diff options
Diffstat (limited to 'acme_dns_tiny.py')
| -rwxr-xr-x[-rw-r--r--] | acme_dns_tiny.py | 28 |
1 files changed, 13 insertions, 15 deletions
diff --git a/acme_dns_tiny.py b/acme_dns_tiny.py index 9922e45..8c0f2b8 100644..100755 --- a/acme_dns_tiny.py +++ b/acme_dns_tiny.py @@ -1,5 +1,4 @@ #!/usr/bin/env python3 -# """\ Tiny ACME client to get TLS certificate by responding to DNS challenges. It uses Let's Encrypt servers by default. @@ -60,21 +59,20 @@ esac """ -import subprocess -import json import base64 -import time -import hashlib -import re -import logging import collections import contextlib +import hashlib +import json +import logging +import re +import subprocess +import time +import dns import docopt import requests -import dns -import dns.resolver as resolver - +from dns import resolver ACME_DEFAULT_DIRECTORY = 'https://acme-v02.api.letsencrypt.org/directory' @@ -95,9 +93,9 @@ def b64json(obj): def openssl(subcommand, stdin=None): """Run openssl command line and raise IOError on non-zero return.""" - binary = True if '-sign' in subcommand or 'DER' in subcommand else False + binary = bool('-sign' in subcommand or 'DER' in subcommand) return subprocess.run( - ['openssl'] + subcommand, + ['openssl', *subcommand], input=stdin.encode('utf8') if binary and stdin is not None else stdin, stdout=subprocess.PIPE, check=True, @@ -115,7 +113,7 @@ def extract_domains_from_csr(csr_path): r'X509v3 Subject Alternative Name:\s+([^\r\n]+)\r?\n', csr, re.MULTILINE) domains = set(re.findall(r'Subject:.*?\s+?CN\s*?=\s*?([^\s,;/]+)', csr) - + re.findall(r'DNS:\s*(\S+)\s*(?:,|$)', san and san[0] or '')) + + re.findall(r'DNS:\s*(\S+)\s*(?:,|$)', (san and san[0]) or '')) if not domains: raise ValueError('No domain to validate in the provided CSR.') return domains @@ -183,7 +181,7 @@ class ACME: def init_sreqs(self, directory_url=None): self.generate_jws_header(self.account_key_path) log.info('Fetch information from the ACME directory.') - self.directory = dirmap = requests.get(directory_url, + self.directory = requests.get(directory_url, headers=self.dirheaders).json() self.request_new_nonce() @@ -281,7 +279,7 @@ class ACME: log.info('Process challenge for authorization: %s', authurl) sreq = self.sreq(authurl).map domain = sreq['identifier']['value'] - challenge = [c for c in sreq['challenges'] if c['type'] == 'dns-01'][0] + challenge = next(c for c in sreq['challenges'] if c['type'] == 'dns-01') token = re.sub(r'[^A-Za-z0-9_-]', '_', challenge['token']) # b64url keyauth = f'{token}.{self.jwk_thumbprint}' keydigest64 = b64sha256(keyauth) |
