vyos-1x.git/src/op_mode/pki.py, branch rolling

pki: T8165: Add ability to show certificate full chain in pem format

2026-06-04T23:33:41+00:00

Add op-mode command having ability to show certificate full chain in pem format as part of PKI configuration. The certificates are ordered beginning with the end entity (leaf) certificate, followed by any intermediate certificates and finally the private key if requested. This allows users to easily export a certificate along with its CA hierarchy for use in external applications, that require the full chain to be provided in a single file. One can now run the following commands: ``` show pki ca NAME pem full-chain show pki certificate NAME pem full-chain show pki certificate NAME private pem full-chain ```

pki: T8877: Add ability to show private key in pem format

2026-05-19T04:33:51+00:00

Add op-mode command having ability to show private key in pem format as part of PKI configuration. This is needed for users who want to render the certificate and its private key.

pki: T7953: implement certbot_renew() function to have everything at one place

2025-10-29T19:18:41+00:00

pki: T7885: "renew certbot force" now supports setting up ACME from scratch

2025-10-02T21:39:40+00:00

Assume someone deleted the certbot_config folder, "renew certbot force" alone will not work as there are no configuration files left to know what to renew. Re-run CLI PKI helper to initially request certificates via ACME again. This "should" (famous last words) never be the case - but sometimes the universe has a bad time.

op-mode: pki: T7648: fix pylint error

2025-07-21T19:02:24+00:00

************* Module pki src/op_mode/pki.py:459:8: E1128: Assigning result of a function call, where the function returns None (assignment-from-none)

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

pki: T7574: add optional force argument to renew certbot-issued certificates

2025-06-23T20:45:32+00:00

Certbot renewal command in op-mode "renew certbot" only works if any of the certificates is up for renewal. There is no CLI option to forcefully renew a certificate. This is about adding a force option to the CLI and with this addition move the entire certbot renew handling to new-style op-mode commands. vyos@vyos:~$ renew certbot force - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /config/auth/letsencrypt/renewal/vyos.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Renewing an existing certificate for vyos.io - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded: /config/auth/letsencrypt/live/vyos/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'post-hook' ran with output: Updating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d... done.

pki: T4914: reformat file by linter rules

2024-10-18T13:46:39+00:00

pki: T4914: Rewrite the PKI op mode in the new style

2024-10-18T12:42:59+00:00

pki: T6481: auto import ACME certificate chain into CLI

2024-10-06T18:13:56+00:00

When using an ACME based certificate with VyOS we provide the necessary PEM files opaque in the background when using the internal tools. This however will not properly work with the CA chain portion, as the system is based on the "pki certificate acme" CLI node of a certificate but CA chains reside under "pki ca". This adds support for importing the PEM data of a CA chain issued via ACME into the "pki ca AUTOCHAIN_ certificate" subsystem so it can be queried by other daemons. Importing the chain only happens, when the chain was not already added manually by the user. ACME certificate chains that are automatically added to the CLI are all prefixed using AUTOCHAIN_certname so they can be consumed by any daemon. This also adds a safeguard when the intermediate CA changes, the referenced name on the CLI stays consitent for any pending daemon updates.