search

plinss / acmebot

Certificate manager bot using ACME protocol
GNU General Public License v3.0
116 stars 20 forks source link

reload_zone_command is always called, also when only http confitmation is used #4

Closed J0s3f closed 7 years ago

J0s3f commented 7 years ago

I use a config where only http(s) is used for validation, meaning for every configured certificate a "http_challenges" entry exists. Still, the command defined in "reload_zone_command" is always executed and the script then stops because it doesn't exist on my system. If I run acmebot again, it continues (with CT submissions).

As a workaround, I defined:

"reload_zone_command": "/bin/true"

which allows the script to work without problems.

plinss commented 7 years ago

If remote DNS updates aren't configured, it's calling reload_zone after issuing certificate to give it a chance to update TLSA records. But, given that TLSA records are entirely optional, this shouldn't be a fatal error.

I made post-certificate change reload_zone non-fatal (will still generate a warning in verbose mode) and also allowed completely disabling reload_zone by setting the command to null or false.

Thanks for the bug report!