From fc78ebae146e757792316b4853a1fe63c31cef73 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 6 Jan 2022 14:45:47 +0100 Subject: [PATCH] security/acme-client: fix ecc cert handling in automations, closes #2723 --- security/acme-client/pkg-descr | 1 + .../library/OPNsense/AcmeClient/LeAutomation/Base.php | 9 ++++++++- .../app/library/OPNsense/AcmeClient/LeCertificate.php | 7 +++++-- .../mvc/app/library/OPNsense/AcmeClient/LeCommon.php | 1 + .../library/OPNsense/AcmeClient/LeValidation/Base.php | 9 ++++++--- 5 files changed, 21 insertions(+), 6 deletions(-) diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr index d7c904fdb..5b08b3bf0 100644 --- a/security/acme-client/pkg-descr +++ b/security/acme-client/pkg-descr @@ -18,6 +18,7 @@ Added: Fixed: * fix calculation of renewal date (#2721) +* properly handle ecc certs in automations (#2723) Changed: * show CA in accounts list diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php index 175a51e9f..1f11081fa 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeAutomation/Base.php @@ -47,7 +47,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon * Initialize LeAutomation object by adding the required configuration. * @return boolean */ - public function init(string $certid, string $certname, string $accountuuid) + public function init(string $certid, string $certname, string $accountuuid, bool $certecc = false) { // Get config object $this->loadConfig(self::CONFIG_PATH, $this->uuid); @@ -79,6 +79,13 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon // Main domain for acme $this->acme_args[] = LeUtils::execSafe('--domain %s', $certname); + // ECC cert + $this->cert_ecc = $certecc; + if ($this->cert_ecc) { + // Pass --ecc to acme client to locate the correct cert directory + $this->acme_args[] = '--ecc'; + } + return true; } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php index 54e32d960..06e406b57 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php @@ -81,6 +81,9 @@ class LeCertificate extends LeCommon if ($this->config->keyLength == 'key_ec256' || $this->config->keyLength == 'key_ec384') { // Pass --ecc to acme client to locate the correct cert directory $this->acme_args[] = '--ecc'; + $this->cert_ecc = true; + } else { + $this->cert_ecc = false; } // Store cert filenames @@ -628,7 +631,7 @@ class LeCertificate extends LeCommon foreach ($automations as $auto_uuid) { $autoFactory = new LeAutomationFactory(); $automation = $autoFactory->getAutomation($auto_uuid); - $automation->init($this->getId(), (string)$this->config->name, (string)$this->config->account); + $automation->init($this->getId(), (string)$this->config->name, (string)$this->config->account, $this->cert_ecc); // Ignore invalid automations. if ($automation->prepare()) { $automation->run(); @@ -677,7 +680,7 @@ class LeCertificate extends LeCommon LeUtils::log_error('invalid challenge type for certificate: ' . (string)$this->config->name); return false; } - if (!$val->init((string)$this->config->id, (string)$this->config->account)) { + if (!$val->init((string)$this->config->id, (string)$this->config->account, $this->cert_ecc)) { LeUtils::log_error('failed to initialize validation for certificate: ' . (string)$this->config->name); return false; } diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php index ce1ed6e71..631fab0c4 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCommon.php @@ -73,6 +73,7 @@ abstract class LeCommon protected $cert_domainalias; # AcmeClient certificate object domain alias protected $cert_challengealias; # AcmeClient certificate object challenge alias protected $cert_keylength; # Private key length + protected $cert_ecc; # ECC cert? // Account details protected $account_id; # AcmeClient account object ID diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php index 3c0a6881a..c0289569e 100644 --- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php +++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/Base.php @@ -50,7 +50,7 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon * @param $accountuuid string the UUID of the account object * @return bool */ - public function init(string $certid, string $accountuuid) + public function init(string $certid, string $accountuuid, bool $certecc = false) { // Get config object $this->loadConfig(self::CONFIG_PATH, $this->uuid); @@ -97,6 +97,9 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon $this->acme_args[] = LeUtils::execSafe('--capath %s', sprintf(self::ACME_CHAIN_FILE, $this->cert_id)); $this->acme_args[] = LeUtils::execSafe('--fullchainpath %s', sprintf(self::ACME_FULLCHAIN_FILE, $this->cert_id)); + // ECC cert + $this->cert_ecc = $certecc; + return true; } @@ -136,8 +139,8 @@ abstract class Base extends \OPNsense\AcmeClient\LeCommon // Issue or renew $acme_action = $renew == true ? 'renew' : 'issue'; - // Handle special key types - if ($this->cert_keylength == 'ec256' || $this->cert_keylength == 'ec384') { + // Handle ECC certs + if ($this->cert_ecc) { if ($renew == true) { // If it's a renew then pass --ecc to acme client to locate the correct cert directory $this->acme_args[] = '--ecc';