← Back
Editing: main.cpython-38.pyc
U �]H� � @ s d Z ddlmZ ddlZddlZddlZddlZddlZ ddl Z ddl m Z ddlmZ ddlZddlmZ ddlmZ ddlmZ dd lmZ dd lmZ dd lmZ dd lmZ dd lmZ ddlm Z ddlmZ ddlmZ ddlm Z ddlm Z ddlm Z ddlm Z ddlm Z ddlm!Z! ddl"m#Z# ddl"m$Z$ ddl"m%Z% ddl&m!Z'm(Z) ddl*m+Z, ddl*m-Z- dd l*m.Z/ d Z0e�1e2�Z3d d � Z4d d!� Z5dpd"d#�Z6d$d%� Z7d&d'� Z8d(d)� Z9d*d+� Z:d,d-� Z;d.d/� Z<d0d1� Z=d2d3� Z>dqd4d5�Z?drd6d7�Z@d8d9� ZAd:d;� ZBd<d=� ZCd>d?� ZDd@dA� ZEdBdC� ZFdsdDdE�ZGdFdG� ZHdHdI� ZIdJdK� ZJdLdM� ZKdNdO� ZLdPdQ� ZMdRdS� ZNdTdU� ZOdVdW� ZPdXdY� ZQdZd[� ZRd\d]� ZSd^d_� ZTd`da� ZUdbdc� ZVddde� ZWdfdg� ZXdhdi� ZYdjdk� ZZdtdldm�Z[e2dnk�re[� Z\e\�r�e3�]doe\� e�^e\� dS )uzCertbot main entry point.� )�print_functionN)�errors)�Union)�account)� cert_manager)�cli)�client)� configuration)� constants)� crypto_util)�eff)�hooks)� interfaces)�log)�renewal)�reporter)�storage)�updater)�util)� filesystem)�misc)�os)r �ops)�disco)� enhancements)� selectionz?User chose to cancel the operation and may reinvoke the client.c C s< | j dkst�| jrdS tj�tj�}d}|�||j � dS )z�Potentially suggest a donation to support Certbot. :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None �renewNz�If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le ) �verb�AssertionErrorZstaging�zope� component� getUtilityr � IReporter� add_message� LOW_PRIORITY)�config� reporter_util�msg� r( �./usr/lib/python3/dist-packages/certbot/main.py� _suggest_donation_if_appropriate1 s r* c C s2 t j�tj�}| jdks t�|jd|jdd� dS )z�Reports on successful dry run :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None r zThe dry run was successful.F)Zon_crashN) r r r! r r" r r r# � HIGH_PRIORITY)r% r& r( r( r) �_report_successful_dry_runE s �r, c C s� t �|� zz|dk r0t�d� t�||| |� nR|dk s<t�t�d� | �||�}|dkrft � d��n |dk r�t � ||� � |j � W 5 t �|� X |S )a! Authenticate and enroll certificate. This method finds the relevant lineage, figures out what to do with it, then performs that action. Includes calls to hooks, various reports, checks, and requests for user input. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names to get a certificate. Defaults to `None` :type domains: `list` of `str` :param certname: Name of new certificate. Defaults to `None` :type certname: str :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: the issued certificate or `None` if doing a dry run :rtype: storage.RenewableCert or None :raises errors.Error: if certificate could not be obtained Nz Renewing an existing certificatezObtaining a new certificateFz!Certificate could not be obtained)r Zpre_hookZ post_hook�logger�infor � renew_certr Z obtain_and_enroll_certificater �ErrorZ deploy_hook�names�live_dir)� le_clientr% �domains�certname�lineager( r( r) �_get_and_save_certU s r7 c C s� d� |�� �}dj|jj|d� |�tjd�}| jsV| jsVt j � t j �j|ddddd�r^d |fS t j � t j�}|�d j|tjd d � tjd d� �tjd�|j� t�t��dS )a� Figure out what to do if a previous cert had a subset of the names now requested :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param cert: Certificate object :type cert: storage.RenewableCert :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: `tuple` of `str` z, a You have an existing certificate that contains a portion of the domains you requested (ref: {0}){br}{br}It contains these names: {1}{br}{br}You requested these names for the new certificate: {2}.{br}{br}Do you want to expand and replace this existing certificate with the new certificate?��brZExpand�Cancelz--expandT�Zcli_flag�force_interactiver z�To obtain a new certificate that contains these names without replacing your existing certificate for {0}, you must use the --duplicate option.{br}{br}For example:{br}{br}{1} --duplicate {2}r � � N)�joinr1 �format� configfile�filenamer �linesep�expandZrenew_by_defaultr r r! r �IDisplay�yesnor" r# �sys�argvr+ r r0 �USER_CANCELLED)r% r4 �cert�existing�questionr& r( r( r) �_handle_subset_cert_request� s: �� � � �� rM c C s� |� � sd|fS t�| |�r$d|fS | jr2d|fS dj|jjtjd�}| j dkrVd}n| j dkrdd}|d g}t j � t j�}|j||d d d �}|d tjkr�t�d ��n(|d d kr�d|fS |d dkr�d|fS td��dS )a� Figure out what to do if a lineage has the same names as a previously obtained one :param config: Configuration object :type config: interfaces.IConfig :param lineage: Certificate lineage object :type lineage: storage.RenewableCert :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: `tuple` of `str` � reinstallr z�You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.{br}(ref: {0}){br}{br}What would you like to do?r8 �runz.Attempt to reinstall this existing certificate�certonlyz%Keep the existing certificate for nowz.Renew & replace the cert (limit ~5 per 7 days)r T)�defaultr< z.Operation canceled. You may re-run the client.r> zThis is impossibleN)Zensure_deployedr Z should_renewrN r@ rA rB r rC r r r r! r rE Zmenu� display_utilZCANCELr r0 r )r% r6 rL Zkeep_opt�choices�displayZresponser( r( r) � _handle_identical_cert_request� s@ � � � �� rU c C sX | j r dS t�| |�\}}|dkr.|dkr.dS |dk r@t| |�S |dk rTt| ||�S dS )a� Determine whether there are duplicated names and how to handle them (renew, reinstall, newcert, or raising an error to stop the client run if the user chooses to cancel the operation when prompted). :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or `None` if renewal shouldn't occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. �ZnewcertNN�NN)Z duplicater Zfind_duplicative_certsrU rM )r% r4 Zident_names_certZsubset_names_certr( r( r) �_find_lineage_for_domains� s rX c C s. t | ||�\}}|dkr"t�d� |dk|fS )aW Finds an existing certificate object given domains and/or a certificate name. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple of a boolean that indicates if this function should be followed by a call to fetch a certificate from the server, and either a RenewableCert instance or None. :rtype: `tuple` of `bool` and :class:`storage.RenewableCert` or `None` rN z Keeping the existing certificate)�&_find_lineage_for_domains_and_certnamer- r. )r% r4 r5 �actionr6 r( r( r) � _find_cert s r[ c C sz |st | |�S t�| |�}|r^|rTtt�| |��t|�krTt| |||�� � d|fS t| |�S |rfdS t� d� |���dS )a� Find appropriate lineage based on given domains and/or certname. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or None if renewal should not occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. r rV z}No certificate with name {0} found. Use -d to specify domains, or run certbot certificates to see possible certificate names.N) rX r �lineage_for_certname�set�domains_for_certname� _ask_user_to_confirm_new_namesr1 rU r �ConfigurationErrorr@ )r% r4 r5 r6 r( r( r) rY $ s � �rY c C s@ t t| �t|� �}t t|�t| � �}|�� |�� ||fS )zWGet lists of items removed from `before` and a lists of items added to `after` )�listr] �sort)ZafterZbefore�added�removedr( r( r) �_get_added_removedM s re c C s( |s d}ndd� |� }|j| tjd�S )z%Format list with given character z {br}(None)z {br}{ch} )Zchr9 )r? r@ r rC )� characterZstringsZ formattedr( r( r) � _format_listW s �rg c C sf | j r dS t||�\}}dj|td|�td|�tjd�}tj�t j �}|j |dddd �sbt � d ��dS ) a� Ask user to confirm update cert certname to contain new_domains. :param config: Configuration object :type config: interfaces.IConfig :param new_domains: List of new domain names :type new_domains: `list` of `str` :param certname: Name of certificate :type certname: str :param old_domains: List of old domain names :type old_domains: `list` of `str` :returns: None :rtype: None :raises errors.ConfigurationError: if cert name and domains mismatch Nz�You are updating certificate {0} to include new domain(s): {1}{br}{br}You are also removing previously included domain(s): {2}{br}{br}Did you intend to make this change?�+�-r8 z Update certr: T)rQ z+Specified mismatched cert name and domains.)Zrenew_with_new_domainsre r@ rg r rC r r r! r rE rF r r` )r% Z new_domainsr5 Z old_domainsrc rd r' �objr( r( r) r_ c s �r_ c C sR d}| j }| jr| j}n|r(t�| |�}|s8t�||�}|sJ|sJt�d��||fS )a Retrieve domains and certname from config or user input. :param config: Configuration object :type config: interfaces.IConfig :param installer: Installer object :type installer: interfaces.IInstaller :param `str` question: Overriding dialog question to ask the user if asked to choose from domain names. :returns: Two-part tuple of domains and certname :rtype: `tuple` of list of `str` and `str` :raises errors.Error: Usage message, if parameters are not used correctly Nz�Please specify --domains, or --installer that will help in domain names autodiscovery, or --cert-name for an existing certificate name.)r5 r4 r r^ � display_opsZ choose_namesr r0 )r% � installerrL r4 r5 r( r( r) �_find_domains_or_certname� s rm c C s� | j rt| � dS |r|s"td��t�|��� }tj�t j �}| j dkrLdnd}|rddj |t jd�nd}dj |||tj|t jd�}|�||j� dS ) aD Reports the creation of a new certificate to the user. :param cert_path: path to certificate :type cert_path: str :param fullchain_path: path to full chain :type fullchain_path: str :param key_path: path to private key, if available :type key_path: str :returns: `None` :rtype: None Nz No certificates saved to report.rO z with the "certonly" option� z+Your key file has been saved at:{br}{0}{br}r8 a Congratulations! Your certificate and chain have been saved at:{br}{0}{br}{1}Your cert will expire on {2}. To obtain a new or tweaked version of this certificate in the future, simply run {3} again{4}. To non-interactively renew *all* of your certificates, run "{3} renew")�dry_runr, r r ZnotAfter�dater r r! r r" r r@ r rC r Z cli_commandr# �MEDIUM_PRIORITY) r% � cert_path�fullchain_path�key_pathZexpiryr& Z verbswitchZprivkey_statementr' r( r( r) �_report_new_cert� s. � �� �ru c s� � fdd�}t �� �}d}� j dk r2|�� j �}n�|�� }t|�dkrRt�|�}n�t|�dkrh|d }nx� jdkr�� js�t� � � _zt j � ||d�\}}W nD t j k r� � Y n. t jk r� tjddd � t �d ��Y nX |j� _ ||fS ) a� Determine which account to use. If ``config.account`` is ``None``, it will be updated based on the user input. Same for ``config.email``. :param config: Configuration object :type config: interfaces.IConfig :returns: Account and optionally ACME client API (biproduct of new registration). :rtype: tuple of :class:`certbot.account.Account` and :class:`acme.client.Client` :raises errors.Error: If unable to register an account with ACME server c sL � j r dS d�| � j�}tj�tj�}|j|ddddd�}|sHt � d��d S )NTzhPlease read the Terms of Service at {0}. You must agree in order to register with the ACME server at {1}ZAgreer: z --agree-tosr; z?Registration cannot proceed without accepting Terms of Service.) Ztosr@ Zserverr r r! r rE rF r r0 )Zterms_of_servicer' rj �result�r% r( r) �_tos_cb� s � ��z#_determine_account.<locals>._tos_cbNr> r )Ztos_cbrn T)�exc_infoz.Unable to register an account with ACME server)r �AccountFileStorage�load�find_all�lenrk Zchoose_account�email� register_unsafely_without_email� get_emailr �registerr ZMissingCommandlineFlagr0 r- �debug�id)r% rx �account_storage�acme�acc�accountsr( rw r) �_determine_account� s6 �� r� c sD t j�tj�}t j�tj�}| j}|dkrBd}|j|ddddd�}|sX|�d|j � dS | j sbt �| j stt �| �| _ t�t�t�| | j ��| | j �� z&t �| � fdd �gd d � d d � � W nz tjk r� d �� �}|�d �|�|j� Y dS tk �r4 } z&d}|�| j| j � |�}t� |��W 5 d}~X Y nX t � | � dS )a� Does the user want to delete their now-revoked certs? If run in non-interactive mode, deleting happens automatically. :param config: parsed command line arguments :type config: interfaces.IConfig :returns: `None` :rtype: None :raises errors.Error: If anything goes wrong, including bad user input, if an overlapping archive dir is found for the specified lineage, etc ... NzmWould you like to delete the cert(s) you just revoked, along with all earlier and later versions of the cert?zYes (recommended)ZNoT)� yes_label�no_labelr< rQ zNot deleting revoked certs.c s � S �Nr( ��x�Z archive_dirr( r) �<lambda>> � z(_delete_if_appropriate.<locals>.<lambda>c S s | j S r� r� r� r( r( r) r� ? r� c S s | S r� r( r� r( r( r) r� ? r� z^Not deleting revoked certs due to overlapping archive dirs. More than one lineage is using {0}rn z_config.default_archive_dir: {0}, config.live_dir: {1}, archive_dir: {2},original exception: {3}) r r r! r rE r" Zdelete_after_revokerF r# r$ rr r r5 r Zcert_path_to_lineager Zfull_archive_path� configobjZ ConfigObjZrenewal_file_for_certnameZmatch_and_check_overlapsr ZOverlappingMatchFoundr@ r? rq � ExceptionZdefault_archive_dirr2 r0 �delete)r% rT r& Zattempt_deletionr' �er( r� r) �_delete_if_appropriate sH � � �� r� c C s> |dk r"t | �\}}t�d|� nd\}}tj| ||||d�S )an Initialize Let's Encrypt Client :param config: Configuration object :type config: interfaces.IConfig :param authenticator: Acme authentication handler :type authenticator: interfaces.IAuthenticator :param installer: Installer object :type installer: interfaces.IInstaller :returns: client: Client object :rtype: client.Client NzPicked account: %rrW �r� )r� r- r� r �Client)r% � authenticatorrl r� r� r( r( r) �_init_le_clientN s r� c C s� t �| �}|�� }tj�tj�}|s(dS tj�tj�j }d}||dddd�}|sTdS t | �\}} t j | |dd| d �} | j �|j� t �| �} | �| j � |�d |j� dS ) z�Deactivate account on server :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None z.Could not find existing account to deactivate.zCAre you sure you would like to irrevocably deactivate your account?Z DeactivateZAbortT)r� r� rQ zDeactivation aborted.Nr� zAccount deactivated.)r rz r| r r r! r r" rE rF r� r r� r� Zdeactivate_registration�regrr� r# rq ) r% �unused_pluginsr� r� r& rF �promptZwants_deactivater� r� � cb_clientZ account_filesr( r( r) � unregisteri s& � r� c C sD | j r d}t�|� t| |�S t�| �}|�� }|r8dS t| � dS )a$ Create accounts on the server. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` or a string indicating and error :rtype: None or str zuUsage 'certbot register --update-registration' is deprecated. Please use 'certbot update_account [options]' instead. zmThere is an existing account; registration of a duplicate account with this command is currently unsupported.N)�update_registrationr- �warning�update_accountr rz r| r� )r% r� r' r� r� r( r( r) r� � s r� c s� t �| �}|�� }tj�tj�� � fdd�}|s4dS | jdkrV| j rHdS t j dd�| _t | �\}}t j| |dd|d�}d d � | j�d �D �}|jj} |j�|jj|jjj|d �d ��|_|jj| d�|_|�||j� t�| � |d�| j�� dS )a$ Modify accounts on the server. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` or a string indicating and error :rtype: None or str c s � � | � j�S r� )r# rq )�m�r& r( r) r� � r� z update_account.<locals>.<lambda>z-Could not find an existing account to update.Nz�--register-unsafely-without-email provided, however, a new e-mail address must currently be provided when updating a registration.F)Zoptionalr� c S s g | ] }d | �qS )zmailto:r( )�.0r~ r( r( r) � <listcomp>� s z"update_account.<locals>.<listcomp>�,)Zcontact)�body)�uriz'Your e-mail address was updated to {0}.)r rz r| r r r! r r" r~ r rk r� r� r r� �splitr� r� r� r� �updater� Z save_regrr Zhandle_subscriptionr@ ) r% r� r� r� Zadd_msgr� r� r� Z acc_contactsZ prev_regr_urir( r� r) r� � s, � r� c C sF |r|n| }|j dk st�|�||j|j |j|j� |�||j� dS )a� Install a cert :param config: Configuration object :type config: interfaces.IConfig :param le_client: Client object :type le_client: client.Client :param domains: List of domains :type domains: `list` of `str` :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: `None` :rtype: None N)rr r Zdeploy_certificatert � chain_pathrs �enhance_config)r% r3 r4 r6 Z path_providerr( r( r) � _install_cert� s �r� c C s* zt �| |d�\}}W n0 tjk rF } zt|� W Y �S d}~X Y nX | joR| j}| jsz|szd}tj | dd|d�d | _t � | |�s�t� d��| jr�t | �} nt �| �r�t�d��| jr�| jr�t| � t| |�\}}t| d|d �}t| ||� n t�d ��t �| ��r&t�| | j�} t �| ||| � dS ) z�Install a previously obtained cert in a server. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None �installNz,Which certificate would you like to install?F�Zallow_multipleZ custom_promptr �VOne ore more of the requested enhancements are not supported by the selected installerzLOne or more of the requested enhancements require --cert-name to be provided�r� rl z�Path to certificate or key was not defined. If your certificate is managed by Certbot, please use --cert-name to define which certificate you would like to install.)�plug_sel�choose_configurator_pluginsr �PluginSelectionError�strrt rr r5 r � get_certnamesr � are_supported�NotSupportedError�_populate_from_certname� are_requestedr` �_check_certificate_and_keyrm r� r� r\ �enable) r% �pluginsrl �_r� Z custom_cert�certname_questionr4 r3 r6 r( r( r) r� s> �� r� c C sZ t �| | j�}|s| S | js&|j| j_| js6|j| j_| jsF|j| j_| jsV|j| j_| S )zfHelper function for install to populate missing config values from lineage defined by --cert-name.)r r\ r5 rt � namespacerr r� rs )r% r6 r( r( r) r� ; s r� c C sP t j�t�| j��s&t�d�| j���t j�t�| j ��sLt�d�| j ���d S )Nz-Error while reading certificate from path {0}z-Error while reading private key from path {0}) r �path�isfiler �realpathrr r r` r@ rt rw r( r( r) r� L s ��r� c C s� t �d| j� | jdkr g n| j}|�� �|�}t �d|� tjtj�t j �j dd�}| j sr| j sr|t|�� dS |� | � |�|�}t �d|� | j s�|t|�� dS |� � |�� }t �d|� |t|�� dS )z�List server software plugins. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None zExpected interfaces: %sNzFiltered plugins: %rF��pausezVerified plugins: %rzPrepared plugins: %s)r- r� �ifacesZvisible� functools�partialr r r! r rE � notificationZinitZpreparer� Zverify� available)r% r� r� Zfiltered�notifyZverifiedr� r( r( r) � plugins_cmdS s, �� r� c sh ddddg}t � fdd�|D ��}t�� �sP|sPd}t�|tjd � t�d ��zt � � |d �\}}W n0 tj k r� } zt |� W Y �S d }~X Y nX t� � |�s�t�d ��d }tj� d d|d�d � _t�� � j�} � jr�| } n d} t�| | �} | �st�d��t�� � j�} � j�s"| j� _|�rHt� d |d�} | j| � jdd� t�� ��rdt�| | |� � d S )z�Add security enhancements to existing configuration :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None ZhstsZredirectZuirZstaplec s g | ]}t � |��qS r( )�getattr)r� Zenhrw r( r) r� � s zenhance.<locals>.<listcomp>z|Please specify one or more enhancement types to configure. To list the available enhancement types, run: %s --help enhance r z#No enhancements requested, exiting.�enhanceNr� zFWhich certificate would you like to use to enhance your configuration?Fr� zJWhich domain names would you like to enable the selected enhancements for?zAUser cancelled the domain selection. No domains defined, exiting.r� )Z ask_redirect) �anyr r� r- r� rG rH r ZMisconfigurationErrorr� r� r� r� r� r� r r� r5 r^ �noninteractive_moderk Z choose_valuesr0 r\ r� r� r� r� )r% r� Zsupported_enhancementsZ oldstyle_enhr' rl r� r� r� Z cert_domainsr4 Zdomain_questionr6 r3 r( rw r) r� z sJ �� r� c C s t �| j| j| |� dS )z�Rollback server configuration changes made during install. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None N)r �rollbackrl Z checkpoints)r% r� r( r( r) r� � s r� c C s t �d� t�| � dS )aP Show changes made to server config during installation View checkpoints and associated configuration changes. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None zZThe config_changes subcommand has been deprecated and will be removed in a future release.N)r- r� r Zview_config_changes�r% r� r( r( r) �config_changes� s r� c C s t �| � dS )ar Update the certificate file family symlinks Use the information in the config file to make symlinks point to the correct archive directory. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None N)r Zupdate_live_symlinksr� r( r( r) �update_symlinks� s r� c C s t �| � dS )aA Rename a certificate Use the information in the config file to rename an existing lineage. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None N)r Zrename_lineager� r( r( r) �rename� s r� c C s t �| � dS )aA Delete a certificate Use the information in the config file to delete an existing lineage. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None N)r r� r� r( r( r) r� � s r� c C s t �| � dS )a Display information about certs configured with Certbot :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None N)r � certificatesr� r( r( r) r� s r� c C s` d | _ | _| jdkr.| jr.t�| | j�| _n | jr@| jrJ| jrJt�d��| jdk r�t � d| jd | jd � t � | jd | jd � t j�| jd �}t�| |�}n0t � d| jd � t| �\}}t�| |j|j�}t �| jd �d }t � d| j� z |�t �|�| j� t| � W n2 tjk �rJ } zt |� W Y �S d}~X Y nX t � | jd � dS )a: Revoke a previously obtained certificate. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` or string indicating error in case of error :rtype: None or str NzCError! Exactly one of --cert-path or --cert-name must be specified!z Revoking %s using cert key %sr r> z Revoking %s using Account Keyz Reason code for revocation: %s) rl r� rr r5 r Zcert_path_for_cert_namer r0 rt r- r� r Z verify_cert_matches_priv_key�joseZJWKr{ r Zacme_from_config_keyr� �keyr� Zpyopenssl_load_certificate�reason�revokeZComparableX509r� � acme_errorsZ ClientErrorr� rk Zsuccess_revocation)r% r� r� r� r� r� rJ r� r( r( r) r� s2 � r� c C s: zt �| |d�\}}W n0 tjk rF } zt|� W Y �S d}~X Y nX t�| |�s^t�d��t| ||�}t | |�\}}t | ||�\}} | } |r�t || ||| �} | r�| j nd} | r�| j nd} | r�| jnd} t| | | | � t| ||| � t�| ��r| �rt�| ||| � | dk�s|�s$t�|� n t�|� t| � dS )z�Obtain a certificate and install. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None rO Nr� )r� r� r r� r� r r� r� r� rm r[ r7 rr rs rt ru r� r� r� rk Zsuccess_installationZsuccess_renewalr* )r% r� rl r� r� r3 r4 r5 �should_get_certr6 Z new_lineagerr rs rt r( r( r) rO K s6 � rO c C sn | j \}}|�|�\}}| jr0t�d| j� dS |�||tj� | j�tj� | j �tj� | j ��\}}}||fS )a� Obtain a cert using a user-supplied CSR This works differently in the CSR case (for now) because we don't have the privkey, and therefore can't construct the files for a lineage. So we just save the cert & chain to disk :/ :param config: Configuration object :type config: interfaces.IConfig :param client: Client object :type client: client.Client :returns: `cert_path` and `fullchain_path` as absolute paths to the actual files :rtype: `tuple` of `str` z*Dry run: skipping saving certificate to %srW ) Z actual_csrZobtain_certificate_from_csrro r- r� rr Zsave_certificater r� �normpathr� rs )r% r3 �csrr� rJ �chainrr rs r( r( r) �_csr_get_and_save_cert� s � � r� c C s� zt �| |d�\}}W n2 tjk rH } zt�d|� � W 5 d}~X Y nX t| ||�}t|| |d�}tj � t j �j }|dkr�|d�|j�dd� n.t�| ||� |�� |d�| j|j�dd� dS ) a� Renew & save an existing cert. Do not install it. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :param lineage: Certificate lineage object :type lineage: storage.RenewableCert :returns: `None` :rtype: None :raises errors.PluginSelectionError: MissingCommandlineFlag if supplied parameters do not pass rP �'Could not choose appropriate plugin: %sN)r6 z9new certificate deployed without reload, fullchain is {0}Fr� zDnew certificate deployed with reload of {0} server; fullchain is {1})r� r� r r� r- r. r� r7 r r r! r rE r� r@ Z fullchainr Zrun_renewal_deployerZrestartrl ) r% r� r6 rl �authr� r3 Zrenewed_lineager� r( r( r) r/ � s, �� ��r/ c C s zt �| |d�\}}W n2 tjk rH } zt�d|� � W 5 d}~X Y nX t| ||�}| jr�t| |�\}}t | ||� t | � dS t | |�\}} t | || �\} } | s�t j�tj�j} | ddd� dS t|| || | �} | r�| jnd}| r�| jnd}| r�| jnd} t | ||| � t | � dS )af Authenticate & obtain cert, but do not install it. This implements the 'certonly' subcommand. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: `list` of `str` :returns: `None` :rtype: None :raises errors.Error: If specified plugin could not be used rP r� Nz5Certificate not yet due for renewal; no action taken.Fr� )r� r� r r� r- r. r� r� r� ru r* rm r[ r r r! r rE r� r7 rr rs rt )r% r� rl r� r� r3 rr rs r4 r5 r� r6 r� rt r( r( r) rP � s. rP c C s zt�| � W 5 t �� X dS )a Renew previously-obtained certificates. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: `list` of `str` :returns: `None` :rtype: None N)r Zrun_saved_post_hooksr Zhandle_renewal_requestr� r( r( r) r � s r c C sV t �| jtj| j� t �| jtj| j� | j| j| j f}|D ]}t j || jd� q<dS )z�Create or verify existence of config, work, and hook directories. :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None )�strictN) r Zset_up_core_dirZ config_dirr ZCONFIG_DIRS_MODEZstrict_permissionsZwork_dirZrenewal_pre_hooks_dirZrenewal_deploy_hooks_dirZrenewal_post_hooks_dirZmake_or_verify_dir)r% Z hook_dirsZhook_dirr( r( r) �make_or_verify_needed_dirs s �r� c C sT | j r d| _t�ttjd��}n$| jr4t�tj�}nt� tj| j �}t j � |� dS )z�Set the displayer :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None T�wN)�quietr� rR ZNoninteractiveDisplay�openr �devnullrG �stdoutZ FileDisplayr< r r �provideUtility)r% Z displayerr( r( r) � set_displayer s �r� c C s | st jdd� } t�� tj�� }t�dt j � t�d| � t�d|� t � || �}t �|�}tj�|� t�� zt�|� t|� W n" tjk r� |jtkr�� Y nX t jdd� dkr�t�d� t |� t � |�}tj�|� t � |j!� |�||�S ) z�Command line argument parsing and main script execution. :returns: result of requested command :raises errors.Error: OS errors triggered by wrong permissions :raises errors.Error: error if plugin command is not supported r> Nzcertbot version: %sz Arguments: %rzDiscovered plugins: %r� )� � zgPython 3.4 support will be dropped in the next release of Certbot - please upgrade your Python version.)"rG rH r Zpre_arg_parse_setup� plugins_discoZPluginsRegistryr| r- r� �certbot� __version__r Zprepare_and_parse_argsr ZNamespaceConfigr r r� r Z+raise_for_non_administrative_windows_rightsZpost_arg_parse_setupr� r r0 �funcr� � version_infor� r� r ZReporterr Zatexit_registerZprint_messages)Zcli_argsr� �argsr% �reportr( r( r) �main6 s0 r� �__main__zExiting with message %s)NNN)N)N)N)N)_�__doc__Z __future__r r� Zlogging.handlersZloggingrG r� Zjosepyr� Zzope.componentr r� r r� Zacme.magic_typingr r� r r r r r r r r r r r r r r r r Zcertbot.compatr r r Zcertbot.displayrR r rk Zcertbot.pluginsr r� r r r� rI Z getLogger�__name__r- r* r, r7 rM rU rX r[ rY re rg r_ rm ru r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rO r� r/ rP r r� r� r� Z err_stringr� �exitr( r( r( r) �<module> s� /02') % ) *<7)&- ;';-7 *1 3
Save File
Cancel