Skip to content

Commit

Permalink
Don't assume order status to be valid
Browse files Browse the repository at this point in the history
Per https://tools.ietf.org/html/rfc8555#section-7.1.3

> status (required, string):  The status of this order.  Possible values are
> "pending", "ready", "processing", "valid", and "invalid".  See Section 7.1.6.
  • Loading branch information
Rogdham authored and lukas2511 committed Apr 2, 2020
1 parent c8333f5 commit 58bd926
Showing 1 changed file with 23 additions and 3 deletions.
26 changes: 23 additions & 3 deletions dehydrated
Original file line number Diff line number Diff line change
Expand Up @@ -699,7 +699,8 @@ sign_csr() {
challenge_identifiers="[${challenge_identifiers%, }]"

echo " + Requesting new certificate order from CA..."
result="$(signed_request "${CA_NEW_ORDER}" '{"identifiers": '"${challenge_identifiers}"'}')"
order_location="$(signed_request "${CA_NEW_ORDER}" '{"identifiers": '"${challenge_identifiers}"'}' 4>&1 | grep -i ^Location: | awk '{print $2}' | tr -d '\r\n')"
result="$(signed_request "${order_location}" "" | clean_json)"

order_authorizations="$(echo ${result} | get_json_array_value authorizations)"
finalize="$(echo "${result}" | get_json_string_value finalize)"
Expand Down Expand Up @@ -867,8 +868,27 @@ sign_csr() {
crt64="$(signed_request "${CA_NEW_CERT}" '{"resource": "new-cert", "csr": "'"${csr64}"'"}' | "${OPENSSL}" base64 -e)"
crt="$( printf -- '-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----\n' "${crt64}" )"
else
result="$(signed_request "${finalize}" '{"csr": "'"${csr64}"'"}' | clean_json | get_json_string_value certificate)"
crt="$(signed_request "${result}" "")"
result="$(signed_request "${finalize}" '{"csr": "'"${csr64}"'"}' | clean_json)"
while :
do
status="$(echo "${result}" | get_json_string_value status)"
echo " > Order is ${status}..."
case "${status}"
in
"processing" | "pending")
sleep 2;
;;
"valid")
break;
;;
*)
_exiterr "Order in status ${status}"
;;
esac
result="$(signed_request "${order_location}" "" | clean_json)"
done
certificate="$(echo "${result}" | get_json_string_value certificate)"
crt="$(signed_request "${certificate}" "")"
fi

# Try to load the certificate to detect corruption
Expand Down

0 comments on commit 58bd926

Please sign in to comment.