3 گa@s:dZddlmZddlZddlZddlZddlmZddlm Z ddlm Z ddlm Z ddlm Z dd lm Z dd lmZdd lmZddlZddlZddlZddlZdd lmZdd lmZddlZddlmZddlmZdd lmZddlmZddlmZddl m!Z!ddl m"Z"ddl m#Z#dd l mZddl m$Z$ddl m%Z%ddl m&Z&ddl m'Z'ddl m(Z(ddl m)Z)ddl m*Z*ddl m+Z+ddl m,Z,ddl-m.Z/ddl-mZ0ddl1m2Z3dd l1m4Z5dd!l6m7Z7dd"l6m8Z8dd#l6m9Z9dd$l:m;Z<ddl:mZ=dd%l>m?Z?d&Z@ejAeBZCejDdd'd(d)ZEdejFejDe e eGe eGe e+jHe e+jHd*d+d,ZIejDe+jHdd-d.d/ZJejDe eGe+jHe eGe e+jHfd0d1d2ZKejDe+jHe eGe e+jHfd3d4d5ZLejDe eGe e eGe e+jHfd6d7d8ZMejDe eGeGe eNe e+jHfd9d:d;ZOejDe eGeGe e eGe e+jHfd9dZQe eQe eQe e eQe eQfd?d@dAZReGe eGeGdBdCdDZSejDe eGeGe eGddEdFdGZTdejDe ejUe eGe e eGeGfdHdIdJZVdejDe ejWe e+jHeNddLdMdNZXdejDe eGe eGe eGddOdPdQZYejDeNd'dRdSZZejDe eGe eGe eGddTdUdVZ[ejDe e!j\e ej]fd'dWdXZ^ejDdd'dYdZZ_ejDe ej`e ejUejFd[d\d]ZaejDe3jbe eGd^d_d`ZcejDe3jbe eGd^dadbZdejDe3jbe eGd^dcddZeejDe e+jHe eGd3dedfZfdejDejFe eGe e+jHddgdhdiZgejDe3jbe eGdjdkdlZhejDejDd'dmdnZiejDdd'dodpZjejDe3jbddjdqdrZkejDe3jbe eGdjdsdtZlejDe3jbddjdudvZmejDe3jbdd^dwdxZnejDe3jbdd^dydzZoejDe3jbdd^d{d|ZpejDe3jbdd^d}d~ZqejDe3jbe eGd^ddZrejDe3jbe eGdjddZsejDejFe e eGe eGe eGfdddZtejDe3jbe+jHddddZuejDe3jbddjddZvejDe3jbdd^ddZwejDdd'ddZxeejDeee=jye=jzfddfd'ddZ{de eGe eeGe|fdddZ}dS)zCertbot main entry point.)contextmanagerN) Generator)IO)Iterable)List)Optional)Tuple)TypeVar)Union)client)errors) configuration) crypto_util) interfaces)util)account) cert_manager)cli) constants)eff)hooks)log)renewal)reporter) snap_config)storage)updater)obj)disco) selection) filesystem)misc)os)ops) enhancementsz?User chose to cancel the operation and may reinvoke the client.)configreturncCs4|jdkst|js|jrdStjtjddddS)zPotentially suggest a donation to support Certbot. :param config: Configuration object :type config: configuration.NamespaceConfig :returns: `None` :rtype: None renewNzIf you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-leF)pause)verbAssertionErrorZstagingquietratexit_register display_util notification)r%r//usr/lib/python3.6/main.py _suggest_donation_if_appropriate=s r1) le_clientr%domainscertnamelineager&c Cstj|z|dk rRtjdj|jr&dndtj|p6|jdt j ||||np|dkrdt j dtjdj|jrvdndtj|d|j ||}|d krt j d |dk rtj||j|jWdtj|X|S) a,Authenticate and enroll certificate. This method finds the relevant lineage, figures out what to do with it, then performs that action. Includes calls to hooks, various reports, checks, and requests for user input. :param config: Configuration object :type config: configuration.NamespaceConfig :param domains: List of domain names to get a certificate. Defaults to `None` :type domains: `list` of `str` :param certname: Name of new certificate. Defaults to `None` :type certname: str :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: the issued certificate or `None` if doing a dry run :rtype: storage.RenewableCert or None :raises errors.Error: if certificate could not be obtained Nz{action} for {domains}z-Simulating renewal of an existing certificatez Renewing an existing certificate)actionr3z5Domain list cannot be none if the lineage is not set.z Simulating a certificate requestzRequesting a certificateFz!Certificate could not be obtained)rZpre_hookr-notifyformatdry_runinternal_display_utilsummarize_domain_listnamesr renew_certr ErrorZobtain_and_enroll_certificateZ deploy_hooklive_dirZ post_hook)r2r%r3r4r5r/r/r0_get_and_save_certWs,       r@)r%certr&cCsVtjd stjd rR|jj}|jj}||krRd}|j|j||}tj|dS)a| This function ensures that the user will not implicitly migrate an existing key from one type to another in the situation where a certificate for that lineage already exist and they have not provided explicitly --key-type and --cert-name. :param config: Current configuration provided by the client :param cert: Matching certificate that could be renewed key_typer4zAre you trying to change the key type of the certificate named {0} from {1} to {2}? Please provide both --cert-name and --key-type on the command line to confirm the change you are trying to make.N) r set_by_clirBupperZprivate_key_typer8 lineagenamer r>)r%rAZ new_key_typeZ cur_key_typemsgr/r/r0%_handle_unexpected_key_type_migrations   rG)r%r3rAr&cCst||dj|j}dj|jj|dj|tjd}|jsV|j sVt j |dddddr^d |fSt j d j|t jd jtjd d tjdtjtd S)aFigure out what to do if a previous cert had a subset of the names now requested :param config: Configuration object :type config: configuration.NamespaceConfig :param domains: List of domain names :type domains: `list` of `str` :param cert: Certificate object :type cert: storage.RenewableCert :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: `tuple` of `str` z, a You have an existing certificate that contains a portion of the domains you requested (ref: {0}){br}{br}It contains these names: {1}{br}{br}You requested these names for the new certificate: {2}.{br}{br}Do you want to expand and replace this existing certificate with the new certificate?)brZExpandCancelz--expandT)cli_flagforce_interactiver'zTo obtain a new certificate that contains these names without replacing your existing certificate for {0}, you must use the --duplicate option.{br}{br}For example:{br}{br}{1} --duplicate {2} N)rGjoinr<r8 configfilefilenamer"linesepexpandZrenew_by_defaultr-yesnor7r cli_commandsysargvr r>USER_CANCELLED)r%r3rAZexistingquestionr/r/r0_handle_subset_cert_requests    rY)r%r5r&cCst|||jsd|fStj||r.d|fS|jrr*)r%r5rXZkeep_optchoicesZresponser/r/r0_handle_identical_cert_requests2       r_)r%r3r&cCsX|jr dStj||\}}|dkr.|dkr.dS|dk r@t||S|dk rTt|||SdS)aDetermine whether there are duplicated names and how to handle them (renew, reinstall, newcert, or raising an error to stop the client run if the user chooses to cancel the operation when prompted). :param config: Configuration object :type config: configuration.NamespaceConfig :param domains: List of domain names :type domains: `list` of `str` :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or `None` if renewal shouldn't occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. newcertN)r`N)r`N)NN)Z duplicaterZfind_duplicative_certsr_rY)r%r3Zident_names_certZsubset_names_certr/r/r0_find_lineage_for_domainss  ra)r%r3r4r&cCs.t|||\}}|dkr"tjd|dk|fS)abFinds an existing certificate object given domains and/or a certificate name. :param config: Configuration object :type config: configuration.NamespaceConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple of a boolean that indicates if this function should be followed by a call to fetch a certificate from the server, and either a RenewableCert instance or None. :rtype: `tuple` of `bool` and :class:`storage.RenewableCert` or `None` rZz Keeping the existing certificate)&_find_lineage_for_domains_and_certnameloggerinfo)r%r3r4r6r5r/r/r0 _find_cert:s recCs|st||Stj||}|rp|rftj||}|rft|t|krft||t||||jd|fSt||S|rxdSt j dj |dS)aFind appropriate lineage based on given domains and/or certname. :param config: Configuration object :type config: configuration.NamespaceConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or None if renewal should not occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. r'r`Nz}No certificate with name {0} found. Use -d to specify domains, or run certbot certificates to see possible certificate names.)r`N) rarlineage_for_certnamedomains_for_certnamesetrG_ask_user_to_confirm_new_namesr<r_r ConfigurationErrorr8)r%r3r4r5Zcomputed_domainsr/r/r0rbSs       rbT)afterbeforer&cCs@tt|t|}tt|t|}|j|j||fS)zWGet lists of items removed from `before` and a lists of items added to `after` )listrhsort)rlrmaddedremovedr/r/r0_get_added_removeds rr) characterstringsr&cCs(|s d}nddj|}|j|tjdS)z%Format list with given character z {br}(None)z {br}{ch} )ZchrH)rNr8r"rQ)rsrtZ formattedr/r/r0 _format_lists ru)r% new_domainsr4 old_domainsr&cCsX|jr dSt||\}}dj|td|td|tjd}tj|dddd sTtj d dS) aAsk user to confirm update cert certname to contain new_domains. :param config: Configuration object :type config: configuration.NamespaceConfig :param new_domains: List of new domain names :type new_domains: `list` of `str` :param certname: Name of certificate :type certname: str :param old_domains: List of old domain names :type old_domains: `list` of `str` :returns: None :rtype: None :raises errors.ConfigurationError: if cert name and domains mismatch NzYou are updating certificate {0} to include new domain(s): {1}{br}{br}You are also removing previously included domain(s): {2}{br}{br}Did you intend to make this change?+-)rHzUpdate certificaterIT)r]z2Specified mismatched certificate name and domains.) Zrenew_with_new_domainsrrr8rur"rQr-rSr rj)r%rvr4rwrprqrFr/r/r0ris ri)r% installerrXr&cCsVd}|j}|jr|j}n|r(tj||}|s8tj||}| rN| rNtjd||fS)aRetrieve domains and certname from config or user input. :param config: Configuration object :type config: configuration.NamespaceConfig :param installer: Installer object :type installer: interfaces.Installer :param `str` question: Overriding default question to ask the user if asked to choose from domain names. :returns: Two-part tuple of domains and certname :rtype: `tuple` of list of `str` and `str` :raises errors.Error: Usage message, if parameters are not used correctly NzPlease specify --domains, or --installer that will help in domain names autodiscovery, or --cert-name for an existing certificate name.)r4r3rrg display_opsZ choose_namesr r>)r%rzrXr3r4r/r/r0_find_domains_or_certnames    r|T)r% installer_errr5new_or_renewed_certr&c sg}|r.|jdjdtjdt||rrjrD|jdn.trb|jdtjdnjsr|jd|szdSfd d tj d tj fD\}}}t ||d t j d t |dd x|D]}t j d|qW|rt dS)aDisplays post-run/certonly advice to the user about renewal and installation. The output varies by runtime configuration and any errors encountered during installation. :param config: Configuration object :type config: configuration.NamespaceConfig :param installer_err: The installer/enhancement error encountered, if any. :type error: Optional[errors.Error] :param lineage: The resulting certificate lineage from the issuance, if any. :type lineage: Optional[storage.RenewableCert] :param bool new_or_renewed_cert: Whether the verb execution resulted in a certificate being saved (created or renewed). zBThe certificate was saved, but could not be installed (installer: zM). After fixing the error shown below, try installing it again by running: z install --cert-name zCertificates created using --csr will not be renewed automatically by Certbot. You will need to renew the certificate before it expires, by running the same Certbot command again.zThis certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same z. command before the certificate's expiry date.zThe certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.Ncs&g|]}tjjrj r|ndqS))rUstdoutisattyr+).0c)r%r/r0 #sz&_report_next_steps.. )endz NEXT STEPS:rz- )appendrzrrT!_cert_name_from_config_or_lineagecsr_is_interactive_only_authpreconfigured_renewalrZ ANSI_SGR_BOLDZANSI_SGR_RESETprintr-r7) r%r}r5r~ZstepsZbold_onnlZbold_offstepr/)r%r0_report_next_stepss2"     r)r% cert_pathfullchain_pathkey_pathr&cCs|jrtjddS|r|s$tdd}|jr)rrFresult)r%r/r0_tos_cbsz#_determine_account.._tos_cbrMzNo account has been chosen.r)Ztos_cbzAccount registered.rT)exc_infoz.Unable to register an account with ACME server)strrAccountFileStorageloadfind_alllenr{Zchoose_accountr r>emailregister_unsafely_without_email get_emailr registerr-r7ZMissingCommandlineFlagrcdebugid)r%raccount_storageacmeaccaccountsZ potential_accr/)r%r0_determine_accounts6         rcs |j}|dkr&d}tj|ddddd}|s.dS|js8t|jsJtj||_tj t j tj ||jddd||jy&tj |fd d gd d d d Wnftjk rtjd dStk r}z(d}|j|j|j|}tj|WYdd}~XnXtj|dS)aDoes the user want to delete their now-revoked certs? If run in non-interactive mode, deleting happens automatically. :param config: parsed command line arguments :type config: configuration.NamespaceConfig :returns: `None` :rtype: None :raises errors.Error: If anything goes wrong, including bad user input, if an overlapping archive dir is found for the specified lineage, etc ... Nz{Would you like to delete the certificate(s) you just revoked, along with all earlier and later versions of the certificate?zYes (recommended)ZNoT) yes_labelno_labelrKr]zutf-8)encodingZdefault_encodingcsS)Nr/)x) archive_dirr/r0sz(_delete_if_appropriate..cSs|jS)N)r)rr/r/r0rscSs|jS)N)rE)rr/r/r0rszhNot deleting revoked certificates due to overlapping archive dirs. More than one certificate is using %sz_config.default_archive_dir: {0}, config.live_dir: {1}, archive_dir: {2},original exception: {3})Zdelete_after_revoker-rSrr*r4rcert_path_to_lineagerZfull_archive_path configobjZ ConfigObjrenewal_file_for_certnameZmatch_and_check_overlapsr ZOverlappingMatchFoundrcZwarning Exceptionr8Zdefault_archive_dirr?r>delete)r%Zattempt_deletionrFer/)rr0_delete_if_appropriates6       r)r%rrzr&cCs>|dk r"t|\}}tjd|nd\}}tj|||||dS)aInitialize Let's Encrypt Client :param config: Configuration object :type config: configuration.NamespaceConfig :param authenticator: Acme authentication handler :type authenticator: Optional[interfaces.Authenticator] :param installer: Installer object :type installer: interfaces.Installer :returns: client: Client object :rtype: client.Client NzPicked account: %r)r)NN)rrcrr Client)r%rrzrrr/r/r0_init_le_clients  r)r%unused_pluginsr&c Cstj|}|j}|sdSd}tj|dddd}|s8dSt|\}}tj||dd|d }|jsht j d |jj |j tj|} | j |jtjd dS) a:Deactivate account on server :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating an error :rtype: None or str z.Could not find existing account to deactivate.zCAre you sure you would like to irrevocably deactivate your account?Z DeactivateZAbortT)rrr]zDeactivation aborted.N)rzACME client is not set.zAccount deactivated.)rrrr-rSrr rrr r>Zdeactivate_registrationregrrr7) r%rrrpromptZwants_deactivaterr cb_clientZ account_filesr/r/r0 unregisters$       rcCs&tj|}|j}|rdSt|dS)a=Create accounts on the server. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating and error :rtype: None or str zmThere is an existing account; registration of a duplicate account with this command is currently unsupported.N)rrrr)r%rrrr/r/r0rGs  rc Cstj|}|j}|sdS|jdkr:|j r:tjdd|_t|\}}tj ||dd|d}|j sjt j df}|jrdd|jj d D}|jj}|j j|jj|jjj|d d |_|jj|d |_|j||j |jstjd ntj||tjdj|jdS)a=Modify accounts on the server. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating and error :rtype: None or str z-Could not find an existing account to update.NF)Zoptional)rzACME client is not set.cSsg|] }d|qS)zmailto:r/)rrr/r/r0rsz"update_account..,)Zcontact)body)urizFAny contact information associated with this account has been removed.z'Your e-mail address was updated to {0}.)rrrrrr{rrr rrr r>splitrrZupdate_registrationupdaterZ update_regrr-r7rZprepare_subscriptionr8) r%rrrrrrZ acc_contactsZ prev_regr_urir/r/r0update_accountfs.      rc Cs@|r |jS|jr|jSytj|}|Stjk r:YnXdS)N)rEr4rrr r>)r%r5Z cert_namer/r/r0rs r)r%r2r3r5r&cCsF|r|n|}|jdk st|j||j|j|j|j|j||jdS)aInstall a cert :param config: Configuration object :type config: configuration.NamespaceConfig :param le_client: Client object :type le_client: client.Client :param domains: List of domains :type domains: `list` of `str` :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: `None` :rtype: None N)rr*Zdeploy_certificaterrrenhance_config)r%r2r3r5Z path_providerr/r/r0 _install_certs   r)r%pluginsr&c Cs$ytj||d\}}Wn&tjk r<}zt|Sd}~XnX|joH|j}|j rt| rtd}tj |dd|dd|_t j ||stj d|jrt |}nt j|rtjd|jr|jrt|t||\}}t|d|d }t|||n tjd t j|r tj||j} t j| |||dS) a'Install a previously obtained cert in a server. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` or the error message :rtype: None or str installNz,Which certificate would you like to install?F)allow_multiple custom_promptrzVOne ore more of the requested enhancements are not supported by the selected installerzLOne or more of the requested enhancements require --cert-name to be provided)rrzzPath to certificate or key was not defined. If your certificate is managed by Certbot, please use --cert-name to define which certificate you would like to install.)plug_selchoose_configurator_pluginsr PluginSelectionErrorrrrr4r get_certnamesr$ are_supportedNotSupportedError_populate_from_certname are_requestedrj_check_certificate_and_keyr|rrrfenable) r%rrz_rZ custom_certcertname_questionr3r2r5r/r/r0rs4         rcCsZtj||j}|s|S|js&|j|j_|js6|j|j_|jsF|j|j_|jsV|j|j_|S)zfHelper function for install to populate missing config values from lineage defined by --cert-name.)rrfr4r namespacerrr)r%r5r/r/r0rs    rcCsPtjjtj|js&tjdj|jtjjtj|j sLtjdj|j dS)Nz-Error while reading certificate from path {0}z-Error while reading private key from path {0}) r"pathisfiler realpathrr rjr8r)r%r/r/r0rs  rcCstjd|j|jdkrgn|j}|jj|}tjd|tjtjdd}|j rl|j rl|t |dS|j||j |}tjd||j s|t |dS|j |j }tjd||t |dS)zList server software plugins. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None zExpected interfaces: %sNzFiltered plugins: %rF)r(zVerified plugins: %rzPrepared plugins: %s) rcrifacesZvisible functoolspartialr-r.ZinitZpreparerZverify available)r%rrZfilteredr7Zverifiedrr/r/r0 plugins_cmd s$       rcsddddg}tfdd|D}tj rP| rPd}tj|tjtjdyt j |d \}}Wn&tj k r}zt |Sd }~XnXtj |stjd d }tjd d |dd_tjj} | d krtjdjr| } n d} tj| | } | s tjdtjj} | s*tjdjs:| j_|r`td |d} | j| jd dtjr|tj| | |d S)a6Add security enhancements to existing configuration :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating an error :rtype: None or str ZhstsZredirectZuirZstaplec3s|]}t|VqdS)N)getattr)rZenh)r%r/r0 Wszenhance..z|Please specify one or more enhancement types to configure. To list the available enhancement types, run: %s --help enhance z#No enhancements requested, exiting.enhanceNzVOne ore more of the requested enhancements are not supported by the selected installerzFWhich certificate would you like to use to enhance your configuration?F)rrrzBCould not find the list of domains for the given certificate name.zJWhich domain names would you like to enable the selected enhancements for?zAUser cancelled the domain selection. No domains defined, exiting.z:Could not find the lineage for the given certificate name.)rrz)Zredirect_default)anyr$rrcerrorrrTr ZMisconfigurationErrorrrrrrrrrr4rgr>noninteractive_moder{Z choose_valuesrfrrrr)r%rZsupported_enhancementsZ oldstyle_enhrFrzrrrZ cert_domainsr3Zdomain_questionr5r2r/)r%r0rGsH         rcCstj|j|j||dS)aRollback server configuration changes made during install. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r rollbackrzZ checkpoints)r%rr/r/r0rs rcCstj|dS)aUpdate the certificate file family symlinks Use the information in the config file to make symlinks point to the correct archive directory. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rZupdate_live_symlinks)r%rr/r/r0update_symlinkssrcCstj|dS)aZRename a certificate Use the information in the config file to rename an existing lineage. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rZrename_lineage)r%rr/r/r0renamesrcCstj|dS)aZDelete a certificate Use the information in the config file to delete an existing lineage. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rr)r%rr/r/r0rsrcCstj|dS)a.Display information about certs configured with Certbot :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r certificates)r%rr/r/r0rsrc Csd|_|_|jdkrV|jrVtjtj||j|}|j|_|jrttj d rt|j|_n|j sj|jrt|jrtt j d|j dk rt jd|j|j tj|j|j t|j d}tjj|j}WdQRXtj||}n,t jd|jt|\}}tj||j|j}t|jd}tj|jd}WdQRXt jd|jy |jtj||jt|Wn(t j!k r} zt"| Sd} ~ XnXt#j$|jdS) aSRevoke a previously obtained certificate. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or string indicating error in case of error :rtype: None or str NserverzCError! Exactly one of --cert-path or --cert-name must be specified!z$Revoking %s using certificate key %srbzRevoking %s using Account KeyrzReason code for revocation: %s)%rzrrr4r RenewableCertrrrrCr r>rrcrrZverify_cert_matches_priv_keyopenjoseZJWKrreadr Zacme_from_config_keyrkeyrZpyopenssl_load_certificatereasonrevokeZComparableX509r acme_errorsZ ClientErrorrr{Zsuccess_revocation) r%rr5frrrrrArr/r/r0rs:        rc)Csytj||d\}}Wn&tjk r<}zt|Sd}~XnXtj||sTtjdt|||}t ||\}}t |||\}} | } |rt ||||| } | r| j nd} | r| j nd} | r| jnd} |rt|| | | d}zyZt|||| tj|o| rtj| |||| dks| r&tj|n tj|Wn*tjk r\}z |}WYdd}~XnXWdt||| |d|r||Xt|tj||jdS)zObtain a certificate and install. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None r[NzVOne ore more of the requested enhancements are not supported by the selected installer)r~)rrr rrr$rrrr|rer@rrrrrrrr{Zsuccess_installationZsuccess_renewalr>rr1rhandle_subscriptionr)r%rrzrrr2r3r4should_get_certr5Z new_lineagerrrr}r/r/r0r[sF    r[)r%r2r&c Cs|j\}}tj|j}tjdj|jr(dndtj |d|j |\}}|jr`t j d|j dS|j||tjj|j tjj|jtjj|j\}}} ||| fS)a@Obtain a cert using a user-supplied CSR This works differently in the CSR case (for now) because we don't have the privkey, and therefore can't construct the files for a lineage. So we just save the cert & chain to disk :/ :param config: Configuration object :type config: configuration.NamespaceConfig :param client: Client object :type client: client.Client :returns: `cert_path`, `chain_path` and `fullchain_path` as absolute paths to the actual files, or None for each if it's a dry-run. :rtype: `tuple` of `str` z{action} for {domains}z Simulating a certificate requestzRequesting a certificate)r6r3z*Dry run: skipping saving certificate to %sN)NNN)Z actual_csrrZget_names_from_reqdatar-r7r8r9r:r;Zobtain_certificate_from_csrrcrrZsave_certificater"rnormpathrr) r%r2rrZ csr_namesrAchainrrrr/r/r0_csr_get_and_save_certbs     "r)r%rr5r&cCsttj||d\}}t|||}t|||d}|s:tjd|rp|j rptj|||t j d|j d|j dS)aRenew & save an existing cert. Do not install it. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :param lineage: Certificate lineage object :type lineage: storage.RenewableCert :returns: `None` :rtype: None :raises errors.PluginSelectionError: MissingCommandlineFlag if supplied parameters do not pass r\)r5z>An existing certificate for the given name could not be found.z Reloading z! server after certificate renewalN) rrrr@r r>r9rZrun_renewal_deployerr-r7rzZrestart)r%rr5rzauthr2Zrenewed_lineager/r/r0r=s   r=c Cs tj||d\}}t|||}|jrpt||\}}}t||||t|dd|j dt|t j ||j dSt ||\}} t ||| \} } | stjddddSt|||| | } | r| jnd}| r| jnd}| r| jnd} t|||| t|d| | o|j dt|t j ||j dS)aAuthenticate & obtain cert, but do not install it. This implements the 'certonly' subcommand. :param config: Configuration object :type config: configuration.NamespaceConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None :raises errors.Error: If specified plugin could not be used r\N)r~z5Certificate not yet due for renewal; no action taken.F)r()rrrrrrrr9r1rrrr|rer-r.r@rrrr) r%rrzrr2rrrr3r4rr5rr/r/r0r\s0 r\c Csztj|WdtjXdS)aRenew previously-obtained certificates. :param config: Configuration object :type config: configuration.NamespaceConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rZhandle_renewal_requestrZrun_saved_post_hooks)r%rr/r/r0r'sr'cCsZtj|jtj|jtj|jtj|j|j|j|j f}x|D]}tj ||jdq>WdS)zCreate or verify existence of config, work, and hook directories. :param config: Configuration object :type config: configuration.NamespaceConfig :returns: `None` :rtype: None )strictN) rZset_up_core_dirZ config_dirrZCONFIG_DIRS_MODEZstrict_permissionsZwork_dirZrenewal_pre_hooks_dirZrenewal_deploy_hooks_dirZrenewal_post_hooks_dirZmake_or_verify_dir)r%Z hook_dirsZhook_dirr/r/r0make_or_verify_needed_dirss  rc csnd}d}|jr,d|_ttjd}tj|}n$|jr@tjtj}ntj tj|j }z |VWd|rh|j XdS)zCreates a display object appropriate to the flags in the supplied config. :param config: Configuration object :returns: Display object NTw) r+rrr"devnullr-NoninteractiveDisplayrUr FileDisplayrKclose)r% displayerrr/r/r0make_displayers     r)cli_argsr&cCs6|stjdd}tjtjjddkr4tj|}t j j }t j dtjt j dtjdt j d|t j d |tjtj||}tj|}tjj|tjtjytj|t|Wn"tjk r|j t!krYnXt"j#|}tjj|tj$t%j&|j't(|}t)j*||j ||SQRXdS) zRun Certbot. :param cli_args: command line to Certbot, defaults to ``sys.argv[1:]`` :type cli_args: `list` of `str` :returns: value for `sys.exit` about the exit status of Certbot :rtype: `str` or `int` or `None` rMNZCERTBOT_SNAPPEDTruezcertbot version: %sz#Location of certbot entry point: %srz Arguments: %rzDiscovered plugins: %r)+rUrVrZpre_arg_parse_setupr"environgetrZ prepare_env plugins_discoPluginsRegistryrrcrcertbot __version__r!Zprepare_virtual_consolerZprepare_and_parse_argsr NamespaceConfigzopeZ componentZprovideUtilityrZIConfigZ+raise_for_non_administrative_windows_rightsZpost_arg_parse_setuprr r>funcrrZReporterZ IReporterrr,Zprint_messagesr display_objZ set_display)r rargsr%Zreportrr/r/r0main's6              r)NNN)N)T)N)N)N)~__doc__ contextlibrrZlogging.handlersZloggingrUZtypingrrrrrrr r rZjosepyrZzope.componentrZzope.interfacerr Z acme_clientr rrr rrrZcertbot._internalrrrrrrrrrrrrZcertbot._internal.displayrrr:Zcertbot._internal.pluginsrr rrZcertbot.compatr r!r"Zcertbot.displayr#r{r-Zcertbot.pluginsr$rWZ getLogger__name__rcrr1rrrr@rGrYr_raboolrerbrkrrruriZ Installerr|r>rrrrZAccountZClientV2rrZ Authenticatorrrrrrrrrrrrrrrrrrrr[rr=r\r'rrrrintrr/r/r/r0s                                        "<-3  (  ")*  '.+&E&, %<4*5&< &?6F"&"2