diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-08-10 18:24:39 +0000 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-08-10 21:04:10 +0200 |
| commit | 0cfdd6a869772defbd6ca7778273bdab4b85dfe7 (patch) | |
| tree | e90bcf11da6a8eb800ba167a48abc24ce81a3c58 /src | |
| parent | 9f34c853adcc94cb8c03e25457f739096c175276 (diff) | |
| download | vyos-1x-0cfdd6a869772defbd6ca7778273bdab4b85dfe7.tar.gz vyos-1x-0cfdd6a869772defbd6ca7778273bdab4b85dfe7.zip | |
pki: T9135: don't crash on an ACME certificate not yet issued
Both the with_pki=True chain injection and "show pki ca" unconditionally read
a certificate's own content to check whether an explicit CA already covers its
chain. For an ACME certificate with no cert.pem yet (pending its first issuance,
or after a failed request), that content is never populated and the lookup
raised KeyError - crashing every with_pki=True consumer and "show pki" alike.
Diffstat (limited to 'src')
| -rwxr-xr-x | src/op_mode/pki.py | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 9b5f9fdcc..91a83ea70 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -162,7 +162,10 @@ def get_config_ca_certificate(name=None): for cert_name, cert_conf in (get_config_certificate() or {}).items(): if 'acme' not in cert_conf: continue - if acme_chain_redundant(cert_conf['certificate'], real_ca_certs): + leaf_cert = cert_conf.get('certificate') + if not leaf_cert: + continue + if acme_chain_redundant(leaf_cert, real_ca_certs): continue chain_entry = acme_chain_ca_entry(vyos_certbot_dir, cert_name) if chain_entry: |