[BUG] acme.cert fails with OpenSSL error only when using salt tls module

[mymindstorm]

Description

When obtaining certificates using acme.cert with my internal acme server, I receive a traceback. I am using https://github.com/smallstep/certificates to run this acme server. Certificates obtained for the normal letsencrypt servers work just fine.

Setup

{{ pillar['letsencrypt']['domain'] }}:
  acme.cert:
    - email: {{ pillar['letsencrypt']['email'] }}
      preferred_challenges: {{ pillar['letsencrypt']['authenticator'] }}
      {% if pillar['letsencrypt']['domain'].endswith('<internal dns name>') %}
      server: https://<internal ca url>
      {% endif %}
    - require:
      - pkg: certbot
      - file: /etc/letsencrypt/cli.ini

Steps to Reproduce the behavior

1. Setup an internal ca using https://github.com/smallstep/certificates
2. Attempt to obtain certificate using acme.cert

    Function: acme.cert
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/lib/python3.6/site-packages/salt/state.py", line 2154, in call
                  *cdata["args"], **cdata["kwargs"]
                File "/usr/lib/python3.6/site-packages/salt/loader.py", line 2106, in wrapper
                  return f(*args, **kwargs)
                File "/usr/lib/python3.6/site-packages/salt/states/acme.py", line 110, in cert
                  elif __salt__["acme.needs_renewal"](certname, renew):
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 431, in needs_renewal
                  return _renew_by(name, window) <= datetime.datetime.today()
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 112, in _renew_by
                  expiry = _expires(name)
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 92, in _expires
                  expiry = __salt__["tls.cert_info"](cert_file).get("not_after", 0)
                File "/usr/lib/python3.6/site-packages/salt/modules/tls.py", line 1706, in cert_info
                  ret["extensions"][key] = str(ext).strip()
                File "/usr/lib/python3.6/site-packages/OpenSSL/crypto.py", line 822, in __str__
                  _openssl_assert(print_result != 0)
                File "/usr/lib/python3.6/site-packages/OpenSSL/_util.py", line 67, in openssl_assert
                  exception_from_error_queue(error)
                File "/usr/lib/python3.6/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
                  raise exception_type(errors)
              OpenSSL.crypto.Error: []

acme.cert works perfectly when I force the acme module to use openssl by setting

salt/salt/modules/acme.py

Line 87 in 214ae8a

if "tls.cert_info" in __salt__:

to if False:

Expected behavior
acme.cert should obtain a certificate successfully as using the cli works fine.

Versions Report

salt --versions-report

``` Salt Version: Salt: 3002.2

Dependency Versions:
cffi: 1.11.5
cherrypy: Not Installed
dateutil: 2.6.1
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.10.1
libgit2: 0.26.8
M2Crypto: 0.35.2
Mako: Not Installed
msgpack: 0.6.2
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: 2.14
pycrypto: Not Installed
pycryptodome: Not Installed
pygit2: 0.26.4
Python: 3.6.8 (default, Aug 24 2020, 17:57:11)
python-gnupg: Not Installed
PyYAML: 3.12
PyZMQ: 19.0.0
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.3

System Versions:
dist: centos 8
locale: UTF-8
machine: x86_64
release: 5.4.78-2-pve
system: Linux
version: CentOS Linux 8

</details>

[nielsk]

In OpenBSD 6.8 I have the same problem but with the default endpoint

{% for source_domain, src_args in pillar.get('redir', {}).items() %}
{{ source_domain }}:
  acme.cert:
    - webroot: /var/www/acme

When I implement the "Fix" (setting to "if False") then a new error pops up:

          ID: www.domain.com
    Function: acme.cert
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/local/lib/python3.8/site-packages/salt/state.py", line 2153, in call
                  ret = self.states[cdata["full"]](
                File "/usr/local/lib/python3.8/site-packages/salt/loader.py", line 2087, in wrapper
                  return f(*args, **kwargs)
                File "/usr/local/lib/python3.8/site-packages/salt/states/acme.py", line 110, in cert
                  elif __salt__["acme.needs_renewal"](certname, renew):
                File "/usr/local/lib/python3.8/site-packages/salt/modules/acme.py", line 432, in needs_renewal
                  return _renew_by(name, window) <= datetime.datetime.today()
                File "/usr/local/lib/python3.8/site-packages/salt/modules/acme.py", line 113, in _renew_by
                  expiry = _expires(name)
                File "/usr/local/lib/python3.8/site-packages/salt/modules/acme.py", line 99, in _expires
                  expiry = float(__salt__["cmd.shell"](strptime_sux_cmd, output_loglevel="quiet"))
              ValueError: could not convert string to float: 'date: unknown option -- -\nusage: date [-aju] [-f pformat] [-r seconds]\n\t[-z output_zone] [+format] [[[[[[cc]yy]mm]dd]HH]MM[.SS]]'
     Started: 10:20:28.395119
    Duration: 97.929 ms
     Changes:

It worked in 6.6, then I updated to 6.8 and it broke

[nielsk]

I have to apply that "if False"-fix. The date-issue is something else. To get it working on OpenBSD 6.8 I have to change it to this:

#if "tls.cert_info" in __salt__:
if False:
    expiry = __salt__["tls.cert_info"](cert_file).get("not_after", 0)
## Cobble it together using the openssl binary
else:
    openssl_cmd = "openssl x509 -in {0} -noout -enddate".format(cert_file)
    # No %e format on my Linux'es here
    #strptime_sux_cmd = 'date --date="$({0} | cut -d= -f2)" +%s'.format(openssl_cmd)
    strptime_sux_cmd = '{0} | cut -d= -f2'.format(openssl_cmd)
    expiry = __salt__['cmd.shell'](strptime_sux_cmd, output_loglevel='quiet')
    #expiry = float(__salt__["cmd.shell"](strptime_sux_cmd, output_loglevel="quiet"))
    # expiry = datetime.datetime.strptime(expiry.split('=', 1)[-1], '%b %e %H:%M:%S %Y %Z')
return datetime.datetime.strptime(expiry, '%b %d %H:%M:%S %Y %Z')
#return datetime.datetime.fromtimestamp(expiry)

[mymindstorm]

@nielsek just FYI, a cleaner workaround that I'm using is to set

disable_modules:
      - tls

in minion config via salt-formula. Although it seems that you are having issues with more than just the tls module.

[nielsek]

@nielsk -^

[nielsk]

Thanks. I will do a pull request for the date problem.

[tandibar]

Any fixes for this Problem? I am running into the same issue...