2016-02-13 00:56:47 +01:00
|
|
|
#!/usr/bin/env python
|
2016-01-10 15:00:43 +01:00
|
|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
|
|
|
# Automated Certificate Manager using ACME
|
2016-04-04 01:17:58 +02:00
|
|
|
# Copyright (c) Markus Hauschild & David Klaftenegger, 2016.
|
2019-01-08 08:12:20 +01:00
|
|
|
# Copyright (c) Rudolf Mayerhofer, 2019.
|
2016-04-04 01:17:58 +02:00
|
|
|
# available under the ISC license, see LICENSE
|
2016-01-10 15:00:43 +01:00
|
|
|
|
2016-01-21 16:43:49 +01:00
|
|
|
import grp
|
2019-02-18 20:45:28 +01:00
|
|
|
import io
|
2016-01-10 15:00:43 +01:00
|
|
|
import os
|
2016-01-21 16:43:49 +01:00
|
|
|
import pwd
|
2016-04-10 02:45:29 +02:00
|
|
|
import stat
|
2019-01-08 08:12:20 +01:00
|
|
|
import subprocess
|
|
|
|
|
2019-02-20 11:49:30 +01:00
|
|
|
from acertmgr import configuration, tools
|
2019-03-28 09:18:28 +01:00
|
|
|
from acertmgr.authority import authority
|
|
|
|
from acertmgr.modes import challenge_handler
|
2019-01-08 08:19:50 +01:00
|
|
|
|
|
|
|
|
2016-01-10 15:43:11 +01:00
|
|
|
# @brief fetch new certificate from letsencrypt
|
2019-01-22 09:05:41 +01:00
|
|
|
# @param settings the domain's configuration options
|
|
|
|
def cert_get(settings):
|
2019-03-28 13:59:44 +01:00
|
|
|
print("Getting certificate for %s" % settings['domainlist'])
|
2019-01-08 08:12:20 +01:00
|
|
|
|
2019-03-28 09:18:28 +01:00
|
|
|
acme = authority(settings['authority'])
|
2019-03-24 17:15:30 +01:00
|
|
|
acme.register_account()
|
2019-01-08 08:12:20 +01:00
|
|
|
|
2019-03-24 17:15:30 +01:00
|
|
|
# create challenge handlers for this certificate
|
2019-01-08 08:19:50 +01:00
|
|
|
challenge_handlers = dict()
|
2019-02-18 20:43:13 +01:00
|
|
|
for domain in settings['domainlist']:
|
2019-01-08 08:19:50 +01:00
|
|
|
# Create the challenge handler
|
2019-03-28 09:18:28 +01:00
|
|
|
challenge_handlers[domain] = challenge_handler(settings['handlers'][domain])
|
2019-01-08 08:12:20 +01:00
|
|
|
|
2019-03-24 17:15:30 +01:00
|
|
|
# create ssl key
|
|
|
|
key_file = settings['key_file']
|
|
|
|
key_length = settings['key_length']
|
|
|
|
if os.path.isfile(key_file):
|
|
|
|
key = tools.read_pem_file(key_file, key=True)
|
|
|
|
else:
|
|
|
|
print("SSL key not found at '{0}'. Creating {1} bit key.".format(key_file, key_length))
|
|
|
|
key = tools.new_ssl_key(key_file, key_length)
|
|
|
|
|
|
|
|
# create ssl csr
|
2019-03-24 17:22:04 +01:00
|
|
|
csr_file = settings['csr_file']
|
|
|
|
if os.path.isfile(csr_file) and str(settings['csr_static']).lower() == 'true':
|
|
|
|
print('Loading CSR from {}'.format(csr_file))
|
|
|
|
cr = tools.read_pem_file(csr_file, csr=True)
|
|
|
|
else:
|
|
|
|
print('Generating CSR for {}'.format(settings['domainlist']))
|
|
|
|
cr = tools.new_cert_request(settings['domainlist'], key)
|
|
|
|
tools.write_pem_file(cr, csr_file)
|
2019-03-24 17:15:30 +01:00
|
|
|
|
|
|
|
# request cert with csr
|
|
|
|
crt, ca = acme.get_crt_from_csr(cr, settings['domainlist'], challenge_handlers)
|
|
|
|
|
|
|
|
# if resulting certificate is valid: store in final location
|
|
|
|
if tools.is_cert_valid(crt, settings['ttl_days']):
|
2019-03-28 00:34:53 +01:00
|
|
|
print("Certificate '{}' renewed and valid until {}".format(crt, crt.not_valid_after))
|
2019-03-24 17:15:30 +01:00
|
|
|
tools.write_pem_file(crt, settings['cert_file'], stat.S_IREAD)
|
2019-03-28 12:33:59 +01:00
|
|
|
if (not str(settings.get('ca_static')).lower() == 'true' or not os.path.exists(settings['ca_file'])) \
|
|
|
|
and ca is not None:
|
2019-03-24 17:15:30 +01:00
|
|
|
tools.write_pem_file(ca, settings['ca_file'])
|
2016-01-10 18:07:00 +01:00
|
|
|
|
2016-01-10 17:29:26 +01:00
|
|
|
|
2016-01-12 17:41:48 +01:00
|
|
|
# @brief put new certificate in place
|
2016-01-10 17:29:26 +01:00
|
|
|
# @param settings the domain's configuration options
|
2016-02-21 11:18:32 +01:00
|
|
|
# @return the action to be executed after the certificate update
|
2019-01-08 08:12:20 +01:00
|
|
|
def cert_put(settings):
|
|
|
|
# TODO error handling
|
2019-01-22 09:05:41 +01:00
|
|
|
ca_file = settings['ca_file']
|
2019-01-08 08:12:20 +01:00
|
|
|
crt_user = settings['user']
|
|
|
|
crt_group = settings['group']
|
|
|
|
crt_perm = settings['perm']
|
|
|
|
crt_path = settings['path']
|
|
|
|
crt_format = settings['format'].split(",")
|
|
|
|
crt_format = [str.strip(x) for x in crt_format]
|
|
|
|
crt_action = settings['action']
|
|
|
|
|
2019-01-22 09:05:41 +01:00
|
|
|
key_file = settings['key_file']
|
|
|
|
crt_final = settings['cert_file']
|
2019-01-08 08:12:20 +01:00
|
|
|
|
2019-01-21 16:18:47 +01:00
|
|
|
with io.open(crt_path, "w+") as crt_fd:
|
2019-01-08 08:12:20 +01:00
|
|
|
for fmt in crt_format:
|
|
|
|
if fmt == "crt":
|
2019-01-21 16:18:47 +01:00
|
|
|
src_fd = io.open(crt_final, "r")
|
2019-01-08 08:12:20 +01:00
|
|
|
crt_fd.write(src_fd.read())
|
|
|
|
src_fd.close()
|
|
|
|
if fmt == "key":
|
2019-01-21 16:18:47 +01:00
|
|
|
src_fd = io.open(key_file, "r")
|
2019-01-08 08:12:20 +01:00
|
|
|
crt_fd.write(src_fd.read())
|
|
|
|
src_fd.close()
|
|
|
|
if fmt == "ca":
|
|
|
|
if not os.path.isfile(ca_file):
|
|
|
|
raise FileNotFoundError("The CA certificate file (%s) is missing!" % ca_file)
|
2019-01-21 16:18:47 +01:00
|
|
|
src_fd = io.open(ca_file, "r")
|
2019-01-08 08:12:20 +01:00
|
|
|
crt_fd.write(src_fd.read())
|
|
|
|
src_fd.close()
|
|
|
|
else:
|
|
|
|
# TODO error handling
|
|
|
|
pass
|
|
|
|
|
|
|
|
# set owner and permissions
|
|
|
|
uid = pwd.getpwnam(crt_user).pw_uid
|
|
|
|
gid = grp.getgrnam(crt_group).gr_gid
|
|
|
|
try:
|
|
|
|
os.chown(crt_path, uid, gid)
|
|
|
|
except OSError:
|
|
|
|
print('Warning: Could not set certificate file ownership!')
|
|
|
|
try:
|
|
|
|
os.chmod(crt_path, int(crt_perm, 8))
|
|
|
|
except OSError:
|
|
|
|
print('Warning: Could not set certificate file permissions!')
|
|
|
|
|
|
|
|
return crt_action
|
2016-01-10 15:00:43 +01:00
|
|
|
|
|
|
|
|
2019-03-27 21:00:21 +01:00
|
|
|
def cert_revoke(cert, configs, reason=None):
|
|
|
|
domains = set(tools.get_cert_domains(cert))
|
|
|
|
for config in configs:
|
|
|
|
if domains == set(config['domainlist']):
|
2019-03-28 09:18:28 +01:00
|
|
|
acme = authority(config['authority'])
|
2019-03-27 21:00:21 +01:00
|
|
|
acme.register_account()
|
|
|
|
acme.revoke_crt(cert, reason)
|
|
|
|
return
|
|
|
|
|
|
|
|
|
2019-02-20 11:49:30 +01:00
|
|
|
def main():
|
2019-01-22 09:05:41 +01:00
|
|
|
# load config
|
2019-03-27 15:17:17 +01:00
|
|
|
runtimeconfig, domainconfigs = configuration.load()
|
2019-03-27 21:00:21 +01:00
|
|
|
if runtimeconfig.get('mode') == 'revoke':
|
|
|
|
# Mode: revoke certificate
|
|
|
|
print("Revoking {}".format(runtimeconfig['revoke']))
|
|
|
|
cert_revoke(tools.read_pem_file(runtimeconfig['revoke']), domainconfigs, runtimeconfig['revoke_reason'])
|
|
|
|
else:
|
|
|
|
# Mode: issue certificates (implicit)
|
|
|
|
# post-update actions (run only once)
|
|
|
|
actions = set()
|
2019-03-28 00:34:53 +01:00
|
|
|
superseded = set()
|
2019-03-28 14:34:06 +01:00
|
|
|
exceptions = list()
|
2019-03-27 21:00:21 +01:00
|
|
|
# check certificate validity and obtain/renew certificates if needed
|
|
|
|
for config in domainconfigs:
|
2019-03-28 14:34:06 +01:00
|
|
|
try:
|
|
|
|
cert = None
|
|
|
|
if os.path.isfile(config['cert_file']):
|
|
|
|
cert = tools.read_pem_file(config['cert_file'])
|
|
|
|
if not cert or not tools.is_cert_valid(cert, config['ttl_days']) or (
|
|
|
|
'force_renew' in runtimeconfig and
|
|
|
|
all(d in config['domainlist'] for d in runtimeconfig['force_renew'])):
|
|
|
|
cert_get(config)
|
|
|
|
if str(config.get('cert_revoke_superseded')).lower() == 'true' and cert:
|
|
|
|
superseded.add(cert)
|
|
|
|
except Exception as e:
|
|
|
|
print("Certificate issue/renew failed: {}".format(e))
|
|
|
|
exceptions.append(e)
|
2019-03-27 21:00:21 +01:00
|
|
|
|
2019-03-28 00:20:55 +01:00
|
|
|
# deploy new certificates after all are renewed
|
2019-03-28 14:34:06 +01:00
|
|
|
deployment_success = True
|
2019-03-28 00:20:55 +01:00
|
|
|
for config in domainconfigs:
|
2019-03-28 14:34:06 +01:00
|
|
|
try:
|
|
|
|
for cfg in config['actions']:
|
|
|
|
if not tools.target_is_current(cfg['path'], config['cert_file']):
|
|
|
|
print("Updating '{}' due to newer version".format(cfg['path']))
|
|
|
|
actions.add(cert_put(cfg))
|
|
|
|
except Exception as e:
|
|
|
|
print("Certificate deployment failed: {}".format(e))
|
|
|
|
exceptions.append(e)
|
|
|
|
deployment_success = False
|
2019-03-27 21:00:21 +01:00
|
|
|
|
|
|
|
# run post-update actions
|
|
|
|
for action in actions:
|
|
|
|
if action is not None:
|
|
|
|
try:
|
|
|
|
# Run actions in a shell environment (to allow shell syntax) as stated in the configuration
|
|
|
|
output = subprocess.check_output(action, shell=True, stderr=subprocess.STDOUT)
|
|
|
|
print("Executed '{}' successfully: {}".format(action, output))
|
|
|
|
except subprocess.CalledProcessError as e:
|
2019-03-28 00:34:53 +01:00
|
|
|
print("Execution of '{}' failed with error '{}': {}".format(e.cmd, e.returncode, e.output))
|
2019-03-28 14:34:06 +01:00
|
|
|
exceptions.append(e)
|
|
|
|
deployment_success = False
|
2019-03-28 00:34:53 +01:00
|
|
|
|
|
|
|
# revoke old certificates as superseded
|
2019-03-28 14:34:06 +01:00
|
|
|
if deployment_success:
|
2019-03-28 00:34:53 +01:00
|
|
|
for superseded_cert in superseded:
|
2019-03-28 14:34:06 +01:00
|
|
|
try:
|
|
|
|
print("Revoking previous certificate '{}' valid until {} as superseded".format(
|
|
|
|
superseded_cert,
|
|
|
|
superseded_cert.not_valid_after))
|
|
|
|
cert_revoke(superseded_cert, domainconfigs, reason=4) # reason=4 is superseded
|
|
|
|
except Exception as e:
|
|
|
|
print("Certificate supersede revoke failed: {}".format(e))
|
|
|
|
exceptions.append(e)
|
|
|
|
|
|
|
|
# throw a RuntimeError with all exceptions caught while working if there were any
|
|
|
|
if len(exceptions) > 0:
|
|
|
|
raise RuntimeError("{} exception(s) occurred during runtime: {}".format(len(exceptions), exceptions))
|