Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _find_domains(args, installer):
if args.domains is None:
domains = display_ops.choose_names(installer)
else:
domains = args.domains
if not domains:
raise errors.Error("Please specify --domains, or --installer that "
"will help in domain names autodiscovery")
return domains
def revoked_status(cert_path, chain_path):
"""Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param str cert_path: Path to certificate
:param str chain_path: Path to chain certificate
"""
url, _ = le_util.run_script(
["openssl", "x509", "-in", cert_path, "-noout", "-ocsp_uri"])
url = url.rstrip()
host = url.partition("://")[2].rstrip("/")
if not host:
raise errors.Error(
"Unable to get OCSP host from cert, url - %s", url)
# This was a PITA...
# Thanks to "Bulletproof SSL and TLS - Ivan Ristic" for helping me out
try:
output, _ = le_util.run_script(
["openssl", "ocsp",
"-no_nonce", "-header", "Host", host,
"-issuer", chain_path,
"-cert", cert_path,
"-url", url,
"-CAfile", chain_path])
except errors.SubprocessError:
return "(OCSP Failure)"
return _translate_ocsp_query(cert_path, output)
def _tos_cb(regr):
if args.tos:
return True
msg = ("Please read the Terms of Service at {0}. You "
"must agree in order to register with the ACME "
"server at {1}".format(
regr.terms_of_service, config.server))
return zope.component.getUtility(interfaces.IDisplay).yesno(
msg, "Agree", "Cancel")
try:
acc, acme = client.register(
config, account_storage, tos_cb=_tos_cb)
except errors.Error as error:
logger.debug(error, exc_info=True)
raise errors.Error(
"Unable to register an account with ACME server")
args.account = acc.id
return acc, acme
elif config.renew_by_default or zope.component.getUtility(
interfaces.IDisplay).yesno(question, "Replace", "Cancel"):
renewal = True
else:
reporter_util = zope.component.getUtility(interfaces.IReporter)
reporter_util.add_message(
"To obtain a new certificate that {0} an existing certificate "
"in its domain-name coverage, you must use the --duplicate "
"option.{br}{br}For example:{br}{br}{1} --duplicate {2}".format(
"duplicates" if ident_names_cert is not None else
"overlaps with",
sys.argv[0], " ".join(sys.argv[1:]),
br=os.linesep
),
reporter_util.HIGH_PRIORITY)
raise errors.Error(
"User did not use proper CLI and would like "
"to reinvoke the client.")
if renewal:
return ident_names_cert if ident_names_cert is not None else subset_names_cert
return None
# Plugin Errors
class PluginError(Error):
"""Let's Encrypt Plugin error."""
class NoInstallationError(PluginError):
"""Let's Encrypt No Installation error."""
class MisconfigurationError(PluginError):
"""Let's Encrypt Misconfiguration error."""
class RevokerError(Error):
"""Let's Encrypt Revoker error."""
class ValidationError(Error):
"""Let's Encrypt Validation error."""
def _lineage_version(self, selection):
"""Returns a tuple containing the lineage and version number."""
if self._is_lineage(selection):
raise errors.Error("Lineage was selected, not a certificate.")
parts = selection.partition(".")
return (self.certs[int(parts[0])], int(parts[2]))
"""Confirm and revoke certificates.
:param certs: certs intended to be revoked
:type certs: :class:`list` of :class:`letsencrypt.revoker.Cert`
:returns: certs successfully revoked
:rtype: :class:`list` of :class:`letsencrypt.revoker.Cert`
"""
success_list = []
try:
for cert in certs:
if self.no_confirm or revocation.confirm_revocation(cert):
try:
self._acme_revoke(cert)
except errors.Error:
# TODO: Improve error handling when networking is set...
logger.error(
"Unable to revoke cert:%s%s", os.linesep, str(cert))
success_list.append(cert)
revocation.success_revocation(cert)
finally:
if success_list:
self._remove_certs_keys(success_list)
return success_list
def _translate_ocsp_query(cert_path, ocsp_output):
"""Returns a label string out of the query."""
if not "Response verify OK":
return "Revocation Unknown"
if cert_path + ": good" in ocsp_output:
return ""
elif cert_path + ": revoked" in ocsp_output:
return REV_LABEL
else:
raise errors.Error(
"Unable to properly parse OCSP output: %s", ocsp_output)