Current File : //lib/python2.7/site-packages/salt/modules/acme.pyc
�
���^c @@ s1 d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z e j
e � Z e j
j j d d d d d g � Z d Z d
� Z d � Z d � Z d d
� Z d d d e d d d d d d d d d d d d d d d � Z d � Z d � Z d � Z d � Z d d � Z d d � Z d S( uo
ACME / Let's Encrypt module
===========================
.. versionadded: 2016.3
This module currently looks for certbot script in the $PATH as
- certbot,
- lestsencrypt,
- certbot-auto,
- letsencrypt-auto
eventually falls back to /opt/letsencrypt/letsencrypt-auto
.. note::
Installation & configuration of the Let's Encrypt client can for example be done using
https://github.com/saltstack-formulas/letsencrypt-formula
.. warning::
Be sure to set at least accept-tos = True in cli.ini!
Most parameters will fall back to cli.ini defaults if None is given.
DNS plugins
-----------
This module currently supports the CloudFlare certbot DNS plugin. The DNS
plugin credentials file needs to be passed in using the
``dns_plugin_credentials`` argument.
Make sure the appropriate certbot plugin for the wanted DNS provider is
installed before using this module.
i ( t absolute_importt print_functiont unicode_literalsNu certbotu letsencryptu certbot-autou letsencrypt-autou! /opt/letsencrypt/letsencrypt-autou /etc/letsencrypt/live/c C@ s t d k d f S( u6
Only work when letsencrypt-auto is installed
uK The ACME execution module cannot be loaded: letsencrypt-auto not installed.N( t LEAt None( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt __virtual__6 s c C@ s t j j t | d j | � � S( u;
Return expected path of a Let's Encrypt live cert
u {0}.pem( t ost patht joint LE_LIVEt format( t namet cert_type( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt
_cert_file= s c C@ s| t | d � } d t k r2 t d | � d } n: d j | � } d j | � } t t d | d d �� } t j j | � S( uV
Return the expiry date of a cert
:return datetime object of expiry date
u certu
tls.cert_infou not_afteru$ openssl x509 -in {0} -noout -enddateu& date --date="$({0} | cut -d= -f2)" +%su cmd.shellt output_loglevelu quiet( R
t __salt__R
t floatt datetimet
fromtimestamp( R t cert_filet expiryt openssl_cmdt strptime_sux_cmd( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt _expiresD s c C@ s5 t | � } | d k r1 | t j d | � } n | S( u�
Date before a certificate should be renewed
:param name: Common Name of the certificate (DNS name of certificate)
:param window: days before expiry date to renew
:return datetime object of first renewal date
t daysN( R R R t timedelta( R t windowR ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt _renew_byY s u rootu 0640c C@ s. t d d d g } d g } t | d � } t d | � sS t j d | � t } n5 t | | � r� t j d | � | j d � t } n | r� | j d
j | � � n | r� | j d j | � � n | r� | r� i t d 6d
d 6S| j d � n | r/| j d � | t k r�| j d j | � � q�ni | | k r�| d k rm| j d � | j d j | � � q�i t d 6d j | � d 6Sn
| j d � | r�| j d j | � � n | r�| j d j | � � n | j d j | � � | d0 k r"x' | D] } | j d j | � � q�Wn | rA| j d j | � � n |
r`| j d j |
� � n | r| j d j | � � n | r�| j d j | � � n | r�| j d j | � � n t d d j | � � } | d d! k rvd" | d# k rQ| j d$ � t d d j | � � } | d d! k rsi t d 6d% j | | d# � d 6Sqvi t d 6d% j | | d# � d 6Sn d& | d' k r�d( j | � } d0 } n3 | r�d) j | � } t } n d* j | � } t } i | d 6t | � d+ 6i d, 6| d 6} t d- t | d. � | | | |
d/ t �\ } } | S(1 u�
Obtain/renew a certificate from an ACME CA, probably Let's Encrypt.
:param name: Common Name of the certificate (DNS name of certificate)
:param aliases: subjectAltNames (Additional DNS names on certificate)
:param email: e-mail address for interaction with ACME provider
:param webroot: True or a full path to use to use webroot. Otherwise use standalone mode
:param test_cert: Request a certificate from the Happy Hacker Fake CA (mutually exclusive with 'server')
:param renew: True/'force' to force a renewal, or a window of renewal before expiry in days
:param keysize: RSA key bits
:param server: API endpoint to talk to
:param owner: owner of the private key file
:param group: group of the private key file
:param mode: mode of the private key file
:param certname: Name of the certificate to save
:param preferred_challenges: A sorted, comma delimited list of the preferred
challenge to use during authorization with the
most preferred challenge listed first.
:param tls_sni_01_port: Port used during tls-sni-01 challenge. This only affects
the port Certbot listens on. A conforming ACME server
will still attempt to connect on port 443.
:param tls_sni_01_address: The address the server listens to during tls-sni-01
challenge.
:param http_01_port: Port used in the http-01 challenge. This only affects
the port Certbot listens on. A conforming ACME server
will still attempt to connect on port 80.
:param https_01_address: The address the server listens to during http-01 challenge.
:param dns_plugin: Name of a DNS plugin to use (currently only 'cloudflare')
:param dns_plugin_credentials: Path to the credentials file if required by the specified DNS plugin
:return: dict with 'result' True/False/None, 'comment' and certificate's expiry date ('not_after')
CLI example:
.. code-block:: bash
salt 'gitlab.example.com' acme.cert dev.example.com "[gitlab.example.com]" test_cert=True renew=14 webroot=/opt/gitlab/embedded/service/gitlab-rails/public
u certonlyu --non-interactiveu --agree-tosu
cloudflareu certu file.file_existsu# Certificate %s does not exist (yet)u Certificate %s will be renewedu --renew-by-defaultu --server {0}u --cert-name {0}u resultu( Use either server or test_cert, not bothu commentu --test-certu --authenticator webrootu --webroot-path {0}u --dns-cloudflareu --dns-cloudflare-credentials {0}u! DNS plugin '{0}' is not supportedu --authenticator standaloneu --email {0}u --rsa-key-size {0}u
--domains {0}u --preferred-challenges {}u --tls-sni-01-port {}u --tls-sni-01-address {}u --http-01-port {}u --http-01-address {}u cmd.run_allu u retcodei u expandu stderru --expandu( Certificate {0} renewal failed with:
{1}u no action takenu stdoutu Certificate {0} unchangedu Certificate {0} renewedu Certificate {0} obtainedu not_afteru changesu file.check_permsu privkeyt follow_symlinksN(
R R
R t logt debugt Falset
needs_renewalt appendt TrueR
R R t expires( R t aliasest emailt webroott test_certt renewt keysizet servert ownert groupt modet certnamet preferred_challengest tls_sni_01_portt tls_sni_01_addresst http_01_portt http_01_addresst
dns_plugint dns_plugin_credentialst cmdt supported_dns_pluginsR t dnst rest commentt resultt rett _( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt certh s� 9
%% ( c C@ s t d t � d S( u�
Return a list of active certificates
CLI example:
.. code-block:: bash
salt 'vhost.example.com' acme.certs
u file.readdiri ( R R ( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt certs� s
c C@ sf t | d � } d t k rC t d | � } | d j � | d <| Sd j | � } t d | d d �S( u
Return information about a certificate
.. note::
Will output tls.cert_info if that's available, or OpenSSL text if not
:param name: CommonName of cert
CLI example:
.. code-block:: bash
salt 'gitlab.example.com' acme.info dev.example.com
u certu
tls.cert_infou
extensionsu! openssl x509 -in {0} -noout -textu cmd.runR u quiet( R
R t keysR
( R R t cert_infoR ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt info s c C@ s t | � j � S( u�
The expiry date of a certificate in ISO format
:param name: CommonName of cert
CLI example:
.. code-block:: bash
salt 'gitlab.example.com' acme.expires dev.example.com
( R t isoformat( R ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyR# $ s c C@ s t d t | d � � S( u
Test if a certificate is in the Let's Encrypt Live directory
:param name: CommonName of cert
Code example:
.. code-block:: python
if __salt__['acme.has']('dev.example.com'):
log.info('That is one nice certificate you have there!')
u file.file_existsu cert( R R
( R ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt has3 s
c C@ s t | | � j � S( u�
Date in ISO format when a certificate should first be renewed
:param name: CommonName of cert
:param window: number of days before expiry when renewal should take place
( R RC ( R R ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt renew_byC s c C@ sA | d k r% | d d t f k r% t St | | � t j j � k S( u�
Check if a certificate needs renewal
:param name: CommonName of cert
:param window: Window in days to renew earlier or True/force to just return True
Code example:
.. code-block:: python
if __salt__['acme.needs_renewal']('dev.example.com'):
__salt__['acme.cert']('dev.example.com', **kwargs)
else:
log.info('Your certificate is still good')
u forceu ForceN( R R" R R t today( R R ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyR M s !( t __doc__t
__future__R R R t loggingR R t salt.utils.patht saltt getLoggert __name__R t utilsR t which_binR R R R
R R R R R> R? RB R# RD RE R ( ( ( s5 /usr/lib/python2.7/site-packages/salt/modules/acme.pyt <module>$ sL �
Mini Shell