···
def check_connection(node, domain, retries=3):
256
-
assert retries >= 0
256
+
assert retries >= 0, f"Failed to connect to https://{domain}"
"openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"
···
for line in result.lower().split("\n"):
if "verification" in line and "error" in line:
return check_connection(node, domain, retries - 1)
def check_connection_key_bits(node, domain, bits, retries=3):
270
-
assert retries >= 0
270
+
assert retries >= 0, f"Did not find expected number of bits ({bits}) in key"
"openssl s_client -CAfile /tmp/ca.crt"
···
print("Key type:", result)
return check_connection_key_bits(node, domain, bits, retries - 1)
def check_stapling(node, domain, retries=3):
285
-
assert retries >= 0
285
+
assert retries >= 0, "OCSP Stapling check failed"
# Pebble doesn't provide a full OCSP responder, so just check the URL
···
print("OCSP Responder URL:", result)
if "${caDomain}:4002" not in result.lower():
return check_stapling(node, domain, retries - 1)
300
+
def download_ca_certs(node, retries=5):
301
+
assert retries >= 0, "Failed to connect to pebble to download root CA certs"
303
+
exit_code, _ = node.execute("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
304
+
exit_code_2, _ = node.execute(
305
+
"curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt"
308
+
if exit_code + exit_code_2 > 0:
310
+
return download_ca_certs(node, retries - 1)
···
acme.wait_for_unit("network-online.target")
acme.wait_for_unit("pebble.service")
316
-
client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
317
-
client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")
329
+
download_ca_certs(client)
with subtest("Can request certificate with HTTPS-01 challenge"):
webserver.wait_for_unit("acme-finished-a.example.test.target")
check_fullchain(webserver, "a.example.test")
check_issuer(webserver, "a.example.test", "pebble")
check_connection(client, "a.example.test")
337
+
with subtest("Certificates and accounts have safe + valid permissions"):
338
+
group = "${nodes.webserver.config.security.acme.certs."a.example.test".group}"
340
+
f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
343
+
f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/.lego/a.example.test/**/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
346
+
f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test | tee /dev/stderr | grep '750 acme {group}' | wc -l) -eq 1"
349
+
f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c \"%a %U %G\" {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"
with subtest("Can generate valid selfsigned certs"):
webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
···
assert keyhash_old == keyhash_new
with subtest("Can request certificates for vhost + aliases (apache-httpd)"):
378
-
switch_to(webserver, "httpd-aliases")
379
-
webserver.wait_for_unit("acme-finished-c.example.test.target")
406
+
switch_to(webserver, "httpd-aliases")
407
+
webserver.wait_for_unit("acme-finished-c.example.test.target")
408
+
except Exception as err:
409
+
_, output = webserver.execute(
410
+
"cat /var/log/httpd/*.log && ls -al /var/lib/acme/acme-challenge"
check_issuer(webserver, "c.example.test", "pebble")
check_connection(client, "c.example.test")
check_connection(client, "d.example.test")
pyrox.dev