upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-06-09 00:32:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Autoconfigure OCSP Stapling with --must-staple

Browse source
This commit is contained in:
sagi 2016-05-25 20:03:45 +00:00
parent 230423e4e0
commit b3aeeefe20
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
certbot/client.py
View file

@ -398,6 +398,7 @@ class Client(object):
hsts = config.hsts if "ensure-http-header" in supported else False
uir = config.uir if "ensure-http-header" in supported else False
staple = config.staple if "staple-ocsp" in supported else False
must_staple = config.must_staple
if redirect is None:
redirect = enhancements.ask("redirect")
@ -411,11 +412,11 @@ class Client(object):
if uir:
self.apply_enhancement(domains, "ensure-http-header",
"Upgrade-Insecure-Requests")
if staple:
if staple or must_staple:
self.apply_enhancement(domains, "staple-ocsp")
msg = ("We were unable to restart web server")
if redirect or hsts or uir or staple:
if redirect or hsts or uir or staple or must_staple:
with error_handler.ErrorHandler(self._rollback_and_restart, msg):
self.installer.restart()

6
certbot/interfaces.py
View file

@ -201,9 +201,9 @@ class IConfig(zope.interface.Interface):
"Email used for registration and recovery contact.")
rsa_key_size = zope.interface.Attribute("Size of the RSA key.")
must_staple = zope.interface.Attribute(
"Whether to request the OCSP Must Staple certificate extension. "
"Additional setup may be required after issuance. This does not "
"currently autoconfigure web servers for OCSP stapling. ")
"Adds the OCSP Must Staple extension to the certificate."
"Autoconfigures OCSP Stapling for supported setups "
"(Apache version >= 2.3.3 ).")
config_dir = zope.interface.Attribute("Configuration directory.")
work_dir = zope.interface.Attribute("Working directory.")