diff options
| -rw-r--r-- | Changelog | 2 | ||||
| -rw-r--r-- | Makefile | 1 | ||||
| -rw-r--r-- | config/lacme.conf | 6 | ||||
| -rwxr-xr-x | lacme | 65 | ||||
| -rw-r--r-- | lacme.md | 21 |
5 files changed, 58 insertions, 37 deletions
@@ -8,6 +8,8 @@ lacme (0.2) upstream; ignored, and the two processes communicate through a socket pair. + lacme: add an option --quiet to avoid mentioning valid certs (useful in cronjobs) + + "config-certs" now points to a space separated list of files or + directories. New default "lacme-certs.conf lacme-certs.d/". - Minor manpage fixes - More useful message upon Validation Challenge failure. @@ -25,6 +25,7 @@ all: ${MANPAGES} install: ${MANPAGES} install -d $(DESTDIR)/etc/lacme + install -d $(DESTDIR)/etc/lacme/lacme-certs.d install -m0644 -t $(DESTDIR)/etc/lacme config/*.conf install -d $(DESTDIR)/usr/share/lacme install -m0644 -t $(DESTDIR)/usr/share/lacme certs/lets-encrypt-x[1-4]-cross-signed.pem diff --git a/config/lacme.conf b/config/lacme.conf index 08afeb4..f963128 100644 --- a/config/lacme.conf +++ b/config/lacme.conf @@ -1,7 +1,7 @@ -# For certificate issuance (new-cert command), specify the certificate -# configuration file to use +# For certificate issuance (new-cert command), specify a space-separated +# certificate configuration files or directories to use # -#config-certs = /etc/lacme/lacme-certs.conf +#config-certs = lacme-certs.conf lacme-certs.d/ [client] @@ -60,7 +60,7 @@ sub usage(;$$) { } exit $rv; } -usage(1) unless GetOptions(\%OPTS, qw/config=s config-certs=s socket=s agreement-uri=s quiet|q debug help|h/); +usage(1) unless GetOptions(\%OPTS, qw/config=s config-certs=s@ socket=s agreement-uri=s quiet|q debug help|h/); usage(0) if $OPTS{help}; $COMMAND = shift(@ARGV) // usage(1, "Missing command"); @@ -68,15 +68,15 @@ $COMMAND = $COMMAND =~ /\A(new-reg|reg=\p{Print}*|new-cert|revoke-cert)\z/ ? $1 : usage(1, "Invalid command: $COMMAND"); # validate and untaint $COMMAND @ARGV = map { /\A(\p{Print}*)\z/ ? $1 : die } @ARGV; # untaint @ARGV +my $CONFFILENAME = $OPTS{config} // first { -f $_ } + ( "./$NAME.conf" + , ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config")."/lacme/$NAME.conf" + , "/etc/lacme/$NAME.conf" + ); do { - my $conffile = $OPTS{config} // first { -f $_ } - ( "./$NAME.conf" - , ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config")."/lacme/$NAME.conf" - , "/etc/lacme/$NAME.conf" - ); - die "Error: Can't find configuration file\n" unless defined $conffile; - print STDERR "Using configuration file: $conffile\n" if $OPTS{debug}; - open $CONFFILE, '<', $conffile or die "Can't open $conffile: $!\n"; + die "Error: Can't find configuration file\n" unless defined $CONFFILENAME; + print STDERR "Using configuration file: $CONFFILENAME\n" if $OPTS{debug}; + open $CONFFILE, '<', $CONFFILENAME or die "Can't open $CONFFILENAME: $!\n"; my $conf = do { local $/ = undef, <$CONFFILE> }; # don't close $CONFFILE so we can pass it to the client @@ -559,24 +559,39 @@ if ($COMMAND eq 'new-reg' or $COMMAND =~ /^reg=/) { # new-cert [SECTION ..] # elsif ($COMMAND eq 'new-cert') { + my $conffiles = defined $OPTS{'config-certs'} ? $OPTS{'config-certs'} + : defined $CONFIG->{_}->{'config-certs'} ? [ split(/\s+/, $CONFIG->{_}->{'config-certs'}) ] + : [ "$NAME-certs.conf", "$NAME-certs.d/" ]; my $conf; - do { - my $conffile = $OPTS{'config-certs'} // $CONFIG->{_}->{'config-certs'} // first { -f $_ } - ( "./$NAME-certs.conf" - , ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config")."/lacme/$NAME-certs.conf" - , "/etc/lacme/$NAME-certs.conf" - ); - die "Error: Can't find certificate configuration file\n" unless defined $conffile; - my $h = Config::Tiny::->read($conffile) or die Config::Tiny::->errstr()."\n"; - my $defaults = delete $h->{_} // {}; - my @valid = qw/certificate certificate-chain certificate-key min-days CAfile - hash keyUsage subject subjectAltName chown chmod notify/; - foreach my $s (keys %$h) { - $conf->{$s} = { map { $_ => delete $h->{$s}->{$_} } @valid }; - die "Unknown option(s) in [$s]: ".join(', ', keys %{$h->{$s}})."\n" if %{$h->{$s}}; - $conf->{$s}->{$_} //= $defaults->{$_} foreach keys %$defaults; + foreach my $conffile (@$conffiles) { + $conffile = ($CONFFILENAME =~ s#[^/]+\z##r).$conffile unless $conffile =~ /\A\//; + my @filenames; + unless ($conffile =~ s#/\z## or -d $conffile) { + @filenames = ($conffile); + } else { + opendir my $dh, $conffile or die "Can't opendir $conffile: $!\n"; + while (readdir $dh) { + if (/\.conf\z/) { + push @filenames, "$conffile/$_"; + } elsif ($_ ne '.' and $_ ne '..') { + warn "$conffile/$_ has unknown suffix, skipping\n"; + } + } + closedir $dh; } - }; + foreach my $filename (sort @filenames) { + print STDERR "Reading $filename\n" if $OPTS{debug}; + my $h = Config::Tiny::->read($filename) or die Config::Tiny::->errstr()."\n"; + my $defaults = delete $h->{_} // {}; + my @valid = qw/certificate certificate-chain certificate-key min-days CAfile + hash keyUsage subject subjectAltName chown chmod notify/; + foreach my $s (keys %$h) { + $conf->{$s} = { map { $_ => delete $h->{$s}->{$_} } @valid }; + die "Unknown option(s) in [$s]: ".join(', ', keys %{$h->{$s}})."\n" if %{$h->{$s}}; + $conf->{$s}->{$_} //= $defaults->{$_} foreach keys %$defaults; + } + } + } my $challenge_dir; my $rv = 0; @@ -151,9 +151,18 @@ Default section *config-certs* : For certificate issuances (`new-cert` command), specify the - certificate configuration file to use (see the **[certificate - configuration file](#certificate-configuration-file)** section below - for the configuration options). + space-separated list of certificate configuration files or + directories to use (see the **[certificate configuration + file](#certificate-configuration-file)** section below for the + configuration options). + + Paths not starting with `/` are relative to the directory name of + the **[configuration filename](#configuration-file)**. The list of + files and directories is processed in order, with the later items + taking precedence. Files in a directory are processed in + lexicographic order, only considering the ones with suffix `.conf`. + + Default: `lacme-certs.conf lacme-certs.d/`. `[client]` section ------------------ @@ -303,12 +312,6 @@ Certificate configuration file For certificate issuances (`new-cert` command), a separate file is used to configure paths to the certificate and key, as well as the subject, subjectAltName, etc. to generate Certificate Signing Requests. -If `--config-certs=` is not given, and if the `config-certs` -configuration option is absent, then `lacme` uses the first existing -configuration file among *./lacme-certs.conf*, -*$XDG_CONFIG_HOME/lacme/lacme-certs.conf* (or -*~/.config/lacme/lacme-certs.conf* if the `XDG_CONFIG_HOME` environment -variable is not set), and */etc/lacme/lacme-certs.conf*. Each section denotes a separate certificate issuance. Valid options are: |