From 0cfdd6a869772defbd6ca7778273bdab4b85dfe7 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 10 Aug 2026 18:24:39 +0000 Subject: pki: T9135: don't crash on an ACME certificate not yet issued Both the with_pki=True chain injection and "show pki ca" unconditionally read a certificate's own content to check whether an explicit CA already covers its chain. For an ACME certificate with no cert.pem yet (pending its first issuance, or after a failed request), that content is never populated and the lookup raised KeyError - crashing every with_pki=True consumer and "show pki" alike. --- src/op_mode/pki.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 9b5f9fdcc..91a83ea70 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -162,7 +162,10 @@ def get_config_ca_certificate(name=None): for cert_name, cert_conf in (get_config_certificate() or {}).items(): if 'acme' not in cert_conf: continue - if acme_chain_redundant(cert_conf['certificate'], real_ca_certs): + leaf_cert = cert_conf.get('certificate') + if not leaf_cert: + continue + if acme_chain_redundant(leaf_cert, real_ca_certs): continue chain_entry = acme_chain_ca_entry(vyos_certbot_dir, cert_name) if chain_entry: -- cgit v1.2.3