mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-11-28 14:11:10 +01:00
Code Issues Projects Releases Wiki Activity

Update ACME order status on order fetch (#20451)

Browse Source 
- When someone is fetching the order to get it's status, compute if we
   need to bump the status to Ready like we do in finalize handler
 - Add a wait state to the ACME docker test suite to deal with a race
   condition
This commit is contained in:
Steven Clark 2023-05-01 16:18:18 -04:00 committed by GitHub
parent 21bde241e0
commit a65e746406
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
builtin/logical/pki/path_acme_order.go
View File

@ -512,6 +512,13 @@ func (b *backend) acmeGetOrderHandler(ac *acmeContext, _ *logical.Request, field
return nil, err return nil, err
} }
if order.Status == ACMEOrderPending {
// Lets see if we can update our order status to ready if all the authorizations have been completed.
if requiredAuthorizationsCompleted(b, ac, uc, order) {
order.Status = ACMEOrderReady
}
}
// Per RFC 8555 -> 7.1.3. Order Objects // Per RFC 8555 -> 7.1.3. Order Objects
// For final orders (in the "valid" or "invalid" state), the authorizations that were completed. // For final orders (in the "valid" or "invalid" state), the authorizations that were completed.
// //

6
builtin/logical/pkiext/pkiext_binary/acme_test.go
View File

@ -276,7 +276,7 @@ func doAcmeValidationWithGoLibrary(t *testing.T, directoryUrl string, acmeOrderI
func(tosURL string) bool { return true }) func(tosURL string) bool { return true })
require.NoError(t, err, "failed registering account") require.NoError(t, err, "failed registering account")
// Create an ACME order that // Create an ACME order
order, err := acmeClient.AuthorizeOrder(testCtx, acmeOrderIdentifiers) order, err := acmeClient.AuthorizeOrder(testCtx, acmeOrderIdentifiers)
require.NoError(t, err, "failed creating ACME order") require.NoError(t, err, "failed creating ACME order")
@ -324,6 +324,10 @@ func doAcmeValidationWithGoLibrary(t *testing.T, directoryUrl string, acmeOrderI
require.NoError(t, err, "failed to accept challenge: %v", challenge) require.NoError(t, err, "failed to accept challenge: %v", challenge)
} }
// Wait for the order/challenges to be validated.
_, err = acmeClient.WaitOrder(testCtx, order.URI)
require.NoError(t, err, "failed waiting for order to be ready")
// Create/sign the CSR and ask ACME server to sign it returning us the final certificate // Create/sign the CSR and ask ACME server to sign it returning us the final certificate
csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
csr, err := x509.CreateCertificateRequest(rand.Reader, cr, csrKey) csr, err := x509.CreateCertificateRequest(rand.Reader, cr, csrKey)