From 5faebdb613ae83947f0428951f6e68d6b66da7db Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 10 Aug 2026 18:32:47 +0000 Subject: pki: T9135: preserve every certificate in an ACME chain, not just the first certbot's chain.pem commonly holds more than one certificate - e.g. the immediate intermediate plus its own issuing root - but the synthetic CA entry built from it only ever kept the first, silently dropping the rest before find_chain() ever saw them. This left a shorter chain than certbot itself actually has, e.g. requiring a root to also be configured manually to reach the same result certbot's own data already provides. Parse every certificate block in chain.pem and emit one synthetic entry per certificate, numbering entries after the first so each is still its own addressable, non-redundant, non-settable object exactly like before. --- src/op_mode/pki.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 91a83ea70..78b896edb 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -151,7 +151,6 @@ def get_config_ca_certificate(name=None): # object, but consumers (find_chain(), "show pki ca") should see it # the same way they'd see a manually-configured CA. from vyos.defaults import directories - from vyos.pki import AUTOCHAIN_PREFIX from vyos.pki import acme_chain_ca_entry from vyos.pki import acme_chain_redundant vyos_certbot_dir = directories['certbot'] @@ -167,9 +166,8 @@ def get_config_ca_certificate(name=None): continue if acme_chain_redundant(leaf_cert, real_ca_certs): continue - chain_entry = acme_chain_ca_entry(vyos_certbot_dir, cert_name) - if chain_entry: - autochain_name = f'{AUTOCHAIN_PREFIX}{cert_name}' + for autochain_name, chain_entry in acme_chain_ca_entry( + vyos_certbot_dir, cert_name).items(): # A real, manually-configured CLI CA object with this name # wins over the synthetic one if autochain_name not in ca_certs: -- cgit v1.2.3