search

danb35 / deploy-freenas

Python script to automate deploying TLS certificates to FreeNAS servers
GNU General Public License v3.0
199 stars 56 forks source link

Certificate not importing but API reporting 200 success? #45

Open Dizlem opened 2 years ago

Dizlem commented 2 years ago

I'm experiencing an odd issue with the final import of the certificate into a TrueNAS-12.0-U6 system. It all seems to work and the NAS responds with a 200 success status and the script indicates success but no certificate is actually imported. It then does a check for the certificate and confirms it isn't there and errors.

I don't think it is the script but the API itself as I can see when I print out the api post payload that the json is populated (looks correct). I can also see the API get for installed certificates working correctly and can print out the response through the script detailing the installed certificates. I can also see the same behaviour when I use postman to recreate the POST API call, it responds with what I assume is a request number (as it increments) and returns a 200 response but no certificate is added.

Is this something that anyone has seen before? Trying to figure out whether its something I've done incorrectly.

I've imported the certificate via the gui for the time being and it works fine but I was hoping to have auto renew setup on a cron job so I wouldn't have to manually update.

root@letsencrypt:/config/*.xxxx.yyyy # /root/.acme.sh/acme.sh --install-cert -d '*.xxxx.yyyy' --reloadcmd "/root/deploy-freenas/deploy_freenas.py" [Mon Nov 15 15:27:03 GMT 2021] Run reload cmd: /root/deploy-freenas/deploy_freenas.py Certificate import successful Certificate list successful Error searching for newly imported certificate in certificate list. [Mon Nov 15 15:27:08 GMT 2021] Reload error for :

dacabdi commented 2 years ago

Experiencing the same issue.

dacabdi commented 2 years ago

@Dizlem, I got it working today. Trying to get around it, in the meantime, I tried to upload the cert directly through the UI and noticed that it does not allow naming the cert with spaces or dots in it. Maybe this is the issue for you too. So, I changed the field cert_base_name to a simple non spaced string and it worked. Apparently the same restriction applies. Hoping this works for you too.

EDIT: If the author confirms that this is the case, I can open a PR doing the validation on the file. Although I would be concerned about that because the validation rules might fall out of sync with the API. I wonder if there is a common source of truth to be consumed here.

7ooL commented 2 years ago

@dacabdi I can confim the issue was the same for me. cert_base_name contained a period (.) and did not return in the certificate list. removing the period worked.

Tuckie commented 1 year ago

I've been having a similar issue with the old cert staying around when upgrading the cert that is attached to my apps.

I tracked down some details from the truenas team: "That endpoint returns a job id. It happens in the background, you need to monitor that job and get its result."

It sounds like another api call (loop) is needed for checking out how the import went (and the same for the cert deletion).