[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Feature request] nginx plugin doesn't auto detect wildcard domains #6384

Open
ciarancourtney opened this issue Sep 18, 2018 · 8 comments
Open

[Feature request] nginx plugin doesn't auto detect wildcard domains #6384

ciarancourtney opened this issue Sep 18, 2018 · 8 comments
Assignees
@ohemorange
Labels
area: acme area: nginx feature request
Milestone
Wishlist

Comments

@ciarancourtney
Copy link

My operating system is (include version):

Ubuntu 18.04.1

I installed Certbot with (certbot-auto, OS package manager, pip, etc):

apt initially, then pip installed all certbot packages to see if issue was resolved

I ran this command and it produced this output:

sudo certbot --authenticator=dns-route53 --installer=nginx

No names were found in your configuration files. Please enter in your domain

Certbot's behavior differed from what I expected because:

I have a single index nginx conf containing a wildcard server_name which routes to all other 'location' confs based on path

Why can't the nginx plugin just detect that its a wildcard cert?

server {
    listen 80;
    server_name .example.com;

    root /var/www;
    index index.html;

    include conf.d/*.location;
}
@ohemorange
Copy link
Contributor

I think I found the problem. To confirm, please either post your logs or check that they contain an error message like Requested domain .example.com is not a FQDN because it contains an empty label

Logs are usually located at /var/log/letsencrypt/letsencrypt.log.

@ohemorange ohemorange self-assigned this Sep 18, 2018
@ohemorange ohemorange added this to the 0.28.0 milestone Sep 18, 2018
@ciarancourtney
Copy link
Author
ciarancourtney commented Sep 19, 2018 •
edited
Loading

Yes thats what appears in log.

FYI The log dir /var/log/letsencrypt/ is not 'tab-able' by non-root users, which may trip up some people.

/var/log/letsencrypt/letsencrypt.log 
2018-09-19 09:58:49,450:DEBUG:certbot.util:Not suggesting name "_"
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/util.py", line 310, in get_filtered_names
    filtered_names.add(enforce_le_validity(name))
  File "/usr/lib/python3/dist-packages/certbot/util.py", line 526, in enforce_le_validity
    "Valid characters are A-Z, a-z, 0-9, ., and -.".format(domain))
certbot.errors.ConfigurationError: _ contains an invalid character. Valid characters are A-Z, a-z, 0-9, ., and -.
2018-09-19 09:58:49,452:DEBUG:certbot.util:Not suggesting name ".example.com"
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/certbot/util.py", line 310, in get_filtered_names
    filtered_names.add(enforce_le_validity(name))
  File "/usr/lib/python3/dist-packages/certbot/util.py", line 522, in enforce_le_validity
    domain = enforce_domain_sanity(domain)
  File "/usr/lib/python3/dist-packages/certbot/util.py", line 601, in enforce_domain_sanity
    raise errors.ConfigurationError("{0} it contains an empty label.".format(msg))
certbot.errors.ConfigurationError: Requested domain .example.com is not a FQDN because it contains an empty label.

@ohemorange
Copy link
Contributor

For users:

Use -d example.com -d *.example.com to specify the domains.

For devs:

Ok so what's going on here is that we have a check that does domain.split('.'), and makes sure that none of the entries in the list are empty. Nginx special-cases .example.com as meaning both example.com and *.example.com in one. Previously, we didn't support wildcards at all, so it made sense not to show this.

This check happens in certbot/util.py, so it's consistent between Nginx and Apache.

The best fix on our end is probably to expand the domain into being read as both domains inside the Nginx plugin, before it goes through the check.

We may also need to do the same thing in Apache.

But then, we have the UX conundrum that this will also work when Nginx is set as authenticator, erroneously displaying wildcard domains when we can't actually get them.

@bmw bmw modified the milestones: 0.28.0, 0.29.0 Nov 7, 2018
@ohemorange
Copy link
Contributor

But then, we have the UX conundrum that this will also work when Nginx is set as authenticator, erroneously displaying wildcard domains when we can't actually get them.

On second thought, this is probably fine, because then the user can run again and select a different domain or use a different authenticator. We should make sure that the error message that happens when you do that is good.

@ohemorange
Copy link
Contributor

@ciarancourtney, any chance you'd be up for submitting a PR to fix this?

@ciarancourtney
Copy link
Author

@ciarancourtney, any chance you'd be up for submitting a PR to fix this?

Sure, I'll take a look

@ohemorange
Copy link
Contributor

Awesome, let me know if you have any questions or run into any snags.

ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 15, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains like star-styl…
32eb4bb 
…e domains

* e.g. mutate .example.com into *.example.com as early as possible
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 15, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains like star-styl…
6c3ffb5 
…e domains

* e.g. mutate .example.com into *.example.com as early as possible
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 17, 2018
@ciarancourtney
closes certbot#6384: Expand .example.com into *.example.com and examp…
983653f 
…le.com in Nginx parser
@ciarancourtney ciarancourtney mentioned this issue Nov 19, 2018
Closed
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 27, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
106f9c1
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 27, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains like star-styl…
251e2b2 
…e domains

* e.g. mutate .example.com into *.example.com as early as possible
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 27, 2018
@ciarancourtney
closes certbot#6384: Expand .example.com into *.example.com and examp…
2b774ba 
…le.com in Nginx parser
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 27, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
ee46569
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Nov 28, 2018
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
6ea340d
@bmw bmw modified the milestones: 0.29.0, 0.30.0 Dec 11, 2018
@bmw bmw modified the milestones: 0.30.0, 0.31.0 Jan 9, 2019
@bmw bmw modified the milestones: 0.31.0, 0.32.0 Feb 6, 2019
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Feb 9, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
4bcfe45
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Feb 9, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
4a97158
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Feb 15, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
ccab9d4
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Feb 21, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
402b263
@bmw bmw modified the milestones: 0.32.0, 0.33.0 Mar 7, 2019
@bmw
Copy link
Member
bmw commented Mar 25, 2019

Do we think this issue will be resolved for the release next week?

ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Mar 25, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
e1eaee0
@bmw bmw modified the milestones: 0.33.0, 0.34.0 Apr 3, 2019
@bmw bmw modified the milestones: 0.34.0, 0.35.0 Apr 15, 2019
ciarancourtney added a commit to ciarancourtney/certbot that referenced this issue Apr 29, 2019
@ciarancourtney
closes certbot#6384: Handle dot-style wildcard domains in nginx config
4bd085d
@bmw bmw modified the milestones: 0.35.0, 0.36.0 Jun 3, 2019
@bmw bmw modified the milestones: 0.36.0, Wishlist Jul 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ohemorange ohemorange

Labels
area: acme area: nginx feature request
Projects
None yet
Milestone
Wishlist
Development

Successfully merging a pull request may close this issue.

closes #6384: Handle dot-style wildcard domains like star-style domains ciarancourtney/certbot
3 participants
@ohemorange @ciarancourtney @bmw