mirror of
https://github.com/certbot/certbot.git
synced 2026-01-26 07:41:33 +03:00
018a304cd6
An early version of the spec indicated that clients should process issuance
sequentially, following Link rel=next from an account URL to an authz URL, to a
new-cert URL. However, the spec has long since moved to putting these URLs in
the directory.
Certbot nominally supports either; This change consolidates on always using the
directory, simplifying things and making the transition to the latest ACME spec
easier.
* Revert "Revert "Remove Link rel=next for authzs and new-certs." (#4277)"
This reverts commit 11ec1eb911.
* Save new_authzr_uri with account for older clients.
* Add test that new_authzr_uri exists in regr.
* Restore backwards compatibility for new_authzr_uri.
* Fix account_test.
* Add test for deprecated URI argument to request_challenges.
* Review feedback.
* Fix test
* Add omitempty to new_cert_uri.
48 lines
1.4 KiB
Python
48 lines
1.4 KiB
Python
"""Example script showing how to use acme client API."""
|
|
import logging
|
|
import os
|
|
import pkg_resources
|
|
|
|
from cryptography.hazmat.backends import default_backend
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
import OpenSSL
|
|
|
|
from acme import client
|
|
from acme import messages
|
|
from acme import jose
|
|
|
|
|
|
logging.basicConfig(level=logging.DEBUG)
|
|
|
|
|
|
DIRECTORY_URL = 'https://acme-staging.api.letsencrypt.org/directory'
|
|
BITS = 2048 # minimum for Boulder
|
|
DOMAIN = 'example1.com' # example.com is ignored by Boulder
|
|
|
|
# generate_private_key requires cryptography>=0.5
|
|
key = jose.JWKRSA(key=rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=BITS,
|
|
backend=default_backend()))
|
|
acme = client.Client(DIRECTORY_URL, key)
|
|
|
|
regr = acme.register()
|
|
logging.info('Auto-accepting TOS: %s', regr.terms_of_service)
|
|
acme.agree_to_tos(regr)
|
|
logging.debug(regr)
|
|
|
|
authzr = acme.request_challenges(
|
|
identifier=messages.Identifier(typ=messages.IDENTIFIER_FQDN, value=DOMAIN))
|
|
logging.debug(authzr)
|
|
|
|
authzr, authzr_response = acme.poll(authzr)
|
|
|
|
csr = OpenSSL.crypto.load_certificate_request(
|
|
OpenSSL.crypto.FILETYPE_ASN1, pkg_resources.resource_string(
|
|
'acme', os.path.join('testdata', 'csr.der')))
|
|
try:
|
|
acme.request_issuance(jose.util.ComparableX509(csr), (authzr,))
|
|
except messages.Error as error:
|
|
print ("This script is doomed to fail as no authorization "
|
|
"challenges are ever solved. Error from server: {0}".format(error))
|