Feature: ACME Certificate Signer

[davidjwbbc]

This adds a new CertificateSigner class, ACMECertificateSigner, to the M1 client API python module. This class allows the python M1 client app to designate an ACME certificate signing service to use when signing certificates for ContentHostingConfigurations using domainNameAlias entries.

This class requires access to the private keys directory (it needs to regenerate the CSR and so needs to sign the new CSR), the default virtual host docroot (for when HTTP to the domainNameAlias is not setup and an ACME challenge is needed) and the domain docroots directory for the AS (to provide the acme challenge authentication for the domain name). These three directories are configured using the keyword parameters to the class instance initialisation.

The class also requires the URL of an ACME directory service.

There are two factory functions, LetsEncryptCertificateSigner and TestLetsEncryptCertificateSigner, which both only take the 3 directories noted above and automatically set the URL of the directory service to point to the Let's Encrypt live service and the Let's Encrypt Staging service respectively.

In a simple setup, this means that the M1 client app must run on the same host as both the AF & AS. It would be possible to run the M1 client on a different host as long as there are network shared directories accessible for the three directories given above.

For the m1-session and msaf-configuration tools the new class (or factory functions) can be configured using:

sudo m1-session configure set certificate_signing_class 'rt_m1_client.certificates.LetsEncryptCertificateSigner(default_docroot_dir=<default-host-docroot>,docroots_dir=<domain-docroots-directory>,private_keys_dir=<AF-privtate-keys-storage-directory>)'

So for the default settings this would be:

sudo m1-session configure set certificate_signing_class 'rt_m1_client.certificates.LetsEncryptCertificateSigner(default_docroot_dir=/usr/share/nginx/html,docroots_dir=/var/cache/rt-5gms/as/docroots,private_keys_dir=/usr/local/var/local/cache/rt-5gms/af/certificates/private)'

Note: This will not use Let's Encrypt for ContentHostingConfiguration distributionConfigurations which do not use domainNameAlias - a new Lets's Encrypt Certificate Manager script will be needed to handle that configuration.

[jordijoangimenez]

@davidjwbbc
I cannot spot anything incorrent given this is up and running. I also think you offloaded code to other classes which is good.

So, I think I can just congratulate you for the efforts.