Remove A and D flag, they are superfluous.
One could always use them on the command line and acme-client would do
the right thing.
IIRC this is a leftover from when we moved to the config file and we
never mopped this up.
It's kinda getting in the way and kinda an itch I have to scratch.
OK?
diff --git acctproc.c acctproc.c
index 23d3a026c04..de32d968dcd 100644
--- acctproc.c
+++ acctproc.c
@@ -311,13 +311,13 @@ out:
}
int
-acctproc(int netsock, const char *acctkey, int newacct)
+acctproc(int netsock, const char *acctkey)
{
FILE *f = NULL;
EVP_PKEY *pkey = NULL;
long lval;
enum acctop op;
- int rc = 0, cc;
+ int rc = 0, cc, newacct = 0;
mode_t prev;
/*
@@ -327,7 +327,10 @@ acctproc(int netsock, const char *acctkey, int newacct)
*/
prev = umask((S_IWUSR | S_IXUSR) | S_IRWXG | S_IRWXO);
- f = fopen(acctkey, newacct ? "wx" : "r");
+ if ((f = fopen(acctkey, "r")) == NULL && errno == ENOENT) {
+ f = fopen(acctkey, "wx");
+ newacct = 1;
+ }
umask(prev);
if (f == NULL) {
diff --git acme-client.1 acme-client.1
index fd4cde3133e..ba8c16bc60a 100644
--- acme-client.1
+++ acme-client.1
@@ -22,7 +22,7 @@
.Nd ACME client
.Sh SYNOPSIS
.Nm acme-client
-.Op Fl ADFnrv
+.Op Fl Fnrv
.Op Fl f Ar configfile
.Ar domain
.Sh DESCRIPTION
@@ -40,16 +40,6 @@ The certificates are typically used to provide HTTPS for web
servers,
but can be used in any situation where domain name validation is required
(such as mail servers).
.Pp
-Before a certificate can be requested, an account key needs to be
-created using the
-.Fl A
-argument.
-The first time a certificate is requested, a domain key needs to be created
with
-.Fl D .
-So a typical invocation the first time it's run would be:
-.Pp
-.Dl # acme-client -ADv example.com
-.Pp
If the certificate already exists and is less than 30 days from expiry,
.Nm
attempts to renew the certificate.
@@ -76,10 +66,6 @@ location "/.well-known/acme-challenge/*" {
.Pp
The options are as follows:
.Bl -tag -width Ds
-.It Fl A
-Create a new RSA account key if one does not already exist.
-.It Fl D
-Create a new RSA domain key if one does not already exist.
.It Fl F
Force certificate renewal, even if it's too soon.
.It Fl f Ar configfile
@@ -127,7 +113,7 @@ and
.Pa httpd.conf
and run:
.Pp
-.Dl # acme-client -ADv example.com && rcctl reload httpd
+.Dl # acme-client -v example.com && rcctl reload httpd
.Pp
A
.Xr cron 8
diff --git extern.h extern.h
index c7a11195530..a61f55e897a 100644
--- extern.h
+++ extern.h
@@ -199,7 +199,7 @@ __BEGIN_DECLS
* Start with our components.
* These are all isolated and talk to each other using sockets.
*/
-int acctproc(int, const char *, int);
+int acctproc(int, const char *);
int certproc(int, int);
int chngproc(int, const char *);
int dnsproc(int);
@@ -207,8 +207,7 @@ int revokeproc(int, const char *, const char *,
int, int, const char *const *, size_t);
int fileproc(int, const char *, const char *, const char *,
const char *);
-int keyproc(int, const char *,
- const char **, size_t, int);
+int keyproc(int, const char *, const char **, size_t);
int netproc(int, int, int, int, int, int, int,
struct authority_c *, const char *const *,
size_t);
diff --git keyproc.c keyproc.c
index 1d18bdeb408..3e7075434da 100644
--- keyproc.c
+++ keyproc.c
@@ -75,7 +75,7 @@ add_ext(STACK_OF(X509_EXTENSION) *sk, int nid, const char
*value)
*/
int
keyproc(int netsock, const char *keyfile,
- const char **alts, size_t altsz, int newkey)
+ const char **alts, size_t altsz)
{
char *der64 = NULL, *der = NULL, *dercp;
char *sans = NULL, *san = NULL;
@@ -85,7 +85,7 @@ keyproc(int netsock, const char *keyfile,
EVP_PKEY *pkey = NULL;
X509_REQ *x = NULL;
X509_NAME *name = NULL;
- int len, rc = 0, cc, nid;
+ int len, rc = 0, cc, nid, newkey = 0;
mode_t prev;
STACK_OF(X509_EXTENSION) *exts = NULL;
@@ -96,7 +96,10 @@ keyproc(int netsock, const char *keyfile,
*/
prev = umask((S_IWUSR | S_IXUSR) | S_IRWXG | S_IRWXO);
- f = fopen(keyfile, newkey ? "wx" : "r");
+ if ((f = fopen(keyfile, "r")) == NULL && errno == ENOENT) {
+ f = fopen(keyfile, "wx");
+ newkey = 1;
+ }
umask(prev);
if (f == NULL) {
diff --git main.c main.c
index 9c301f586e5..bf9d51c182e 100644
--- main.c
+++ main.c
@@ -57,14 +57,8 @@ main(int argc, char *argv[])
struct domain_c *domain = NULL;
struct altname_c *ac;
- while ((c = getopt(argc, argv, "ADFnrvf:")) != -1)
+ while ((c = getopt(argc, argv, "Fnrvf:")) != -1)
switch (c) {
- case 'A':
- popts |= ACME_OPT_NEWACCT;
- break;
- case 'D':
- popts |= ACME_OPT_NEWDKEY;
- break;
case 'F':
force = 1;
break;
@@ -173,28 +167,11 @@ main(int argc, char *argv[])
ne++;
}
- if (!(popts & ACME_OPT_NEWDKEY) && access(domain->key, R_OK) == -1) {
- warnx("%s: domain key file must exist", domain->key);
- ne++;
- } else if ((popts & ACME_OPT_NEWDKEY) && access(domain->key, R_OK)
- != -1) {
- dodbg("%s: domain key exists (not creating)", domain->key);
- popts &= ~ACME_OPT_NEWDKEY;
- }
-
if (access(chngdir, R_OK) == -1) {
warnx("%s: challenge directory must exist", chngdir);
ne++;
}
- if (!(popts & ACME_OPT_NEWACCT) && access(acctkey, R_OK) == -1) {
- warnx("%s: account key file must exist", acctkey);
- ne++;
- } else if ((popts & ACME_OPT_NEWACCT) && access(acctkey, R_OK) != -1) {
- dodbg("%s: account key exists (not creating)", acctkey);
- popts &= ~ACME_OPT_NEWACCT;
- }
-
if (ne > 0)
return EXIT_FAILURE;
@@ -276,7 +253,7 @@ main(int argc, char *argv[])
close(file_fds[0]);
close(file_fds[1]);
c = keyproc(key_fds[0], domain->key,
- (const char **)alts, altsz, (popts & ACME_OPT_NEWDKEY));
+ (const char **)alts, altsz);
exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
}
@@ -295,7 +272,7 @@ main(int argc, char *argv[])
close(chng_fds[0]);
close(file_fds[0]);
close(file_fds[1]);
- c = acctproc(acct_fds[0], acctkey, (popts & ACME_OPT_NEWACCT));
+ c = acctproc(acct_fds[0], acctkey);
exit(c ? EXIT_SUCCESS : EXIT_FAILURE);
}
@@ -408,6 +385,6 @@ main(int argc, char *argv[])
return rc != COMP__MAX ? EXIT_FAILURE : (c == 2 ? EXIT_SUCCESS : 2);
usage:
fprintf(stderr,
- "usage: acme-client [-ADFnrv] [-f configfile] domain\n");
+ "usage: acme-client [-Fnrv] [-f configfile] domain\n");
return EXIT_FAILURE;
}
diff --git parse.h parse.h
index e371f191910..d1c1fee2515 100644
--- parse.h
+++ parse.h
@@ -58,9 +58,7 @@ struct keyfile {
};
#define ACME_OPT_VERBOSE 0x00000001
-#define ACME_OPT_NEWACCT 0x00000002
-#define ACME_OPT_NEWDKEY 0x00000004
-#define ACME_OPT_CHECK 0x00000008
+#define ACME_OPT_CHECK 0x00000004
struct acme_conf {
int opts;
diff --git parse.y parse.y
index 220269ed279..e3c375c15b0 100644
--- parse.y
+++ parse.y
@@ -29,6 +29,7 @@
#include <sys/stat.h>
#include <ctype.h>
#include <err.h>
+#include <errno.h>
#include <limits.h>
#include <stdarg.h>
#include <stdio.h>
@@ -69,7 +70,7 @@ struct domain_c *conf_new_domain(struct
acme_conf *, char *);
struct keyfile *conf_new_keyfile(struct acme_conf *, char *);
void clear_config(struct acme_conf *);
void print_config(struct acme_conf *);
-int conf_check_file(char *, int);
+int conf_check_file(char *);
TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead);
struct sym {
@@ -270,8 +271,7 @@ domainoptsl : ALTERNATIVE NAMES '{' altname_l '}'
}
if ((s = strdup($3)) == NULL)
err(EXIT_FAILURE, "strdup");
- if (!conf_check_file(s,
- (conf->opts & ACME_OPT_NEWDKEY))) {
+ if (!conf_check_file(s)) {
free(s);
YYERROR;
}
@@ -1046,7 +1046,7 @@ domain_valid(const char *cp)
}
int
-conf_check_file(char *s, int dontstat)
+conf_check_file(char *s)
{
struct stat st;
@@ -1054,14 +1054,14 @@ conf_check_file(char *s, int dontstat)
warnx("%s: not an absolute path", s);
return 0;
}
- if (dontstat)
- return 1;
if (stat(s, &st)) {
+ if (errno == ENOENT)
+ return 1;
warn("cannot stat %s", s);
return 0;
}
- if (st.st_mode & (S_IRWXG | S_IRWXO)) {
- warnx("%s: group read/writable or world read/writable", s);
+ if (st.st_mode & S_IRWXO) {
+ warnx("%s: world read/writable", s);
return 0;
}
return 1;
--
I'm not entirely sure you are real.
