acmesmith 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8f7314678f48d9decad7c7bedda283390a42f7b2
-  data.tar.gz: c65377ad9caf33a936fb75c2529f70eb80500879
+  metadata.gz: 63bbb87b41e2ab5fbe44ca6ad4026795e314519f
+  data.tar.gz: c1d0645c4dc6d710e0422afd4caade86ed46c745
 SHA512:
-  metadata.gz: bf2a7d3e56f5d99454eba7e1cb9940be726c880d0fd8b395396e7f4bf8181b1187d136c7ea9c3e56e629c9a164583cd4480e217bf90ce88ac7dba83d91344093
-  data.tar.gz: db4c635849f2c0f37493c0a1cadbb34404104ada41509ce6a8b0a3ea27b17330b7adf5349e9f0496434909d2a9a5fb203884585a2580dbc2b0214aad24141720
+  metadata.gz: d01c1960e2fa8eae938260f3bb9a2f52f7caedf31d4540c667ab6061f4c8095bb1855e34d1170b409b5d7f396438dc69b38474bf2d25458563e1924a1ddf0c47
+  data.tar.gz: f5ae0c2375fb018564e5c5dbb5fe107613d35dbac0227e8c62e58b4037e6936acd5adef2a46f96eceaa93115af687375e08388973a66389d3037ddb99625b131

data/lib/acmesmith/command.rb

@@ -22,42 +22,81 @@ module Acmesmith
       puts "Generated:\n#{key.private_key.public_key.to_pem}"
     end
 
-    desc "authorize DOMAIN", "Get authz for DOMAIN."
-    def authorize(domain)
-      authz = acme.authorize(domain: domain)
-
-      challenges = [authz.http01, authz.dns01, authz.tls_sni01].compact
-
-      challenge = nil
-      responder = config.challenge_responders.find do |x|
-        challenge = challenges.find { |_| x.support?(_.class::CHALLENGE_TYPE) }
+    desc "authorize DOMAIN [DOMAIN ...]", "Get authz for DOMAIN."
+    def authorize(*domains)
+      targets = domains.map do |domain|
+        authz = acme.authorize(domain: domain)
+        challenges = [authz.http01, authz.dns01, authz.tls_sni01].compact
+        challenge = nil
+        responder = config.challenge_responders.find do |x|
+          challenge = challenges.find { |_| x.support?(_.class::CHALLENGE_TYPE) }
+        end
+        {domain: domain, authz: authz, responder: responder, challenge: challenge}
       end
 
-      responder.respond(domain, challenge)
-
       begin
-        puts "=> Requesting verification..."
-        challenge.request_verification
-        loop do
-          status = challenge.verify_status
-          puts " * verify_status: #{status}"
-          break if status == 'valid'
-          if status == "invalid"
-            err = challenge.error
-            puts "#{err["type"]}: #{err["detail"]}"
-          end
-          sleep 3
+        targets.each do |target|
+          target[:responder].respond(target[:domain], target[:challenge])
         end
-        puts "=> Done"
+
+        targets.each do |target|
+          puts "=> Requesting verifications..."
+          target[:challenge].request_verification
+        end
+          loop do
+            all_valid = true
+            targets.each do |target|
+              next if target[:valid]
+
+              status = target[:challenge].verify_status
+              puts " * [#{target[:domain]}] verify_status: #{status}"
+
+              if status == 'valid'
+                target[:valid] = true
+                next
+              end
+
+              all_valid = false
+              if status == "invalid"
+                err = target[:challenge].error
+                puts " ! [#{target[:domain]}] #{err["type"]}: #{err["detail"]}"
+              end
+            end
+            break if all_valid
+            sleep 3
+          end
+          puts "=> Done"
       ensure
-        responder.cleanup(domain, challenge)
+        targets.each do |target|
+          target[:responder].cleanup(target[:domain], target[:challenge])
+        end
       end
     end
 
     desc "request COMMON_NAME [SAN]", "request certificate for CN +COMMON_NAME+ with SANs +SAN+"
     def request(common_name, *sans)
       csr = Acme::Client::CertificateRequest.new(common_name: common_name, names: sans)
-      acme_cert = acme.new_certificate(csr)
+      retried = false
+      acme_cert = begin
+        acme.new_certificate(csr)
+      rescue Acme::Client::Error::Unauthorized => e
+        raise unless config.auto_authorize_on_request
+
+        puts "=> Authorizing unauthorized domain names"
+        # https://github.com/letsencrypt/boulder/blob/b9369a481415b3fe31e010b34e2ff570b89e42aa/ra/ra.go#L604
+        m = e.message.match(/authorizations for these names not found or expired: ((?:[a-zA-Z0-9_.\-]+(?:,\s+|$))+)/)
+        if m && m[1]
+          domains = m[1].split(/,\s+/)
+        else
+          warn " ! Error message on certificate request was #{e.message.inspect} and acmesmith couldn't determine which domain names are unauthorized (maybe a bug)"
+          warn " ! Attempting to authorize all domains in this certificate reuqest for now."
+          domains = [common_name, *sans]
+        end
+        puts " * #{domains.join(', ')}"
+        authorize(*domains)
+        retried = true
+        retry unless retried
+      end
 
       cert = Certificate.from_acme_client_certificate(acme_cert)
       storage.put_certificate(cert, certificate_key_passphrase)

data/lib/acmesmith/config.rb

@@ -36,6 +36,10 @@ module Acmesmith
       @config['certificate_key_passphrase']
     end
 
+    def auto_authorize_on_request
+      @config.fetch('auto_authorize_on_request', true)
+    end
+
     def storage
       @storage ||= begin
         c = @config['storage'].dup

data/lib/acmesmith/version.rb

@@ -1,3 +1,3 @@
 module Acmesmith
-  VERSION = "0.5.1"
+  VERSION = "0.6.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: acmesmith
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.6.0
 platform: ruby
 authors:
 - sorah (Shota Fukumori)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-19 00:00:00.000000000 Z
+date: 2017-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: acme-client
@@ -157,7 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.10
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: ACME client (Let's encrypt client) to manage certificate in multi server