security/acme-client: fix ecc cert handling in automations, closes #2723

security/acme-client/pkg-descr

@@ -18,6 +18,7 @@ Added:
 
 Fixed:
 * fix calculation of renewal date (#2721)
+* properly handle ecc certs in automations (#2723)
 
 Changed:
 * show CA in accounts list

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php

@@ -47,7 +47,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
      * Initialize LeAutomation object by adding the required configuration.
      * @return boolean
      */
-    public function init(string $certid, string $certname, string $accountuuid)
+    public function init(string $certid, string $certname, string $accountuuid, bool $certecc = false)
     {
         // Get config object
         $this->loadConfig(self::CONFIG_PATH, $this->uuid);
@@ -79,6 +79,13 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
         // Main domain for acme
         $this->acme_args[] = LeUtils::execSafe('--domain %s', $certname);
 
+        // ECC cert
+        $this->cert_ecc = $certecc;
+        if ($this->cert_ecc) {
+            // Pass --ecc to acme client to locate the correct cert directory
+            $this->acme_args[] = '--ecc';
+        }
+
         return true;
     }
 

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php

@@ -81,6 +81,9 @@ class LeCertificate extends LeCommon
         if ($this->config->keyLength == 'key_ec256' || $this->config->keyLength == 'key_ec384') {
             // Pass --ecc to acme client to locate the correct cert directory
             $this->acme_args[] = '--ecc';
+            $this->cert_ecc = true;
+        } else {
+            $this->cert_ecc = false;
         }
 
         // Store cert filenames
@@ -628,7 +631,7 @@ class LeCertificate extends LeCommon
         foreach ($automations as $auto_uuid) {
             $autoFactory = new LeAutomationFactory();
             $automation = $autoFactory->getAutomation($auto_uuid);
-            $automation->init($this->getId(), (string)$this->config->name, (string)$this->config->account);
+            $automation->init($this->getId(), (string)$this->config->name, (string)$this->config->account, $this->cert_ecc);
             // Ignore invalid automations.
             if ($automation->prepare()) {
                 $automation->run();
@@ -677,7 +680,7 @@ class LeCertificate extends LeCommon
                 LeUtils::log_error('invalid challenge type for certificate: ' . (string)$this->config->name);
                 return false;
             }
-            if (!$val->init((string)$this->config->id, (string)$this->config->account)) {
+            if (!$val->init((string)$this->config->id, (string)$this->config->account, $this->cert_ecc)) {
                 LeUtils::log_error('failed to initialize validation for certificate: ' . (string)$this->config->name);
                 return false;
             }

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php

@@ -73,6 +73,7 @@ abstract class LeCommon
     protected $cert_domainalias;    # AcmeClient certificate object domain alias
     protected $cert_challengealias; # AcmeClient certificate object challenge alias
     protected $cert_keylength;      # Private key length
+    protected $cert_ecc;            # ECC cert?
 
     // Account details
     protected $account_id;          # AcmeClient account object ID

security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php

@@ -50,7 +50,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
      * @param $accountuuid string the UUID of the account object
      * @return bool
      */
-    public function init(string $certid, string $accountuuid)
+    public function init(string $certid, string $accountuuid, bool $certecc = false)
     {
         // Get config object
         $this->loadConfig(self::CONFIG_PATH, $this->uuid);
@@ -97,6 +97,9 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
         $this->acme_args[] = LeUtils::execSafe('--capath %s', sprintf(self::ACME_CHAIN_FILE, $this->cert_id));
         $this->acme_args[] = LeUtils::execSafe('--fullchainpath %s', sprintf(self::ACME_FULLCHAIN_FILE, $this->cert_id));
 
+        // ECC cert
+        $this->cert_ecc = $certecc;
+
         return true;
     }
 
@@ -136,8 +139,8 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon
         // Issue or renew
         $acme_action = $renew == true ? 'renew' : 'issue';
 
-        // Handle special key types
-        if ($this->cert_keylength == 'ec256' || $this->cert_keylength == 'ec384') {
+        // Handle ECC certs
+        if ($this->cert_ecc) {
             if ($renew == true) {
                 // If it's a renew then pass --ecc to acme client to locate the correct cert directory
                 $this->acme_args[] = '--ecc';