def test_702_003(self): domain = self.test_domain nameA = "test-a." + domain nameB = "test-b." + domain domains = [domain, nameA, nameB] # # generate 1 MD and 2 vhosts conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_md(domains) conf.add_vhost(nameA, docRoot="htdocs/a") conf.add_vhost(nameB, docRoot="htdocs/b") conf.install() # # create docRoot folder self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "a"), "name.txt", nameA) self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "b"), "name.txt", nameB) # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) # # check: SSL is running OK certA = TestEnv.get_cert(nameA) assert nameA in certA.get_san_list() certB = TestEnv.get_cert(nameB) assert nameB in certB.get_san_list() assert certA.get_serial() == certB.get_serial() # assert TestEnv.get_content(nameA, "/name.txt") == nameA assert TestEnv.get_content(nameB, "/name.txt") == nameB
def test_700_002(self): # generate config with two MDs domain = self.test_domain domainA = "a-" + domain domainB = "b-" + domain domainsA = [domainA, "www." + domainA] domainsB = [domainB, "www." + domainB] conf = HttpdConf() conf.add_admin("*****@*****.**") conf.add_drive_mode("auto") conf.add_md(domainsA) conf.add_md(domainsB) conf.add_vhost(domainsA) conf.add_vhost(domainsB) conf.install() # # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domainsA) TestEnv.check_md(domainsB) # await drive completion assert TestEnv.await_completion([domainA, domainB]) TestEnv.check_md_complete(domainA) TestEnv.check_md_complete(domainB) # # check: SSL is running OK certA = TestEnv.get_cert(domainA) assert domainsA == certA.get_san_list() certB = TestEnv.get_cert(domainB) assert domainsB == certB.get_san_list() # # should have a single account now assert 1 == len(TestEnv.list_accounts())
def test_702_001(self): domain = self.test_domain # generate config with one MD domains = [domain, "www." + domain] conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_drive_mode("auto") conf.add_md(domains) conf.install() # # restart, check that MD is synched to store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) stat = TestEnv.get_md_status(domain) assert stat["watched"] == 0 # # add vhost for MD, restart should drive it conf.add_vhost(domains) conf.install() assert TestEnv.apache_restart() == 0 assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) stat = TestEnv.get_md_status(domain) assert stat["watched"] == 1 cert = TestEnv.get_cert(domain) assert domain in cert.get_san_list() # # challenges should have been removed # file system needs to have correct permissions TestEnv.check_dir_empty(TestEnv.store_challenges()) TestEnv.check_file_permissions(domain)
def test_702_006(self): domain = self.test_domain nameA = "test-a." + domain domains = [domain, nameA] # # generate 1 MD, 1 vhost conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_ca_challenges(["invalid-01", "invalid-02"]) conf.add_md(domains) conf.add_vhost(nameA, docRoot="htdocs/a") conf.install() # # create docRoot folder self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "a"), "name.txt", nameA) # # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # await drive completion md = TestEnv.await_error(domain) assert md assert md['renewal']['errors'] > 0 assert md['renewal']['last']['problem'] == 'challenge-mismatch' assert 'account' not in md['ca'] # # check: that request to domains give 503 Service Unavailable cert = TestEnv.get_cert(nameA) assert nameA in cert.get_san_list() assert TestEnv.getStatus(nameA, "/name.txt") == 503
def test_702_005(self): domain = self.test_domain nameA = "test-a." + domain domains = [domain, nameA] # # generate 1 MD and 1 vhost conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_drive_mode("manual") conf.add_md(domains) conf.add_vhost(nameA, docRoot="htdocs/a") conf.install() # # create docRoot folder self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "a"), "name.txt", nameA) # # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # # check: that request to domains give 503 Service Unavailable cert1 = TestEnv.get_cert(nameA) assert nameA in cert1.get_san_list() assert TestEnv.getStatus(nameA, "/name.txt") == 503 # # check temporary cert from server cert2 = CertUtil(TestEnv.path_fallback_cert(domain)) assert cert1.get_serial() == cert2.get_serial(), \ "Unexpected temporary certificate on vhost %s. Expected cn: %s , but found cn: %s" % ( nameA, cert2.get_cn(), cert1.get_cn() )
def test_720_006(self): dns01cmd = ("%s/dns01.py" % TestEnv.TESTROOT) domain = self.test_domain dwild = "*." + domain domain2 = "www." + domain domains = [domain, dwild, domain2] conf = HttpdConf() conf.add_admin("*****@*****.**") conf.add_ca_challenges(["dns-01"]) conf.add_dns01_cmd(dns01cmd) conf.add_md(domains) conf.add_vhost(domain2) conf.add_vhost([domain, dwild]) conf.install() # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # await drive completion assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) # check: SSL is running OK certA = TestEnv.get_cert(domain) altnames = certA.get_san_list() for domain in [domain, dwild]: assert domain in altnames
def test_602_000(self): # test case: generate config with md -> restart -> drive -> generate config # with vhost and ssl -> restart -> check HTTPS access domain = self.test_domain domains = [domain, "www." + domain] # - generate config with one md conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_drive_mode("manual") conf.add_md(domains) conf.install() # - restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # - drive assert TestEnv.a2md(["-v", "drive", domain])['rv'] == 0 assert TestEnv.apache_restart() == 0 TestEnv.check_md_complete(domain) # - append vhost to config conf.add_vhost(domains) conf.install() assert TestEnv.apache_restart() == 0 # check: SSL is running OK cert = TestEnv.get_cert(domain) assert domain in cert.get_san_list() # check file system permissions: TestEnv.check_file_permissions(domain)
def test_702_040(self): domain = self.test_domain domains = [domain, "www." + domain] # # generate 1 MD and 1 vhost conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_line("LogLevel core:debug") conf.add_line("LogLevel ssl:debug") conf.add_line("Protocols http/1.1 acme-tls/1") conf.add_drive_mode("auto") conf.add_ca_challenges(["tls-alpn-01"]) conf.add_md(domains) conf.add_vhost(domains) conf.install() # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # check that acme-tls/1 is available for all domains stat = TestEnv.get_md_status(domain) assert stat["proto"]["acme-tls/1"] == domains assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) # # check SSL running OK cert = TestEnv.get_cert(domain) assert domain in cert.get_san_list()
def test_730_002(self): # MD with static cert files, force driving domain = self.test_domain domains = [domain, 'www.%s' % domain] testpath = os.path.join(TestEnv.GEN_DIR, 'test_920_001') # cert that is only 10 more days valid CertUtil.create_self_signed_cert(domains, { "notBefore": -80, "notAfter": 10 }, serial=730001, path=testpath) cert_file = os.path.join(testpath, 'pubcert.pem') pkey_file = os.path.join(testpath, 'privkey.pem') assert os.path.exists(cert_file) assert os.path.exists(pkey_file) conf = HttpdConf() conf.add_admin("*****@*****.**") conf.start_md(domains) conf.add_line("MDCertificateFile %s" % (cert_file)) conf.add_line("MDCertificateKeyFile %s" % (pkey_file)) conf.add_line("MDRenewMode always") conf.end_md() conf.add_vhost(domain) conf.install() assert TestEnv.apache_restart() == 0 # check if the domain uses it, it appears in our stats and renewal is off cert = TestEnv.get_cert(domain) assert ('%X' % 730001) == cert.get_serial() stat = TestEnv.get_md_status(domain) assert stat assert 'cert' in stat assert stat['renew'] == True assert TestEnv.await_renewal(domains)
def test_702_031(self): domain = self.test_domain nameX = "test-x." + domain nameA = "test-a." + domain nameB = "test-b." + domain nameC = "test-c." + domain domains = [nameX, nameA, nameB] # # generate 1 MD and 2 vhosts conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_md(domains) conf.add_vhost(nameA) conf.add_vhost(nameB) conf.install() # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) assert TestEnv.await_completion([nameX]) TestEnv.check_md_complete(nameX) # # check: SSL is running OK certA = TestEnv.get_cert(nameA) assert nameA in certA.get_san_list() certB = TestEnv.get_cert(nameB) assert nameB in certB.get_san_list() assert certA.get_serial() == certB.get_serial() # # change MD by removing 1st name and adding another new_list = [nameA, nameB, nameC] conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_md(new_list) conf.add_vhost(nameA) conf.add_vhost(nameB) conf.install() # restart, check that host still works and have new cert assert TestEnv.apache_restart() == 0 TestEnv.check_md(new_list, md=nameX) assert TestEnv.await_completion([nameA]) # certA2 = TestEnv.get_cert(nameA) assert nameA in certA2.get_san_list() assert certA.get_serial() != certA2.get_serial()
def test_702_032(self): domain = self.test_domain name1 = "server1." + domain name2 = "server2.b" + domain # need a separate TLD to avoid rate limites # # generate 2 MDs and 2 vhosts conf = HttpdConf() conf.add_admin("admin@" + domain) conf._add_line("MDMembers auto") conf.add_md([name1]) conf.add_md([name2]) conf.add_vhost(name1) conf.add_vhost(name2) conf.install() # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md([name1]) TestEnv.check_md([name2]) assert TestEnv.await_completion([name1, name2]) TestEnv.check_md_complete(name2) # # check: SSL is running OK cert1 = TestEnv.get_cert(name1) assert name1 in cert1.get_san_list() cert2 = TestEnv.get_cert(name2) assert name2 in cert2.get_san_list() # # remove second md and vhost, add name2 to vhost1 conf = HttpdConf() conf.add_admin("admin@" + domain) conf._add_line("MDMembers auto") conf.add_md([name1]) conf.add_vhost([name1, name2]) conf.install() assert TestEnv.apache_restart() == 0 TestEnv.check_md([name1, name2]) assert TestEnv.await_completion([name1]) # cert1b = TestEnv.get_cert(name1) assert name1 in cert1b.get_san_list() assert name2 in cert1b.get_san_list() assert cert1.get_serial() != cert1b.get_serial()
def test_602_002(self): # test case: one md, that covers two vhosts domain = self.test_domain nameA = "a." + domain nameB = "b." + domain domains = [domain, nameA, nameB] # - generate config with one md conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_drive_mode("manual") conf.add_md(domains) conf.install() # - restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # - drive assert TestEnv.a2md(["drive", domain])['rv'] == 0 assert TestEnv.apache_restart() == 0 TestEnv.check_md_complete(domain) # - append vhost to config conf.add_vhost(nameA, docRoot="htdocs/a") conf.add_vhost(nameB, docRoot="htdocs/b") conf.install() # - create docRoot folder self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "a"), "name.txt", nameA) self._write_res_file(os.path.join(TestEnv.APACHE_HTDOCS_DIR, "b"), "name.txt", nameB) # check: SSL is running OK assert TestEnv.apache_restart() == 0 certA = TestEnv.get_cert(nameA) assert nameA in certA.get_san_list() certB = TestEnv.get_cert(nameB) assert nameB in certB.get_san_list() assert certA.get_serial() == certB.get_serial() assert TestEnv.get_content(nameA, "/name.txt") == nameA assert TestEnv.get_content(nameB, "/name.txt") == nameB
def test_700_030(self): domain = self.test_domain nameX = "x." + domain nameA = "a." + domain nameB = "b." + domain domains = [nameX, nameA, nameB] # # generate 1 MD and 2 vhosts conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_md(domains) conf.add_vhost(nameA) conf.add_vhost(nameB) conf.install() # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) assert TestEnv.await_completion([nameX]) TestEnv.check_md_complete(nameX) # # check: SSL is running OK certA = TestEnv.get_cert(nameA) assert nameA in certA.get_san_list() certB = TestEnv.get_cert(nameB) assert nameB in certB.get_san_list() assert certA.get_serial() == certB.get_serial() # # change MD by removing 1st name new_list = [nameA, nameB] conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_md(new_list) conf.add_vhost(nameA) conf.add_vhost(nameB) conf.install() # restart, check that host still works and have same cert assert TestEnv.apache_restart() == 0 TestEnv.check_md(new_list, md=nameX) status = TestEnv.get_certificate_status(nameA) assert status['serial'] == certA.get_serial()
def test_602_001(self): # test case: same as test_600_000, but with two parallel managed domains domainA = "a-" + self.test_domain domainB = "b-" + self.test_domain # - generate config with one md domainsA = [domainA, "www." + domainA] domainsB = [domainB, "www." + domainB] conf = HttpdConf() conf.add_admin("*****@*****.**") conf.add_drive_mode("manual") conf.add_md(domainsA) conf.add_md(domainsB) conf.install() # - restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domainsA) TestEnv.check_md(domainsB) # - drive assert TestEnv.a2md(["drive", domainA])['rv'] == 0 assert TestEnv.a2md(["drive", domainB])['rv'] == 0 assert TestEnv.apache_restart() == 0 TestEnv.check_md_complete(domainA) TestEnv.check_md_complete(domainB) # - append vhost to config conf.add_vhost(domainsA) conf.add_vhost(domainsB) conf.install() # check: SSL is running OK assert TestEnv.apache_restart() == 0 certA = TestEnv.get_cert(domainA) assert domainsA == certA.get_san_list() certB = TestEnv.get_cert(domainB) assert domainsB == certB.get_san_list()
def test_702_002(self): domain = self.test_domain domainA = "a-" + domain domainB = "b-" + domain # # generate config with two MDs domainsA = [domainA, "www." + domainA] domainsB = [domainB, "www." + domainB] conf = HttpdConf() conf.add_admin("*****@*****.**") conf.add_drive_mode("auto") conf.add_md(domainsA) conf.add_md(domainsB) conf.add_vhost(domainsA) conf.add_vhost(domainsB) conf.install() # # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domainsA) TestEnv.check_md(domainsB) # # await drive completion, do not restart assert TestEnv.await_completion([domainA, domainB], restart=False) # staged certificates are now visible on the status resources status = TestEnv.get_md_status(domainA) assert 'renewal' in status assert 'cert' in status['renewal'] assert 'sha256-fingerprint' in status['renewal']['cert'] # restart and activate assert TestEnv.apache_restart() == 0 # check: SSL is running OK certA = TestEnv.get_cert(domainA) assert domainsA == certA.get_san_list() certB = TestEnv.get_cert(domainB) assert domainsB == certB.get_san_list()
def test_710_001(self): domain = self.test_domain # use ACMEv1 initially TestEnv.set_acme('acmev1') # generate config with one MD, restart, gets cert domains = [ domain, "www." + domain ] conf = HttpdConf() conf.add_admin( "admin@" + domain ) conf.add_md( domains ) conf.add_vhost(domains) conf.install() assert TestEnv.apache_restart() == 0 assert TestEnv.await_completion([ domain ] ) TestEnv.check_md_complete(domain) cert1 = TestEnv.get_cert(domain) assert domain in cert1.get_san_list() # use ACMEv2 now for everything TestEnv.set_acme('acmev2') conf = HttpdConf() conf.add_admin( "admin@" + domain ) conf.add_md( domains ) conf.add_vhost(domains) conf.install() # restart, gets cert, should still be the same cert as it remains valid assert TestEnv.apache_restart() == 0 status = TestEnv.get_certificate_status( domain ) assert status['serial'] == cert1.get_serial() # change the MD so that we need a new cert domains = [ domain, "www." + domain, "another." + domain ] conf = HttpdConf() conf.add_admin( "admin@" + domain ) conf.add_md( domains ) conf.add_vhost(domains) conf.install() assert TestEnv.apache_restart() == 0 assert TestEnv.await_completion([ domain ] ) # should no longer the same cert status = TestEnv.get_certificate_status( domain ) assert status['serial'] != cert1.get_serial() TestEnv.check_md_complete(domain) # should have a 2 accounts now assert 2 == len(TestEnv.list_accounts())
def test_700_004(self, challengeType): # generate 1 MD and 1 vhost domain = self.test_domain domains = [domain, "www." + domain] conf = HttpdConf() conf.add_admin("admin@" + domain) conf.add_line("Protocols http/1.1 acme-tls/1") conf.add_drive_mode("auto") conf.add_ca_challenges([challengeType]) conf.add_md(domains) conf.add_vhost(domains) conf.install() # # restart (-> drive), check that MD was synched and completes assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) # # check SSL running OK cert = TestEnv.get_cert(domain) assert domain in cert.get_san_list()
def test_720_002b(self): dns01cmd = ("%s/dns01-not-found.py" % TestEnv.TESTROOT) domain = self.test_domain domains = [domain, "xxx." + domain] conf = HttpdConf() conf.add_admin("*****@*****.**") conf.add_dns01_cmd(dns01cmd) conf.add_md(domains) conf.add_vhost(domains) conf.install() # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md(domains) # await drive completion assert TestEnv.await_completion([domain]) TestEnv.check_md_complete(domain) # check: SSL is running OK certA = TestEnv.get_cert(domain) altnames = certA.get_san_list() for domain in domains: assert domain in altnames
def test_710_002(self): domain = self.test_domain # use ACMEv1 initially TestEnv.set_acme('acmev1') domainA = "a-" + domain domainB = "b-" + domain # generate config with two MDs domainsA = [ domainA, "www." + domainA ] domainsB = [ domainB, "www." + domainB ] conf = HttpdConf() conf.add_admin( "*****@*****.**" ) conf.add_line( "MDMembers auto" ) conf.add_md( [ domainA ] ) conf.add_md( [ domainB ] ) conf.add_vhost(domainsA) conf.add_vhost(domainsB) conf.install() # restart, check that md is in store assert TestEnv.apache_restart() == 0 TestEnv.check_md( domainsA ) TestEnv.check_md( domainsB ) # await drive completion assert TestEnv.await_completion( [ domainA, domainB ] ) TestEnv.check_md_complete(domainsA[0]) TestEnv.check_md_complete(domainsB[0]) cert1 = TestEnv.get_cert(domainA) # should have a single account now assert 1 == len(TestEnv.list_accounts()) # use ACMEv2 now for everything TestEnv.set_acme('acmev2') # change the MDs so that we need a new cert domainsA = [ domainA, "www." + domainA, "another." + domainA ] domainsB = [ domainB, "www." + domainB, "another." + domainB ] conf = HttpdConf() conf.add_admin( "*****@*****.**" ) conf.add_line( "MDMembers auto" ) conf.add_md( [ domainA ] ) conf.add_md( [ domainB ] ) conf.add_vhost(domainsA) conf.add_vhost(domainsB) conf.install() # restart, gets cert assert TestEnv.apache_restart() == 0 assert TestEnv.await_completion([ domainA, domainB ] ) TestEnv.check_md( domainsA ) TestEnv.check_md( domainsB ) TestEnv.check_md_complete(domainsA[0]) cert2 = TestEnv.get_cert(domainA) # should no longer the same cert assert cert1.get_serial() != cert2.get_serial() # should have a 2 accounts now assert 2 == len(TestEnv.list_accounts())