def fetch_all_pending_acme_certs(): """Instantiate celery workers to resolve all pending Acme certificates""" function = f"{__name__}.{sys._getframe().f_code.co_name}" task_id = None if celery.current_task: task_id = celery.current_task.request.id log_data = { "function": function, "message": "Starting job.", "task_id": task_id, } if task_id and is_task_active(function, task_id, None): log_data["message"] = "Skipping task: Task is already active" current_app.logger.debug(log_data) return current_app.logger.debug(log_data) pending_certs = pending_certificate_service.get_unresolved_pending_certs() # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == "acme-issuer": if datetime.now(timezone.utc) - cert.last_updated > timedelta(minutes=5): log_data["message"] = "Triggering job for cert {}".format(cert.name) log_data["cert_name"] = cert.name log_data["cert_id"] = cert.id current_app.logger.debug(log_data) fetch_acme_cert.delay(cert.id) metrics.send(f"{function}.success", "counter", 1) return log_data
def fetch_all_pending_acme_certs(): """Instantiate celery workers to resolve all pending Acme certificates""" pending_certs = pending_certificate_service.get_unresolved_pending_certs() function = f"{__name__}.{sys._getframe().f_code.co_name}" log_data = { "function": function, "message": "Starting job.", } current_app.logger.debug(log_data) # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == "acme-issuer": if datetime.now(timezone.utc) - cert.last_updated > timedelta( minutes=5): log_data["message"] = "Triggering job for cert {}".format( cert.name) log_data["cert_name"] = cert.name log_data["cert_id"] = cert.id current_app.logger.debug(log_data) fetch_acme_cert.delay(cert.id) red.set(f'{function}.last_success', int(time.time())) metrics.send(f"{function}.success", 'counter', 1)
def fetch_all_pending_acme_certs(): """Instantiate celery workers to resolve all pending Acme certificates""" pending_certs = pending_certificate_service.get_unresolved_pending_certs() # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == 'acme-issuer': if cert.last_updated == cert.date_created or datetime.now( timezone.utc) - cert.last_updated > timedelta(minutes=3): fetch_acme_cert.delay(cert.id)
def report_unresolved_pending_certificates_age(): """Celery task that for each unresolved pending certificate emits a metric with the current time since creation (seconds).""" pending_certs = pending_certificate_service.get_unresolved_pending_certs() now = arrow.now() for cert in pending_certs: value = int((cert.date_created - now).total_seconds()) metrics.send( "unresolved_pending_certificate_age", "counter", value, metric_tags={"certificate": cert.name}, )
def fetch_all_pending_acme_certs(): """Instantiate celery workers to resolve all pending Acme certificates""" pending_certs = pending_certificate_service.get_unresolved_pending_certs() log_data = { "function": "{}.{}".format(__name__, sys._getframe().f_code.co_name), "message": "Starting job." } current_app.logger.debug(log_data) # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == 'acme-issuer': if datetime.now(timezone.utc) - cert.last_updated > timedelta(minutes=5): log_data["message"] = "Triggering job for cert {}".format(cert.name) log_data["cert_name"] = cert.name log_data["cert_id"] = cert.id current_app.logger.debug(log_data) fetch_acme_cert.delay(cert.id)
def fetch_all_pending_acme_certs(): """Instantiate celery workers to resolve all pending Acme certificates""" pending_certs = pending_certificate_service.get_unresolved_pending_certs() log_data = { "function": "{}.{}".format(__name__, sys._getframe().f_code.co_name), "message": "Starting job." } current_app.logger.debug(log_data) # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == 'acme-issuer': if datetime.now(timezone.utc) - cert.last_updated > timedelta(minutes=5): log_data["message"] = "Triggering job for cert {}".format(cert.name) log_data["cert_name"] = cert.name log_data["cert_id"] = cert.id current_app.logger.debug(log_data) fetch_acme_cert.delay(cert.id)
def fetch_all_pending_certs(): """Instantiate celery workers to resolve all certificates""" function = f"{__name__}.{sys._getframe().f_code.co_name}" task_id = None if celery.current_task: task_id = celery.current_task.request.id log_data = { "function": function, "message": "Starting fetching all pending certs.", "task_id": task_id, } if task_id and is_task_active(function, task_id, None): log_data["message"] = "Skipping task: Task is already active" current_app.logger.debug(log_data) return current_app.logger.debug(log_data) pending_certs = pending_certificate_service.get_unresolved_pending_certs() for cert in pending_certs: cert_authority = get_authority(cert.authority_id) # handle only certs from non-acme issuers, as acme certs are specially # taken care of in the `fetach_all_pending_acme_certs` function if cert_authority.plugin_name != "acme-issuer": log_data["message"] = "Triggering job for cert {}".format( cert.name) log_data["cert_name"] = cert.name log_data["cert_id"] = cert.id current_app.logger.debug(log_data) fetch_cert.delay(cert.id) metrics.send(f"{function}.success", "counter", 1) return log_data
def fetch_all_acme(): """ Attempt to get full certificates for each pending certificate listed with the acme-issuer. This is more efficient for acme-issued certificates because it will configure all of the DNS challenges prior to resolving any certificates. """ log_data = { "function": "{}.{}".format(__name__, sys._getframe().f_code.co_name) } pending_certs = pending_certificate_service.get_unresolved_pending_certs() new = 0 failed = 0 wrong_issuer = 0 acme_certs = [] # We only care about certs using the acme-issuer plugin for cert in pending_certs: cert_authority = get_authority(cert.authority_id) if cert_authority.plugin_name == 'acme-issuer': acme_certs.append(cert) else: wrong_issuer += 1 authority = plugins.get("acme-issuer") resolved_certs = authority.get_ordered_certificates(acme_certs) for cert in resolved_certs: real_cert = cert.get("cert") # It's necessary to reload the pending cert due to detached instance: http://sqlalche.me/e/bhk3 pending_cert = pending_certificate_service.get(cert.get("pending_cert").id) if real_cert: # If a real certificate was returned from issuer, then create it in Lemur and mark # the pending certificate as resolved final_cert = pending_certificate_service.create_certificate(pending_cert, real_cert, pending_cert.user) pending_certificate_service.update( pending_cert.id, resolved=True ) pending_certificate_service.update( pending_cert.id, resolved_cert_id=final_cert.id ) # add metrics to metrics extension new += 1 else: failed += 1 error_log = copy.deepcopy(log_data) error_log["message"] = "Pending certificate creation failure" error_log["pending_cert_id"] = pending_cert.id error_log["last_error"] = cert.get("last_error") error_log["cn"] = pending_cert.cn if pending_cert.number_attempts > 4: error_log["message"] = "Marking pending certificate as resolved" send_pending_failure_notification(pending_cert, notify_owner=pending_cert.notify) # Mark "resolved" as True pending_certificate_service.update( cert.id, resolved=True ) else: pending_certificate_service.increment_attempt(pending_cert) pending_certificate_service.update( cert.get("pending_cert").id, status=str(cert.get("last_error")) ) current_app.logger.error(error_log) log_data["message"] = "Complete" log_data["new"] = new log_data["failed"] = failed log_data["wrong_issuer"] = wrong_issuer current_app.logger.debug(log_data) print( "[+] Certificates: New: {new} Failed: {failed} Not using ACME: {wrong_issuer}".format( new=new, failed=failed, wrong_issuer=wrong_issuer ) )