netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2486 from fraenki/acme_300

Browse Source 
security/acme-client: release 3.0
This commit is contained in:
Frank Wall
2021-08-08 18:56:04 +02:00
committed by GitHub
parent c149e55aa6 fe092d785f
commit 3ddcb8fa3a
35 changed files with 424 additions and 156 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/acme-client/Makefile
+2 -2
View File
@@ -1,6 +1,6 @@
PLUGIN_NAME= acme-client
PLUGIN_VERSION= 2.6
PLUGIN_COMMENT= Let's Encrypt client
PLUGIN_VERSION= 3.0
PLUGIN_COMMENT= ACME Client
PLUGIN_MAINTAINER= opnsense@moov.de
PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon
security/acme-client/pkg-descr
+24
View File
@@ -8,6 +8,30 @@ WWW: https://github.com/acmesh-official/acme.sh
Plugin Changelog
================
3.0
Added:
* add support for new ACME CAs: buypass, buypass_test, sslcom, zerossl (#2361)
* add CA setting to accounts, make it possible to use multiple CAs
* add introduction pages and an option to hide them
* add tooltips for account command buttons (#2188)
* add support for custom ACME EAB kid/hmac when registering accounts
Fixed:
* properly set/get the UUID of LE objects
Changed:
* rename plugin from "Let's Encrypt client" to "ACME Client" (#2361)
* change the suffix for imports to the certificate storage to "ACME Client" (#2361)
* rename "Let's Encrypt Environment" to "ACME CA" and move to account settings (#2361)
* preserve old LE accounts/certs by adding a compatibility layer (#2361)
* update tooltip style for 21.7 (#2188)
* show more options in list view for challenge types and automations
Removed:
* remove the legacy log file and only rely on syslog logging (#2366)
* remove obsolete account parameters: certificateAuthority, lastUpdate
2.6
Added:
security/acme-client/src/etc/inc/plugins.inc.d/acmeclient.inc
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -58,7 +58,7 @@ function acmeclient_services()
}
$services[] = array(
'description' => gettext('Let\'s Encrypt client'),
'description' => gettext('ACME client'),
'pidfile' => '/var/run/lighttpd-acme-challenge.pid',
'configd' => array(
'restart' => array('acme-http-challenge restart'),
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/AccountsController.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -41,6 +41,9 @@ class AccountsController extends \OPNsense\Base\IndexController
{
// include form definitions
$this->view->formDialogAccount = $this->getForm("dialogAccount");
// set additional view parameters
$mdlAcme = new \OPNsense\AcmeClient\AcmeClient();
$this->view->showIntro = (string)$mdlAcme ->settings->showIntro;
// choose template
$this->view->pick('OPNsense/AcmeClient/accounts');
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/ActionsController.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -41,6 +41,9 @@ class ActionsController extends \OPNsense\Base\IndexController
{
// include form definitions
$this->view->formDialogAction = $this->getForm("dialogAction");
// set additional view parameters
$mdlAcme = new \OPNsense\AcmeClient\AcmeClient();
$this->view->showIntro = (string)$mdlAcme ->settings->showIntro;
// choose template
$this->view->pick('OPNsense/AcmeClient/actions');
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ActionsController.php
+1 -1
View File
@@ -72,7 +72,7 @@ class ActionsController extends ApiMutableModelControllerBase
public function searchAction()
{
return $this->searchBase('actions.action', array('enabled', 'name', 'description'), 'name');
return $this->searchBase('actions.action', array('enabled', 'name', 'type', 'description'), 'name');
}
public function sftpGetIdentityAction()
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/SettingsController.php
+5 -5
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -263,7 +263,7 @@ class SettingsController extends ApiMutableModelControllerBase
// Add a new HAProxy ACL
$acl_uuid = $mdlHAProxy->newAcl(
"find_acme_challenge",
"Added by Let's Encrypt plugin",
"Added by ACME Client plugin",
"path_beg",
"0",
array("path_beg" => "/.well-known/acme-challenge/")
@@ -273,7 +273,7 @@ class SettingsController extends ApiMutableModelControllerBase
$backend_uuid = $mdlHAProxy->newBackend(
"1",
"acme_challenge_backend",
"Added by Let's Encrypt plugin",
"Added by ACME Client plugin",
"http",
"source",
"",
@@ -283,7 +283,7 @@ class SettingsController extends ApiMutableModelControllerBase
// Add a new HAProxy action
$action_uuid = $mdlHAProxy->newAction(
"redirect_acme_challenges",
"Added by Let's Encrypt plugin",
"Added by ACME Client plugin",
"if",
"",
"and",
@@ -298,7 +298,7 @@ class SettingsController extends ApiMutableModelControllerBase
// Add a new HAProxy server
$server_uuid = $mdlHAProxy->newServer(
"acme_challenge_host",
"Added by Let's Encrypt plugin",
"Added by ACME Client plugin",
"127.0.0.1",
$acme_port,
"active",
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/Api/ValidationsController.php
+1 -1
View File
@@ -73,6 +73,6 @@ class ValidationsController extends ApiMutableModelControllerBase
public function searchAction()
{
return $this->searchBase('validations.validation', array('enabled', 'name', 'description'), 'name');
return $this->searchBase('validations.validation', array('enabled', 'name', 'method', 'description'), 'name');
}
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/CertificatesController.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -41,6 +41,9 @@ class CertificatesController extends \OPNsense\Base\IndexController
{
// include form definitions
$this->view->formDialogCertificate = $this->getForm("dialogCertificate");
// set additional view parameters
$mdlAcme = new \OPNsense\AcmeClient\AcmeClient();
$this->view->showIntro = (string)$mdlAcme ->settings->showIntro;
// choose template
$this->view->pick('OPNsense/AcmeClient/certificates');
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/IndexController.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -45,6 +45,9 @@ class IndexController extends \OPNsense\Base\IndexController
{
// include form definitions
$this->view->settingsForm = $this->getForm("settings");
// set additional view parameters
$mdlAcme = new \OPNsense\AcmeClient\AcmeClient();
$this->view->showIntro = (string)$mdlAcme ->settings->showIntro;
// pick the template to serve
$this->view->pick('OPNsense/AcmeClient/settings');
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/ValidationsController.php
+4 -1
View File
@@ -1,7 +1,7 @@
<?php
/**
* Copyright (C) 2017 Frank Wall
* Copyright (C) 2017-2021 Frank Wall
* Copyright (C) 2015 Deciso B.V.
*
* All rights reserved.
@@ -41,6 +41,9 @@ class ValidationsController extends \OPNsense\Base\IndexController
{
// include form definitions
$this->view->formDialogValidation = $this->getForm("dialogValidation");
// set additional view parameters
$mdlAcme = new \OPNsense\AcmeClient\AcmeClient();
$this->view->showIntro = (string)$mdlAcme ->settings->showIntro;
// choose template
$this->view->pick('OPNsense/AcmeClient/validations');
}
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogAccount.xml
+23 -4
View File
@@ -17,6 +17,10 @@
<type>text</type>
<help>Description for this account.</help>
</field>
<field>
<label>NOTE: Settings below must not be changed after account registration.</label>
<type>header</type>
</field>
<field>
<id>account.email</id>
<label>E-Mail Address</label>
@@ -24,10 +28,25 @@
<help>Optional e-mail address for this account.</help>
</field>
<field>
<id>account.certificateAuthority</id>
<label>Certificate Authority</label>
<id>account.ca</id>
<label>ACME CA</label>
<type>dropdown</type>
<help><![CDATA[Select the certificate authority for this account.]]></help>
<advanced>true</advanced>
<help><![CDATA[The ACME CA that should be used for this account and all associated certificates. Note that some of them offer paid services and may require a subscription. Check the <a href="https://github.com/acmesh-official/acme.sh/wiki/Server" target="_blank">acme.sh documentation</a> for a list of supported CAs.]]></help>
</field>
<field>
<label>Optional EAB Credentials</label>
<type>header</type>
</field>
<field>
<id>account.eab_kid</id>
<label>Key Identifier</label>
<type>text</type>
<help><![CDATA[An optional value provided by the CA when using ACME External Account Binding (EAB).]]></help>
</field>
<field>
<id>account.eab_hmac</id>
<label>HMAC Key</label>
<type>password</type>
<help><![CDATA[An optional value provided by the CA when using ACME External Account Binding (EAB).]]></help>
</field>
</form>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
+4 -4
View File
@@ -27,24 +27,24 @@
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help><![CDATA[Configure additional names that should be part of the certificate, i.e. www.example.com or mail.example.com. Use TAB key to complete typing a FQDN.<br/><div class="text-info"><b>NOTE:</b>You need to forcefully re-issue the certificate if you change "Alt Names" after the certificate was signed by the Let's Encrypt Authority! Use the "issue" button in the Commands column in this case.</div>]]></help>
<help><![CDATA[Configure additional names that should be part of the certificate, i.e. www.example.com or mail.example.com. Use TAB key to complete typing a FQDN.<br/><div class="text-info"><b>NOTE:</b>You need to forcefully re-issue the certificate if you change "Alt Names" after the certificate was signed by the ACME CA! Use the "issue" button in the Commands column in this case.</div>]]></help>
<hint>Enter FQDN here. Finish with TAB.</hint>
</field>
<field>
<label>Let's Encrypt Settings</label>
<label>ACME CA Settings</label>
<type>header</type>
</field>
<field>
<id>certificate.account</id>
<label>LE Account</label>
<type>dropdown</type>
<help><![CDATA[Set the Let's Encrypt account to use for this certificate.]]></help>
<help><![CDATA[Set the ACME CA account to use for this certificate.]]></help>
</field>
<field>
<id>certificate.validationMethod</id>
<label>Challenge Type</label>
<type>dropdown</type>
<help><![CDATA[Set the Let's Encrypt challenge type for this certificate.]]></help>
<help><![CDATA[Set the ACME challenge type for this certificate.]]></help>
</field>
<field>
<id>certificate.autoRenewal</id>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+3 -3
View File
@@ -21,7 +21,7 @@
<id>validation.method</id>
<label>Challenge Type</label>
<type>dropdown</type>
<help>Set the Let's Encrypt challenge type. You'll have to add configuration for the selected challenge type below.</help>
<help>Set the ACME challenge type. You'll have to add configuration for the selected challenge type below.</help>
</field>
<field>
<label>HTTP-01</label>
@@ -48,7 +48,7 @@
<id>validation.http_opn_interface</id>
<label>Interface</label>
<type>dropdown</type>
<help><![CDATA[The FQDN's used in your certificate must currently point to an official IP address. Choose the interface where this IP address is currently configured. OPNsense will automatically create a temporary port forward to allow the Let's Encrypt validation to succeed. This will lead to a short downtime of the service that is normally used with this IP address.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
<help><![CDATA[The FQDN's used in your certificate must currently point to an official IP address. Choose the interface where this IP address is currently configured. OPNsense will automatically create a temporary port forward to allow the ACME validation to succeed. This will lead to a short downtime of the service that is normally used with this IP address.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
</field>
<field>
<id>validation.http_opn_ipaddresses</id>
@@ -56,7 +56,7 @@
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help><![CDATA[The FQDN's used in your certificate must currently point to one or more official IP addresses. Enter the all of these IP addresses here. OPNsense will automatically create a temporary port forward to allow the Let's Encrypt validation to succeed. This will lead to a short downtime of the service that is normally used with these IP addresses.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
<help><![CDATA[The FQDN's used in your certificate must currently point to one or more official IP addresses. Enter the all of these IP addresses here. OPNsense will automatically create a temporary port forward to allow the ACME validation to succeed. This will lead to a short downtime of the service that is normally used with these IP addresses.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
<hint>Enter IP addresses here. Finish each with TAB.</hint>
</field>
<field>
security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/settings.xml
+8 -8
View File
@@ -3,7 +3,7 @@
<id>acmeclient.settings.enabled</id>
<label>Enable Plugin</label>
<type>checkbox</type>
<help><![CDATA[Enable Let's Encrypt plugin.]]></help>
<help><![CDATA[Enable ACME client plugin.]]></help>
</field>
<field>
<id>acmeclient.settings.autoRenewal</id>
@@ -11,12 +11,6 @@
<type>checkbox</type>
<help><![CDATA[Enable automatic renewal for certificates to prevent expiration. This will add a cron job to the system. You may want to customize the cron job schedule to your needs, because re-issueing a certificate may lead to a short downtime, depending on the selected challenge type and service.]]></help>
</field>
<field>
<id>acmeclient.settings.environment</id>
<label>Let's Encrypt Environment</label>
<type>dropdown</type>
<help><![CDATA[Choose Let's Encrypts staging environment when using it for the first time or while testing new challenge types. The staging environment offers <a href="https://letsencrypt.org/docs/staging-environment/">relaxed rate limits</a>.<br/><div class="text-info"><b>NOTE:</b>Certificates signed by the staging environment are NOT valid. You need to forcefully re-sign (or delete and re-create) them after switching from staging to production environment.</div>]]></help>
</field>
<field>
<id>acmeclient.settings.haproxyIntegration</id>
<label>HAProxy Integration</label>
@@ -29,11 +23,17 @@
<type>dropdown</type>
<help><![CDATA[Specifies the log level for acme.sh, default is "normal". All other log levels add information for debug purposes, but be aware that this will break the log formatting in the GUI. Levels "debug 2" and "debug 3" log successively deeper log messages from the acme.sh including messages from DNS-01 DNSAPI scripts.]]></help>
</field>
<field>
<id>acmeclient.settings.showIntro</id>
<label>Show introduction pages</label>
<type>checkbox</type>
<help><![CDATA[Uncheck to hide all introduction pages.]]></help>
</field>
<field>
<id>acmeclient.settings.challengePort</id>
<label>Local HTTP Port</label>
<type>text</type>
<help><![CDATA[When using HTTP-01 as challenge type, a local webserver is used to provide acme challenge data to the Let's Encrypt servers. The local webserver is NOT directly exposed to the outside and should NOT use port 80 or any other well-known port. This setting allows you to change the local port of this webserver in case it interferes with another local service. Defaults to port 43580.]]></help>
<help><![CDATA[When using HTTP-01 as challenge type, a local webserver is used to provide acme challenge data to the ACME CA. The local webserver is NOT directly exposed to the outside and should NOT use port 80 or any other well-known port. This setting allows you to change the local port of this webserver in case it interferes with another local service. Defaults to port 43580.]]></help>
<advanced>true</advanced>
</field>
<field>
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php
+14 -7
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -31,7 +31,7 @@ namespace OPNsense\AcmeClient;
use OPNsense\Core\Config;
/**
* Manage Let's Encrypt accounts with acme.sh
* Manage ACME CA accounts with acme.sh
* @package OPNsense\AcmeClient
*/
class LeAccount extends LeCommon
@@ -53,8 +53,8 @@ class LeAccount extends LeCommon
// Set log level
$this->setLoglevel();
// Set Let's Encrypt environment
$this->setEnvironment();
// Set ACME CA
$this->setCa($uuid);
// Store acme filenames
$this->acme_args[] = LeUtils::execSafe('--home %s', self::ACME_HOME_DIR);
@@ -66,14 +66,14 @@ class LeAccount extends LeCommon
public function generateKey()
{
// Collect account information
$account_conf_dir = self::ACME_BASE_ACCOUNT_DIR . '/' . (string)$this->config->id . '_' . $this->environment;
$account_conf_dir = self::ACME_BASE_ACCOUNT_DIR . '/' . (string)$this->config->id . '_' . $this->ca_compat;
$account_conf_file = $account_conf_dir . '/account.conf';
$account_key_file = $account_conf_dir . '/account.key';
$account_json_file = $account_conf_dir . '/account.json';
$account_ca_file = $account_conf_dir . '/ca.conf';
$acme_conf = array();
$acme_conf[] = "CERT_HOME='" . self::ACME_HOME_DIR . "'";
$acme_conf[] = "LOG_FILE='" . self::ACME_LOG_FILE . "'";
$acme_conf[] = "SYS_LOG='" . $this->acme_syslog . "'";
$acme_conf[] = "ACCOUNT_KEY_PATH='" . $account_key_file . "'";
$acme_conf[] = "ACCOUNT_JSON_PATH='" . $account_json_file . "'";
$acme_conf[] = "CA_CONF='" . $account_ca_file . "'";
@@ -192,7 +192,7 @@ class LeAccount extends LeCommon
}
/**
* register account with Let's Encrypt
* register account with configured ACME CA
* @return bool
*/
public function register()
@@ -212,6 +212,13 @@ class LeAccount extends LeCommon
if (!($this->isRegistered())) {
LeUtils::log_debug('starting account registration for ' . (string)$this->config->name, $this->debug);
// Check if ACME External Account Binding (EAB) is enabled
if (!empty((string)$this->config->eab_kid) && !empty((string)$this->config->eab_hmac)) {
LeUtils::log_debug('enabling ACME EAB for this account', $this->debug);
$this->acme_args[] = LeUtils::execSafe('--eab-kid %s', $this->config->eab_kid);
$this->acme_args[] = LeUtils::execSafe('--eab-hmac-key %s', $this->config->eab_hmac);
}
// Preparation to run acme client
$proc_env = $this->acme_env; // env variables for proc_open()
$proc_env['PATH'] = $this::ACME_ENV_PATH;
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php
+3 -3
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2018 Deciso B.V.
* Copyright (C) 2018 Franco Fichtner <franco@opnsense.org>
* All rights reserved.
@@ -63,8 +63,8 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
// Set log level
$this->setLoglevel();
// Set Let's Encrypt environment
$this->setEnvironment();
// Set ACME CA
$this->setCa($accountuuid);
return true;
}
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomationInterface.php
+2 -2
View File
@@ -1,7 +1,7 @@
<?php
/*
* Copyright (C) 2020 Frank Wall
* Copyright (C) 2020-2021 Frank Wall
* Copyright (C) 2018 Deciso B.V.
* All rights reserved.
*
@@ -30,7 +30,7 @@
namespace OPNsense\AcmeClient;
/**
* Interface for Let's Encrypt automations
* Interface for ACME Client automations
* @package OPNsense\AcmeClient
*/
interface LeAutomationInterface
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php
+10 -9
View File
@@ -37,7 +37,7 @@ use OPNsense\AcmeClient\LeAutomationFactory;
use OPNsense\AcmeClient\LeValidationFactory;
/**
* Manage Let's Encrypt certificates with acme.sh
* Manage ACME certificates with acme.sh
* @package OPNsense\AcmeClient
*/
class LeCertificate extends LeCommon
@@ -74,8 +74,8 @@ class LeCertificate extends LeCommon
// Set log level
$this->setLoglevel();
// Set Let's Encrypt environment
$this->setEnvironment();
// Set ACME CA
$this->setCa((string)$this->config->account);
// Handle special key types
if ($this->config->keyLength == 'key_ec256' || $this->config->keyLength == 'key_ec384') {
@@ -169,7 +169,7 @@ class LeCertificate extends LeCommon
// Collect required CA information
$ca_cn = LeUtils::local_cert_get_cn($ca_content, false);
$ca['descr'] = (string)$ca_cn . ' (Let\'s Encrypt)';
$ca['descr'] = (string)$ca_cn . ' (ACME Client)';
// Prepare CA for import
LeUtils::local_ca_import($ca, $ca_content);
@@ -186,7 +186,7 @@ class LeCertificate extends LeCommon
}
} else {
// Create new CA
LeUtils::log("importing Let's Encrypt CA: ${ca_cn}");
LeUtils::log("importing ACME CA: ${ca_cn}");
$newca = Config::getInstance()->object()->addChild('ca');
foreach (array_keys($ca) as $cacfg) {
$newca->addChild($cacfg, (string)$ca[$cacfg]);
@@ -251,7 +251,7 @@ class LeCertificate extends LeCommon
// Collect required cert information
$cert_cn = LeUtils::local_cert_get_cn($cert_content, false);
$cert['descr'] = (string)$cert_cn . ' (Let\'s Encrypt)';
$cert['descr'] = (string)$cert_cn . ' (ACME Client)';
$cert['refid'] = $cert_refid;
// Prepare certificate for import
@@ -277,7 +277,7 @@ class LeCertificate extends LeCommon
$newcert->addChild($certcfg, (string)$cert[$certcfg]);
}
}
LeUtils::log("${import_log_message} Let's Encrypt X.509 certificate: ${cert_cn}");
LeUtils::log("${import_log_message} ACME X.509 certificate: ${cert_cn}");
/**
* Step 3: update configuration
@@ -300,7 +300,7 @@ class LeCertificate extends LeCommon
}
/**
* check if certificate is already issued by Let's Encrypt
* check if certificate is already issued by ACME CA
* @return bool
*/
public function isIssued()
@@ -351,6 +351,7 @@ class LeCertificate extends LeCommon
return false;
}
LeUtils::log("${acme_action} certificate: " . (string)$this->config->name);
LeUtils::log('using CA: ' . $this->ca);
// Ensure that account is registered.
if (!($this->setAccount())) {
@@ -528,7 +529,7 @@ class LeCertificate extends LeCommon
LeUtils::log('revoking certificate: ' . (string)$this->config->name);
// Collect account information
$account_conf_dir = self::ACME_BASE_ACCOUNT_DIR . '/' . $this->account_id . '_' . $this->environment;
$account_conf_dir = self::ACME_BASE_ACCOUNT_DIR . '/' . $this->account_id . '_' . $this->ca_compat;
$account_conf_file = $account_conf_dir . '/account.conf';
// Preparation to run acme client
security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php
+44 -13
View File
@@ -32,7 +32,7 @@ use OPNsense\Core\Config;
use OPNsense\AcmeClient\LeUtils;
/**
* Common constants and functions for all Let's Encrypt classes
* Common constants and functions for all ACME classes
* @package OPNsense\AcmeClient
*/
abstract class LeCommon
@@ -42,7 +42,6 @@ abstract class LeCommon
public const ACME_BASE_CERT_DIR = '/var/etc/acme-client/certs';
public const ACME_BASE_CONFIG_DIR = '/var/etc/acme-client/configs';
public const ACME_HOME_DIR = '/var/etc/acme-client/home';
public const ACME_LOG_FILE = '/var/log/acme.sh.log';
// Defaults for acme.sh
public const ACME_ACCOUNT_KEY_LENGTH = 4096;
@@ -61,6 +60,7 @@ abstract class LeCommon
protected $acme_args = array(); # command line arguments to be passed to acme.sh
protected $acme_env = array(); # environment variables to be used when running acme.sh
protected $acme_keylength; # private key length in acme.sh compatible format
protected $acme_syslog; # syslog log level
// Certificate details and configuration
protected $cert_id; # AcmeClient certificate object ID
@@ -83,7 +83,8 @@ abstract class LeCommon
protected $cron; # Run from cron job
protected $config; # AcmeClient config object
protected $debug; # Debug logging (bool)
protected $environment; # Let's Encrypt environment (uses shortnames)
protected $ca; # ACME CA
protected $ca_compat; # ACME CA for compat with old LE CA names
protected $force; # Force operation
protected $model; # AcmeClient model object
protected $uuid; # AcmeClient config object uuid
@@ -104,7 +105,7 @@ abstract class LeCommon
*/
public function getUuid()
{
return (string)$this->config->uuid;
return (string)$this->uuid;
}
/**
@@ -123,6 +124,7 @@ abstract class LeCommon
// Store config objects
$this->config = $obj;
$this->model = $model;
$this->uuid = $uuid;
return true;
}
@@ -136,12 +138,41 @@ abstract class LeCommon
}
/**
* set Let's Encrypt environment for acme.sh
* set ACME CA for acme.sh
*/
public function setEnvironment()
public function setCa(string $uuid)
{
$this->environment = (string)$this->model->getNodeByReference('settings.environment');
$this->acme_args[] = $this->environment == 'stg' ? '--staging' : null;
// Get account config object
$model = new \OPNsense\AcmeClient\AcmeClient();
$obj = $model->getNodeByReference("accounts.account.${uuid}");
if (empty($obj) || $obj == null) {
LeUtils::log_error("unable to set CA, account not found: ${uuid}");
return false;
}
// Extract ACME CA from account config
$acme_ca = (string)$obj->ca;
$this->ca = $acme_ca;
// Add CA to acme arguments
$this->acme_args[] = LeUtils::execSafe('--server %s', $acme_ca);
// Evaluate how the CA should be represented in filenames.
// This is a compatibility layer. It ensures that old files that
// were generated for the Let's Encrypt Production/Staging CA
// can still be used.
switch ($acme_ca) {
case 'letsencrypt':
$ca_compat = 'prod';
break;
case 'letsencrypt_test':
$ca_compat = 'stg';
break;
default:
$ca_compat = $acme_ca;
break;
}
$this->ca_compat = $ca_compat;
}
/**
@@ -155,34 +186,34 @@ abstract class LeCommon
case 'extended':
$this->acme_args[] = '--syslog 6';
$this->acme_args[] = '--log-level 2';
$this->acme_syslog = 6;
$this->debug = false;
break;
case 'debug':
$this->acme_args[] = '--syslog 7';
$this->acme_args[] = '--debug';
$this->acme_syslog = 7;
$this->debug = true;
break;
case 'debug2':
$this->acme_args[] = '--syslog 7';
$this->acme_args[] = '--debug 2';
$this->acme_syslog = 7;
$this->debug = true;
break;
case 'debug3':
$this->acme_args[] = '--syslog 7';
$this->acme_args[] = '--debug 3';
$this->acme_syslog = 7;
$this->debug = true;
break;
default:
$this->acme_args[] = '--syslog 6';
$this->acme_args[] = '--log-level 1';
$this->acme_syslog = 6;
$this->debug = false;
break;
}
// Set log file
// NOTE: This log file is no longer exposed to the GUI. However, it may
// still turn out to be useful for debug purposes in rare egde cases.
$this->acme_args[] = LeUtils::execSafe('--log %s', self::ACME_LOG_FILE);
}
/**

Some files were not shown because too many files have changed in this diff Show More