Allowing to write intermediate certificate into file. #34328
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ansibot
added
affects_2.5
|
The test |
ansibot
added
ci_verified
gundalow
removed
the
needs_triage
gundalow
reviewed
Jan 3, 2018
| @@ -92,6 +92,13 @@ | |||
| description: The destination file for the certificate. | |||
| required: true | |||
| aliases: ['cert'] | |||
| chain_dest: | |||
There was a problem hiding this comment.
Any reason you have the primary name as chain_dest and an alias of chain, then use the alias in the examples
There was a problem hiding this comment.
The primary name for the certificate filename is dest, with an alias of cert. That's why I used chain_dest as primary and chain as an alias.
The examples don't use cert either (but dest); since there's basically only one example (with three alternatives for the first step), either the primary or the alias should be used in all examples.
There was a problem hiding this comment.
Now that there's a second example using the aliases (see #35077), I've added this alias there as well. (I amended it into the existing commit.)
| @@ -855,6 +868,7 @@ def main(): | |||
| data=dict(required=False, no_log=True, default=None, type='dict'), | |||
| fullchain=dict(required=False, default=True, type='bool'), | |||
| dest=dict(required=True, aliases=['cert'], type='path'), | |||
| chain_dest=dict(required=False, deafult=None, aliases=['chain'], type='path'), | |||
There was a problem hiding this comment.
Thanks! Fixed that.
|
@felixfontein This PR contains |
ansibot
added
needs_revision
felixfontein
force-pushed
the
letsencrypt-chain-export
branch
from
d459f65
to
cd66266
Compare
ansibot
added
community_review
ansibot
added
the
stale_ci
|
ready_for_review |
felixfontein
force-pushed
the
letsencrypt-chain-export
branch
from
cd66266
to
1d40443
Compare
ansibot
added
owner_pr
felixfontein
force-pushed
the
letsencrypt-chain-export
branch
from
064885b
to
dbc6526
Compare
ansibot
added
needs_revision
|
Hmm, the failing test doesn't seem to be related to this PR: |
felixfontein
force-pushed
the
letsencrypt-chain-export
branch
from
dbc6526
to
8fec5c7
Compare
ansibot
added
community_review
|
Yep, "random fluke". Fixed by rebase without change... |
|
looks good to me. |
ansibot
added
automerge
|
Thanks! |
Lujeni
pushed a commit
to Lujeni/ansible
that referenced
this pull request
Feb 1, 2018
* Allowing to write intermediate certificate into file. * Fixing merge errors introduced in 25b1db5 (ansible#34916).
ansibot
added
feature
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SUMMARY
Allows the
letsencryptmodule to export the intermediate certificate to a file.Fixes #18996 and extends #22074 (which allows to only write one combined file with certificate and intermediate certificate).
ISSUE TYPE
COMPONENT NAME
letsencrypt
ANSIBLE VERSION
ADDITIONAL INFORMATION
The original issue #18996 asked for a way to get hold of the intermediate certificate. Since that one is not only needed to create the full chain (i.e. concatenation of certificate and intermediate, which is sent by the webserver to the client so it can validate the certificate), but also to create the root chain (root and intermediate certificate, which is used by the web server to validate OCSP responses to be stapled), the fix in #22074 is not sufficient (without extra processing). (See comment by @8w in original issue.)
This PR allows to write the intermediate certificate to a separate file, so it can be combined with whatever the caller wants (and not just the certificate).