/// <exception cref="LetsEncryptMikroTikException"/> private async Task ChallengeAlpnAsync(IChallengeContext challengeContext, string keyAuthString) { using (var alpnChallenge = new AlpnChallenge(_config, _domainName, keyAuthString)) { await ChallengeAsync(alpnChallenge, challengeContext).ConfigureAwait(false); } }
/// <summary> /// /// </summary> /// <param name="challengeUrl"></param> /// <param name="challengeContent"></param> /// <param name="challengeFilePath"></param> public void GenerateHttpChallenge(out string challengeUrl, out string challengeContent, out string challengeFilePath) { this.OrderContext = this.AcmeContext.NewOrder(new List <string>() { this.HostName }).Result; if (this.OrderContext == null) { throw new Exception("Could not create certificate order."); } // And fetching authorizations var orderAuthz = this.OrderContext.Authorizations().Result; // Looping through authorizations foreach (IAuthorizationContext authz in orderAuthz) { // Although this is a loop, we only allow one authorization per request in our implementation, this.HttpChallenge = this.GenerateChallengeRequests(authz).Result; if (this.HttpChallenge == null) { break; } // TODO: Revisar estos valores challengeContent = this.HttpChallenge.KeyAuthz; challengeUrl = $"http://{this.HostName}/.well-known/acme-challenge/" + this.HttpChallenge.Token; challengeFilePath = ".well-known/acme-challenge/" + this.HttpChallenge.Token; return; } throw new Exception("No authorization order was created."); }
public void Challenge(IChallengeContext context) { if (PriorHandler != null) { PriorHandler.Challenge(context); } }
/// <exception cref="LetsEncryptMikroTikException"/> private async Task HttpChallengeAsync(IChallengeContext httpChallenge, string keyAuthString) { using (var challenge = new HttpChallenge(_config, keyAuthString)) { await ChallengeAsync(challenge, httpChallenge).ConfigureAwait(false); } }
/// <summary> /// 执行HTTP-01验证 /// </summary> /// <param name="authz">授权上下文</param> /// <param name="challengeTokenPath">http-01验证令牌文件存放路径</param> /// <returns></returns> public static async Task <ChallengeStatus?> HttpChallengeValidateAsync(IAuthorizationContext authz, string challengeTokenPath = "") { IChallengeContext httpChallenge = await authz.Http(); var keyAuthz = httpChallenge.KeyAuthz; File.WriteAllText(Path.Combine(challengeTokenPath, httpChallenge.Token), keyAuthz); /* * 向ACME服务器发送申请/请求,以验证域名所有权 * 注意,此处需要延迟轮询等等,具体可以参考GITHUB的几个issues * 需要延迟轮询:https://github.com/fszlin/certes/issues/194 * 如何获取当前验证状态:https://github.com/fszlin/certes/issues/89 */ Challenge challengeResult = await httpChallenge.Validate(); //等待服务器验证结果,每隔3秒轮询一次,最多轮询10次 var attempts = 10; while (attempts > 0 && (challengeResult.Status == ChallengeStatus.Pending || challengeResult.Status == ChallengeStatus.Processing)) { await Task.Delay(3000); challengeResult = await httpChallenge.Resource(); attempts--; } return(challengeResult.Status); }
protected sealed override Task <IDisposable> CreateChallengeHandler(IChallengeContext ch, string hostName, IKey accountKey) { Log.Indent(); Log.WriteVerboseLine("Key:"); Log.WriteVerboseLine(ch.KeyAuthz); Log.Unindent(); return(Task.FromResult(CreateChallengeHandler(ch.Token, ch.KeyAuthz))); }
private string ComputeKeyAuthorization(IChallengeContext challenge, IKey key) { // From Certes/Acme/Challenge.cs var jwkThumbprintEncoded = key.Thumbprint(); var token = challenge.Token; return($"{token}.{jwkThumbprintEncoded}"); }
public async Task <string> GetDnsAuthorizationTextAsync() { var authorization = (await orderContext.Authorizations()).First(); challengeContext = await authorization.Dns(); return(acmeContext.AccountKey.DnsTxt(challengeContext.Token)); }
/// <summary> /// if not already validate, ask ACME CA to check we have answered the nominated challenges correctly /// </summary> /// <param name="log"> </param> /// <param name="challengeType"> </param> /// <param name="attemptedChallenge"> </param> /// <returns> </returns> public async Task <StatusMessage> SubmitChallenge(ILog log, string challengeType, AuthorizationChallengeItem attemptedChallenge) { if (!attemptedChallenge.IsValidated) { IChallengeContext challenge = (IChallengeContext)attemptedChallenge.ChallengeData; try { Challenge result = await challenge.Validate(); int attempts = 10; while (attempts > 0 && result.Status == ChallengeStatus.Pending || result.Status == ChallengeStatus.Processing) { result = await challenge.Resource(); } if (result.Status == ChallengeStatus.Valid) { return(new StatusMessage { IsOK = true, Message = "Submitted" }); } else { var challengeError = await challenge.Resource(); return(new StatusMessage { IsOK = false, Message = challengeError.Error?.Detail }); } } catch (AcmeRequestException exp) { var msg = $"Submit Challenge failed: {exp.Error?.Detail}"; log.Error(msg); return(new StatusMessage { IsOK = false, Message = msg }); } } else { return(new StatusMessage { IsOK = true, Message = "Validated" }); } }
public async Task <StatusMessage> SubmitChallenge(string domainIdentifierId, string challengeType, AuthorizationChallengeItem attemptedChallenge) { // if not already validate, ask ACME server to validate we have answered the required // challenge correctly if (!attemptedChallenge.IsValidated) { IChallengeContext challenge = (IChallengeContext)attemptedChallenge.ChallengeData; try { var result = await challenge.Validate(); if (result.Status == ChallengeStatus.Valid || result.Status == ChallengeStatus.Pending) { return(new StatusMessage { IsOK = true, Message = "Submitted" }); } else { var challengeError = await challenge.Resource(); return(new StatusMessage { IsOK = false, Message = challengeError.ToString() }); } } catch (Exception exp) { LogAction("SubmitChallenge failed. ", exp.Message); var challengeError = await challenge.Resource(); return(new StatusMessage { IsOK = false, Message = challengeError.ToString() }); } } else { return(new StatusMessage { IsOK = true, Message = "Validated" }); } }
public virtual void Challenge(IChallengeContext context) { if (ShouldHandleScheme(context.AuthenticationSchemes)) { ChallengeContext = context; context.Accept(BaseOptions.AuthenticationScheme, BaseOptions.Description.Dictionary); } if (PriorHandler != null) { PriorHandler.Challenge(context); } }
public virtual void Challenge(IChallengeContext context) { if (SecurityHelper.LookupChallenge(context.AuthenticationTypes, BaseOptions.AuthenticationType, BaseOptions.AuthenticationMode)) { ChallengeContext = context; context.Accept(BaseOptions.AuthenticationType, BaseOptions.Description.Dictionary); } if (PriorHandler != null) { PriorHandler.Challenge(context); } }
/// <summary> /// Validates a DNS challenge. Similar to HTTP Validation, but different because of DNSChallenge value which is signed by account key /// </summary> /// <param name="dnsChallenge"></param> /// <returns></returns> private async Task <bool> ValidateDNSChallenge(String domain, IChallengeContext dnsChallenge, IDNSChallengeValidator dnsChallengeValidator) { if (dnsChallenge == null) { throw new Exception("DNS Validation mode setup, but server returned no DNS challenge."); } // We get the resource fresh var dnsChallengeStatus = await dnsChallenge.Resource(); // If it's invalid, we stop right away. Should not happen, but anyway... if (dnsChallengeStatus.Status == ChallengeStatus.Invalid) { throw new Exception("DNS challenge has an invalid status"); } // Let's prepare for ACME-DNS validation var dnsValue = _acme.AccountKey.DnsTxt(dnsChallenge.Token); var dnsKey = $"_acme-challenge.{domain}".Replace("*.", ""); if (!dnsChallengeValidator.PrepareChallengeForValidation(dnsKey, dnsValue)) { return(false); } // We sleep 5 seconds gefore first check, in order to leave the time to DNS to propagate System.Threading.Thread.Sleep(5000); // Now let's ping the ACME service to validate the challenge token Challenge challengeRes = await dnsChallenge.Validate(); // We need to loop, because ACME service might need some time to validate the challenge token int retry = 0; while (((challengeRes.Status == ChallengeStatus.Pending) || (challengeRes.Status == ChallengeStatus.Processing)) && (retry < 10)) { // We sleep 2 seconds between each request, to leave time to ACME service to refresh System.Threading.Thread.Sleep(2000); // We refresh the challenge object from ACME service challengeRes = await dnsChallenge.Resource(); retry++; } // If challenge is Invalid, Pending or Processing, something went wrong... if (challengeRes.Status != ChallengeStatus.Valid) { return(false); } return(true); }
protected override async Task <IDisposable> CreateChallengeHandler(IChallengeContext ch, string hostName, IKey accountKey) { var cnameQuery = await lookupClient.QueryAsync($"_acme-challenge.{hostName}", QueryType.CNAME).ConfigureAwait(true); var cnameRecord = cnameQuery.Answers.CnameRecords().Single(); var fullName = cnameRecord.CanonicalName.Value.TrimEnd('.'); Log.WriteVerboseLine("DNS CNAME target:"); Log.WriteVerboseLine(fullName); var txt = accountKey.DnsTxt(ch.Token); Log.WriteVerboseLine("DNS value:"); Log.WriteVerboseLine(txt); return(new TxtRecord(this, fullName, txt)); }
private string ComputeDnsValue(IChallengeContext challenge, IKey key) { // From Certes/Acme/Challenge.cs var keyAuthString = ComputeKeyAuthorization(challenge, key); var keyAuthBytes = Encoding.UTF8.GetBytes(keyAuthString); var sha256 = new Sha256Digest(); var hashed = new byte[sha256.GetDigestSize()]; sha256.BlockUpdate(keyAuthBytes, 0, keyAuthBytes.Length); sha256.DoFinal(hashed, 0); var dnsValue = JwsConvert.ToBase64String(hashed); return(dnsValue); }
async Task <IChalageStatus> ValidateChalage(IChallengeContext challengeCtx) { // Now let's ping the ACME service to validate the challenge token try { Challenge challenge = await challengeCtx.Validate( ); if (challenge.Status == ChallengeStatus.Invalid) { _logger.Write("Error occured while validating acme challenge to {0} :: error==>{1}", domain.ZoneName, challenge.Error.Detail); return(new ChalageStatus { status = false, errorDescription = challenge.Error.Detail }); } // We need to loop, because ACME service might need some time to validate the challenge token int retry = 0; while (((challenge.Status == ChallengeStatus.Pending) || (challenge.Status == ChallengeStatus.Processing)) && (retry < 30)) { // We sleep 2 seconds between each request, to leave time to ACME service to refresh Thread.Sleep(2000); // We refresh the challenge object from ACME service challenge = await challengeCtx.Resource( ); retry++; } if (challenge.Status == ChallengeStatus.Invalid) { _logger.Write("Error occured while validating acme challenge to {0} :: error==>{1}", domain.ZoneName, challenge.Error.Detail); return(new ChalageStatus { status = false, errorDescription = challenge.Error.Detail }); } return(new ChalageStatus { status = true }); } catch (Exception e) { _logger.Write("Error occured while validating acme challenge to {0} :: error==>{1}", domain.ZoneName, e.Message); _logger.Write(e.StackTrace); return(new ChalageStatus { status = false, errorDescription = e.Message }); } }
/// <summary> /// Small method that validates one challenge using the specified validator /// </summary> /// <param name="httpChallenge"></param> /// <param name="challengeValidator"></param> /// <returns>true if validated, false otherwise</returns> private async Task <bool> ValidateChallenge(IChallengeContext httpChallenge, IHTTPChallengeValidator challengeValidator) { // We get the resource fresh var httpChallengeStatus = await httpChallenge.Resource(); // If it's invalid, we stop right away. Should not happen, but anyway... if (httpChallengeStatus.Status == ChallengeStatus.Invalid) { throw new Exception("HTTP challenge has an invalid status"); } // Else we start the challenge validation if (!challengeValidator.PrepareChallengeForValidation(httpChallenge.Token, httpChallenge.KeyAuthz)) { return(false); } // Now let's ping the ACME service to validate the challenge token Challenge challengeRes = await httpChallenge.Validate(); // We need to loop, because ACME service might need some time to validate the challenge token int retry = 0; while (((challengeRes.Status == ChallengeStatus.Pending) || (challengeRes.Status == ChallengeStatus.Processing)) && (retry < 10)) { // We sleep 2 seconds between each request, to leave time to ACME service to refresh System.Threading.Thread.Sleep(2000); // We refresh the challenge object from ACME service challengeRes = await httpChallenge.Resource(); retry++; } // Finally we cleanup everything that was needed for validation challengeValidator.CleanupChallengeAfterValidation(httpChallenge.Token); // If challenge is Invalid, Pending or Processing, something went wrong... if (challengeRes.Status != ChallengeStatus.Valid) { return(false); } return(true); }
public static async Task WaitForCompletion(this IChallengeContext challengeContext, TimeSpan pollInterval, ILogger logger = null) { // Get the challenges ressource to check if it's valid var challenge = await challengeContext.Resource(); while (!challenge.HasFinished()) { // If nor finished processing, poll every second challenge = await challengeContext.Resource(); await Task.Delay(pollInterval); } logger?.LogDebug("Http challenge finished with status {status}", challenge.Status?.ToString() ?? "[null]"); if (challenge.Status == ChallengeStatus.Invalid) { // Throw if invalid new AcmeException(challenge.Error?.Detail ?? "ACME http challenge not successful."); } }
private async Task Validate(IAuthorizationContext authorizationContext) { IChallengeContext httpChallenge = await authorizationContext.Http(); httpChallengeStore.AddChallengeResponse(httpChallenge.Token, httpChallenge.KeyAuthz); await httpChallenge.Validate(); for (int i = 0; i < 10; i++) { Authorization authorization = await authorizationContext.Resource(); if (authorization.Status is AuthorizationStatus.Valid) { return; } await Task.Delay(TimeSpan.FromMilliseconds(2)); } }
/// <summary> /// 创建订单 /// </summary> /// <param name="domain"></param> /// <param name="email"></param> /// <returns></returns> public async Task <bool> CreateOrder(string domain) { //todo:验证domain和email this.Domain = domain; try { this.order = await acme.NewOrder(new[] { Domain }); var authz = (await this.order.Authorizations()).First(); this.dnsChallenge = await authz.Dns(); this.ChallengeDomain = $"_acme-challenge.{this.FriendllyDomain}"; this.ChallengRecordValue = acme.AccountKey.DnsTxt(this.dnsChallenge.Token); return(true); } catch { return(false); } }
public async Task <IOrderResult> CreateOrRenewCert(int rec = 0, bool forceRenew = false) { try { { var(status, result) = IsValidConfig( ); if (!status) { _logger.Write(result); return(new OrderResult { success = false, taskType = TaskType.NOTHING, errorDescription = result }); } } _logger.Write("Create or Renew Certificate for {0}", domain.ZoneName); ICertificate oldCertificate = GetCertificate( ); if (oldCertificate.status) { if (!oldCertificate.isExpired && forceRenew == false) { _logger.Write("Certificate not expired for {0}", domain.ZoneName); return(new OrderResult { success = true, taskType = TaskType.INSTALL_CERT, oldCertificate = oldCertificate.Cert }); } } await this.PrepareContext( ); IOrderResult orderResult = new OrderResult { success = true }; if (oldCertificate.status) { _logger.Write("Revoke Certificate for {0}", domain.ZoneName); try { await _acmeCtx.Ctx.RevokeCertificate(oldCertificate.Cert.RawData, RevocationReason.Unspecified); } catch (Exception r) { _logger.Write("Error occured while Revoke Certificate for {0}; Error=>{1}", domain.ZoneName, r.Message); _logger.Write(r.StackTrace); if (r.Message.IndexOf("alreadyRevoked") <= -1) { return(new OrderResult { taskType = TaskType.NOTHING, errorDescription = r.Message, success = false }); } } } if (domain.IsWildcard) { _orderContext = await _acmeCtx.Ctx.NewOrder(new List <string> { domain.ZoneName, domain.DomainName }); } else { _orderContext = await _acmeCtx.Ctx.NewOrder(new List <string> { domain.DomainName }); } List <IChallengeCtx> challengeCtxs = new List <IChallengeCtx>( ); List <IDnsTxtStore> dnsTxt = this.GetDnsTXT( ); if (domain.IsWildcard) { if (dnsTxt == null) { dnsTxt = new List <IDnsTxtStore>( ); } List <IDnsTxtStore> writeDnsTxt = new List <IDnsTxtStore>( ); _logger.Write("Defined acme challenge type DNS for Wildcard(*) {0}", domain.ZoneName); _logger.Write("Get Authorization Context for {0}", domain.ZoneName); IEnumerable <IAuthorizationContext> authCtx = await _orderContext.Authorizations( ); _logger.Write("Authorization Context found for {0}", domain.ZoneName); foreach (IAuthorizationContext authz in authCtx) { IChallengeContext challengeCtx = await authz.Dns( ); string txt = _acmeCtx.Ctx.AccountKey.DnsTxt(challengeCtx.Token); IDnsTxtStore dnsTxtStore = dnsTxt.FirstOrDefault(a => a.content == txt); if (dnsTxtStore != null) { challengeCtxs.Add(new ChallengeCtx { ctx = challengeCtx, txtName = dnsTxtStore.name }); dnsTxt.Remove(dnsTxtStore); continue; } ICFAPIResponse cFAPIResponse = await _cfDns.AddRecord(new QueryConfig { DOMAIN_NAME = domain.ZoneName, RECORD_TYPE = CFRecordType.TXT, RECORD_NAME = "_acme-challenge", RECORD_CONTENT = txt, NAME = string.Concat("_acme-challenge.", domain.ZoneName) }); if (!cFAPIResponse.success) { orderResult.success = false; orderResult.errorDescription = JsonConvert.SerializeObject(cFAPIResponse.messages, _cfDns.jsonSettings); break; } IChallengeCtx cCtx = new ChallengeCtx { ctx = challengeCtx }; dnsTxtStore = new DnsTxtStore { content = txt }; string txtName = string.Empty; if (cFAPIResponse.result is JObject) { JObject jObject = ( JObject )cFAPIResponse.result; dnsTxtStore.id = GetJPropertyValue(jObject.Property("id")); txtName = GetJPropertyValue(jObject.Property("name")); } else { txtName = string.Concat("_acme-challenge.", domain.ZoneName); } dnsTxtStore.name = txtName; writeDnsTxt.Add(dnsTxtStore); cCtx.txtName = txtName; challengeCtxs.Add(cCtx); } if (orderResult.success == false) { return(orderResult); } ; if (writeDnsTxt.Count > 0) { this.WriteDnsTXT(writeDnsTxt); writeDnsTxt.Clear( ); } } else { throw new NotImplementedException("Not Implemented!!!"); } foreach (IChallengeCtx cCtx in challengeCtxs) { _logger.Write("Validating acme-challenge => {0} for Domain {1}", cCtx.txtName, domain.ZoneName); IChalageStatus chalageStatus = await this.ValidateChalage(cCtx.ctx); if (chalageStatus.status == false) { orderResult.success = false; orderResult.errorDescription = chalageStatus.errorDescription; break; } } if (domain.IsWildcard) { foreach (IDnsTxtStore txt in dnsTxt) { await _cfDns.RemoveRecord(new QueryConfig { DOMAIN_NAME = domain.ZoneName, RECORD_TYPE = CFRecordType.TXT, RECORD_NAME = "_acme-challenge", RECORD_CONTENT = txt.content, NAME = txt.name, RECORD_ID = txt.id }); } } if (!orderResult.success) { _logger.Write("Error occured while creating order request for {0} . Error=>{1}", domain.ZoneName, orderResult.errorDescription); return(orderResult); } orderResult.taskType = TaskType.DOWNLOAD_CERT; orderResult.oldCertificate = oldCertificate.Cert; return(orderResult); } catch (Exception e) { if (rec >= MAX_TRY) { _logger.Write("Error occured while creating order request for {0} . Error=>{1}", domain.ZoneName, e.Message); _logger.Write(e.StackTrace); return(new OrderResult { taskType = TaskType.NOTHING, errorDescription = e.Message, success = false }); } return(await CreateOrRenewCert(rec ++)); } }
protected abstract Task <IDisposable> CreateChallengeHandler(IChallengeContext ch, string hostName, IKey accountKey);
private record DnsChallenge(IChallengeContext Challenge, string FullDnsName, string RecordName);
/// <exception cref="LetsEncryptMikroTikException"/> private async Task ChallengeAsync(IChallenge challenge, IChallengeContext httpChallenge) { // Запустить asp net. Log.Information("Запускаем веб-сервер."); challenge.Start(); string mtNatId = MtAddDstNatRule(dstPort: challenge.PublicPort, toPorts: challenge.ListenPort); string mtFilterId = MtAllowPortFilter(dstPort: challenge.ListenPort, publicPort: challenge.PublicPort); string mtMangleId = MtAllowMangleRule(dstPort: challenge.ListenPort); // Правило в микротике начинает работать не мгновенно. await Task.Delay(2000).ConfigureAwait(false); //Challenge status; try { // Ask the ACME server to validate our domain ownership. Log.Information("Информируем Let's Encrypt что мы готовы пройти валидацию."); Challenge?status = await httpChallenge.Validate().ConfigureAwait(false); bool waitWithSem = true; while (status.Status == ChallengeStatus.Pending) { if (waitWithSem) { Log.Information("Ожидаем 20 сек. входящий HTTP запрос."); Task t = await Task.WhenAny(Task.Delay(20_000), challenge.Completion).ConfigureAwait(false); if (t == challenge.Completion) { waitWithSem = false; Log.Information("Успешно выполнили входящий запрос. Ждём 15 сек. перед запросом сертификата."); await Task.Delay(15_000).ConfigureAwait(false); } else // Таймаут. { waitWithSem = false; Log.Information("Запрос ещё не поступил. Дополнительно ожидаем ещё 5 сек."); await Task.Delay(5000).ConfigureAwait(false); } } else { Log.Information("Заказ всё ещё в статусе Pending. Делаем дополнительную паузу на 5 сек."); await Task.Delay(5_000).ConfigureAwait(false); } Log.Information("Запрашиваем статус нашего заказа."); status = await httpChallenge.Resource().ConfigureAwait(false); } if (status.Status == ChallengeStatus.Valid) { Log.Information("Статус заказа: Valid. Загружаем сертификат."); } else { Log.Error($"Статус заказа: {status.Status}"); throw new LetsEncryptMikroTikException($"Статус заказа: {status.Status}. Ошибка: {status.Error.Detail}"); } } finally { // Возвращаем NAT ClosePort(mtFilterId); RemoveNatRule(mtNatId); RemoveMangleRule(mtMangleId); } }
public virtual void Challenge(IChallengeContext context) { if (ShouldHandleScheme(context.AuthenticationSchemes)) { ChallengeContext = context; context.Accept(BaseOptions.AuthenticationScheme, BaseOptions.Description.Dictionary); } if (PriorHandler != null) { PriorHandler.Challenge(context); } }
public static void GetFirstCert(bool staging = true) { ContextAccountBundle bundle; if (staging) { bundle = GetStagingParameters(); } else { bundle = GetNonStagingParameters(); } var account = bundle.Account; var ctx = bundle.Ctx; IOrderListContext orders = account.Orders().Result; List <IOrderContext> orderContexts = new List <IOrderContext>(orders.Orders().Result); IOrderContext currentOrder = null; if (orderContexts.Count == 0) { currentOrder = ctx.NewOrder(new[] { "jcf-ai.com" }).Result; } else { foreach (IOrderContext orderCtx in orderContexts) { if (orderCtx.Resource().Result.Status != OrderStatus.Valid) { currentOrder = orderCtx; break; } } if (currentOrder == null) { currentOrder = ctx.NewOrder(new[] { "jcf-ai.com" }).Result; } } Order order = currentOrder.Resource().Result; var authorizationList = currentOrder.Authorizations().Result; IAuthorizationContext currentAuthContext; IEnumerator <IAuthorizationContext> enumerator = authorizationList.GetEnumerator(); while (enumerator.Current == null) { enumerator.MoveNext(); } currentAuthContext = enumerator.Current; Authorization authResource = currentAuthContext.Resource().Result; IChallengeContext httpContext = currentAuthContext.Http().Result; if (httpContext.Resource().Result.Status != ChallengeStatus.Valid) { if (!System.IO.Directory.Exists("tokens")) { System.IO.Directory.CreateDirectory("tokens"); } StreamWriter writer = new StreamWriter("tokens/" + httpContext.Token); writer.Write(httpContext.KeyAuthz); writer.Close(); Challenge httpChallenge = httpContext.Validate().Result; } //Everything should be good to go on the whole validate everything front. IKey privateKey = KeyFactory.NewKey(KeyAlgorithm.ES384); var cert = currentOrder.Generate( new CsrInfo() { CountryName = "US", State = "Washington", Locality = "Tacoma", CommonName = "jcf-ai.com" }, privateKey).Result; byte[] pfx = cert.ToPfx(privateKey).Build("jcf-ai.com", "pass"); FileStream pfxOutStream = new FileStream("jcf-ai.pfx", FileMode.Create, FileAccess.Write); pfxOutStream.Write(pfx, 0, pfx.Length); pfxOutStream.Close(); ProcessStartInfo psi = new ProcessStartInfo("powershell", "-Command ./bindcert.ps1 jcf-ai.pfx pass"); psi.CreateNoWindow = true; Process.Start(psi); }
/// <summary> /// HTTP-01 challenge. /// </summary> /// <exception cref="LetsEncryptMikroTikException"/> public async Task <LetsEncryptCert> GetCertAsync(string?accountPemKey = null) { AcmeContext acme; IAccountContext account; //Uri knownServer = _letsEncryptAddress; if (accountPemKey != null) { // Load the saved account key var accountKey = KeyFactory.FromPem(accountPemKey); acme = new AcmeContext(_letsEncryptAddress, accountKey); Log.Information("Авторизация в Let's Encrypt."); account = await acme.Account().ConfigureAwait(false); } else { acme = new AcmeContext(_letsEncryptAddress); Log.Information("Авторизация в Let's Encrypt."); account = await acme.NewAccount(_config.Email, termsOfServiceAgreed : true).ConfigureAwait(false); // Save the account key for later use //string pemKey = acme.AccountKey.ToPem(); } Log.Information("Заказываем новый сертификат."); IOrderContext order = await acme.NewOrder(new[] { _config.DomainName }).ConfigureAwait(false); // Get the token and key authorization string. Log.Information("Получаем способы валидации заказа."); var authz = (await order.Authorizations().ConfigureAwait(false)).First(); if (_config.UseAlpn) { Log.Information("Выбираем TLS-ALPN-01 способ валидации."); IChallengeContext challenge = await authz.TlsAlpn().ConfigureAwait(false); string keyAuthz = challenge.KeyAuthz; string token = challenge.Token; await ChallengeAlpnAsync(challenge, keyAuthz).ConfigureAwait(false); } else { Log.Information("Выбираем HTTP-01 способ валидации."); IChallengeContext challenge = await authz.Http().ConfigureAwait(false); string keyAuthz = challenge.KeyAuthz; await HttpChallengeAsync(challenge, keyAuthz).ConfigureAwait(false); } Log.Information("Загружаем сертификат."); // Download the certificate once validation is done IKey privateKey = KeyFactory.NewKey(KeyAlgorithm.RS256); CertificateChain cert = await order.Generate(new CsrInfo { CommonName = _config.DomainName, CountryName = "CA", State = "Ontario", Locality = "Toronto", Organization = "Certes", OrganizationUnit = "Dev", }, privateKey) .ConfigureAwait(false); // Export full chain certification. string certPem = cert.ToPem(); string keyPem = privateKey.ToPem(); // Export PFX PfxBuilder pfxBuilder = cert.ToPfx(privateKey); byte[] pfx = pfxBuilder.Build(friendlyName: _config.DomainName, password: ""); //await acme.RevokeCertificate(pfx, RevocationReason.Superseded, privateKey); using (var cert2 = new X509Certificate2(pfx)) { return(new LetsEncryptCert(cert2.NotAfter, certPem, keyPem, cert2.GetCommonName(), cert2.GetSha2Thumbprint())); } }
/// <summary> /// if not already validate, ask ACME CA to check we have answered the nominated challenges correctly /// </summary> /// <param name="log"> </param> /// <param name="challengeType"> </param> /// <param name="attemptedChallenge"> </param> /// <returns> </returns> public async Task <StatusMessage> SubmitChallenge(ILog log, string challengeType, AuthorizationChallengeItem attemptedChallenge) { if (attemptedChallenge == null) { return(new StatusMessage { IsOK = false, Message = "Challenge could not be submitted. No matching attempted challenge." }); } if (!attemptedChallenge.IsValidated) { try { await _acme.HttpClient.ConsumeNonce(); } catch (Exception) { return(new StatusMessage { IsOK = false, Message = "Failed to resume communication with Certificate Authority API. Try again later." }); } IChallengeContext challenge = (IChallengeContext)attemptedChallenge.ChallengeData; try { var result = await challenge.Validate(); var attempts = 10; while (attempts > 0 && result.Status == ChallengeStatus.Pending || result.Status == ChallengeStatus.Processing) { result = await challenge.Resource(); await Task.Delay(500); } if (result.Status == ChallengeStatus.Valid) { return(new StatusMessage { IsOK = true, Message = "Submitted" }); } else { var challengeError = await challenge.Resource(); return(new StatusMessage { IsOK = false, Message = challengeError.Error?.Detail }); } } catch (AcmeRequestException exp) { var msg = $"Submit Challenge failed: {exp.Error?.Detail}"; log.Error(msg); return(new StatusMessage { IsOK = false, Message = msg }); } } else { return(new StatusMessage { IsOK = true, Message = "Validated" }); } }
public async Task <Challenge> ValidateChallengeAsync(IChallengeContext httpChallenge) { _logger.LogAcmeAction("ValidateChallenge", httpChallenge); return(await httpChallenge.Validate()); }
public virtual void Challenge(IChallengeContext context) { if (SecurityHelper.LookupChallenge(context.AuthenticationTypes, BaseOptions.AuthenticationType, BaseOptions.AuthenticationMode)) { ChallengeContext = context; context.Accept(BaseOptions.AuthenticationType, BaseOptions.Description.Dictionary); } if (PriorHandler != null) { PriorHandler.Challenge(context); } }
public void Challenge(IChallengeContext context) { throw new NotImplementedException(); }