security/acme-client: add new button to wipe config+data, closes #243

2026-05-22 18:44:07 -07:00 · 2019-01-29 18:59:47 +01:00
parent 34af0c3bec
commit abcd19c64c
3 changed files with 71 additions and 1 deletions
@@ -194,4 +194,31 @@ class ServiceController extends ApiControllerBase
        $response = $backend->configdRun("acmeclient sign-all-certs");
        return array("result" => $response);
    }
+
+    /**
+     * Remove ALL certificate data and configuration and reset ALL states
+     * @return array
+     * @throws \Exception
+     */
+    public function resetAction()
+    {
+        $model = new AcmeClient();
+        // reset certificate states
+        foreach ($model->getNodeByReference('certificates.certificate')->iterateItems() as $cert) {
+            $cert->lastUpdate = null;
+            $cert->statusCode = null;
+            $cert->statusLastUpdate = null;
+        }
+        // reset account states
+        foreach ($model->getNodeByReference('accounts.account')->iterateItems() as $account) {
+            $account->lastUpdate = null;
+        }
+        // reset acme.sh data
+        $backend = new Backend();
+        $response = $backend->configdRun("acmeclient reset-acme-client");
+        // serialize to config and save
+        $model->serializeToConfig();
+        Config::getInstance()->save();
+        return array("result" => $response);
+    }
 }
@@ -1,6 +1,6 @@
 {#

-Copyright (C) 2017 Frank Wall
+Copyright (C) 2017-2019 Frank Wall
 OPNsense® is Copyright © 2014-2015 by Deciso B.V.
 All rights reserved.

@@ -184,6 +184,42 @@ POSSIBILITY OF SUCH DAMAGE.
            });
        });

+        // Reset certificate data (aka wipe everything)
+        $("#resetAct").click(function(){
+
+            // set progress animation
+            $('[id*="resetAct_progress"]').each(function(){
+                $(this).addClass("fa fa-spinner fa-pulse");
+            });
+
+            BootstrapDialog.show({
+                type: BootstrapDialog.TYPE_DANGER,
+                title: "{{ lang._('Wipe all certificate and account data') }}",
+                message: "{{ lang._('This will remove ALL certificates, private keys, CSRs from acme client and reset all certificate and account states. However, existing certificates will remain in OPNsense trust storage. The acme client will automatically regenerate everything on its next scheduled run. This is most useful when importing a config backup to a new firewall. Continue?') }}",
+                buttons: [{
+                    label: '{{ lang._('Continue') }}',
+                    cssClass: 'btn-primary',
+                    action: function(dlg){
+                        ajaxCall(url="/api/acmeclient/service/reset", sendData={}, callback=function(data,status) {
+                        });
+
+                        dlg.close();
+                    }
+                }, {
+                    icon: 'fa fa-trash-o',
+                    label: '{{ lang._('Abort') }}',
+                    action: function(dlg){
+                        dlg.close();
+                    }
+                }]
+            });
+
+            // when done, disable progress animation
+            $('[id*="resetAct_progress"]').each(function(){
+                $(this).removeClass("fa fa-spinner fa-pulse");
+            });
+
+        });
    });

 </script>
@@ -201,6 +237,7 @@ POSSIBILITY OF SUCH DAMAGE.
        <hr/>
        <button class="btn btn-primary" id="reconfigureAct" type="button"><b>{{ lang._('Apply') }}</b><i id="reconfigureAct_progress" class=""></i></button>
        <button class="btn btn-primary" id="configtestAct" type="button"><b>{{ lang._('Test Config') }}</b><i id="configtestAct_progress" class=""></i></button>
+        <button class="btn btn-primary" id="resetAct" type="button"><b>{{ lang._('Reset acme client') }}</b><i id="resetAct_progress" class=""></i></button>
        <br/>
    </div>
    <div class="col-md-12">
@@ -71,3 +71,9 @@ command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/upload_highwinds.php
 parameters:-c %s -a %s
 type:script
 message:uploading a certificate to highwinds
+
+[reset-acme-client]
+command:/usr/bin/find /var/etc/acme-client/home /var/etc/acme-client/configs /var/etc/acme-client/certs /var/etc/acme-client/keys /var/etc/acme-client/accounts -type f -delete
+parameters:
+type:script
+message:wiping acme client config and data