-13 16:38:33 -08:00
2b849a6520
Update plugin.py
...
making lint happy
2020-02-13 15:58:07 -08:00
9db1ea3307
Merge branch 'master' into master
2020-02-13 12:47:06 -08:00
571c8bf42d
Error when validity_end date is empty #2905
...
this lines of code (114ff) in threw an error, when the validity_end date was empty:
if options.get("validity_end") > arrow.utcnow().shift(years=2):
raise Exception(
"Verisign issued certificates cannot exceed two years in validity"
)
Actually, they are not needed, because immidiately following is a check for an empty validity_end and for the length of the entered period.
When I commented it out for testing, the error was gone and everything worked as expected.
2020-02-13 07:38:04 +01:00
6c7bb5f9b7
Fixed TLS secret format ( #2913 )
...
The Plugin handled the TLS secret format wrong: it sent chain certificate instead of requested public certificate #2913
2020-02-13 07:35:35 +01:00
ca8e73286f
fixed get_domains() to remove duplicate entries, updated usage and tests
2020-02-12 15:10:24 -08:00
b23ae60847
Merge branch 'master' into vault-k8s-auth
2020-02-10 11:12:52 -08:00
bcdb3173bd
ensuring that "3" is set as an integer instead of a string
2020-02-04 18:23:17 -08:00
8ea54d7db2
removing exception if domain zone not found. Logging the issue instead
2020-02-04 14:50:56 -08:00
48bccd6f68
moving _check_config() lower in file, near other private methods
2020-02-03 19:08:28 -08:00
c38e651eb0
Merge branch 'powerdnsplugin_01' of github.com:Netflix/lemur into powerdnsplugin_01
2020-02-03 19:04:05 -08:00
53f81fb09f
updating based on suggestions in 2911
2020-02-03 18:58:31 -08:00
ac0282529e
adding basic logging on success
2020-02-03 11:05:20 -08:00
fecb5b6252
Merge branch 'master' into powerdnsplugin_01
2020-01-31 16:37:57 -08:00
be7736d350
adding dns tests and assorted exception handling
2020-01-31 13:16:37 -08:00
969a7107fe
fixed PowerDNS Tests
2020-01-29 13:12:09 -08:00
ef115ef2b1
moving PowerDNS number_of_attempts to global config variable ACME_POWERDNS_RETRIES
2020-01-29 11:20:39 -08:00
b91899fe99
created CLI options for testin ACME over dns. Examle: `acme dnstest -d _acme-chall.foo.com -t token1`
2020-01-28 19:13:28 -08:00
620f972635
Fixed an error
...
Found out that I introduced an error when I changed code up for publishig. The certserv.py I use does not return the ID of the certificate created. For now I just leave the field empty. I will create another issue , so that the ID is filled up.
2020-01-27 11:04:49 +01:00
c465062673
integrated PowerDNS plugin into dns_providers
2020-01-23 23:53:38 -08:00
bddae6e428
adding PowerDNS delete_txt_record with associated tests
2020-01-22 16:18:52 -08:00
52c7686d58
adding wait_for_dns_change() and tests for PowerDNS ACME plugin
2020-01-21 18:47:21 -08:00
915ec0ba63
added PowerDNS support for create_txt_record and associated tests
2020-01-21 17:08:59 -08:00
acf531ece3
Merge branch 'master' into vault-k8s-auth
2020-01-20 15:18:29 -08:00
3080a9527c
adding PowerDNS get_zones functionality and unit tests
2020-01-17 18:29:37 -08:00
Mathias Petermann
csine-nflx
Hossein Shafagh
Jasmine Schladen
sayali
sirferl
sirferl
Raul Benencia
Javier Ramos
Curtis Castrapel
Curtis
Chad S
Ilya Makarov
Ilya Makarov
e11it
Hossein Shafagh