From 71545518825e80ef580b1507a8f08b287ec7f9fa Mon Sep 17 00:00:00 2001 From: Laurent Peuch Date: Wed, 14 Oct 2020 03:50:14 +0200 Subject: [PATCH 1/2] [fix] intermediate_certificate is now included in signed certificate Fixes #1644 --- src/yunohost/certificate.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index 64582c222..06baa3c65 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -539,12 +539,6 @@ def _fetch_and_enable_new_certificate(domain, staging=False, no_checks=False): raise YunohostError('certmanager_cert_signing_failed') - import requests # lazy loading this module for performance reasons - try: - intermediate_certificate = requests.get(INTERMEDIATE_CERTIFICATE_URL, timeout=30).text - except requests.exceptions.Timeout as e: - raise YunohostError('certmanager_couldnt_fetch_intermediate_cert') - # Now save the key and signed certificate logger.debug("Saving the key and signed certificate...") @@ -573,7 +567,6 @@ def _fetch_and_enable_new_certificate(domain, staging=False, no_checks=False): with open(domain_cert_file, "w") as f: f.write(signed_certificate) - f.write(intermediate_certificate) _set_permissions(domain_cert_file, "root", "ssl-cert", 0o640) From 46268185c5ae680ad5259aee275f30c703c21ee4 Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Wed, 14 Oct 2020 04:08:34 +0200 Subject: [PATCH 2/2] Remove stale code --- locales/en.json | 1 - src/yunohost/certificate.py | 2 -- 2 files changed, 3 deletions(-) diff --git a/locales/en.json b/locales/en.json index 115928001..c50734005 100644 --- a/locales/en.json +++ b/locales/en.json @@ -124,7 +124,6 @@ "certmanager_cert_renew_success": "Let's Encrypt certificate renewed for the domain '{domain:s}'", "certmanager_cert_signing_failed": "Could not sign the new certificate", "certmanager_certificate_fetching_or_enabling_failed": "Trying to use the new certificate for {domain:s} did not work...", - "certmanager_couldnt_fetch_intermediate_cert": "Timed out when trying to fetch intermediate certificate from Let's Encrypt. Certificate installation/renewal aborted—please try again later.", "certmanager_domain_not_diagnosed_yet": "There is no diagnosis result for domain {domain} yet. Please re-run a diagnosis for categories 'DNS records' and 'Web' in the diagnosis section to check if the domain is ready for Let's Encrypt. (Or if you know what you are doing, use '--no-checks' to turn off those checks.)", "certmanager_domain_cert_not_selfsigned": "The certificate for domain {domain:s} is not self-signed. Are you sure you want to replace it? (Use '--force' to do so.)", "certmanager_domain_dns_ip_differs_from_public_ip": "The DNS records for domain '{domain:s}' is different from this server's IP. Please check the 'DNS records' (basic) category in the diagnosis for more info. If you recently modified your A record, please wait for it to propagate (some DNS propagation checkers are available online). (If you know what you are doing, use '--no-checks' to turn off those checks.)", diff --git a/src/yunohost/certificate.py b/src/yunohost/certificate.py index 06baa3c65..8bafcbd4f 100644 --- a/src/yunohost/certificate.py +++ b/src/yunohost/certificate.py @@ -65,8 +65,6 @@ STAGING_CERTIFICATION_AUTHORITY = "https://acme-staging.api.letsencrypt.org" # For prod PRODUCTION_CERTIFICATION_AUTHORITY = "https://acme-v02.api.letsencrypt.org" -INTERMEDIATE_CERTIFICATE_URL = "https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem" - # # Front-end stuff # #