Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add flag --bupem to make a bottom-up PEM #1864

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add flag --bupem to make a bottom-up PEM #1864

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions cmd/certs_storage.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ const (
type CertificatesStorage struct {
rootPath string
archivePath string
bundle bool
bupem bool
pem bool
pfx bool
pfxPassword string
Expand All @@ -54,6 +56,8 @@ func NewCertificatesStorage(ctx *cli.Context) *CertificatesStorage {
return &CertificatesStorage{
rootPath: filepath.Join(ctx.String("path"), baseCertificatesFolderName),
archivePath: filepath.Join(ctx.String("path"), baseArchivesFolderName),
bundle: !ctx.Bool("no-bundle"),
bupem: ctx.Bool("bupem"),
pem: ctx.Bool("pem"),
pfx: ctx.Bool("pfx"),
pfxPassword: ctx.String("pfx.pass"),
Expand Down Expand Up @@ -102,8 +106,8 @@ func (s *CertificatesStorage) SaveResource(certRes *certificate.Resource) {
if err != nil {
log.Fatalf("Unable to save PrivateKey for domain %s\n\t%v", domain, err)
}
} else if s.pem || s.pfx {
// we don't have the private key; can't write the .pem or .pfx file
} else if s.bupem || s.pem || s.pfx {
// we don't have the private key; can't write the .bupem, .pem or .pfx file
log.Fatalf("Unable to save PEM or PFX without private key for domain %s. Are you using a CSR?", domain)
}

Expand Down Expand Up @@ -181,6 +185,20 @@ func (s *CertificatesStorage) WriteCertificateFiles(domain string, certRes *cert
return fmt.Errorf("unable to save key file: %w", err)
}

if s.bupem { // how we make the bupem depends on whether the bundle flag is true. bottom-up == private key first.
if s.bundle { // bundle is true by default. So certRes.Certificate already consists of OurX509+Int+CA
err = s.WriteFile(domain, ".bupem", bytes.Join([][]byte{certRes.PrivateKey, certRes.Certificate}, nil))
if err != nil {
return fmt.Errorf("unable to save bottom-up PEM file: %w", err)
}
} else { // when bundle is false, we want pKey+OurX509+Int+CA
err = s.WriteFile(domain, ".bupem", bytes.Join([][]byte{certRes.PrivateKey, certRes.Certificate, certRes.IssuerCertificate}, nil))
if err != nil {
return fmt.Errorf("unable to save bottom-up PEM file: %w", err)
}
}
}

if s.pem {
err = s.WriteFile(domain, ".pem", bytes.Join([][]byte{certRes.Certificate, certRes.PrivateKey}, nil))
if err != nil {
Expand Down
4 changes: 4 additions & 0 deletions cmd/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,10 @@ func CreateFlags(defaultPath string) []cli.Flag {
Usage: "Set the DNS timeout value to a specific value in seconds. Used only when performing authoritative name server queries.",
Value: 10,
},
&cli.BoolFlag{
Name: "bupem",
Usage: "Generate an additional 'bottom-up' .bupem (PEM, base64) file by concatenating the .key, .crt and issuer .crt together, in that order.",
Copy link
Member

@dmke dmke May 28, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"PEM, base64" is redundant, as all PEM files encode X.509 DER serialization data as Base64. I'd reword it as:

Suggested change
Usage: "Generate an additional 'bottom-up' .bupem (PEM, base64) file by concatenating the .key, .crt and issuer .crt together, in that order.",
Usage: "Generate an additional 'bottom-up PEM' file (.bupem) by concatenating the private key, leaf certificate and issuer chain (in that order) into a single file.",

(I'm not sure on the article in front of "private key": Is it required there, and/or do "leaf certificate" and "issuer chain" also need a "the"?)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not strictly necessary - abstract is equally intelligible. First 'the' is acceptable in native English.

},
&cli.BoolFlag{
Name: "pem",
Usage: "Generate an additional .pem (base64) file by concatenating the .key and .crt files together.",
Expand Down
1 change: 1 addition & 0 deletions docs/data/zz_cli_help.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ COMMANDS:

GLOBAL OPTIONS:
--accept-tos, -a By setting this flag to true you indicate that you accept the current Let's Encrypt terms of service. (default: false)
--bupem Generate an additional 'bottom-up' .bupem (PEM, base64) file by concatenating the .key, .crt and issuer .crt together, in that order. (default: false)
--cert.timeout value Set the certificate timeout value to a specific value in seconds. Only used when obtaining certificates. (default: 30)
--csr value, -c value Certificate signing request filename, if an external CSR is to be used.
--dns value Solve a DNS-01 challenge using the specified provider. Can be mixed with other types of challenges. Run 'lego dnshelp' for help on usage.
Expand Down