Skip to content

Ensure acme server is stopped when challenge fails #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
j-chmielewski wants to merge 1 commit into
base: release/2.0
Choose a base branch
from
Open

Ensure acme server is stopped when challenge fails #275

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 34 additions & 28 deletions src/acme.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,50 +243,56 @@ pub async fn run_acme_http01(
}
});

// Now populate the challenge map and notify LE - server is already up.
let mut authorizations = order.authorizations();
let validation_result = async {
// Now populate the challenge map and notify LE - server is already up.
let mut authorizations = order.authorizations();

while let Some(result) = authorizations.next().await {
let mut authz = result.context("Failed to retrieve ACME authorization")?;
let mut challenge = authz
.challenge(ChallengeType::Http01)
.ok_or_else(|| anyhow!("ACME server did not offer HTTP-01 challenge"))?;
while let Some(result) = authorizations.next().await {
let mut authz = result.context("Failed to retrieve ACME authorization")?;
let mut challenge = authz
.challenge(ChallengeType::Http01)
.ok_or_else(|| anyhow!("ACME server did not offer HTTP-01 challenge"))?;

let token = challenge.token.clone();
let key_auth = challenge.key_authorization().as_str().to_owned();
let token = challenge.token.clone();
let key_auth = challenge.key_authorization().as_str().to_owned();

info!("Preparing HTTP-01 challenge for domain: {domain} (token: {token})");
info!("Preparing HTTP-01 challenge for domain: {domain} (token: {token})");

{
let mut map = challenge_map.lock().unwrap();
map.insert(token, key_auth);
{
let mut map = challenge_map.lock().unwrap();
map.insert(token, key_auth);
}

challenge
.set_ready()
.await
.context("Failed to signal ACME challenge as ready")?;
info!("HTTP-01 challenge signalled as ready; waiting for Let's Encrypt to validate");
}

challenge
.set_ready()
// LE will now attempt HTTP-01 validation against our challenge server.
let _ = progress_tx.send(AcmeStep::ValidatingDomain);
info!("Polling Let's Encrypt for domain validation result...");

// Wait for the order to become ready for finalization.
order
.poll_ready(&RetryPolicy::default())
.await
.context("Failed to signal ACME challenge as ready")?;
info!("HTTP-01 challenge signalled as ready; waiting for Let's Encrypt to validate");
.context("ACME order did not become ready")
}

// LE will now attempt HTTP-01 validation against our challenge server.
let _ = progress_tx.send(AcmeStep::ValidatingDomain);
info!("Polling Let's Encrypt for domain validation result...");

// Wait for the order to become ready for finalization.
let status = order
.poll_ready(&RetryPolicy::default())
.await
.context("ACME order did not become ready")?;
info!("Domain validation complete, order status: {status:?}");
.await;

server_handle.abort();
let _ = server_handle.await;
info!("ACME challenge server shut down; port 80 released");

if let Some(done_tx) = port80_permit {
let _ = done_tx.send(());
}

let status = validation_result?;
info!("Domain validation complete, order status: {status:?}");

// Domain validated; finalizing order and retrieving the certificate.
let _ = progress_tx.send(AcmeStep::IssuingCertificate);
info!("Finalizing ACME order and requesting certificate issuance...");
Expand Down
Loading