tykling / certgrinder Goto Github PK

Certgrinder is a client/server system for getting LetsEncrypt certificates for your infrastructure. ACME challenges are handled by the Certgrinder server, making it possible to get certificates in highly isolated environments, since only an SSH connection to the Certgrinder server is needed.

Shell 0.61% Python 77.59% Roff 21.78% Dockerfile 0.01%

pki x509 letsencrypt certbot ocsp tlsa spki

certgrinder's People

Contributors

Stargazers

Watchers

Forkers

simonclausen reynir telling estella zarya dlangille bellyfat dallemon

certgrinder's Issues

log message clarifications

It would be nice if the certgrinder x.yy.z running, log-level is ABC log message could include information to identify the client, like the reported SSH ip address.
It would also be nice if the Certificate SAN list is different from the expected message could state the difference between the current (on-disk certificate) and the expected domainsets. perhaps something like

f"to-be-added: {set(expected).difference(set(ondisk)) } to-be-removed: { set(ondisk).difference(set(expected)) }"

"show spki" outputs sha256 hashes but others exist (like sha512)

"check certificate" should check existence of all certificate files

add pidfile stuff

get/check/show OCSP commands

do something about quoting across ssh for certgrinderd command, some templating might be needed for the command, args with quotes are fucky

Do not renew OCSP response until (Next Update - This Update) / 2 has passed

Fix IDNA and make some IDNA tests

`ValueError: error parsing asn1 value: ParseError { kind: ShortData }` inside `load_ocsp_response()`

Traceback (most recent call last):
  File "/opt/certgrinder/virtualenv/bin/certgrinder", line 8, in <module>
    sys.exit(main())
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/certgrinder/certgrinder.py", line 2259, in main
    certgrinder.grind(args)
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/certgrinder/certgrinder.py", line 1835, in grind
    getattr(self, args.method)()
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/certgrinder/certgrinder.py", line 1641, in periodic
    if not self.check_ocsp():
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/certgrinder/certgrinder.py", line 1139, in check_ocsp
    ocsp_response = self.load_ocsp_response(self.ocsp_response_path)
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/certgrinder/certgrinder.py", line 1045, in load_ocsp_response
    return ocsp.load_der_ocsp_response(ocsp_response_data)
  File "/opt/certgrinder/virtualenv/lib/python3.10/site-packages/cryptography/x509/ocsp.py", line 622, in load_der_ocsp_response
    return ocsp.load_der_ocsp_response(data)
ValueError: error parsing asn1 value: ParseError { kind: ShortData }

certgrinderd should watch CT logs

Include manpages in MANIFEST.in

Maybe build them in pre-commit hook?

certgrinderd should support a `show acmeaccount` command

certgrinderd should support a show acmeaccount command to return the acme url for https://datatracker.ietf.org/doc/rfc8657/ use

Support new certificate chain with two intermediates, also support selecting alternate chain

Add "ping" command to check server connection without doing anything

use https://pem.readthedocs.io/en/stable/ for parsing PEM files

0.17.0 does not renew staging certificates when run without --staging

switch to structured logging

logging is a mess, especially when the client has to show logs from the server. Revamp the whole thing into structured logging.

debian default syslog socket

I believe this should be

syslog-socket: "/run/systemd/journal/syslog"

on debian, it would be nice if the certgrinder client could try that on Linux, or perhaps try both the BSD and Debian paths before failing.

Fix code to have a hooks.d folder where post renew hooks can be dropped in by ansible roles

log actions

Drop certbot dependency and use py-acme instead

Use hash in filename

To avoid a changed SAN list being written to the same files

add Dockerfiles

Revamp docker support

The certgrinder docker image for 0.17.2 should be updated so it installs 0.17.2
A new certgrinder docker image needs to be created for the latest released version 0.18.1
A certgrinderd docker image would be nice, with nginx and powerdns maybe
Consider a github action or somesuch to create new docker images when a release is tagged

domain-list:

Running into a weird issue that is most certainly user error, would greatly appreciate some feedback...

Running certgrinder -c ~/certgrinder.conf get certificate to test setup, which results in one of two errors, depending how domain-list: is formatted.

When formatted as

domain-list: "example.com"

I receive the following error:

[certgrinder@proxy /]$ certgrinder -c ~/certgrinder.conf get certificate
Traceback (most recent call last):
File "/usr/local/bin/certgrinder", line 33, in
sys.exit(load_entry_point('certgrinder==0.17.2', 'console_scripts', 'certgrinder')())
File` "/usr/local/lib/python3.8/site-packages/certgrinder/certgrinder.py", line 2232, in main
certgrinder.grind(args)
File "/usr/local/lib/python3.8/site-packages/certgrinder/certgrinder.py", line 1799, in grind
assert isinstance(self.conf["domain-list"], list)
AssertionError

However, when formatted as

domain-list:
- "example.com"

the following ssh error appears, apparently related to having an illegal "-" in the command.

[certgrinder@proxy /]$ certgrinder -c ~/certgrinder.conf get certificate
2022-05-17 06:12:50 -0600 certgrinder INFO Getting new certificate for domainset ['example.com'] ...
2022-05-17 06:12:50 -0600 certgrinder WARNING ssh: illegal option -- -
.....
2022-05-17 06:12:50 -0600 certgrinder ERROR Did not get any output, expected a certificate chain in stdout from certgrinderd

This is on FreeBSD 13.0, client has stock ssh/d_configs, server slightly modified but I'm not sure how that could cause this.

Any idea what I am doing wrong?

cryptography 35.0+ support

The new cryptography 35.0 moved some stuff resulting in the error

AttributeError: module 'cryptography.hazmat.backends.openssl' has no attribute 'ocsp'

"Unsupported access method, please file a certgrinder bug"

This happens when an OCSP responder isn't working and Certgrinderd goes to the next server, more info needed:

2020-10-14 00:00:04 +0000 certgrinder ERROR certgrinderd: OCSP request failed for URL http://ocsp.int-x3.letsencrypt.org with HTTP status code 500 - trying next OCSP server
2020-10-14 00:00:04 +0000 certgrinder WARNING Traceback (most recent call last):
2020-10-14 00:00:04 +0000 certgrinder WARNING   File "/home/certgrinderd/virtualenv/bin/certgrinderd", line 8, in <module>
2020-10-14 00:00:04 +0000 certgrinder WARNING     sys.exit(main())
2020-10-14 00:00:04 +0000 certgrinder WARNING   File "/usr/home/certgrinderd/virtualenv/lib/python3.7/site-packages/certgrinderd/certgrinderd.py", line 1236, in main
2020-10-14 00:00:04 +0000 certgrinder WARNING     method()
2020-10-14 00:00:04 +0000 certgrinder WARNING   File "/usr/home/certgrinderd/virtualenv/lib/python3.7/site-packages/certgrinderd/certgrinderd.py", line 543, in get_ocsp_command
2020-10-14 00:00:04 +0000 certgrinder WARNING     ocsp_response = self.get_ocsp_response(certpath=self.conf["certificate-file"])
2020-10-14 00:00:04 +0000 certgrinder WARNING   File "/usr/home/certgrinderd/virtualenv/lib/python3.7/site-packages/certgrinderd/certgrinderd.py", line 608, in get_ocsp_response
2020-10-14 00:00:04 +0000 certgrinder WARNING     ), "Unsupported access method, please file a certgrinder bug"
2020-10-14 00:00:04 +0000 certgrinder WARNING AssertionError: Unsupported access method, please file a certgrinder bug
2020-10-14 00:00:04 +0000 certgrinder ERROR Did not get an OCSP response in stdout from certgrinderd
2020-10-14 00:00:04 +0000 certgrinder ERROR Failed getting a new OCSP response for domainset: ['deic-ore.anycast.censurfridns.dk', 'deic-ore.anycast.censurfridns.nu', 'deic-ore.anycast.uncensoreddns.org', 'deic-ore.anycast.uncensoreddns.dk', 'anycast.censurfridns.dk', 'anycast.censurfridns.nu', 'anycast.uncensoreddns.org', 'anycast.uncensoreddns.dk']
reloadAllCertificates()
exporter_exporter: stopped
exporter_exporter: started

certgrinder should support a `show caa` command

certgrinder should support a show caa command to make certgrinderd return the CAA record including method and account pin as described in https://datatracker.ietf.org/doc/rfc8657/