diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-08-10 18:24:39 +0000 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-08-10 21:04:10 +0200 |
| commit | 0cfdd6a869772defbd6ca7778273bdab4b85dfe7 (patch) | |
| tree | e90bcf11da6a8eb800ba167a48abc24ce81a3c58 /python | |
| parent | 9f34c853adcc94cb8c03e25457f739096c175276 (diff) | |
| download | vyos-1x-0cfdd6a869772defbd6ca7778273bdab4b85dfe7.tar.gz vyos-1x-0cfdd6a869772defbd6ca7778273bdab4b85dfe7.zip | |
pki: T9135: don't crash on an ACME certificate not yet issued
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/config.py | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/python/vyos/config.py b/python/vyos/config.py index 9d7801758..e79f659b7 100644 --- a/python/vyos/config.py +++ b/python/vyos/config.py @@ -382,8 +382,9 @@ class Config(object): # already completes the chain, making this # redundant. cert_conf = pki_dict['certificate'][certificate] - if 'acme' in cert_conf and not acme_chain_redundant( - cert_conf['certificate'], real_ca_certs): + leaf_cert = cert_conf.get('certificate') + if leaf_cert and 'acme' in cert_conf and not acme_chain_redundant( + leaf_cert, real_ca_certs): chain_entry = acme_chain_ca_entry(vyos_certbot_dir, certificate) if chain_entry: ca_dict = pki_dict.setdefault('ca', {}) |