From 0b744dede5d45378a6240987c5ca1ebee9b352f4 Mon Sep 17 00:00:00 2001 From: Nataliia Solomko Date: Thu, 29 Oct 2026 14:23:47 +0200 Subject: pki: T9531: Fix OpenConnect ACME certificate detection with HAProxy When HAProxy was configured, OpenConnect's certificate was checked against a variable left over from the HAProxy loop instead of the ACME certificate being processed. If no HAProxy service had an SSL certificate, every pki commit failed with UnboundLocalError. Now OpenConnect is listed only for the certificate it actually uses. --- src/conf_mode/pki.py | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) (limited to 'src') diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py index 9a15be8c8..4efef811d 100755 --- a/src/conf_mode/pki.py +++ b/src/conf_mode/pki.py @@ -523,24 +523,22 @@ def get_config(config=None): # certificate is used by. # Required to check if we might need to run certbot behind a reverse proxy. if 'certificate' in pki: + haproxy = dict_search('system.load_balancing.haproxy', pki) for name, cert_config in pki['certificate'].items(): if 'acme' not in cert_config: continue - if not dict_search('system.load_balancing.haproxy', pki): - continue # Determine which service depends on ACME issued certificates # We only need to add services blocking the default certbot ports # 80 and 443. For instance there won't be a conflict with strongSwan # as it runs on different ports. used_by = [] # We start with HAProxy - for cert_list, _ in dict_search_recursive( - pki['system']['load_balancing']['haproxy'], 'certificate'): - if name in cert_list: - used_by.append('haproxy') + if haproxy: + for cert_list, _ in dict_search_recursive(haproxy, 'certificate'): + if name in cert_list: + used_by.append('haproxy') # Check if OpenConnect consumes an ACME certificate - tmp = dict_search('system.vpn.openconnect.ssl.certificate', pki) - if tmp and tmp in cert_list: + if dict_search('system.vpn.openconnect.ssl.certificate', pki) == name: used_by.append('openconnect') if used_by: -- cgit v1.2.3