certapi 1.1.8__tar.gz → 1.1.9__tar.gz

{certapi-1.1.8/src/certapi.egg-info → certapi-1.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.8
+Version: 1.1.9
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.8 → certapi-1.1.9}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.8",
+    version="1.1.9",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-1.1.8 → certapi-1.1.9}/src/certapi/client/renewal_manager.py

@@ -476,7 +476,8 @@ class RenewalManager:
                 "key_type": self.key_type,
                 "expiry_days": self.expiry_days,
                 "renew_threshold_days": renew_threshold_days,
-                "skip_failing": False,
+                # Renewal should obtain whatever can be issued, then self-sign unresolved domains.
+                "skip_failing": True,
                 "batch_domains": True,
                 "self_verify": self.self_verify,
                 "country": self.country,
@@ -492,7 +493,16 @@ class RenewalManager:
             )
             if res is None:
                 return
-            self._update_expiry_cache(res.issued + res.existing)
+            certs = res.issued + res.existing
+            self._update_expiry_cache(certs)
+            covered_domains = self._covered_domains_from_response(certs)
+            unresolved_domains = [domain for domain in domains if domain not in covered_domains]
+            for domain in unresolved_domains:
+                self._add_to_blacklist(domain, now)
+                if domain in domains_with_cached_entries or self._has_local_certificate(domain):
+                    self._schedule_existing_certificate_retry(domain, now)
+                else:
+                    self._register_self_signed(domain)
         except Exception as e:
             self._set_error(e)
             for domain in domains:
@@ -563,6 +573,14 @@ class RenewalManager:
             self._cache = {d: exp for d, exp in self._cache.items() if d in self._watch_domains}
             self._lock.notify_all()
 
+    def _covered_domains_from_response(self, certs) -> Set[str]:
+        covered: Set[str] = set()
+        for cert in certs:
+            for domain in cert.domains:
+                if domain:
+                    covered.add(domain)
+        return covered
+
     def _add_to_blacklist(self, domain: str, now: datetime):
         with self._lock:
             self._blacklist[domain] = now + timedelta(seconds=self.blacklist_duration_seconds)

{certapi-1.1.8 → certapi-1.1.9/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.8
+Version: 1.1.9
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai

{certapi-1.1.8 → certapi-1.1.9}/tests/test_renewal_manager.py

@@ -425,7 +425,7 @@ def test_renewal_manager_passes_typed_obtain_options_into_renewal_calls():
     assert len(client.calls) == 1
     assert client.calls[0]["kwargs"]["batch_domains"] is True
     assert client.calls[0]["kwargs"]["self_verify"] is False
-    assert client.calls[0]["kwargs"]["skip_failing"] is False
+    assert client.calls[0]["kwargs"]["skip_failing"] is True
     assert client.calls[0]["kwargs"]["renew_threshold_days"] == 30
     assert client.calls[0]["kwargs"]["organization"] == "certapi-tests"
 
@@ -523,6 +523,25 @@ def test_new_domain_failure_selfsigns_and_blacklists():
     assert len(client.calls) == 2
 
 
+def test_partial_renewal_success_selfsigns_uncovered_domains():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClient()
+    client.key_store = DummyKeyStore()
+    ok_cert = _make_cert_pem("ok.example.com", now, valid_for_days=60)
+    client.set_handler(
+        "ok.example.com",
+        CertificateResponse(issued=[IssuedCert(cert=ok_cert, domains=["ok.example.com"])], existing=[]),
+    )
+
+    mgr = RenewalManager(client, renew_threshold_days=30, clock_fn=lambda: now)
+    mgr._renew_domains(["ok.example.com", "missing.example.com"], now)
+
+    with mgr._lock:
+        assert "ok.example.com" in mgr._cache
+    assert len(client.key_store.saved_certs) == 1
+    assert client.key_store.saved_certs[0][2] == "missing.example.com.selfsigned"
+
+
 def test_update_watch_domains_blocks_until_running_worker_processes_domains():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     started = threading.Event()
@@ -672,7 +691,7 @@ def test_remote_certapi_polling_prints_waiting_message(capsys):
     assert len(client.obtain_calls) == 1
 
 
-def test_remote_renewal_disables_skip_failing_so_unverified_domain_fails():
+def test_remote_renewal_uses_skip_failing_and_selfsigns_unresolved_domain():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     client = DummyRemoteSkipFailingClient()
     client.key_store = DummyKeyStore()
@@ -681,9 +700,9 @@ def test_remote_renewal_disables_skip_failing_so_unverified_domain_fails():
     mgr.update_watch_domains(["missing.example.com"])
 
     assert len(client.obtain_calls) == 1
-    assert client.obtain_calls[0]["kwargs"]["skip_failing"] is False
+    assert client.obtain_calls[0]["kwargs"]["skip_failing"] is True
     assert "missing.example.com" in mgr.get_state()["blacklisted_domains"]
-    assert "None of the domains are owned" in mgr.get_state()["last_error_message"]
+    assert mgr.get_state()["last_error_message"] is None
     assert len(client.key_store.saved_certs) == 1
     assert client.key_store.saved_certs[0][2] == "missing.example.com.selfsigned"