From 0cfdd6a869772defbd6ca7778273bdab4b85dfe7 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 10 Aug 2026 18:24:39 +0000 Subject: pki: T9135: don't crash on an ACME certificate not yet issued Both the with_pki=True chain injection and "show pki ca" unconditionally read a certificate's own content to check whether an explicit CA already covers its chain. For an ACME certificate with no cert.pem yet (pending its first issuance, or after a failed request), that content is never populated and the lookup raised KeyError - crashing every with_pki=True consumer and "show pki" alike. --- python/vyos/config.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'python') diff --git a/python/vyos/config.py b/python/vyos/config.py index 9d7801758..e79f659b7 100644 --- a/python/vyos/config.py +++ b/python/vyos/config.py @@ -382,8 +382,9 @@ class Config(object): # already completes the chain, making this # redundant. cert_conf = pki_dict['certificate'][certificate] - if 'acme' in cert_conf and not acme_chain_redundant( - cert_conf['certificate'], real_ca_certs): + leaf_cert = cert_conf.get('certificate') + if leaf_cert and 'acme' in cert_conf and not acme_chain_redundant( + leaf_cert, real_ca_certs): chain_entry = acme_chain_ca_entry(vyos_certbot_dir, certificate) if chain_entry: ca_dict = pki_dict.setdefault('ca', {}) -- cgit v1.2.3