pki: T9531: Fix OpenConnect ACME certificate detection with HAProxy

When HAProxy was configured, OpenConnect's certificate was checked
against a variable left over from the HAProxy loop instead of the ACME
certificate being processed. If no HAProxy service had an SSL
certificate, every pki commit failed with UnboundLocalError.

Now OpenConnect is listed only for the certificate it actually uses.

1 files changed, 6 insertions, 8 deletions

diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 9a15be8c8..4efef811d 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -523,24 +523,22 @@ def get_config(config=None):
     # certificate is used by.
     # Required to check if we might need to run certbot behind a reverse proxy.
     if 'certificate' in pki:
+        haproxy = dict_search('system.load_balancing.haproxy', pki)
         for name, cert_config in pki['certificate'].items():
             if 'acme' not in cert_config:
                 continue
-            if not dict_search('system.load_balancing.haproxy', pki):
-                continue
             # Determine which service depends on ACME issued certificates
             # We only need to add services blocking the default certbot ports
             # 80 and 443. For instance there won't be a conflict with strongSwan
             # as it runs on different ports.
             used_by = []
             # We start with HAProxy
-            for cert_list, _ in dict_search_recursive(
-                pki['system']['load_balancing']['haproxy'], 'certificate'):
-                if name in cert_list:
-                    used_by.append('haproxy')
+            if haproxy:
+                for cert_list, _ in dict_search_recursive(haproxy, 'certificate'):
+                    if name in cert_list:
+                        used_by.append('haproxy')
             # Check if OpenConnect consumes an ACME certificate
-            tmp = dict_search('system.vpn.openconnect.ssl.certificate', pki)
-            if tmp and tmp in cert_list:
+            if dict_search('system.vpn.openconnect.ssl.certificate', pki) == name:
                 used_by.append('openconnect')
 
             if used_by: