security/acme-client: fix account config, closes #4622

security/acme-client/pkg-descr

@@ -15,9 +15,11 @@ Added:
 * add support for Websupport.sk DNS API (#4540)
 
 Changed:
+* automatically fix account config if CERT_HOME is set (#4622)
 * automatically resolve cron job mismatch (#4627)
 
 Fixed:
+* deploy hooks may use the old CERT_HOME (#4622)
 * acme.sh is always called with "--days 1" (#4711)
 * avoid startup error: "rmdir... Not a directory" (#4743)
 * fails to create/update cron job on UUID mismatch (#4627)

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAccount.php

@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2020-2024 Frank Wall
+ * Copyright (C) 2020-2025 Frank Wall
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -224,9 +224,6 @@ class LeAccount extends LeCommon
                 return false;
             }
 
-            // Fix account config
-            $this->fixConfig();
-
             // Update account status.
             LeUtils::log('account registration successful for ' . $this->config->name);
             $this->setStatus(200);
@@ -234,6 +231,9 @@ class LeAccount extends LeCommon
             LeUtils::log_debug('account already registered: ' . (string)$this->config->name, $this->debug);
         }
 
+        // Always check (and fix) account config
+        $this->fixConfig();
+
         return true;
     }
 
@@ -251,18 +251,21 @@ class LeAccount extends LeCommon
                 // Parse config file and remove property
                 $account_conf = parse_ini_file($account_conf_file);
                 if (isset($account_conf['CERT_HOME'])) {
+                    LeUtils::log('fixing invalid account config (CERT_HOME): ' . $this->config->name);
                     unset($account_conf['CERT_HOME']);
-                }
 
-                // Convert array back to ini file format
-                $new_account_conf = array();
-                foreach ($account_conf as $key => $value) {
-                    $new_account_conf[] = "{$key}='{$value}'";
-                }
+                    // Convert array back to ini file format
+                    $new_account_conf = array();
+                    foreach ($account_conf as $key => $value) {
+                        $new_account_conf[] = "{$key}='{$value}'";
+                    }
 
-                // Write changes back to file
-                file_put_contents($account_conf_file, implode("\n", $new_account_conf) . "\n");
-                chmod($account_conf_file, 0600);
+                    // Write changes back to file
+                    file_put_contents($account_conf_file, implode("\n", $new_account_conf) . "\n");
+                    chmod($account_conf_file, 0600);
+                } else {
+                    LeUtils::log('account config is valid (CERT_HOME): ' . $this->config->name);
+                }
             }
         }
     }

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php

@@ -618,6 +618,8 @@ class LeCertificate extends LeCommon
             $this->loadConfig(self::CONFIG_PATH, $this->uuid);
         }
         LeUtils::log('account is registered: ' . (string)$account->config->name);
+        // Always check (and fix) account config
+        $account->fixConfig();
         return true;
     }