.github/workflows/release.yml

@@ -5,14 +5,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v2
       with:
         fetch-depth: 0
 
     - name: Install dependencies
       run: |
         sudo apt update -qq -y
-        sudo apt install -qq -y build-essential fakeroot git python-all python3-cryptography python3-pip python3-stdeb python3-wheel twine dh-python
+        sudo apt install -qq -y build-essential fakeroot git python-all python3-cryptography python3-pip python3-stdeb python3-wheel twine
         sudo pip3 install --upgrade setuptools wheel
 
     - name: Prepare build process
@@ -22,7 +22,7 @@ jobs:
         git fetch --tags -f
         VER="$(python3 setup.py --version)"
         echo "Version found: $VER"
-        echo "version=$VER" >> $GITHUB_OUTPUT
+        echo "::set-output name=version::$VER"
 
     - name: Build python package using setuptools (source/wheel)
       run: |
@@ -36,20 +36,12 @@ jobs:
         sed "s/=determine_version()/='$(python3 setup.py --version)'/gi" -i setup.py
         sed "s@('readme'@('share/doc/python3-acertmgr'@" -i setup.py
         # Determine recommended dependencies for deb package
-        echo "recommends3=$(echo "python3-pkg-resources")" >> $GITHUB_OUTPUT
-        # Find optional dependencies to suggest in deb package       
-        echo "suggests3=$(python3 -c "from setup import extra_requirements; print('\n'.join(['\n'.join(x) for x in extra_requirements.values()]))" | grep -v cryptography | sed 's/PyYAML/yaml/gi' | awk '{ printf("python3-%s, ",$1)};' | awk '{$1=$1; print}')" >> $GITHUB_OUTPUT
+        echo "::set-output name=recommends3::$(echo "python3-pkg-resources")"
+        # Find optional dependencies to suggest in deb package
+        echo "::set-output name=suggests3::$(python3 -c "from setup import extra_requirements; print('\n'.join(['\n'.join(x) for x in extra_requirements.values()]))" | grep -v cryptography | sed 's/PyYAML/yaml/gi' | awk '{ printf("python3-%s, ",$1)};' | awk '{$1=$1; print}')"
 
     - name: Build debian package using setuptools and stdeb
-      run: |
-        # Create debianized source directory
-        python3 setup.py --command-packages=stdeb.command sdist_dsc --with-python2=False --with-python3=True --recommends3="${{ steps.stdebprep.outputs.recommends3 }}" --suggests3="${{ steps.stdebprep.outputs.suggests3 }}"
-        # Enter debianzied source directory (first sub-directory under deb_dist)
-        cd "$(find deb_dist -maxdepth 1 -type d | grep -v 'deb_dist$\|tmp_sdist_dsc' | head -n1)"
-        # Enforce GZIP compressed debian package info for older OS versions
-        echo -e 'override_dh_builddeb:\n\tdh_builddeb -- -Zgzip\n' >> debian/rules
-        # Build deb package
-        DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -rfakeroot -uc -us
+      run: python3 setup.py --command-packages=stdeb.command sdist_dsc --with-python2=False --with-python3=True --recommends3="${{ steps.stdebprep.outputs.recommends3 }}" --suggests3="${{ steps.stdebprep.outputs.suggests3 }}" bdist_deb
 
     - name: Create a changelog from git log since last non-pre/rc tag
       run: |
@@ -93,22 +85,9 @@ jobs:
           artifacts/*.whl
           artifacts/*.deb
 
-    - name: Check PyPI secrets
-      id: checksecrets
-      shell: bash
-      run: |
-        if [ "$USER" == "" -o "$PASSWORD" == "" ]; then
-          echo "secretspresent=NO" >> $GITHUB_OUTPUT
-        else
-          echo "secretspresent=YES" >> $GITHUB_OUTPUT
-        fi
-      env:
-        USER: ${{ secrets.PYPI_USERNAME }}
-        PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-
     - name: Create new PyPI release
-      if: steps.checksecrets.outputs.secretspresent == 'YES' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && (!(contains(github.ref, 'rc') || contains(github.ref, 'pre')))
-      uses: pypa/gh-action-pypi-publish@release/v1
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && (!(contains(github.ref, 'rc') || contains(github.ref, 'pre')))
+      uses: pypa/gh-action-pypi-publish@master
       with:
         user: ${{ secrets.PYPI_USERNAME }}
         password: ${{ secrets.PYPI_PASSWORD }}

README.md

@@ -12,7 +12,7 @@ Requirements
 ------------
 
   * Python (2.7+ and 3.5+ should work)
-  * cryptography>=0.6
+  * cryptography>=0.6 (usually includes the optional idna module)
 
 Optional requirements (to use specified features)
 ------------------------------------------------------
@@ -56,7 +56,7 @@ By default the directory (work_dir) containing the working data (csr,certificate
 4 configuration contexts are known (*domainconfig (d) > globalconfig (g) > commandline (c) > built-in defaults*) with the following directives (subject to change, usual usage context written bold):
 
 | Directive               | Context           | Description                                                                                                                                  | Built-in Default                     |
-| ---                     | ---               |----------------------------------------------------------------------------------------------------------------------------------------------| ---                                  |
+| ---                     | ---               | ---                                                                                                                                          | ---                                  |
 | -c/--config-file        | **c**             | global configuration file (optional)                                                                                                         | /etc/acertmgr/acertmgr.conf          |
 | -d/--config-dir         | **c**             | directory containing domain configuration files (ending with .conf, globalconfig will be excluded automatically if in same directory)        | /etc/acertmgr/*.conf                 |
 | -w/--work-dir           | **c**             | working directory containing csr/certificates/keys/ca files                                                                                  | /etc/acertmgr                        |
@@ -65,7 +65,7 @@ By default the directory (work_dir) containing the working data (csr,certificate
 | --revoke-reason         | **c**             | Provide a reason code for the revocation (see https://tools.ietf.org/html/rfc5280#section-5.3.1 for valid values)                            |                                      |
 | domain (san-domain...): | **d**             | (domainconfig section start) Domains to use in the cert request. This value will be MD5-hashed as cert_id.                                   |                                      |
 | api                     | d,**g**           | Determines the API version used                                                                                                              | v2                                   |
-| authority               | d,**g**           | URL to the certificate authorities ACME API root (without trailing /directory or similar)                                                    | https://acme-v02.api.letsencrypt.org |
+| authority               | d,**g**           | URL to the certificate authorities API                                                                                                       | https://acme-v02.api.letsencrypt.org |
 | authority_tos_agreement | d,**g**,c         | Indicates agreement to the ToS of the certificate authority (--authority-tos-agreement on command line)                                      |                                      |
 | authority_contact_email | d,**g**           | (v2 API only) Contact e-mail to be registered with your account key                                                                          |                                      |
 | account_key             | d,**g**           | Path to the account key                                                                                                                      | {work_dir}/account.key               |
@@ -74,7 +74,7 @@ By default the directory (work_dir) containing the working data (csr,certificate
 | ttl_days                | d,**g**           | Renew certificate if it has less than this value validity left                                                                               | 30                                   |
 | validate_ocsp           | d,**g**           | Renew certificate if it's OCSP status is REVOKED. Allowed values for this key are: false, sha1, sha224, sha256, sha384, sha512               | sha1 (as mandated by RFC5019)        |
 | cert_dir                | d,**g**           | Directory containing all certificate related data (crt,key,csr)                                                                              | {work_dir}                           |
-| key_algorithm           | d,**g**           | Key-algorithm for newly generated private keys (RSA, ECC, ED25519, ED448)                                                                    | RSA                                  |
+| key_algorithm           | d,**g**           | Key-algorithm for newly generated private keys (RSA, EC, ED25519, ED448)                                                                     | RSA                                  |
 | key_length              | d,**g**           | Key-length for newly generated RSA private keys (in bits) or EC curve (256=P-256, 384=P-384, 521=P-521)                                      | depends on key_algorithm             |
 | csr_static              | **d**,g           | Whether to re-use a static CSR or generate a new dynamic CSR                                                                                 | false                                |
 | csr_file                | **d**,g           | Path to store (and load) the certificate CSR file                                                                                            | {cert_dir}/{cert_id}.csr             |
@@ -121,4 +121,4 @@ Please keep the following in mind when using this software:
      * Create a dedicated user for acertmgr (e.g. acertmgr)
      * Run a acertmgr as that user (add acertmgr to that users cron!)
      * Access rights to read/write all files configured with the created user
-     * Run any programs/scripts defined on cert update as the created user (might need work-arounds with sudo or wrapper scripts)
+     * Run any programs/scripts defined on cert update as the created user (might need work-arounds with sudo or wrapper scripts)

acertmgr/__init__.py

@@ -15,7 +15,7 @@ import sys
 from acertmgr import configuration, tools
 from acertmgr.authority import authority
 from acertmgr.modes import challenge_handler
-from acertmgr.tools import log, LOG_REPLACEMENTS
+from acertmgr.tools import log
 
 try:
     import pwd
@@ -139,10 +139,6 @@ def cert_revoke(cert, configs, fallback_authority, reason=None):
 def main():
     # load config
     runtimeconfig, domainconfigs = configuration.load()
-    # register idna-mapped domains as LOG_REPLACEMENTS for better readability of log output
-    for domainconfig in domainconfigs:
-        LOG_REPLACEMENTS.update({k: "{} [{}]".format(k, v) for k, v in domainconfig['domainlist_idna_mapped'].items()})
-    # Start processing
     if runtimeconfig.get('mode') == 'revoke':
         # Mode: revoke certificate
         log("Revoking {}".format(runtimeconfig['revoke']))

acertmgr/authority/v2.py

@@ -260,8 +260,8 @@ class ACMEAuthority(AbstractACMEAuthority):
         if code >= 400:
             raise ValueError("Error downloading certificate chain: {0} {1}".format(code, certificate))
 
-        cert_dict = re.match((r'(?P<cert>^-----BEGIN CERTIFICATE-----\n[^\-]+\n-----END CERTIFICATE-----)\n*'
-                              r'(?P<ca>-----BEGIN CERTIFICATE-----\n.+\n-----END CERTIFICATE-----)?$'),
+        cert_dict = re.match((r'(?P<cert>-----BEGIN CERTIFICATE-----[^\-]+-----END CERTIFICATE-----)\n\n'
+                              r'(?P<ca>-----BEGIN CERTIFICATE-----[^\-]+-----END CERTIFICATE-----)?'),
                              certificate, re.DOTALL).groupdict()
         cert = tools.convert_pem_str_to_cert(cert_dict['cert'])
         if cert_dict['ca'] is None:

acertmgr/configuration.py

@@ -90,14 +90,9 @@ def parse_config_entry(entry, globalconfig, runtimeconfig):
     config['id'] = hashlib.md5(domains.encode('utf-8')).hexdigest()
 
     # Convert unicode to IDNA domains
-    config['domainlist_idna_mapped'] = {}
-    for idx in range(0, len(config['domainlist'])):
-        if any(ord(c) >= 128 for c in config['domainlist'][idx]):
-            domain_human = config['domainlist'][idx]
-            domain_idna = idna_convert(domain_human)
-            if domain_idna != domain_human:
-                config['domainlist'][idx] = domain_idna  # Update domain with idna counterpart
-                config['domainlist_idna_mapped'][domain_idna] = domain_human  # Store original domain for reference
+    config['domaintranslation'] = idna_convert(config['domainlist'])
+    if len(config['domaintranslation']) > 0:
+        config['domainlist'] = [x for x, _ in config['domaintranslation']]
 
     # Action config defaults
     config['defaults'] = globalconfig.get('defaults', {})
@@ -124,17 +119,6 @@ def parse_config_entry(entry, globalconfig, runtimeconfig):
     # Use a static cert request
     update_config_value(config, 'csr_static', localconfig, globalconfig, "false")
 
-    # SSL key algorithm (if key has to be (re-)generated)
-    update_config_value(config, 'key_algorithm', localconfig, globalconfig, None)
-    # Update config id if we have a key algorithm set to allow for
-    # multiple certs with different algorithms for the same set of domains
-    if config.get('key_algorithm', None):
-        config['id'] += "_" + config['key_algorithm'].lower()
-
-    # SSL key length (if key has to be (re-)generated, converted to int)
-    update_config_value(config, 'key_length', localconfig, globalconfig, None)
-    config['key_length'] = int(config['key_length']) if config['key_length'] else None
-
     # SSL cert request location
     update_config_value(config, 'csr_file', localconfig, globalconfig,
                         os.path.join(config['cert_dir'], "{}.csr".format(config['id'])))
@@ -147,6 +131,13 @@ def parse_config_entry(entry, globalconfig, runtimeconfig):
     update_config_value(config, 'key_file', localconfig, globalconfig,
                         os.path.join(config['cert_dir'], "{}.key".format(config['id'])))
 
+    # SSL key algorithm (if key has to be (re-)generated)
+    update_config_value(config, 'key_algorithm', localconfig, globalconfig, None)
+
+    # SSL key length (if key has to be (re-)generated, converted to int)
+    update_config_value(config, 'key_length', localconfig, globalconfig, None)
+    config['key_length'] = int(config['key_length']) if config['key_length'] else None
+
     # SSL CA location / use static
     update_config_value(config, 'ca_file', localconfig, globalconfig,
                         os.path.join(config['cert_dir'], "{}.ca".format(config['id'])))
@@ -171,8 +162,8 @@ def parse_config_entry(entry, globalconfig, runtimeconfig):
             cfg.update(genericfgs[0])
 
         # Update handler config with more specific values (use original names for translated unicode domains)
-        specificcfgs = [x for x in handlerconfigs if
-                        'domain' in x and x['domain'] == config['domainlist_idna_mapped'].get(domain, domain)]
+        _domain = _domaintranslation_dict.get(domain, domain)
+        specificcfgs = [x for x in handlerconfigs if 'domain' in x and x['domain'] == _domain]
         if len(specificcfgs) > 0:
             cfg.update(specificcfgs[0])
 
@@ -231,9 +222,9 @@ def load():
 
     # - force-rewew
     if args.force_renew:
-        domaintranslation = [idna_convert(d) for d in args.force_renew.split(' ')]
+        domaintranslation = idna_convert(args.force_renew.split(' '))
         if len(domaintranslation) > 0:
-            runtimeconfig['force_renew'] = domaintranslation
+            runtimeconfig['force_renew'] = [x for x, _ in domaintranslation]
         else:
             runtimeconfig['force_renew'] = args.force_renew.split(' ')
 
@@ -264,29 +255,15 @@ def load():
                     os.path.abspath(domain_config_file) != os.path.abspath(global_config_file):
                 with io.open(domain_config_file) as config_fd:
                     try:
-                        data = json.load(config_fd)
+                        for entry in json.load(config_fd).items():
+                            domainconfigs.append(parse_config_entry(entry, globalconfig, runtimeconfig))
                     except ValueError:
                         import yaml
                         config_fd.seek(0)
-                        data = yaml.safe_load(config_fd)
-                    if isinstance(data, list):
-                        # Handle newer config in list format (allows for multiple entries with same domains)
-                        entries = list()
-                        for element in data:
-                            entries += element.items()
-                    else:
-                        # Handle older config format with just one entry per same domain set
-                        entries = data.items()
-                    for entry in entries:
-                        domainconfigs.append(parse_config_entry(entry, globalconfig, runtimeconfig))
+                        for entry in yaml.safe_load(config_fd).items():
+                            domainconfigs.append(parse_config_entry(entry, globalconfig, runtimeconfig))
 
     # Define a fallback authority from global configuration / defaults
     runtimeconfig['fallback_authority'] = parse_authority([], globalconfig, runtimeconfig)
 
     return runtimeconfig, domainconfigs
-
-
-if __name__ == '__main__':
-    # Simple configuration load test and output
-    from pprint import pprint
-    pprint(load())

acertmgr/modes/standalone.py

@@ -28,20 +28,10 @@ class HTTPServer6(HTTPServer):
 class ChallengeHandler(HTTPChallengeHandler):
     def __init__(self, config):
         HTTPChallengeHandler.__init__(self, config)
-        self.bind_address = config.get("bind_address", "")
-        self.port = int(config.get("port", 80))
+        bind_address = config.get("bind_address", "")
+        port = int(config.get("port", 80))
 
         self.challenges = {}  # Initialize the challenge data dict
-        self.server_thread = None
-        self.server = None
-
-    def create_challenge(self, domain, thumbprint, token):
-        self.challenges[token] = "{0}.{1}".format(token, thumbprint)
-
-    def destroy_challenge(self, domain, thumbprint, token):
-        del self.challenges[token]
-
-    def start_challenge(self, domain, thumbprint, token):
         _self = self
 
         # Custom HTTP request handler
@@ -64,11 +54,19 @@ class ChallengeHandler(HTTPChallengeHandler):
                 self.end_headers()
                 self.wfile.write(value)
 
+        self.server_thread = None
         try:
-            self.server = HTTPServer6((self.bind_address, self.port), _HTTPRequestHandler)
+            self.server = HTTPServer6((bind_address, port), _HTTPRequestHandler)
         except socket.gaierror:
-            self.server = HTTPServer((self.bind_address, self.port), _HTTPRequestHandler)
+            self.server = HTTPServer((bind_address, port), _HTTPRequestHandler)
 
+    def create_challenge(self, domain, thumbprint, token):
+        self.challenges[token] = "{0}.{1}".format(token, thumbprint)
+
+    def destroy_challenge(self, domain, thumbprint, token):
+        del self.challenges[token]
+
+    def start_challenge(self, domain, thumbprint, token):
         def _serve():
             self.server.serve_forever()
 
@@ -80,6 +78,3 @@ class ChallengeHandler(HTTPChallengeHandler):
         if self.server_thread.is_alive():
             self.server.shutdown()
             self.server_thread.join()
-            self.server.server_close()
-            self.server = None
-            self.server_thread = None

acertmgr/tools.py

@@ -10,7 +10,6 @@ import base64
 import datetime
 import io
 import os
-import re
 import stat
 import sys
 import traceback
@@ -38,8 +37,6 @@ try:
 except ImportError:
     from urllib2 import urlopen, Request  # Python 2
 
-LOG_REPLACEMENTS = {}
-
 
 class InvalidCertificateError(Exception):
     pass
@@ -61,9 +58,6 @@ def log(msg, exc=None, error=False, warning=False):
         prefix = ""
 
     output = prefix + msg
-    for k, v in LOG_REPLACEMENTS.items():
-        output = output.replace(k, v)
-
     if exc:
         _, exc_value, _ = sys.exc_info()
         if not getattr(exc, '__traceback__', None) and exc == exc_value:
@@ -144,7 +138,7 @@ def new_ssl_key(path=None, key_algo=None, key_size=None):
             key_size=key_size,
             backend=default_backend()
         )
-    elif key_algo.lower() == 'ec' or key_algo.lower() == 'ecc':
+    elif key_algo.lower() == 'ec':
         if not key_size or key_size == 256:
             key_curve = ec.SECP256R1
         elif key_size == 384:
@@ -248,7 +242,8 @@ def get_cert_domains(cert):
     if san_cert:
         for d in san_cert.value:
             domains.add(d.value)
-    return domains
+    # Convert IDNA domain to correct representation and return the list
+    return [x for x, _ in idna_convert(domains)]
 
 
 # @brief determine certificate cn
@@ -262,26 +257,15 @@ def get_cert_valid_until(cert):
 
 
 # @brief convert certificate to PEM format
-# @param cert certificate object or a list thereof
+# @param cert certificate object in pyopenssl format
 # @return the certificate in PEM format
 def convert_cert_to_pem_str(cert):
-    if not isinstance(cert, list):
-        cert = [cert]
-    result = list()
-    for data in cert:
-        result.append(data.public_bytes(serialization.Encoding.PEM).decode('utf8'))
-    return '\n'.join(result)
+    return cert.public_bytes(serialization.Encoding.PEM).decode('utf8')
 
 
 # @brief load a PEM certificate from str
-# @return a certificate object or a list of objects if multiple are in the string
 def convert_pem_str_to_cert(certdata):
-    certs = re.findall(r'(-----BEGIN CERTIFICATE-----\n[^\-]+\n-----END CERTIFICATE-----)',
-                       certdata, re.DOTALL)
-    result = list()
-    for data in certs:
-        result.append(x509.load_pem_x509_certificate(data.encode('utf8'), default_backend()))
-    return result[0] if len(result) == 1 else result
+    return x509.load_pem_x509_certificate(certdata.encode('utf8'), default_backend())
 
 
 # @brief serialize cert/csr to DER bytes
@@ -389,19 +373,26 @@ def target_is_current(target, file):
     return target_date >= crt_date
 
 
-# @brief convert domain to idna representation (if applicable
-def idna_convert(domain):
-    try:
-        if any(ord(c) >= 128 for c in domain):
-            # Translate IDNA domain name from a unicode domain (handle wildcards separately)
-            if domain.startswith('*.'):
-                idna_domain = "*.{}".format(domain[2:].encode('idna').decode('ascii'))
-            else:
-                idna_domain = domain.encode('idna').decode('ascii')
-            return idna_domain
-    except Exception as e:
-        log("Unicode domain(s) found but IDNA names could not be translated due to error: {}".format(e), error=True)
-    return domain
+# @brief convert domain list to idna representation (if applicable
+def idna_convert(domainlist):
+    if any(ord(c) >= 128 for c in ''.join(domainlist)):
+        try:
+            domaintranslation = list()
+            for domain in domainlist:
+                if any(ord(c) >= 128 for c in domain):
+                    # Translate IDNA domain name from a unicode domain (handle wildcards separately)
+                    if domain.startswith('*.'):
+                        idna_domain = "*.{}".format(domain[2:].encode('idna').decode('ascii'))
+                    else:
+                        idna_domain = domain.encode('idna').decode('ascii')
+                    result = idna_domain, domain
+                else:
+                    result = domain, domain
+                domaintranslation.append(result)
+            return domaintranslation
+        except Exception as e:
+            log("Unicode domain(s) found but IDNA names could not be translated due to error: {}".format(e), error=True)
+    return [(x, x) for x in domainlist]
 
 
 # @brief validate the OCSP status for a given certificate by the given issuer
@@ -420,9 +411,6 @@ def is_ocsp_valid(cert, issuer, hash_algo):
         log("Invalid hash algorithm '{}' used for OCSP validation. Validation ignored.".format(hash_algo), warning=True)
         return True
 
-    if isinstance(issuer, list):
-        issuer = issuer[0]   # First certificate in the CA chain is the immediate issuer
-
     try:
         ocsp_urls = []
         aia = cert.extensions.get_extension_for_oid(ExtensionOID.AUTHORITY_INFORMATION_ACCESS)
@@ -432,7 +420,7 @@ def is_ocsp_valid(cert, issuer, hash_algo):
 
         # This is a bit of a hack due to validation problems within cryptography (TODO: Check if this is still true)
         # Correct replacement:  ocsprequest = ocsp.OCSPRequestBuilder().add_certificate(cert, issuer, algorithm).build()
-        ocsprequest = ocsp.OCSPRequestBuilder((cert, issuer, (algorithm)())).build()
+        ocsprequest = ocsp.OCSPRequestBuilder((cert, issuer, algorithm)).build()
         ocsprequestdata = ocsprequest.public_bytes(serialization.Encoding.DER)
         for ocsp_url in ocsp_urls:
             response = get_url(ocsp_url,

docs/domain.yaml

@@ -68,12 +68,3 @@ mail.example.com smtp.example.com webmail.example.net *.intra.example.com:
   perm: '400'
   format: crt,ca
   action: '/etc/init.d/postfix reload'
-
-# this will use a different authority for the following set of domains (buypass.com in this example)
-buypass-example.com *.buypass-example.com:
-- authority: 'https://api.buypass.com/acme'  # Removed trailing /directory from buypass docs for API endpoint
-  mode: dns.nsupdate
-  nsupdate_keyname: buypass
-  nsupdate_keyvalue: Test1234512359==
-  nsupdate_keyalgorithm: HMAC-MD5.SIG-ALG.REG.INT
-

version.txt

@@ -1 +1 @@
-1.0.5
+1.0.3