Project

General

Profile

Actions
Copy link

Bug #16946

closed
KL

Mixed DNS and HTTP validation methods clear environment variables during multi-domain certificate issue

Bug #16946: Mixed DNS and HTTP validation methods clear environment variables during multi-domain certificate issue

Added by Konrad Lanz 2 months ago. Updated about 2 months ago.

Status:
Duplicate
Priority:
Normal
Assignee:
-
Category:
ACME
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
All
Affected Plus Version:
Affected Architecture:
All

Description

When creating a certificate containing multiple SANs that use mixed validation methods (e.g., Domain 1 uses DNS-deSEC, Domain 2 uses Standalone HTTP), the environment variables are cleared.

In `/usr/local/pkg/acme/acme.inc`, `$envvariables = array();` is defined inside the `foreach ($certificate['a_domainlist']['item'] as $domain)` loop. As a result, subsequent loop items (like an HTTP validation row that doesn't supply DNS keys) clear out the environmental array variables collected from previous rows before executing `signCertificate()`.

Moving `$envvariables = array();` immediately above the `foreach` loop fixes the issue, allowing environment definitions to accumulate properly across all target domains in a single execution pass.

Related issues 1 (1 open — 0 closed)

Is duplicate of Bug #8560: ACME cannot validate multiple domains which use different authorization methodsFeedbackJim Pingle06/08/2018

Actions

KL Updated by Konrad Lanz 2 months ago Actions
Copy link
 #2 

Konrad Lanz wrote in #note-2:
> awk -v bang="!" 'NR==3687 {$0="\t\t\t\t\t\tif (" bang "isset($envvariables)) { $envvariables = array(); }"} {print}' /usr/local/pkg/acme/acme.inc > /usr/local/pkg/acme/acme.inc.tmp && mv /usr/local/pkg/acme/acme.inc.tmp /usr/local/pkg/acme/acme.inc
> 
> sed -n '3685,3690p' /usr/local/pkg/acme/acme.inc
> 
> diff /usr/local/pkg/acme/acme.inc /usr/local/pkg/acme/acme.inc.bak                                                    3687c3687
> <                                               if (!isset($envvariables)) { $envvariables = array(); }
> ---
> >                                       $envvariables = array();

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #4

  • Priority changed from Urgent to Normal

JP Updated by Jim Pingle about 2 months ago Actions
Copy link
 #5

  • Assignee set to Jim Pingle

JP Updated by Jim Pingle about 2 months ago Actions
Copy link
 #6

  • Status changed from New to Duplicate
  • Assignee deleted (Jim Pingle)

The PR does seem to fix this, but this is a duplicate of #8560 -- I left a comment on there referencing back to this one.

JP Updated by Jim Pingle about 2 months ago Actions
Copy link
 #7

  • Is duplicate of Bug #8560: ACME cannot validate multiple domains which use different authorization methods added
Actions
Copy link

Also available in: Atom