From bb3ef24a8d97dd9b0299cf23e4815c57c5ad7fb7 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 13:17:43 +0100
Subject: typofix

---
 tests/cert-install | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'tests/cert-install')

diff --git a/tests/cert-install b/tests/cert-install
index f2147d2..347570c 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -103,7 +103,7 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test3.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test3.crt)"
 [ "$st" = "root:root 0644" ]
 
-# chmod user
+# chown user
 openssl genpkey -algorithm RSA -out /etc/lacme/test4.key
 cat >"/etc/lacme/lacme-certs.conf.d/test4.conf" <<- EOF
 	[test4]
@@ -120,7 +120,7 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
 [ "$st" = "nobody:root 0644" ]
 
-# chmod user:group
+# chown user:group
 openssl genpkey -algorithm RSA -out /etc/lacme/test5.key
 cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
 	[test5]
@@ -137,7 +137,7 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
 [ "$st" = "nobody:nogroup 0644" ]
 
-# chown
+# chmod
 openssl genpkey -algorithm RSA -out /etc/lacme/test6.key
 cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
 	[test6]
-- 
cgit v1.2.3


From c96f887e5d8a1625f7dfb76d7f646499aead8eed Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 13:18:00 +0100
Subject: tab damage

---
 tests/cert-install | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'tests/cert-install')

diff --git a/tests/cert-install b/tests/cert-install
index 347570c..afc86c3 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -110,7 +110,7 @@ cat >"/etc/lacme/lacme-certs.conf.d/test4.conf" <<- EOF
 	certificate-key = /etc/lacme/test4.key
 	certificate = /etc/lacme/test4.pem
 	certificate-chain = /etc/lacme/test4.crt
-    chown = nobody
+	chown = nobody
 	subject = $subject
 EOF
 
@@ -127,7 +127,7 @@ cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
 	certificate-key = /etc/lacme/test5.key
 	certificate = /etc/lacme/test5.pem
 	certificate-chain = /etc/lacme/test5.crt
-    chown = nobody:nogroup
+	chown = nobody:nogroup
 	subject = $subject
 EOF
 
@@ -144,7 +144,7 @@ cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
 	certificate-key = /etc/lacme/test6.key
 	certificate = /etc/lacme/test6.pem
 	certificate-chain = /etc/lacme/test6.crt
-    chmod = 0400
+	chmod = 0400
 	subject = $subject
 EOF
 
-- 
cgit v1.2.3


From 539e3a8b8a2baf6746716125e99231da14a153a9 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 13:19:21 +0100
Subject: tests/cert-install: Include tests for failing chown(2).

Due to unknown user/group name.
---
 Changelog          |  2 ++
 tests/cert-install | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)

(limited to 'tests/cert-install')

diff --git a/Changelog b/Changelog
index ae42df7..ee90be3 100644
--- a/Changelog
+++ b/Changelog
@@ -9,6 +9,8 @@ lacme (0.8.1) upstream;
    messages.
  - tests/drop-privileges: ensure failure to drop privileges yields an
    error instead of retaining root priviliges.
+ - tests/cert-install: include tests for failing chown(2) due to unknown
+   user/group name.
 
  -- Guilhem Moulin <guilhem@fripost.org>  Mon, 22 Feb 2021 12:04:28 +0100
 
diff --git a/tests/cert-install b/tests/cert-install
index afc86c3..39110f4 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -120,6 +120,15 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
 [ "$st" = "nobody:root 0644" ]
 
+rm -f /etc/lacme/test4.pem /etc/lacme/test4.crt
+sed -ri "s/^chown\\s*=.*/chown = nonexistent-user/" /etc/lacme/lacme-certs.conf.d/test4.conf
+! lacme newOrder test4 2>"$STDERR" || fail newOrder test4
+grepstderr -Fxq "getpwnam(nonexistent-user)"
+st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
+[ "$st" = "root:root 0644" ]
+st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
+[ "$st" = "root:root 0644" ]
+
 # chown user:group
 openssl genpkey -algorithm RSA -out /etc/lacme/test5.key
 cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
@@ -137,6 +146,15 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
 [ "$st" = "nobody:nogroup 0644" ]
 
+rm -f /etc/lacme/test5.pem /etc/lacme/test5.crt
+sed -ri "s/^chown\\s*=.*/chown = nobody:nonexistent-group/" /etc/lacme/lacme-certs.conf.d/test5.conf
+! lacme newOrder test5 2>"$STDERR" || fail newOrder test5
+grepstderr -Fxq "getgrnam(nonexistent-group)"
+st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
+[ "$st" = "root:root 0644" ]
+st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
+[ "$st" = "root:root 0644" ]
+
 # chmod
 openssl genpkey -algorithm RSA -out /etc/lacme/test6.key
 cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
-- 
cgit v1.2.3


From cdd025133a306cd8d3e81aa832ac056119d65f3a Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 20:03:44 +0100
Subject: lacme: Don't write certificate(-chain) file on chown/chmod failure.

Otherwise we end up with files with mode 0644 owned by root:root, and
subsequent lacme(8) invocations will likely not renew them for a while.

This change also saves a chown(2) call.  And the new logic (chown resp.
chmod from root:root resp. 0600) is safe if we ever include private key
material in there too.
---
 Changelog          |  1 +
 lacme              | 54 +++++++++++++++++++++++++++++-------------------------
 tests/cert-install | 34 ++++++++++++++--------------------
 3 files changed, 44 insertions(+), 45 deletions(-)

(limited to 'tests/cert-install')

diff --git a/Changelog b/Changelog
index e047ac5..2a027f1 100644
--- a/Changelog
+++ b/Changelog
@@ -2,6 +2,7 @@ lacme (0.8.1) upstream;
 
  + lacme-accountd: improve log messages and refactor logging logic.
  + lacme-accountd: refuse to sign JWS with an invalid Protected Header.
+ + lacme: don't write certificate(-chain) file on chown/chmod failure.
  - lacme: in the [accountd] config, let lacme-accountd(1) do the
    %-expansion for 'config', not lacme(8) when building the command.
  - lacme-accountd: don't log debug messages unless --debug is set.
diff --git a/lacme b/lacme
index fb19646..2366830 100755
--- a/lacme
+++ b/lacme
@@ -657,8 +657,9 @@ sub spawn($@) {
 #############################################################################
 # Install the certificate (optionally excluding the chain of trust)
 #
-sub install_cert($$;$) {
-    my ($filename, $chain, $leafonly) = @_;
+sub install_cert(%) {
+    my %args = @_;
+    my $filename = $args{path} // die;
 
     my ($dirname, $basename) =
         $filename =~ /\A(.*)\/([^\/]+)\z/ ? ($1, $2) : ('.', $filename);
@@ -666,10 +667,8 @@ sub install_cert($$;$) {
                                TEMPLATE => "$basename.XXXXXX") // die;
 
     eval {
-        my $umask = umask() // die "umask: $!";
-        chmod(0644 &~ $umask, $fh) or die "chmod: $!";
-        if ($leafonly) {
-            # keep only the leaf certificate
+        if ($args{nochain}) {
+            # keep only the first certificate in the file
             pipe my $rd, my $wd or die "pipe: $!";
             my $pid = fork // die "fork: $!";
             unless ($pid) {
@@ -678,16 +677,34 @@ sub install_cert($$;$) {
                 exec qw/openssl x509 -outform PEM/ or die;
             }
             $rd->close() or die "close: $!";
-            $wd->print($chain);
+            $wd->print($args{content});
             $wd->close() or die "close: $!";
 
             waitpid $pid => 0;
             die $? if $? > 0;
         } else {
-            $fh->print($chain) or die "print: $!";
+            $fh->print($args{content}) or die "print: $!";
         }
+
+        my $mode;
+        if ((my $m = $args{mode}) ne "") {
+            $mode = oct($m) // die;
+        } else {
+            my $umask = umask() // die;
+            $mode = 0644 &~ $umask;
+        }
+        chmod($mode, $fh) or die "chown: $!";
+
+        if ((my $owner = $args{owner}) ne "") {
+            my ($user, $group) = split /:/, $owner, 2;
+            my $uid = getpwnam($user) // die "getpwnam($user)", ($! ? ": $!" : "\n");
+            my $gid = getgrnam($group) // die "getgrnam($group)", ($! ? ": $!" : "\n") if defined $group;
+            chown($uid, $gid // -1, $fh) or die "chown: $!";
+        }
+
         $fh->close() or die "close: $!";
     };
+
     my $path = $fh->filename();
     if ($@) {
         print STDERR "Unlinking $path\n" if $OPTS{debug};
@@ -837,29 +854,16 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
             }
         }
 
+        my %install = ( content => $x509, mode => $conf->{chmod} // "", owner => $conf->{chown} // "" );
+
         # install certificate
         if ((my $path = $conf->{'certificate'} // "") ne "") {
             print STDERR "Installing X.509 certificate $path\n";
-            install_cert($path, $x509, 1);
+            install_cert(%install, path => $path, nochain => 1);
         }
         if ((my $path = $conf->{'certificate-chain'} // "") ne "") {
             print STDERR "Installing X.509 certificate chain $path\n";
-            install_cert($path, $x509);
-        }
-
-        if ((my $own = $conf->{chown} // "") ne "") {
-            my ($user, $group) = split /:/, $own, 2;
-            my $uid = getpwnam($user) // die "getpwnam($user)", ($! ? ": $!" : "\n");
-            my $gid = getgrnam($group) // die "getgrnam($group)", ($! ? ": $!" : "\n") if defined $group;
-            foreach (@certs) {
-                chown($uid, $gid // -1, $_) or die "chown: $!";
-            }
-        }
-        if ((my $mode = $conf->{chmod} // "") ne "") {
-            my $mode = oct($mode) // die;
-            foreach (@certs) {
-                chmod($mode, $_) or die "chown: $!";
-            }
+            install_cert(%install, path => $path);
         }
 
         my @certopts = join ',', qw/no_header no_version no_pubkey no_sigdump/;
diff --git a/tests/cert-install b/tests/cert-install
index 39110f4..5d8a239 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -110,25 +110,22 @@ cat >"/etc/lacme/lacme-certs.conf.d/test4.conf" <<- EOF
 	certificate-key = /etc/lacme/test4.key
 	certificate = /etc/lacme/test4.pem
 	certificate-chain = /etc/lacme/test4.crt
-	chown = nobody
+	chown = nonexistent-user
 	subject = $subject
 EOF
 
+! lacme newOrder test4 2>"$STDERR" || fail newOrder test4
+grepstderr -Fxq "getpwnam(nonexistent-user)"
+! test -e /etc/lacme/test4.pem
+! test -e /etc/lacme/test4.crt
+
+sed -ri "s/^chown\\s*=.*/chown = nobody/" /etc/lacme/lacme-certs.conf.d/test4.conf
 lacme newOrder test4 2>"$STDERR" || fail newOrder test4
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
 [ "$st" = "nobody:root 0644" ]
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
 [ "$st" = "nobody:root 0644" ]
 
-rm -f /etc/lacme/test4.pem /etc/lacme/test4.crt
-sed -ri "s/^chown\\s*=.*/chown = nonexistent-user/" /etc/lacme/lacme-certs.conf.d/test4.conf
-! lacme newOrder test4 2>"$STDERR" || fail newOrder test4
-grepstderr -Fxq "getpwnam(nonexistent-user)"
-st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
-[ "$st" = "root:root 0644" ]
-st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
-[ "$st" = "root:root 0644" ]
-
 # chown user:group
 openssl genpkey -algorithm RSA -out /etc/lacme/test5.key
 cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
@@ -136,25 +133,22 @@ cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
 	certificate-key = /etc/lacme/test5.key
 	certificate = /etc/lacme/test5.pem
 	certificate-chain = /etc/lacme/test5.crt
-	chown = nobody:nogroup
+	chown = nobody:nonexistent-group
 	subject = $subject
 EOF
 
+! lacme newOrder test5 2>"$STDERR" || fail newOrder test5
+grepstderr -Fxq "getgrnam(nonexistent-group)"
+! test -e /etc/lacme/test5.pem
+! test -e /etc/lacme/test5.crt
+
+sed -ri "s/^chown\\s*=.*/chown = nobody:nogroup/" /etc/lacme/lacme-certs.conf.d/test5.conf
 lacme newOrder test5 2>"$STDERR" || fail newOrder test5
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
 [ "$st" = "nobody:nogroup 0644" ]
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
 [ "$st" = "nobody:nogroup 0644" ]
 
-rm -f /etc/lacme/test5.pem /etc/lacme/test5.crt
-sed -ri "s/^chown\\s*=.*/chown = nobody:nonexistent-group/" /etc/lacme/lacme-certs.conf.d/test5.conf
-! lacme newOrder test5 2>"$STDERR" || fail newOrder test5
-grepstderr -Fxq "getgrnam(nonexistent-group)"
-st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
-[ "$st" = "root:root 0644" ]
-st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
-[ "$st" = "root:root 0644" ]
-
 # chmod
 openssl genpkey -algorithm RSA -out /etc/lacme/test6.key
 cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
-- 
cgit v1.2.3


From c612a7ff44995f4f9c39fa0fb68470d90c88decf Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 21:01:12 +0100
Subject: lacme: Default mode for certificate(-chain) creation is 0644 minus
 umask restrictions.

Also, always spawn the client with umask 0022 so a starting lacme(8)
with a restrictive umask doesn't impede serving challenge response
files.
---
 Changelog          |  4 ++++
 client             |  3 ++-
 lacme              |  1 +
 lacme.8.md         |  3 ++-
 tests/cert-install | 45 +++++++++++++++++++++++++++++++--------------
 5 files changed, 40 insertions(+), 16 deletions(-)

(limited to 'tests/cert-install')

diff --git a/Changelog b/Changelog
index 2a027f1..f7f11f6 100644
--- a/Changelog
+++ b/Changelog
@@ -3,6 +3,10 @@ lacme (0.8.1) upstream;
  + lacme-accountd: improve log messages and refactor logging logic.
  + lacme-accountd: refuse to sign JWS with an invalid Protected Header.
  + lacme: don't write certificate(-chain) file on chown/chmod failure.
+ + lacme: default mode for certificate(-chain) creation is 0644 minus
+   umask restrictions.  Also, always spawn the client with umask 0022 so
+   a starting lacme(8) with a restrictive umask doesn't impede serving
+   challenge files.
  - lacme: in the [accountd] config, let lacme-accountd(1) do the
    %-expansion for 'config', not lacme(8) when building the command.
  - lacme-accountd: don't log debug messages unless --debug is set.
diff --git a/client b/client
index 6438f6a..33189d3 100755
--- a/client
+++ b/client
@@ -338,7 +338,8 @@ elsif ($COMMAND eq 'newOrder') {
         my $keyAuthorization = $challenge->{token}.'.'.$JWK_thumbprint;
 
         # serve $keyAuthorization at http://$domain/.well-known/acme-challenge/$challenge->{token}
-        if (sysopen(my $fh, $challenge->{token}, O_CREAT|O_EXCL|O_WRONLY, 0644)) {
+        if (sysopen(my $fh, $challenge->{token}, O_CREAT|O_EXCL|O_WRONLY)) {
+            # note: the file is created mode 0666 minus umask restrictions
             $fh->print($keyAuthorization);
             $fh->close() or die "close: $!";
         } elsif ($! == EEXIST) {
diff --git a/lacme b/lacme
index 2366830..9012890 100755
--- a/lacme
+++ b/lacme
@@ -581,6 +581,7 @@ sub acme_client($@) {
     set_FD_CLOEXEC($client, 1);
     my $rv = spawn({in => $args->{in}, out => $args->{out}, child => sub() {
         drop_privileges($conf->{user}, $conf->{group}, $args->{chdir} // '/');
+        umask(0022) // die;
         set_FD_CLOEXEC($_, 0) foreach ($CONFFILE, $client);
         seek($CONFFILE, SEEK_SET, 0) or die "seek: $!";
         $ENV{DEBUG} = $OPTS{debug} // 0;
diff --git a/lacme.8.md b/lacme.8.md
index c39f51c..7f6558e 100644
--- a/lacme.8.md
+++ b/lacme.8.md
@@ -429,7 +429,8 @@ Valid settings are:
 *chmod*
 
 :   An optional octal mode to chmod the issued *certificate* and
-    *certificate-chain* to.
+    *certificate-chain* to.  By default the files are created with mode
+    0644 minus umask restrictions.
 
 *notify*
 
diff --git a/tests/cert-install b/tests/cert-install
index 5d8a239..c49a294 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -149,40 +149,57 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.crt)"
 [ "$st" = "nobody:nogroup 0644" ]
 
-# chmod
+# umask restrictions (also test empty values)
 openssl genpkey -algorithm RSA -out /etc/lacme/test6.key
 cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
 	[test6]
 	certificate-key = /etc/lacme/test6.key
-	certificate = /etc/lacme/test6.pem
 	certificate-chain = /etc/lacme/test6.crt
-	chmod = 0400
+	certificate =
+	chmod =
+	chown =
 	subject = $subject
 EOF
 
-lacme newOrder test6 2>"$STDERR" || fail newOrder test6
-st="$(stat -c "%U:%G %#a" /etc/lacme/test6.pem)"
-[ "$st" = "root:root 0400" ]
+( umask 0077 && lacme newOrder test6 2>"$STDERR" || fail newOrder test6 )
+! test -e /etc/lacme/test6.pem
 st="$(stat -c "%U:%G %#a" /etc/lacme/test6.crt)"
-[ "$st" = "root:root 0400" ]
+[ "$st" = "root:root 0600" ]
 
-# post-issuance notification
+# chmod
 openssl genpkey -algorithm RSA -out /etc/lacme/test7.key
 cat >"/etc/lacme/lacme-certs.conf.d/test7.conf" <<- EOF
 	[test7]
 	certificate-key = /etc/lacme/test7.key
+	certificate = /etc/lacme/test7.pem
 	certificate-chain = /etc/lacme/test7.crt
+	chmod = 0400
 	subject = $subject
-	notify = touch /tmp/test7.notify
 EOF
 
 lacme newOrder test7 2>"$STDERR" || fail newOrder test7
-grepstderr -Fxq "Running notification command \`touch /tmp/test7.notify\`"
-test -e /tmp/test7.notify
+st="$(stat -c "%U:%G %#a" /etc/lacme/test7.pem)"
+[ "$st" = "root:root 0400" ]
+st="$(stat -c "%U:%G %#a" /etc/lacme/test7.crt)"
+[ "$st" = "root:root 0400" ]
 
-rm -f /tmp/test7.notify
-lacme newOrder test7 2>"$STDERR" || fail newOrder test7
+# post-issuance notification
+openssl genpkey -algorithm RSA -out /etc/lacme/test8.key
+cat >"/etc/lacme/lacme-certs.conf.d/test8.conf" <<- EOF
+	[test8]
+	certificate-key = /etc/lacme/test8.key
+	certificate-chain = /etc/lacme/test8.crt
+	subject = $subject
+	notify = touch /tmp/test8.notify
+EOF
+
+lacme newOrder test8 2>"$STDERR" || fail newOrder test8
+grepstderr -Fxq "Running notification command \`touch /tmp/test8.notify\`"
+test -e /tmp/test8.notify
+
+rm -f /tmp/test8.notify
+lacme newOrder test8 2>"$STDERR" || fail newOrder test8
 ngrepstderr -Fq "Running notification command"
-! test -e /tmp/test7.notify
+! test -e /tmp/test8.notify
 
 # vim: set filetype=sh :
-- 
cgit v1.2.3


From c6a4aaa6128d55ba5f7f3cd2bd75f789f69ae407 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 24 Feb 2021 21:24:13 +0100
Subject: lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp.
 'chmod'.

---
 Changelog               |  2 ++
 config/lacme-certs.conf |  4 ++--
 lacme                   |  8 ++++++--
 lacme.8.md              |  4 ++--
 tests/cert-install      | 20 ++++++++++----------
 5 files changed, 22 insertions(+), 16 deletions(-)

(limited to 'tests/cert-install')

diff --git a/Changelog b/Changelog
index f7f11f6..14add81 100644
--- a/Changelog
+++ b/Changelog
@@ -7,6 +7,8 @@ lacme (0.8.1) upstream;
    umask restrictions.  Also, always spawn the client with umask 0022 so
    a starting lacme(8) with a restrictive umask doesn't impede serving
    challenge files.
+ + lacme: add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp.
+   'chmod'.
  - lacme: in the [accountd] config, let lacme-accountd(1) do the
    %-expansion for 'config', not lacme(8) when building the command.
  - lacme-accountd: don't log debug messages unless --debug is set.
diff --git a/config/lacme-certs.conf b/config/lacme-certs.conf
index 5259690..4af5652 100644
--- a/config/lacme-certs.conf
+++ b/config/lacme-certs.conf
@@ -52,11 +52,11 @@
 # username[:groupname] to chown the issued certificate and
 # certificate-chain with.
 #
-#chown = root:root
+#owner = root:root
 
 # Octal mode to chmod the issued certificate and certificate-chain with.
 #
-#chmod = 0644
+#mode = 0644
 
 # Command to pass the the system's command shell ("/bin/sh -c") after
 # successful installation of the certificate and/or certificate-chain.
diff --git a/lacme b/lacme
index 9012890..2d9202d 100755
--- a/lacme
+++ b/lacme
@@ -761,7 +761,8 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
             my $def = delete $h->{_} // {};
             $defaults{$_} = $def->{$_} foreach keys %$def;
             my @valid = qw/certificate certificate-chain certificate-key min-days CAfile
-                           hash keyUsage subject subjectAltName tlsfeature chown chmod notify/;
+                           hash keyUsage subject subjectAltName tlsfeature
+                           owner chown mode chmod notify/;
             foreach my $s (keys %$h) {
                 $conf->{$s} = { map { $_ => delete $h->{$s}->{$_} } @valid };
                 die "Unknown option(s) in [$s]: ".join(', ', keys %{$h->{$s}})."\n" if %{$h->{$s}};
@@ -855,7 +856,10 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
             }
         }
 
-        my %install = ( content => $x509, mode => $conf->{chmod} // "", owner => $conf->{chown} // "" );
+        my %install = ( content => $x509,
+            mode  => $conf->{mode}  // $conf->{chmod} // "",
+            owner => $conf->{owner} // $conf->{chown} // ""
+        );
 
         # install certificate
         if ((my $path = $conf->{'certificate'} // "") ne "") {
diff --git a/lacme.8.md b/lacme.8.md
index 7f6558e..65f1c36 100644
--- a/lacme.8.md
+++ b/lacme.8.md
@@ -421,12 +421,12 @@ Valid settings are:
     See [`x509v3_config`(5ssl)] for a list of possible values.  Note
     that the ACME server might override the value provided here.
 
-*chown*
+*owner*, *chown*
 
 :   An optional `username[:groupname]` to chown the issued *certificate*
     and *certificate-chain* to.
 
-*chmod*
+*mode*, *chmod*
 
 :   An optional octal mode to chmod the issued *certificate* and
     *certificate-chain* to.  By default the files are created with mode
diff --git a/tests/cert-install b/tests/cert-install
index c49a294..4b3e820 100644
--- a/tests/cert-install
+++ b/tests/cert-install
@@ -103,14 +103,14 @@ st="$(stat -c "%U:%G %#a" /etc/lacme/test3.pem)"
 st="$(stat -c "%U:%G %#a" /etc/lacme/test3.crt)"
 [ "$st" = "root:root 0644" ]
 
-# chown user
+# owner user
 openssl genpkey -algorithm RSA -out /etc/lacme/test4.key
 cat >"/etc/lacme/lacme-certs.conf.d/test4.conf" <<- EOF
 	[test4]
 	certificate-key = /etc/lacme/test4.key
 	certificate = /etc/lacme/test4.pem
 	certificate-chain = /etc/lacme/test4.crt
-	chown = nonexistent-user
+	owner = nonexistent-user
 	subject = $subject
 EOF
 
@@ -119,21 +119,21 @@ grepstderr -Fxq "getpwnam(nonexistent-user)"
 ! test -e /etc/lacme/test4.pem
 ! test -e /etc/lacme/test4.crt
 
-sed -ri "s/^chown\\s*=.*/chown = nobody/" /etc/lacme/lacme-certs.conf.d/test4.conf
+sed -ri "s/^owner\\s*=.*/owner = nobody/" /etc/lacme/lacme-certs.conf.d/test4.conf
 lacme newOrder test4 2>"$STDERR" || fail newOrder test4
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.pem)"
 [ "$st" = "nobody:root 0644" ]
 st="$(stat -c "%U:%G %#a" /etc/lacme/test4.crt)"
 [ "$st" = "nobody:root 0644" ]
 
-# chown user:group
+# owner user:group
 openssl genpkey -algorithm RSA -out /etc/lacme/test5.key
 cat >"/etc/lacme/lacme-certs.conf.d/test5.conf" <<- EOF
 	[test5]
 	certificate-key = /etc/lacme/test5.key
 	certificate = /etc/lacme/test5.pem
 	certificate-chain = /etc/lacme/test5.crt
-	chown = nobody:nonexistent-group
+	owner = nobody:nonexistent-group
 	subject = $subject
 EOF
 
@@ -142,7 +142,7 @@ grepstderr -Fxq "getgrnam(nonexistent-group)"
 ! test -e /etc/lacme/test5.pem
 ! test -e /etc/lacme/test5.crt
 
-sed -ri "s/^chown\\s*=.*/chown = nobody:nogroup/" /etc/lacme/lacme-certs.conf.d/test5.conf
+sed -ri "s/^owner\\s*=.*/owner = nobody:nogroup/" /etc/lacme/lacme-certs.conf.d/test5.conf
 lacme newOrder test5 2>"$STDERR" || fail newOrder test5
 st="$(stat -c "%U:%G %#a" /etc/lacme/test5.pem)"
 [ "$st" = "nobody:nogroup 0644" ]
@@ -156,8 +156,8 @@ cat >"/etc/lacme/lacme-certs.conf.d/test6.conf" <<- EOF
 	certificate-key = /etc/lacme/test6.key
 	certificate-chain = /etc/lacme/test6.crt
 	certificate =
-	chmod =
-	chown =
+	mode =
+	owner =
 	subject = $subject
 EOF
 
@@ -166,14 +166,14 @@ EOF
 st="$(stat -c "%U:%G %#a" /etc/lacme/test6.crt)"
 [ "$st" = "root:root 0600" ]
 
-# chmod
+# mode
 openssl genpkey -algorithm RSA -out /etc/lacme/test7.key
 cat >"/etc/lacme/lacme-certs.conf.d/test7.conf" <<- EOF
 	[test7]
 	certificate-key = /etc/lacme/test7.key
 	certificate = /etc/lacme/test7.pem
 	certificate-chain = /etc/lacme/test7.crt
-	chmod = 0400
+	mode = 0400
 	subject = $subject
 EOF
 
-- 
cgit v1.2.3