3aaf87ee6d
Currently we don't set a contact email with our accounts. This is an optional feature, but would be helpful for things like [1] where we would be notified of certificates affected by bugs, etc. Setup the email address in the acme.sh config which will apply with any new accounts created. To update all the existing hosts, we see if the account email is added/modified in the config *and* if we have existing account details; if so we need a manual update call. For anyone who might be poking here, we also add a note on sharing an account based on some broadly agreed upon discussion in IRC. [1] https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864 Change-Id: Ib4dc3e179010419a1b18f355d13b62c6cc4bc7e8
141 lines
5.1 KiB
Python
141 lines
5.1 KiB
Python
# Copyright 2019 Red Hat, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import pytest
|
|
|
|
testinfra_hosts = ['adns-letsencrypt.opendev.org',
|
|
'letsencrypt01.opendev.org',
|
|
'letsencrypt02.opendev.org']
|
|
|
|
|
|
def test_acme_zone(host):
|
|
if host.backend.get_hostname() != 'adns-letsencrypt.opendev.org':
|
|
pytest.skip()
|
|
acme_opendev_zone = host.file('/var/lib/bind/zones/acme.opendev.org/zone.db')
|
|
assert acme_opendev_zone.exists
|
|
|
|
# On our test nodes, unbound is listening on 127.0.0.1:53; this
|
|
# ensures the query hits bind
|
|
query_addr = host.ansible("setup")["ansible_facts"]["ansible_default_ipv4"]["address"]
|
|
cmd = host.run("dig -t txt acme.opendev.org @" + query_addr)
|
|
count = 0
|
|
for line in cmd.stdout.split('\n'):
|
|
if line.startswith('acme.opendev.org. 60 IN TXT'):
|
|
count = count + 1
|
|
if count != 6:
|
|
# NOTE(ianw): I'm sure there's more pytest-y ways to save this
|
|
# for debugging ...
|
|
print(cmd.stdout)
|
|
assert count == 6, "Did not see required number of TXT records!"
|
|
|
|
def test_certs_created(host):
|
|
if host.backend.get_hostname() == 'letsencrypt01.opendev.org':
|
|
domain_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt01.opendev.org/letsencrypt01.opendev.org.key')
|
|
assert domain_one.exists
|
|
assert domain_one.user == "root"
|
|
assert domain_one.group == "letsencrypt"
|
|
assert domain_one.mode == 0o640
|
|
|
|
cert_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt01.opendev.org/letsencrypt01.opendev.org.cer')
|
|
assert cert_one.exists
|
|
assert cert_one.user == "root"
|
|
assert cert_one.group == "letsencrypt"
|
|
assert cert_one.mode == 0o640
|
|
|
|
ca_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt01.opendev.org/ca.cer')
|
|
assert ca_one.exists
|
|
assert ca_one.user == "root"
|
|
assert ca_one.group == "letsencrypt"
|
|
assert ca_one.mode == 0o640
|
|
|
|
domain_two = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'someotherservice.opendev.org/someotherservice.opendev.org.key')
|
|
assert domain_two.exists
|
|
assert domain_two.user == "root"
|
|
assert domain_two.group == "letsencrypt"
|
|
assert domain_two.mode == 0o640
|
|
|
|
cert_two = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'someotherservice.opendev.org/someotherservice.opendev.org.cer')
|
|
assert cert_two.exists
|
|
assert cert_two.user == "root"
|
|
assert cert_two.group == "letsencrypt"
|
|
assert cert_two.mode == 0o640
|
|
|
|
ca_two = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'someotherservice.opendev.org/ca.cer')
|
|
assert ca_one.exists
|
|
assert ca_one.user == "root"
|
|
assert ca_one.group == "letsencrypt"
|
|
assert ca_one.mode == 0o640
|
|
|
|
elif host.backend.get_hostname() == 'letsencrypt02.opendev.org':
|
|
domain_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt02.opendev.org/letsencrypt02.opendev.org.key')
|
|
assert domain_one.exists
|
|
assert domain_one.user == "root"
|
|
assert domain_one.group == "letsencrypt"
|
|
assert domain_one.mode == 0o640
|
|
|
|
cert_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt02.opendev.org/letsencrypt02.opendev.org.cer')
|
|
assert cert_one.exists
|
|
assert cert_one.user == "root"
|
|
assert cert_one.group == "letsencrypt"
|
|
assert cert_one.mode == 0o640
|
|
|
|
ca_one = host.file(
|
|
'/etc/letsencrypt-certs/'
|
|
'letsencrypt02.opendev.org/ca.cer')
|
|
assert ca_one.exists
|
|
assert ca_one.user == "root"
|
|
assert ca_one.group == "letsencrypt"
|
|
assert ca_one.mode == 0o640
|
|
|
|
else:
|
|
pytest.skip()
|
|
|
|
def test_updated_handler(host):
|
|
if host.backend.get_hostname() == 'letsencrypt01.opendev.org':
|
|
stamp_file = host.file('/tmp/letsencrypt01-main-service.stamp')
|
|
assert stamp_file.exists
|
|
stamp_file = host.file('/tmp/letsencrypt01-other-service.stamp')
|
|
assert stamp_file.exists
|
|
|
|
elif host.backend.get_hostname() == 'letsencrypt02.opendev.org':
|
|
stamp_file = host.file('/tmp/letsencrypt02-main-service.stamp')
|
|
assert stamp_file.exists
|
|
|
|
else:
|
|
pytest.skip()
|
|
|
|
def test_acme_sh_config(host):
|
|
if not host.backend.get_hostname().startswith('letsencrypt0'):
|
|
pytest.skip()
|
|
|
|
config = host.file('/root/.acme.sh/account.conf')
|
|
assert config.exists
|
|
assert config.contains("^ACCOUNT_EMAIL='le-test@opendev.org'")
|