| Server IP : 35.236.43.222 / Your IP : 216.73.216.143 Web Server : Apache System : Linux order-form-vm-001 5.10.0-37-cloud-amd64 #1 SMP Debian 5.10.247-1 (2025-12-11) x86_64 User : deploy ( 1002) PHP Version : 8.1.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/lib/python3/dist-packages/certbot/_internal/__pycache__/ |
Upload File : |
a
�`�x � @ s� d Z ddlZddlZddlZddlmZ ddlmZ ddlZ ddl
Z
ddl Z ddl
mZ ddl
mZ ddl
mZ ddl
mZ dd lmZ dd
lmZ ddlZddlmZ ddlmZ dd lmZ dd lmZ dd
lm Z ddlm Z ddlm Z ddlm Z ddlm Z ddlm!Z! ddlm"Z" ddl#m$Z% ddl&m'Z' ddl(m)Z* e�+e,�Z-d/dd�Z.dd� Z/dd � Z0G d d � d e1�Z2d d � Z3d0d!d"�Z4d#d$� Z5G d%d&� d&e1�Z6d1d'd(�Z7d)d*� Z8d+d,� Z9d-d.� Z:dS )2zCertbot client API.� N)�default_backend)�generate_private_key)�client)� crypto_util)�errors)�messages)�List)�Optional)�
interfaces)�util)�account)� auth_handler)�cli)� constants)�eff)�
error_handler)�storage)� selection)�os)�opsc C s* t j||| j t| �d�}t �||| j�S )z Wrangle ACME client construction)r Z
verify_ssl�
user_agent)� acme_clientZ
ClientNetworkZ
no_verify_ssl�determine_user_agentZBackwardsCompatibleClientV2�server)�config�key�regr�net� r �:/usr/lib/python3/dist-packages/certbot/_internal/client.py�acme_from_config_key& s �r c C s� | j du rzd}tj�d�dkr,d}d}d}ntj}t�� }t� � }|�
t j ||| j
| j| jt| �|| jrrd| j nd � }n| j }|S )
z�
Set a user_agent string in the config based on the choice of plugins.
(this wasn't knowable at construction time)
:returns: the client's User-Agent string
:rtype: `str`
Nz\CertbotACMEClient/{0} ({1}; {2}{8}) Authenticator/{3} Installer/{4} ({5}; flags: {6}) Py/{7}Z CERTBOT_DOCS�1zcertbot(-auto)zOS_NAME OS_VERSIONzmajor.minor.patchlevelz; � )r r �environ�getr � cli_commandr Zget_os_info_ua�platform�python_version�format�certbot� __version__�
authenticator� installer�verb�ua_flagsZuser_agent_comment)r Zuar% Zos_infor' r r r r . s
�r c s� t � t�rdS g }� jr"|�d� � jr2|�d� � jrB|�d� � jrR|�d� d}� fdd�|D �}t|�rz|�d � d
�|�S ) z@Turn some very important CLI flags into clues in the user agent.�FLAGS�dupZfrnZasn�n)ZpreZpostZrenewZ manual_authZmanual_cleanupc s g | ]}t � |d ��qS )Z_hook)�getattr)�.0�h�r r r �
<listcomp>[ � z ua_flags.<locals>.<listcomp>�hook� ) �
isinstance� DummyConfigZ duplicate�appendZrenew_by_default�allow_subset_of_names�noninteractive_mode�any�join)r �flagsZ
hook_namesZhooksr r5 r r. M s
r. c @ s e Zd ZdZdd� Zdd� ZdS )r; z'Shim for computing a sample user agent.c C s d| _ d| _d | _d| _d S )NZXXXZYYYZ
SUBCOMMAND)r+ r, r r- )�selfr r r �__init__b s zDummyConfig.__init__c C s dS )z-Any config properties we might have are None.Nr )rB �namer r r � __getattr__h s zDummyConfig.__getattr__N)�__name__�
__module__� __qualname__�__doc__rC rE r r r r r; ` s r; c C s
t t� �S )z<Document what this Certbot's user agent string will be like.)r r; r r r r �sample_user_agentl s rJ c C s� |� � rt�d| j� | jdu rN| js>d}t�|� t�|��| j sNt�
d� | j rZd| _t d| j t
� d�}tjt�|�d�}t| |�}t|| |�}t�||�}|�||� t�| |� ||fS )a� Register new account with an ACME CA.
This function takes care of generating fresh private key,
registering the account, optionally accepting CA Terms of Service
and finally saving the account. It should be called prior to
initialization of `Client`, unless account has already been created.
:param .IConfig config: Client configuration.
:param .AccountStorage account_storage: Account storage where newly
registered account will be saved to. Save happens only after TOS
acceptance step, so any account private keys or
`.RegistrationResource` will not be persisted if `tos_cb`
returns ``False``.
:param tos_cb: If ACME CA requires the user to accept a Terms of
Service before registering account, client action is
necessary. For example, a CLI tool would prompt the user
acceptance. `tos_cb` must be a callable that should accept
`.RegistrationResource` and return a `bool`: ``True`` iff the
Terms of Service present in the contained
`.Registration.terms_of_service` is accepted by the client, and
``False`` otherwise. ``tos_cb`` will be called only if the
client action is necessary, i.e. when ``terms_of_service is not
None``. This argument is optional, if not supplied it will
default to automatic acceptance!
:raises certbot.errors.Error: In case of any client problems, in
particular registration failure, or unaccepted Terms of Service.
:raises acme.errors.Error: In case of any protocol problems.
:returns: Newly registered and saved account, as well as protocol
API handle (should be used in `Client` initialization).
:rtype: `tuple` of `.Account` and `acme.client.Client`
z*There are already existing accounts for %sNzLNo email was provided and --register-unsafely-without-email was not present.zRegistering without email!i )Zpublic_exponent�key_sizeZbackend)r )Zfind_all�logger�infor �emailZ register_unsafely_without_email�warningr �Error�dry_run�debugr � rsa_key_sizer �joseZJWKRSAZComparableRSAKeyr �perform_registrationr ZAccount�saver Zprepare_subscription) r Zaccount_storage�tos_cb�msgZrsa_keyr �acmer Zaccr r r �registerr s. &
�
rZ c
C s� |j o
|j}|r<| jjj�� }tjj||j |j| jj d�}nd}| �
� rZ|sZd}t � |��z tj
j|j|d�}| �||�W S tj y� } zb|jdks�|jdkr�|jr�d|j }t � |��tjdd �|_t| ||�W Y d}~S � W Y d}~n
d}~0 0 dS )
aj
Actually register new account, trying repeatedly if there are email
problems
:param acme.client.Client client: ACME client object.
:param .IConfig config: Client configuration.
:param Callable tos_cb: a callback to handle Term of Service agreement.
:returns: Registration Resource.
:rtype: `acme.messages.RegistrationResource`
)�account_public_keyZkidZhmac_key� directoryNzRServer requires external account binding. Please use --eab-kid and --eab-hmac-key.)rN Zexternal_account_bindingZ invalidEmailZinvalidContactzzThe ACME server believes %s is an invalid email address. Please ensure it is a valid email and attempt registration again.T)Zinvalid)Zeab_kidZ eab_hmac_keyr r r Z
public_keyr ZExternalAccountBindingZ from_datar\ Zexternal_account_requiredr rP ZNewRegistrationrN Znew_account_and_tos�coder> � display_opsZ get_emailrU ) rY r rW Zeab_credentials_suppliedr[ ZeabrX Znewreg�er r r rU � s8
�
��
rU c @ sz e Zd ZdZd dd�Zd dd�Zd dd�Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z d dd�Z d dd�Z
dd� Zdd� ZdS )!�Clientaq Certbot's client.
:ivar .IConfig config: Client configuration.
:ivar .Account account: Account registered with `register`.
:ivar .AuthHandler auth_handler: Authorizations handler that will
dispatch DV challenges to appropriate authenticators
(providing `.IAuthenticator` interface).
:ivar .IAuthenticator auth: Prepared (`.IAuthenticator.prepare`)
authenticator that can solve ACME challenges.
:ivar .IInstaller installer: Installer.
:ivar acme.client.BackwardsCompatibleClientV2 acme: Optional ACME
client API handle. You might already have one from `register`.
Nc C sr || _ || _|| _|| _|du r>| jdur>t|| jj| jj�}|| _|durht� || j| j| j j
�| _nd| _dS )zInitialize a client.N) r r �authr, r r r rY r
Z AuthHandlerZ pref_challs)rB r Zaccount_ra r, rY r r r rC � s �zClient.__init__c C s� | j du r"d}t�|� t�|��| jjdu r8t�d��t�d|� |du r\| j|j dd�}t
j
� � t
j dd� }| j
jdu}| jj|||d �}|j}|r�|jr�t�|g|j | j
j| j
j �}t�|�\}}|�� |�� fS )
aW Obtain certificate.
:param .util.CSR csr: PEM-encoded Certificate Signing
Request. The key used to generate this CSR can be different
than `authkey`.
:param acme.messages.OrderResource orderr: contains authzrs
:returns: certificate and chain as PEM byte strings
:rtype: tuple
Nz>Unable to obtain certificate because authenticator is not set.z+Please register with the ACME server first.zCSR: %sF)� best_effort�Z )Zseconds)Zfetch_alternative_chains)r
rL rO r rP r r rR � _get_order_and_authorizations�data�datetimeZnowZ timedeltar Zpreferred_chainrY Zfinalize_orderZ
fullchain_pemZalternative_fullchains_pemr Zfind_chain_with_issuerrQ Z cert_and_chain_from_fullchain�encode) rB �csr�orderrrX ZdeadlineZget_alt_chainsZ fullchain�cert�chainr r r �obtain_certificate_from_csr s0
�
��z"Client.obtain_certificate_from_csrc s� |durZt |d�� }|}|�� }W d � n1 s40 Y tj||d�}t�d|� nd}| jj}d}t| jj t
�r�| jj d | j_ | jj r�| jj dkr�| jj }d| j_ d| j_
d | j_n | jjr�| jj �� d
kr�| jj}| jj�r.|�p
tjdtj||| jj d �d�}tjdd t�|j|| jj�d
�} n2|�pLtj|| jj| jj |d�}t�||| jj�} | � | j | jj �}
|
j } t dd� | D ��� � fdd�|D �} | jj �r�| |k�r�| jj�s�t!�"|j#� t!�"| j#� | �$| �S | �%| |
�\}
}|
||| fS dS )a� Obtains a certificate from the ACME server.
`.register` must be called before `.obtain_certificate`
:param list domains: domains to get a certificate
:returns: certificate as PEM string, chain as PEM string,
newly generated private key (`.util.Key`), and DER-encoded
Certificate Signing Request (`.util.CSR`).
:rtype: tuple
N�rb)�file�pemz%Reusing existing private key from %s.r Zecdsaz./chain-ecdsa.pemz./cert-ecdsa.pemz./key-ecdsa.pemZrsa)�bits�elliptic_curve�key_typero )rn �formre )rK �key_dirrr rq c s s | ]}|j jjV qd S )N)�bodyZ
identifier�value)r3 �ar r r � <genexpr>x r7 z,Client.obtain_certificate.<locals>.<genexpr>c s g | ]}|� v r|�qS r r )r3 �d�Z auth_domainsr r r6 y r7 z-Client.obtain_certificate.<locals>.<listcomp>)&�open�readr ZKeyrL rM r rS r: rr �listrq Zauth_chain_pathZauth_cert_path�key_path�lowerrQ r Zmake_key�CSR�acme_crypto_utilZmake_csrro Z must_stapleZ
init_save_keyrt Z
init_save_csrZcsr_dirrd re r= �authorizations�setr �removern �obtain_certificaterl )rB �domainsZ old_keypath�fZkeypathZkeypemr rK rq rh ri �authzrZsuccessful_domainsrj rk r rz r r� . sd &
�� ��
�
zClient.obtain_certificatec C s� z| j �|�}W n tjy. t�d��Y n0 |rt| jjrt| j� |�\}}|rft
� d� | j �|�}|rtt
� d� | j�
||�}|j|d�S )a` Request a new order and complete its authorizations.
:param str csr_pem: A CSR in PEM format.
:param bool best_effort: True if failing to complete all
authorizations should not raise an exception
:returns: order resource containing its completed authorizations
:rtype: acme.messages.OrderResource
zWThe currently selected ACME CA endpoint does not support issuing wildcard certificates.z*Recreating order after authz deactivationszCertbot was unable to obtain fresh authorizations for every domain. The dry run will continue, but results may not be accurate.)r� )rY Z new_order� acme_errorsZWildcardUnsupportedErrorr rP r rQ r
Z deactivate_valid_authorizationsrL rR rO Zhandle_authorizations�update)rB Zcsr_pemrb ri Z deactivatedZfailedr� r r r rd � s
z$Client._get_order_and_authorizationsc C s| | � |�\}}}}| jjtjd ks6| jjtjd kr@t�d� | �||�}| jj rdt�
d|� dS t j �
|||j|| j�S )a{ Obtain and enroll certificate.
Get a new certificate for the specified domains using the specified
authenticator and installer, and then create a new renewable lineage
containing it.
:param domains: domains to request a certificate for
:type domains: `list` of `str`
:param certname: requested name of lineage
:type certname: `str` or `None`
:returns: A new :class:`certbot._internal.storage.RenewableCert` instance
referred to the enrolled cert lineage, False if the cert could not
be obtained, or None if doing a successful dry run.
�
config_dir�work_dirzdNon-standard path(s), might not work with crontab installed by your operating system package managerz-Dry run: Skipping creating new lineage for %sN)r� r r� r Z CLI_DEFAULTSr� rL rM �_choose_lineagenamerQ rR r Z
RenewableCertZ new_lineagero )rB r� �certnamerj rk r �_�new_namer r r � obtain_and_enroll_certificate� s$ �� ��z$Client.obtain_and_enroll_certificatec C s. |r|S t �|d �r&|d dd� S |d S )a/ Chooses a name for the new lineage.
:param domains: domains in certificate request
:type domains: `list` of `str`
:param certname: requested name of lineage
:type certname: `str` or `None`
:returns: lineage name that should be used
:rtype: str
r � N)r Zis_wildcard_domain)rB r� r� r r r r� � s
zClient._choose_lineagenamec
C s� |||fD ] }t �tj�|�d| jj� q
td|�\}}z|�|� W |� � n
|� � 0 t
� d|� td|�\} }
td|�\} } t || � t || | � ||
| fS )a Saves the certificate received from the ACME server.
:param str cert_pem:
:param str chain_pem:
:param str cert_path: Candidate path to a certificate.
:param str chain_path: Candidate path to a certificate chain.
:param str fullchain_path: Candidate path to a full cert chain.
:returns: cert_path, chain_path, and fullchain_path as absolute
paths to the actual files
:rtype: `tuple` of `str`
:raises IOError: If unable to find room to write the cert files
i� � cert_pathz4Server issued certificate; certificate written to %s�
chain_path�fullchain_path)
r Zmake_or_verify_dirr �path�dirnamer Zstrict_permissions�_open_pem_file�write�closerL rM � _save_chain)
rB Zcert_pem� chain_pemr� r� r� r� Z cert_fileZ
abs_cert_path�
chain_fileZabs_chain_pathZfullchain_fileZabs_fullchain_pathr r r �save_certificate� s ���
zClient.save_certificatec C s� | j du r t�d� t�d��|du r*dn
tj�|�}d}t� | j
|��V |D ]4}| j j |tj�|�tj�|�||d� | j � � qN| j � d� W d � n1 s�0 Y d}t� | j
|�� | j �� W d � n1 s�0 Y dS )a Install certificate
:param list domains: list of domains to install the certificate
:param str privkey_path: path to certificate private key
:param str cert_path: certificate file path (optional)
:param str chain_path: chain file path
NzANo installer specified, client is unable to deploythe certificate�No installer availablez!Unable to install the certificate)Zdomainr� r~ r� r� zDeployed ACME CertificatezuWe were unable to install your certificate, however, we successfully restored your server to its prior configuration.)r, rL rO r rP r r� �abspathr � ErrorHandler�_recovery_routine_with_msgZ deploy_certrV �_rollback_and_restart�restart)rB r� Z privkey_pathr� r� r� rX �domr r r �deploy_certificate s$
� *zClient.deploy_certificateTc C s� | j du r t�d� t�d��d}dddd|fd f}| j �� }|D ]Z\}}} t| j|�}
||v r�|d
krt|
du rt|}
|
r�| �||| � d }qB|
rBt�d |� qBd
} |r�t �
| j | �� | j � � W d � n1 s�0 Y dS )af Enhance the configuration.
:param list domains: list of domains to configure
:param chain_path: chain file path
:type chain_path: `str` or `None`
:param redirect_default: boolean value that the "redirect" flag should default to
:raises .errors.Error: if no installer is specified in the
client.
NzDNo installer is specified, there isn't any configuration to enhance.r� F)Zhsts�ensure-http-headerzStrict-Transport-Security)�redirectr� NZstaplez staple-ocsp)Zuirr� zUpgrade-Insecure-Requestsr� TzKOption %s is not supported by the selected installer. Skipping enhancement.z$We were unable to restart web server)
r, rL rO r rP Zsupported_enhancementsr2 r �apply_enhancementr r� r� r� ) rB r� r� Zredirect_defaultZenhancedZenhancement_infoZ supportedZ config_nameZenhancement_nameZoptionZ config_valuerX r r r �enhance_config+ s6
�
�zClient.enhance_configc
C s� d| }t �| j|��� |D ]r}z| j�|||� W q tjyj |dkrZt�d|� n t�d|� Y q tj y� t�d||� � Y q 0 q | j�
d| � W d � n1 s�0 Y dS )a� Applies an enhancement on all domains.
:param list domains: list of ssl_vhosts (as strings)
:param str enhancement: name of enhancement, e.g. ensure-http-header
:param str options: options to enhancement, e.g. Strict-Transport-Security
.. note:: When more `options` are needed, make options a list.
:raises .errors.PluginError: If Enhancement is not supported, or if
there is any other problem with the enhancement.
zmWe were unable to set up enhancement %s for your server, however, we successfully installed your certificate.r� z Enhancement %s was already set.z#Unable to set enhancement %s for %szAdd enhancement %sN) r r� r� r, Zenhancer Z PluginEnhancementAlreadyPresentrL rO Z PluginErrorrV )rB r� Z enhancementZoptionsrX r� r r r r� V s* ����
zClient.apply_enhancementc C s* | j �� tj�tj�}|�||j� dS )z�Calls the installer's recovery routine and prints success_msg
:param str success_msg: message to show on successful recovery
N) r, Zrecovery_routine�zope� component�
getUtilityr
� IReporter� add_message�
HIGH_PRIORITY�rB Z success_msgZreporterr r r r� y s
z!Client._recovery_routine_with_msgc C s` t �d� tj�tj�}z| j�� | j� � W n |�
d|j � � Y n0 |�
||j � dS )z�Rollback the most recent checkpoint and restart the webserver
:param str success_msg: message to show on successful rollback
z0Rolling back to previous server configuration...z�An error occurred and we failed to restore your config and restart your server. Please post to https://community.letsencrypt.org/c/help with details about your configuration and this error you received.N) rL Zcriticalr� r� r� r
r� r, �rollback_checkpointsr� r� r� r� r r r r� � s
�z Client._rollback_and_restart)N)N)N)T)N)rF rG rH rI rC rl r� rd r� r� r� r� r� r� r� r� r r r r r` � s
&
[ $($
+
#
r` c C s� | j r t�| j �s t�d��|r�|jdkr`tj�tjj |j
�}tj� tjj |�}t
�|j|d�}|j
r|t�|j
�s|t�d��|j
r�| j r�t�|j
| j �s�t�d��dS )a� Validate Key and CSR files.
Verifies that the client key and csr arguments are valid and correspond to
one another. This does not currently check the names in the CSR due to
the inability to read SANs from CSRs in python crypto libraries.
If csr is left as None, only the key will be validated.
:param privkey: Key associated with CSR
:type privkey: :class:`certbot.util.Key`
:param .util.CSR csr: CSR
:raises .errors.Error: when validation fails
z#The provided key is not a valid keyZderro z#The provided CSR is not a valid CSRz The key and CSR do not matchN)ro r Z
valid_privkeyr rP rs �OpenSSLZcryptoZload_certificate_requestZ
FILETYPE_ASN1re Zdump_certificate_requestZ FILETYPE_PEMr r� rn Z valid_csrZcsr_matches_pubkey)Zprivkeyrh Zcsr_objZ cert_bufferr r r �validate_key_csr� s$
��
�r� c C s0 t j|| |dd�}|dur,|�|� |�� dS )z�Revert configuration the specified number of checkpoints.
:param int checkpoints: Number of checkpoints to revert.
:param config: Configuration.
:type config: :class:`certbot.interfaces.IConfig`
z,Which installer should be used for rollback?)ZquestionN)�plugin_selectionZpick_installerr� r� )Zdefault_installerZ checkpointsr Zpluginsr, r r r �rollback� s
�
r� c C sL t �| �r&tj|ddd�tj�|�fS t�|dd�}|d tj�|d �fS )a' Open a pem file.
If cli_arg_path was set by the client, open that.
Otherwise, uniquify the file path.
:param str cli_arg_path: the cli arg name, e.g. cert_path
:param str pem_path: the pem file path to open
:returns: a tuple of file object and its absolute file path
i� �wb)�chmod�moder � )r Z
set_by_clir Z safe_openr r� r� Z unique_file)Z cli_arg_pathZpem_pathZuniqr r r r� � s
�r� c C s4 z|� | � W |�� n
|�� 0 t�d|j� dS )z�Saves chain_pem at a unique path based on chain_path.
:param str chain_pem: certificate chain in PEM format
:param str chain_file: chain file object
zCert chain written to %sN)r� r� rL rM rD )r� r� r r r r� � s r� )N)N)N);rI rf Zloggingr& Z cryptography.hazmat.backendsr Z-cryptography.hazmat.primitives.asymmetric.rsar ZjosepyrT r� Zzope.componentr� rY r r r r� r r� r Zacme.magic_typingr r r) r
r Zcertbot._internalr r
r r r r r Zcertbot._internal.pluginsr r� Zcertbot.compatr Zcertbot.displayr r^ Z getLoggerrF rL r r r. �objectr; rJ rZ rU r` r� r� r� r� r r r r �<module> sZ
G- 6
.