Re-remove macOS test cases

.codecov.yml

@@ -1,18 +0,0 @@
-coverage:
-  status:
-    project:
-      default: off
-      linux:
-        flags: linux
-        # Fixed target instead of auto set by #7173, can
-        # be removed when flags in Codecov are added back.
-        target: 97.5
-        threshold: 0.1
-        base: auto
-      windows:
-        flags: windows
-        # Fixed target instead of auto set by #7173, can
-        # be removed when flags in Codecov are added back.
-        target: 97.6
-        threshold: 0.1
-        base: auto

.github/stale.yml

@@ -1,35 +0,0 @@
-# Configuration for https://github.com/marketplace/stale
-
-# Number of days of inactivity before an Issue or Pull Request becomes stale
-daysUntilStale: 365
-
-# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
-# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
-# When changing this value, be sure to also update markComment below.
-daysUntilClose: 30
-
-# Ignore issues with an assignee (defaults to false)
-exemptAssignees: true
-
-# Label to use when marking as stale
-staleLabel: needs-update
-
-# Comment to post when marking as stale. Set to `false` to disable
-markComment: >
-  We've made a lot of changes to Certbot since this issue was opened. If you
-  still have this issue with an up-to-date version of Certbot, can you please
-  add a comment letting us know? This helps us to better see what issues are
-  still affecting our users. If there is no activity in the next 30 days, this
-  issue will be automatically closed.
-
-# Comment to post when closing a stale Issue or Pull Request.
-closeComment: >
-  This issue has been closed due to lack of activity, but if you think it
-  should be reopened, please open a new issue with a link to this one and we'll
-  take a look.
-
-# Limit the number of actions per hour, from 1-30. Default is 30
-limitPerRun: 1
-
-# Don't mark pull requests as stale.
-only: issues

.gitignore

@@ -6,8 +6,7 @@ dist*/
 /venv*/
 /kgs/
 /.tox/
-/releases*/
-/log*
+/releases/
 letsencrypt.log
 certbot.log
 letsencrypt-auto-source/letsencrypt-auto.sig.lzma.base64
@@ -39,13 +38,3 @@ tests/letstest/venv/
 
 # pytest cache
 .cache
-.mypy_cache/
-.pytest_cache/
-
-# docker files
-.docker
-
-# certbot tests
-.certbot_test_workspace
-**/assets/pebble*
-**/assets/challtestsrv*

.pylintrc

@@ -41,7 +41,7 @@ load-plugins=linter_plugin
 # --enable=similarities". If you want to run only the classes checker, but have
 # no Warning level messages displayed, use"--disable=all --enable=classes
 # --disable=W"
-disable=fixme,locally-disabled,locally-enabled,abstract-class-not-used,abstract-class-little-used,bad-continuation,too-few-public-methods,no-self-use,invalid-name,too-many-instance-attributes,cyclic-import,duplicate-code
+disable=fixme,locally-disabled,abstract-class-not-used,abstract-class-little-used,bad-continuation,too-few-public-methods,no-self-use,invalid-name,too-many-instance-attributes,cyclic-import,duplicate-code
 # abstract-class-not-used cannot be disabled locally (at least in
 # pylint 1.4.1), same for abstract-class-little-used
 
@@ -251,7 +251,7 @@ ignored-modules=pkg_resources,confargparse,argparse,six.moves,six.moves.urllib
 
 # List of classes names for which member attributes should not be checked
 # (useful for classes with attributes dynamically set).
-ignored-classes=Field,Header,JWS,closing
+ignored-classes=SQLObject
 
 # When zope mode is activated, add a predefined set of Zope acquired attributes
 # to generated-members.
@@ -304,7 +304,7 @@ max-args=6
 
 # Argument names that match this expression will be ignored. Default to name
 # with leading underscore
-ignored-argument-names=(unused)?_.*|dummy
+ignored-argument-names=_.*
 
 # Maximum number of locals for function / method body
 max-locals=15

.travis.yml

@@ -4,11 +4,59 @@ cache:
     directories:
         - $HOME/.cache/pip
 
+before_install:
+  - '([ $TRAVIS_OS_NAME == linux ] && dpkg -s libaugeas0) || (brew update && brew install augeas python3 && brew upgrade python && brew link python)'
+
 before_script:
-  - 'if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then ulimit -n 1024 ; fi'
-  # On Travis, the fastest parallelization for integration tests has proved to be 4.
-  - 'if [[ "$TOXENV" == *"integration"* ]]; then export PYTEST_ADDOPTS="--numprocesses 4"; fi'
-  - export TOX_TESTENV_PASSENV=TRAVIS
+  - 'if [ $TRAVIS_OS_NAME = osx ] ; then ulimit -n 1024 ; fi'
+
+matrix:
+  include:
+    - python: "2.7"
+      env: TOXENV=py27_install BOULDER_INTEGRATION=1
+      sudo: required
+      services: docker
+    - python: "2.7"
+      env: TOXENV=cover FYI="this also tests py27"
+    - sudo: required
+      env: TOXENV=nginx_compat
+      services: docker
+      before_install:
+      addons:
+    - python: "2.7"
+      env: TOXENV=lint
+    - python: "2.6"
+      env: TOXENV=py26
+      sudo: required
+      services: docker
+    - python: "2.7"
+      env: TOXENV=py27-oldest
+      sudo: required
+      services: docker
+    - python: "3.3"
+      env: TOXENV=py33
+      sudo: required
+      services: docker
+    - python: "3.6"
+      env: TOXENV=py36
+      sudo: required
+      services: docker
+    - sudo: required
+      env: TOXENV=apache_compat
+      services: docker
+      before_install:
+      addons:
+    - sudo: required
+      env: TOXENV=le_auto_trusty
+      services: docker
+      before_install:
+      addons:
+    - python: "2.7"
+      env: TOXENV=apacheconftest
+      sudo: required
+    - python: "2.7"
+      env: TOXENV=nginxroundtrip
+
 
 # Only build pushes to the master branch, PRs, and branches beginning with
 # `test-` or of the form `digit(s).digit(s).x`. This reduces the number of
@@ -16,37 +64,20 @@ before_script:
 # is a cap of on the number of simultaneous runs.
 branches:
   only:
-    # apache-parser-v2 is a temporary branch for doing work related to
-    # rewriting the parser in the Apache plugin.
-    - apache-parser-v2
     - master
     - /^\d+\.\d+\.x$/
     - /^test-.*$/
 
-# Jobs for the main test suite are always executed (including on PRs) except for pushes on master.
-not-on-master: &not-on-master
-  if: NOT (type = push AND branch = master)
-
-# Jobs for the extended test suite are executed for cron jobs and pushes to
-# non-development branches. See the explanation for apache-parser-v2 above.
-extended-test-suite: &extended-test-suite
-  if: type = cron OR (type = push AND branch NOT IN (apache-parser-v2, master))
-
-matrix:
-  include:
-    # Main test suite
-    - python: "2.7"
-      env: ACME_SERVER=pebble TOXENV=integration
-      sudo: required
-      services: docker
-      <<: *not-on-master
 # container-based infrastructure
 sudo: false
 
 addons:
   apt:
+    sources:
+    - augeas
     packages:  # Keep in sync with letsencrypt-auto-source/pieces/bootstrappers/deb_common.sh and Boulder.
     - python-dev
+    - python-virtualenv
     - gcc
     - libaugeas0
     - libssl-dev
@@ -55,16 +86,23 @@ addons:
     # For certbot-nginx integration testing
     - nginx-light
     - openssl
+    # for apacheconftest
+    - apache2
+    - libapache2-mod-wsgi
+    - libapache2-mod-macro
 
-# tools/pip_install.py is used to pin packages to a known working version
-# except in tests where the environment variable CERTBOT_NO_PIN is set.
-# virtualenv is listed here explicitly to make sure it is upgraded when
-# CERTBOT_NO_PIN is set to work around failures we've seen when using an older
-# version of virtualenv.
-install: "tools/pip_install.py -U codecov tox virtualenv"
-script: tox
+install: "travis_retry $(command -v pip || command -v pip3) install tox coveralls"
+script:
+    - travis_retry tox
+    - '[ -z "${BOULDER_INTEGRATION+x}" ] || (travis_retry tests/boulder-fetch.sh && tests/tox-boulder-integration.sh)'
 
-after_success: '[ "$TOXENV" == "py27-cover" ] && codecov -F linux'
+after_success: '[ "$TOXENV" == "cover" ] && coveralls'
 
 notifications:
   email: false
+  irc:
+    channels:
+      - secure: "SGWZl3ownKx9xKVV2VnGt7DqkTmutJ89oJV9tjKhSs84kLijU6EYdPnllqISpfHMTxXflNZuxtGo0wTDYHXBuZL47w1O32W6nzuXdra5zC+i4sYQwYULUsyfOv9gJX8zWAULiK0Z3r0oho45U+FR5ZN6TPCidi8/eGU+EEPwaAw="
+    on_success: never
+    on_failure: always
+    use_notice: true

AUTHORS.md

@@ -5,7 +5,6 @@ Authors
 * Aaron Zuehlke
 * Ada Lovelace
 * [Adam Woodbeck](https://github.com/awoodbeck)
-* [Adrien Ferrand](https://github.com/adferrand)
 * [Aidin Gharibnavaz](https://github.com/aidin36)
 * [AJ ONeal](https://github.com/coolaj86)
 * [Alcaro](https://github.com/Alcaro)
@@ -15,7 +14,6 @@ Authors
 * [Alex Gaynor](https://github.com/alex)
 * [Alex Halderman](https://github.com/jhalderm)
 * [Alex Jordan](https://github.com/strugee)
-* [Alex Zorin](https://github.com/alexzorin)
 * [Amjad Mashaal](https://github.com/TheNavigat)
 * [Andrew Murray](https://github.com/radarhere)
 * [Anselm Levskaya](https://github.com/levskaya)
@@ -77,7 +75,6 @@ Authors
 * [Fabian](https://github.com/faerbit)
 * [Faidon Liambotis](https://github.com/paravoid)
 * [Fan Jiang](https://github.com/tcz001)
-* [Felix Lechner](https://github.com/lechner)
 * [Felix Schwarz](https://github.com/FelixSchwarz)
 * [Felix Yan](https://github.com/felixonmars)
 * [Filip Ochnik](https://github.com/filipochnik)

CHANGELOG.md

@@ -1,950 +1,6 @@
 # Certbot change log
 
-Certbot adheres to [Semantic Versioning](https://semver.org/).
-
-## 0.37.0 - master
-
-### Added
-
-* Turn off session tickets for apache plugin by default
-* acme: Authz deactivation added to `acme` module.
-
-### Changed
-
-*
-
-### Fixed
-
-*
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.36.0 - 2019-07-11
-
-### Added
-
-* Turn off session tickets for nginx plugin by default
-* Added missing error types from RFC8555 to acme
-
-### Changed
-
-* Support for Ubuntu 14.04 Trusty has been removed.
-* Update the 'manage your account' help to be more generic.
-* The error message when Certbot's Apache plugin is unable to modify your
-  Apache configuration has been improved.
-* Certbot's config_changes subcommand has been deprecated and will be
-  removed in a future release.
-* `certbot config_changes` no longer accepts a --num parameter.
-* The functions `certbot.plugins.common.Installer.view_config_changes` and
-  `certbot.reverter.Reverter.view_config_changes` have been deprecated and will
-  be removed in a future release.
-
-### Fixed
-
-* Replace some unnecessary platform-specific line separation.
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.35.1 - 2019-06-10
-
-### Fixed
-
-* Support for specifying an authoritative base domain in our dns-rfc2136 plugin
-  has been removed. This feature was added in our last release but had a bug
-  which caused the plugin to fail so the feature has been removed until it can
-  be added properly.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* certbot-dns-rfc2136
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.35.0 - 2019-06-05
-
-### Added
-
-* dns_rfc2136 plugin now supports explicitly specifing an authorative
-  base domain for cases when the automatic method does not work (e.g.
-  Split horizon DNS)
-
-### Changed
-
-*
-
-### Fixed
-
-* Renewal parameter `webroot_path` is always saved, avoiding some regressions
-  when `webroot` authenticator plugin is invoked with no challenge to perform.
-* Certbot now accepts OCSP responses when an explicit authorized
-  responder, different from the issuer, is used to sign OCSP
-  responses.
-* Scripts in Certbot hook directories are no longer executed when their
-  filenames end in a tilde.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* certbot
-* certbot-dns-rfc2136
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.34.2 - 2019-05-07
-
-### Fixed
-
-* certbot-auto no longer writes a check_permissions.py script at the root
-  of the filesystem.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-changes in this release were to certbot-auto.
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.34.1 - 2019-05-06
-
-### Fixed
-
-* certbot-auto no longer prints a blank line when there are no permissions
-  problems.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-changes in this release were to certbot-auto.
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.34.0 - 2019-05-01
-
-### Changed
-
-* Apache plugin now tries to restart httpd on Fedora using systemctl if a
-  configuration test error is detected. This has to be done due to the way
-  Fedora now generates the self signed certificate files upon first
-  restart.
-* Updated Certbot and its plugins to improve the handling of file system permissions
-  on Windows as a step towards adding proper Windows support to Certbot.
-* Updated urllib3 to 1.24.2 in certbot-auto.
-* Removed the fallback introduced with 0.32.0 in `acme` to retry a challenge response
-  with a `keyAuthorization` if sending the response without this field caused a
-  `malformed` error to be received from the ACME server.
-* Linode DNS plugin now supports api keys created from their new panel
-  at [cloud.linode.com](https://cloud.linode.com)
-
-### Fixed
-
-* Fixed Google DNS Challenge issues when private zones exist
-* Adding a warning noting that future versions of Certbot will automatically configure the
-  webserver so that all requests redirect to secure HTTPS access. You can control this
-  behavior and disable this warning with the --redirect and --no-redirect flags.
-* certbot-auto now prints warnings when run as root with insecure file system
-  permissions. If you see these messages, you should fix the problem by
-  following the instructions at
-  https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/,
-  however, these warnings can be disabled as necessary with the flag
-  --no-permissions-check.
-* `acme` module uses now a POST-as-GET request to retrieve the registration
-  from an ACME v2 server
-* Convert the tsig algorithm specified in the certbot_dns_rfc2136 configuration file to
-  all uppercase letters before validating. This makes the value in the config case
-  insensitive.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-cloudflare
-* certbot-dns-cloudxns
-* certbot-dns-digitalocean
-* certbot-dns-dnsimple
-* certbot-dns-dnsmadeeasy
-* certbot-dns-gehirn
-* certbot-dns-google
-* certbot-dns-linode
-* certbot-dns-luadns
-* certbot-dns-nsone
-* certbot-dns-ovh
-* certbot-dns-rfc2136
-* certbot-dns-route53
-* certbot-dns-sakuracloud
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.33.1 - 2019-04-04
-
-### Fixed
-
-* A bug causing certbot-auto to print warnings or crash on some RHEL based
-  systems has been resolved.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-changes in this release were to certbot-auto.
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.33.0 - 2019-04-03
-
-### Added
-
-* Fedora 29+ is now supported by certbot-auto. Since Python 2.x is on a deprecation
-  path in Fedora, certbot-auto will install and use Python 3.x on Fedora 29+.
-* CLI flag `--https-port` has been added for Nginx plugin exclusively, and replaces
-  `--tls-sni-01-port`. It defines the HTTPS port the Nginx plugin will use while
-  setting up a new SSL vhost. By default the HTTPS port is 443.
-
-### Changed
-
-* Support for TLS-SNI-01 has been removed from all official Certbot plugins.
-* Attributes related to the TLS-SNI-01 challenge in `acme.challenges` and `acme.standalone`
-  modules are deprecated and will be removed soon.
-* CLI flags `--tls-sni-01-port` and `--tls-sni-01-address` are now no-op, will
-  generate a deprecation warning if used, and will be removed soon.
-* Options `tls-sni` and `tls-sni-01` in `--preferred-challenges` flag are now no-op,
-  will generate a deprecation warning if used, and will be removed soon.
-* CLI flag `--standalone-supported-challenges` has been removed.
-
-### Fixed
-
-* Certbot uses the Python library cryptography for OCSP when cryptography>=2.5
-  is installed. We fixed a bug in Certbot causing it to interpret timestamps in
-  the OCSP response as being in the local timezone rather than UTC.
-* Issue causing the default CentOS 6 TLS configuration to ignore some of the
-  HTTPS VirtualHosts created by Certbot. mod_ssl loading is now moved to main
-  http.conf for this environment where possible.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.32.0 - 2019-03-06
-
-### Added
-
-* If possible, Certbot uses built-in support for OCSP from recent cryptography
-  versions instead of the OpenSSL binary: as a consequence Certbot does not need
-  the OpenSSL binary to be installed anymore if cryptography>=2.5 is installed.
-
-### Changed
-
-* Certbot and its acme module now depend on josepy>=1.1.0 to avoid printing the
-  warnings described at https://github.com/certbot/josepy/issues/13.
-* Apache plugin now respects CERTBOT_DOCS environment variable when adding
-  command line defaults.
-* The running of manual plugin hooks is now always included in Certbot's log
-  output.
-* Tests execution for certbot, certbot-apache and certbot-nginx packages now relies on pytest.
-* An ACME CA server may return a "Retry-After" HTTP header on authorization polling, as
-  specified in the ACME protocol, to indicate when the next polling should occur. Certbot now
-  reads this header if set and respect its value.
-* The `acme` module avoids sending the `keyAuthorization` field in the JWS
-  payload when responding to a challenge as the field is not included in the
-  current ACME protocol. To ease the migration path for ACME CA servers,
-  Certbot and its `acme` module will first try the request without the
-  `keyAuthorization` field but will temporarily retry the request with the
-  field included if a `malformed` error is received. This fallback will be
-  removed in version 0.34.0.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.31.0 - 2019-02-07
-
-### Added
-
-* Avoid reprocessing challenges that are already validated
-  when a certificate is issued.
-* Support for initiating (but not solving end-to-end) TLS-ALPN-01 challenges
-  with the `acme` module.
-
-### Changed
-
-* Certbot's official Docker images are now based on Alpine Linux 3.9 rather
-  than 3.7. The new version comes with OpenSSL 1.1.1.
-* Lexicon-based DNS plugins are now fully compatible with Lexicon 3.x (support
-  on 2.x branch is maintained).
-* Apache plugin now attempts to configure all VirtualHosts matching requested
-  domain name instead of only a single one when answering the HTTP-01 challenge.
-
-### Fixed
-
-* Fixed accessing josepy contents through acme.jose when the full acme.jose
-  path is used.
-* Clarify behavior for deleting certs as part of revocation.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-cloudxns
-* certbot-dns-dnsimple
-* certbot-dns-dnsmadeeasy
-* certbot-dns-gehirn
-* certbot-dns-linode
-* certbot-dns-luadns
-* certbot-dns-nsone
-* certbot-dns-ovh
-* certbot-dns-sakuracloud
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.30.2 - 2019-01-25
-
-### Fixed
-
-* Update the version of setuptools pinned in certbot-auto to 40.6.3 to
-  solve installation problems on newer OSes.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, this
-release only affects certbot-auto.
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.30.1 - 2019-01-24
-
-### Fixed
-
-* Always download the pinned version of pip in pipstrap to address breakages
-* Rename old,default.conf to old-and-default.conf to address commas in filenames
-  breaking recent versions of pip.
-* Add VIRTUALENV_NO_DOWNLOAD=1 to all calls to virtualenv to address breakages
-  from venv downloading the latest pip
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* certbot-apache
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.30.0 - 2019-01-02
-
-### Added
-
-* Added the `update_account` subcommand for account management commands.
-
-### Changed
-
-* Copied account management functionality from the `register` subcommand
-  to the `update_account` subcommand.
-* Marked usage `register --update-registration` for deprecation and
-  removal in a future release.
-
-### Fixed
-
-* Older modules in the josepy library can now be accessed through acme.jose
-  like it could in previous versions of acme. This is only done to preserve
-  backwards compatibility and support for doing this with new modules in josepy
-  will not be added. Users of the acme library should switch to using josepy
-  directly if they haven't done so already.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.29.1 - 2018-12-05
-
-### Added
-
-*
-
-### Changed
-
-*
-
-### Fixed
-
-* The default work and log directories have been changed back to
-  /var/lib/letsencrypt and /var/log/letsencrypt respectively.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* certbot
-
-More details about these changes can be found on our GitHub repo.
-
-## 0.29.0 - 2018-12-05
-
-### Added
-
-* Noninteractive renewals with `certbot renew` (those not started from a
-  terminal) now randomly sleep 1-480 seconds before beginning work in
-  order to spread out load spikes on the server side.
-* Added External Account Binding support in cli and acme library.
-  Command line arguments --eab-kid and --eab-hmac-key added.
-
-### Changed
-
-* Private key permissioning changes: Renewal preserves existing group mode
-  & gid of previous private key material. Private keys for new
-  lineages (i.e. new certs, not renewed) default to 0o600.
-
-### Fixed
-
-* Update code and dependencies to clean up Resource and Deprecation Warnings.
-* Only depend on imgconverter extension for Sphinx >= 1.6
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-cloudflare
-* certbot-dns-digitalocean
-* certbot-dns-google
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/62?closed=1
-
-## 0.28.0 - 2018-11-7
-
-### Added
-
-* `revoke` accepts `--cert-name`, and doesn't accept both `--cert-name` and `--cert-path`.
-* Use the ACMEv2 newNonce endpoint when a new nonce is needed, and newNonce is available in the directory.
-
-### Changed
-
-* Removed documentation mentions of `#letsencrypt` IRC on Freenode.
-* Write README to the base of (config-dir)/live directory
-* `--manual` will explicitly warn users that earlier challenges should remain in place when setting up subsequent challenges.
-* Warn when using deprecated acme.challenges.TLSSNI01
-* Log warning about TLS-SNI deprecation in Certbot
-* Stop preferring TLS-SNI in the Apache, Nginx, and standalone plugins
-* OVH DNS plugin now relies on Lexicon>=2.7.14 to support HTTP proxies
-* Default time the Linode plugin waits for DNS changes to propogate is now 1200 seconds.
-
-### Fixed
-
-* Match Nginx parser update in allowing variable names to start with `${`.
-* Fix ranking of vhosts in Nginx so that all port-matching vhosts come first
-* Correct OVH integration tests on machines without internet access.
-* Stop caching the results of ipv6_info in http01.py
-* Test fix for Route53 plugin to prevent boto3 making outgoing connections.
-* The grammar used by Augeas parser in Apache plugin was updated to fix various parsing errors.
-* The CloudXNS, DNSimple, DNS Made Easy, Gehirn, Linode, LuaDNS, NS1, OVH, and
-  Sakura Cloud DNS plugins are now compatible with Lexicon 3.0+.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-cloudxns
-* certbot-dns-dnsimple
-* certbot-dns-dnsmadeeasy
-* certbot-dns-gehirn
-* certbot-dns-linode
-* certbot-dns-luadns
-* certbot-dns-nsone
-* certbot-dns-ovh
-* certbot-dns-route53
-* certbot-dns-sakuracloud
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/59?closed=1
-
-## 0.27.1 - 2018-09-06
-
-### Fixed
-
-* Fixed parameter name in OpenSUSE overrides for default parameters in the
-  Apache plugin. Certbot on OpenSUSE works again.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* certbot-apache
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/60?closed=1
-
-## 0.27.0 - 2018-09-05
-
-### Added
-
-* The Apache plugin now accepts the parameter --apache-ctl which can be
-  used to configure the path to the Apache control script.
-
-### Changed
-
-* When using `acme.client.ClientV2` (or
- `acme.client.BackwardsCompatibleClientV2` with an ACME server that supports a
- newer version of the ACME protocol), an `acme.errors.ConflictError` will be
- raised if you try to create an ACME account with a key that has already been
- used. Previously, a JSON parsing error was raised in this scenario when using
- the library with Let's Encrypt's ACMEv2 endpoint.
-
-### Fixed
-
-* When Apache is not installed, Certbot's Apache plugin no longer prints
-  messages about being unable to find apachectl to the terminal when the plugin
-  is not selected.
-* If you're using the Apache plugin with the --apache-vhost-root flag set to a
-  directory containing a disabled virtual host for the domain you're requesting
-  a certificate for, the virtual host will now be temporarily enabled if
-  necessary to pass the HTTP challenge.
-* The documentation for the Certbot package can now be built using Sphinx 1.6+.
-* You can now call `query_registration` without having to first call
-  `new_account` on `acme.client.ClientV2` objects.
-* The requirement of `setuptools>=1.0` has been removed from `certbot-dns-ovh`.
-* Names in certbot-dns-sakuracloud's tests have been updated to refer to Sakura
-  Cloud rather than NS1 whose plugin certbot-dns-sakuracloud was based on.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-package with changes other than its version number was:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-ovh
-* certbot-dns-sakuracloud
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/57?closed=1
-
-## 0.26.1 - 2018-07-17
-
-### Fixed
-
-* Fix a bug that was triggered when users who had previously manually set `--server` to get ACMEv2 certs tried to renew ACMEv1 certs.
-
-Despite us having broken lockstep, we are continuing to release new versions of all Certbot components during releases for the time being, however, the only package with changes other than its version number was:
-
-* certbot
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/58?closed=1
-
-## 0.26.0 - 2018-07-11
-
-### Added
-
-* A new security enhancement which we're calling AutoHSTS has been added to
-  Certbot's Apache plugin. This enhancement configures your webserver to send a
-  HTTP Strict Transport Security header with a low max-age value that is slowly
-  increased over time. The max-age value is not increased to a large value
-  until you've successfully managed to renew your certificate. This enhancement
-  can be requested with the --auto-hsts flag.
-* New official DNS plugins have been created for Gehirn Infrastracture Service,
-  Linode, OVH, and Sakura Cloud. These plugins can be found on our Docker Hub
-  page at https://hub.docker.com/u/certbot and on PyPI.
-* The ability to reuse ACME accounts from Let's Encrypt's ACMEv1 endpoint on
-  Let's Encrypt's ACMEv2 endpoint has been added.
-* Certbot and its components now support Python 3.7.
-* Certbot's install subcommand now allows you to interactively choose which
-  certificate to install from the list of certificates managed by Certbot.
-* Certbot now accepts the flag `--no-autorenew` which causes any obtained
-  certificates to not be automatically renewed when it approaches expiration.
-* Support for parsing the TLS-ALPN-01 challenge has been added back to the acme
-  library.
-
-### Changed
-
-* Certbot's default ACME server has been changed to Let's Encrypt's ACMEv2
-  endpoint. By default, this server will now be used for both new certificate
-  lineages and renewals.
-* The Nginx plugin is no longer marked labeled as an "Alpha" version.
-* The `prepare` method of Certbot's plugins is no longer called before running
-  "Updater" enhancements that are run on every invocation of `certbot renew`.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with functional changes were:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-gehirn
-* certbot-dns-linode
-* certbot-dns-ovh
-* certbot-dns-sakuracloud
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/55?closed=1
-
-## 0.25.1 - 2018-06-13
-
-### Fixed
-
-* TLS-ALPN-01 support has been removed from our acme library. Using our current
-  dependencies, we are unable to provide a correct implementation of this
-  challenge so we decided to remove it from the library until we can provide
-  proper support.
-* Issues causing test failures when running the tests in the acme package with
-  pytest<3.0 has been resolved.
-* certbot-nginx now correctly depends on acme>=0.25.0.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with changes other than their version number were:
-
-* acme
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/56?closed=1
-
-## 0.25.0 - 2018-06-06
-
-### Added
-
-* Support for the ready status type was added to acme. Without this change,
-  Certbot and acme users will begin encountering errors when using Let's
-  Encrypt's ACMEv2 API starting on June 19th for the staging environment and
-  July 5th for production. See
-  https://community.letsencrypt.org/t/acmev2-order-ready-status/62866 for more
-  information.
-* Certbot now accepts the flag --reuse-key which will cause the same key to be
-  used in the certificate when the lineage is renewed rather than generating a
-  new key.
-* You can now add multiple email addresses to your ACME account with Certbot by
-  providing a comma separated list of emails to the --email flag.
-* Support for Let's Encrypt's upcoming TLS-ALPN-01 challenge was added to acme.
-  For more information, see
-  https://community.letsencrypt.org/t/tls-alpn-validation-method/63814/1.
-* acme now supports specifying the source address to bind to when sending
-  outgoing connections. You still cannot specify this address using Certbot.
-* If you run Certbot against Let's Encrypt's ACMEv2 staging server but don't
-  already have an account registered at that server URL, Certbot will
-  automatically reuse your staging account from Let's Encrypt's ACMEv1 endpoint
-  if it exists.
-* Interfaces were added to Certbot allowing plugins to be called at additional
-  points. The `GenericUpdater` interface allows plugins to perform actions
-  every time `certbot renew` is run, regardless of whether any certificates are
-  due for renewal, and the `RenewDeployer` interface allows plugins to perform
-  actions when a certificate is renewed. See `certbot.interfaces` for more
-  information.
-
-### Changed
-
-* When running Certbot with --dry-run and you don't already have a staging
-  account, the created account does not contain an email address even if one
-  was provided to avoid expiration emails from Let's Encrypt's staging server.
-* certbot-nginx does a better job of automatically detecting the location of
-  Nginx's configuration files when run on BSD based systems.
-* acme now requires and uses pytest when running tests with setuptools with
-  `python setup.py test`.
-* `certbot config_changes` no longer waits for user input before exiting.
-
-### Fixed
-
-* Misleading log output that caused users to think that Certbot's standalone
-  plugin failed to bind to a port when performing a challenge has been
-  corrected.
-* An issue where certbot-nginx would fail to enable HSTS if the server block
-  already had an `add_header` directive has been resolved.
-* certbot-nginx now does a better job detecting the server block to base the
-  configuration for TLS-SNI challenges on.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with functional changes were:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/54?closed=1
-
-## 0.24.0 - 2018-05-02
-
-### Added
-
-* certbot now has an enhance subcommand which allows you to configure security
-  enhancements like HTTP to HTTPS redirects, OCSP stapling, and HSTS without
-  reinstalling a certificate.
-* certbot-dns-rfc2136 now allows the user to specify the port to use to reach
-  the DNS server in its credentials file.
-* acme now parses the wildcard field included in authorizations so it can be
-  used by users of the library.
-
-### Changed
-
-* certbot-dns-route53 used to wait for each DNS update to propagate before
-  sending the next one, but now it sends all updates before waiting which
-  speeds up issuance for multiple domains dramatically.
-* Certbot's official Docker images are now based on Alpine Linux 3.7 rather
-  than 3.4 because 3.4 has reached its end-of-life.
-* We've doubled the time Certbot will spend polling authorizations before
-  timing out.
-* The level of the message logged when Certbot is being used with
-  non-standard paths warning that crontabs for renewal included in Certbot
-  packages from OS package managers may not work has been reduced. This stops
-  the message from being written to stderr every time `certbot renew` runs.
-
-### Fixed
-
-* certbot-auto now works with Python 3.6.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with changes other than their version number were:
-
-* acme
-* certbot
-* certbot-apache
-* certbot-dns-digitalocean (only style improvements to tests)
-* certbot-dns-rfc2136
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/52?closed=1
-
-## 0.23.0 - 2018-04-04
-
-### Added
-
-* Support for OpenResty was added to the Nginx plugin.
-
-### Changed
-
-* The timestamps in Certbot's logfiles now use the system's local time zone
-  rather than UTC.
-* Certbot's DNS plugins that use Lexicon now rely on Lexicon>=2.2.1 to be able
-  to create and delete multiple TXT records on a single domain.
-* certbot-dns-google's test suite now works without an internet connection.
-
-### Fixed
-
-* Removed a small window that if during which an error occurred, Certbot
-  wouldn't clean up performed challenges.
-* The parameters `default` and `ipv6only` are now removed from `listen`
-  directives when creating a new server block in the Nginx plugin.
-* `server_name` directives enclosed in quotation marks in Nginx are now properly
-  supported.
-* Resolved an issue preventing the Apache plugin from starting Apache when it's
-  not currently running on RHEL and Gentoo based systems.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with changes other than their version number were:
-
-* certbot
-* certbot-apache
-* certbot-dns-cloudxns
-* certbot-dns-dnsimple
-* certbot-dns-dnsmadeeasy
-* certbot-dns-google
-* certbot-dns-luadns
-* certbot-dns-nsone
-* certbot-dns-rfc2136
-* certbot-nginx
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/50?closed=1
-
-## 0.22.2 - 2018-03-19
-
-### Fixed
-
-* A type error introduced in 0.22.1 that would occur during challenge cleanup
-  when a Certbot plugin raises an exception while trying to complete the
-  challenge was fixed.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with changes other than their version number were:
-
-* certbot
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/53?closed=1
-
-## 0.22.1 - 2018-03-19
-
-### Changed
-
-* The ACME server used with Certbot's --dry-run and --staging flags is now
-  Let's Encrypt's ACMEv2 staging server which allows people to also test ACMEv2
-  features with these flags.
-
-### Fixed
-
-* The HTTP Content-Type header is now set to the correct value during
-  certificate revocation with new versions of the ACME protocol.
-* When using Certbot with Let's Encrypt's ACMEv2 server, it would add a blank
-  line to the top of chain.pem and between the certificates in fullchain.pem
-  for each lineage. These blank lines have been removed.
-* Resolved a bug that caused Certbot's --allow-subset-of-names flag not to
-  work.
-* Fixed a regression in acme.client.Client that caused the class to not work
-  when it was initialized without a ClientNetwork which is done by some of the
-  other projects using our ACME library.
-
-Despite us having broken lockstep, we are continuing to release new versions of
-all Certbot components during releases for the time being, however, the only
-packages with changes other than their version number were:
-
-* acme
-* certbot
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/51?closed=1
-
-## 0.22.0 - 2018-03-07
-
-### Added
-
-* Support for obtaining wildcard certificates and a newer version of the ACME
-  protocol such as the one implemented by Let's Encrypt's upcoming ACMEv2
-  endpoint was added to Certbot and its ACME library. Certbot still works with
-  older ACME versions and will automatically change the version of the protocol
-  used based on the version the ACME CA implements.
-* The Apache and Nginx plugins are now able to automatically install a wildcard
-  certificate to multiple virtual hosts that you select from your server
-  configuration.
-* The `certbot install` command now accepts the `--cert-name` flag for
-  selecting a certificate.
-* `acme.client.BackwardsCompatibleClientV2` was added to Certbot's ACME library
-  which automatically handles most of the differences between new and old ACME
-  versions. `acme.client.ClientV2` is also available for people who only want
-  to support one version of the protocol or want to handle the differences
-  between versions themselves.
-* certbot-auto now supports the flag --install-only which has the script
-  install Certbot and its dependencies and exit without invoking Certbot.
-* Support for issuing a single certificate for a wildcard and base domain was
-  added to our Google Cloud DNS plugin. To do this, we now require your API
-  credentials have additional permissions, however, your credentials will
-  already have these permissions unless you defined a custom role with fewer
-  permissions than the standard DNS administrator role provided by Google.
-  These permissions are also only needed for the case described above so it
-  will continue to work for existing users. For more information about the
-  permissions changes, see the documentation in the plugin.
-
-### Changed
-
-* We have broken lockstep between our ACME library, Certbot, and its plugins.
-  This means that the different components do not need to be the same version
-  to work together like they did previously. This makes packaging easier
-  because not every piece of Certbot needs to be repackaged to ship a change to
-  a subset of its components.
-* Support for Python 2.6 and Python 3.3 has been removed from ACME, Certbot,
-  Certbot's plugins, and certbot-auto. If you are using certbot-auto on a RHEL
-  6 based system, it will walk you through the process of installing Certbot
-  with Python 3 and refuse to upgrade to a newer version of Certbot until you
-  have done so.
-* Certbot's components now work with older versions of setuptools to simplify
-  packaging for EPEL 7.
-
-### Fixed
-
-* Issues caused by Certbot's Nginx plugin adding multiple ipv6only directives
-  has been resolved.
-* A problem where Certbot's Apache plugin would add redundant include
-  directives for the TLS configuration managed by Certbot has been fixed.
-* Certbot's webroot plugin now properly deletes any directories it creates.
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/48?closed=1
-
-## 0.21.1 - 2018-01-25
-
-### Fixed
-
-* When creating an HTTP to HTTPS redirect in Nginx, we now ensure the Host
-  header of the request is set to an expected value before redirecting users to
-  the domain found in the header. The previous way Certbot configured Nginx
-  redirects was a potential security issue which you can read more about at
-  https://community.letsencrypt.org/t/security-issue-with-redirects-added-by-certbots-nginx-plugin/51493.
-* Fixed a problem where Certbot's Apache plugin could fail HTTP-01 challenges
-  if basic authentication is configured for the domain you request a
-  certificate for.
-* certbot-auto --no-bootstrap now properly tries to use Python 3.4 on RHEL 6
-  based systems rather than Python 2.6.
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/49?closed=1
-
-## 0.21.0 - 2018-01-17
-
-### Added
-
-* Support for the HTTP-01 challenge type was added to our Apache and Nginx
-  plugins. For those not aware, Let's Encrypt disabled the TLS-SNI-01 challenge
-  type which was what was previously being used by our Apache and Nginx plugins
-  last week due to a security issue. For more information about Let's Encrypt's
-  change, click
-  [here](https://community.letsencrypt.org/t/2018-01-11-update-regarding-acme-tls-sni-and-shared-hosting-infrastructure/50188).
-  Our Apache and Nginx plugins will automatically switch to use HTTP-01 so no
-  changes need to be made to your Certbot configuration, however, you should
-  make sure your server is accessible on port 80 and isn't behind an external
-  proxy doing things like redirecting all traffic from HTTP to HTTPS. HTTP to
-  HTTPS redirects inside Apache and Nginx are fine.
-* IPv6 support was added to the Nginx plugin.
-* Support for automatically creating server blocks based on the default server
-  block was added to the Nginx plugin.
-* The flags --delete-after-revoke and --no-delete-after-revoke were added
-  allowing users to control whether the revoke subcommand also deletes the
-  certificates it is revoking.
-
-### Changed
-
-* We deprecated support for Python 2.6 and Python 3.3 in Certbot and its ACME
-  library. Support for these versions of Python will be removed in the next
-  major release of Certbot. If you are using certbot-auto on a RHEL 6 based
-  system, it will guide you through the process of installing Python 3.
-* We split our implementation of JOSE (Javascript Object Signing and
-  Encryption) out of our ACME library and into a separate package named josepy.
-  This package is available on [PyPI](https://pypi.python.org/pypi/josepy) and
-  on [GitHub](https://github.com/certbot/josepy).
-* We updated the ciphersuites used in Apache to the new [values recommended by
-  Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29).
-  The major change here is adding ChaCha20 to the list of supported
-  ciphersuites.
-
-### Fixed
-
-* An issue with our Apache plugin on Gentoo due to differences in their
-  apache2ctl command have been resolved.
-
-More details about these changes can be found on our GitHub repo:
-https://github.com/certbot/certbot/milestone/47?closed=1
+Certbot adheres to [Semantic Versioning](http://semver.org/).
 
 ## 0.20.0 - 2017-12-06
 
@@ -1340,7 +396,7 @@ https://github.com/certbot/certbot/pulls?q=is%3Apr%20milestone%3A0.11.1%20is%3Ac
 
 ### Added
 
-* When using the standalone plugin while running Certbot interactively
+* When using the standalone plugin while running Certbot interactively 
 and a required port is bound by another process, Certbot will give you
 the option to retry to grab the port rather than immediately exiting.
 * You are now able to deactivate your account with the Let's Encrypt

CHANGES.rst

@@ -0,0 +1,8 @@
+ChangeLog
+=========
+
+To see the changes in a given release, view the issues closed in a given
+release's GitHub milestone:
+
+ - `Past releases <https://github.com/certbot/certbot/milestones?state=closed>`_
+ - `Upcoming releases <https://github.com/certbot/certbot/milestones>`_

CODE_OF_CONDUCT.md

@@ -1 +0,0 @@
-This project is governed by [EFF's Public Projects Code of Conduct](https://www.eff.org/pages/eppcode).

CONTRIBUTING.md

@@ -33,5 +33,3 @@ started. In particular, we recommend you read these sections
  - [Finding issues to work on](https://certbot.eff.org/docs/contributing.html#find-issues-to-work-on)
  - [Coding style](https://certbot.eff.org/docs/contributing.html#coding-style)
  - [Submitting a pull request](https://certbot.eff.org/docs/contributing.html#submitting-a-pull-request)
- - [EFF's Public Projects Code of Conduct](https://www.eff.org/pages/eppcode)
-

Dockerfile

@@ -0,0 +1,27 @@
+FROM python:2-alpine
+
+ENTRYPOINT [ "certbot" ]
+EXPOSE 80 443
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
+WORKDIR /opt/certbot
+
+COPY CHANGES.rst README.rst setup.py src/
+COPY acme src/acme
+COPY certbot src/certbot
+
+RUN apk add --no-cache --virtual .certbot-deps \
+        libffi \
+        libssl1.0 \
+        openssl \
+        ca-certificates \
+        binutils
+RUN apk add --no-cache --virtual .build-deps \
+        gcc \
+        linux-headers \
+        openssl-dev \
+        musl-dev \
+        libffi-dev \
+    && pip install --no-cache-dir \
+        --editable /opt/certbot/src/acme \
+        --editable /opt/certbot/src \
+    && apk del .build-deps

Dockerfile-dev

@@ -1,21 +1,70 @@
 # This Dockerfile builds an image for development.
-FROM debian:buster
+FROM ubuntu:trusty
+MAINTAINER Jakub Warmuz <jakub@warmuz.org>
+MAINTAINER William Budington <bill@eff.org>
+MAINTAINER Yan <yan@eff.org>
 
-# Note: this only exposes the port to other docker containers.
-EXPOSE 80 443
+# Note: this only exposes the port to other docker containers. You
+# still have to bind to 443@host at runtime, as per the ACME spec.
+EXPOSE 443
+
+# TODO: make sure --config-dir and --work-dir cannot be changed
+# through the CLI (certbot-docker wrapper that uses standalone
+# authenticator and text mode only?)
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
 
 WORKDIR /opt/certbot/src
 
+# no need to mkdir anything:
+# https://docs.docker.com/reference/builder/#copy
+# If <dest> doesn't exist, it is created along with all missing
+# directories in its path.
+
 # TODO: Install Apache/Nginx for plugin development.
-COPY . .
-RUN apt-get update && \
-    apt-get install apache2 git nginx-light -y && \
-    letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \
+COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto
+RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \
+    apt-get install python3-dev git -y && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* \
            /tmp/* \
            /var/tmp/*
 
-RUN VENV_NAME="../venv" python tools/venv.py
+# the above is not likely to change, so by putting it further up the
+# Dockerfile we make sure we cache as much as possible
+
+COPY setup.py README.rst CHANGES.rst MANIFEST.in linter_plugin.py tox.cover.sh tox.ini .pylintrc /opt/certbot/src/
+
+# all above files are necessary for setup.py, however, package source
+# code directory has to be copied separately to a subdirectory...
+# https://docs.docker.com/reference/builder/#copy: "If <src> is a
+# directory, the entire contents of the directory are copied,
+# including filesystem metadata. Note: The directory itself is not
+# copied, just its contents." Order again matters, three files are far
+# more likely to be cached than the whole project directory
+
+COPY certbot /opt/certbot/src/certbot/
+COPY acme /opt/certbot/src/acme/
+COPY certbot-apache /opt/certbot/src/certbot-apache/
+COPY certbot-nginx /opt/certbot/src/certbot-nginx/
+COPY letshelp-certbot /opt/certbot/src/letshelp-certbot/
+COPY certbot-compatibility-test /opt/certbot/src/certbot-compatibility-test/
+COPY tests /opt/certbot/src/tests/
+
+RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv && \
+    /opt/certbot/venv/bin/pip install -U pip && \
+    /opt/certbot/venv/bin/pip install -U setuptools && \
+    /opt/certbot/venv/bin/pip install \
+    -e /opt/certbot/src/acme \
+    -e /opt/certbot/src \
+    -e /opt/certbot/src/certbot-apache \
+    -e /opt/certbot/src/certbot-nginx \
+    -e /opt/certbot/src/letshelp-certbot \
+    -e /opt/certbot/src/certbot-compatibility-test \
+    -e /opt/certbot/src[dev,docs]
+
+# install in editable mode (-e) to save space: it's not possible to
+# "rm -rf /opt/certbot/src" (it's stays in the underlaying image);
+# this might also help in debugging: you can "docker run --entrypoint
+# bash" and investigate, apply patches, etc.
 
 ENV PATH /opt/certbot/venv/bin:$PATH

Dockerfile-old

@@ -0,0 +1,75 @@
+# https://github.com/letsencrypt/letsencrypt/pull/431#issuecomment-103659297
+# it is more likely developers will already have ubuntu:trusty rather
+# than e.g. debian:jessie and image size differences are negligible
+FROM ubuntu:trusty
+MAINTAINER Jakub Warmuz <jakub@warmuz.org>
+MAINTAINER William Budington <bill@eff.org>
+
+# Note: this only exposes the port to other docker containers. You
+# still have to bind to 443@host at runtime, as per the ACME spec.
+EXPOSE 443
+
+# TODO: make sure --config-dir and --work-dir cannot be changed
+# through the CLI (certbot-docker wrapper that uses standalone
+# authenticator and text mode only?)
+VOLUME /etc/letsencrypt /var/lib/letsencrypt
+
+WORKDIR /opt/certbot
+
+# no need to mkdir anything:
+# https://docs.docker.com/reference/builder/#copy
+# If <dest> doesn't exist, it is created along with all missing
+# directories in its path.
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY letsencrypt-auto-source/letsencrypt-auto /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto
+RUN /opt/certbot/src/letsencrypt-auto-source/letsencrypt-auto --os-packages-only && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* \
+           /tmp/* \
+           /var/tmp/*
+
+# the above is not likely to change, so by putting it further up the
+# Dockerfile we make sure we cache as much as possible
+
+
+COPY setup.py README.rst CHANGES.rst MANIFEST.in letsencrypt-auto-source/pieces/pipstrap.py /opt/certbot/src/
+
+# all above files are necessary for setup.py and venv setup, however,
+# package source code directory has to be copied separately to a
+# subdirectory...
+# https://docs.docker.com/reference/builder/#copy: "If <src> is a
+# directory, the entire contents of the directory are copied,
+# including filesystem metadata. Note: The directory itself is not
+# copied, just its contents." Order again matters, three files are far
+# more likely to be cached than the whole project directory
+
+COPY certbot /opt/certbot/src/certbot/
+COPY acme /opt/certbot/src/acme/
+COPY certbot-apache /opt/certbot/src/certbot-apache/
+COPY certbot-nginx /opt/certbot/src/certbot-nginx/
+
+
+RUN virtualenv --no-site-packages -p python2 /opt/certbot/venv
+
+# PATH is set now so pipstrap upgrades the correct (v)env
+ENV PATH /opt/certbot/venv/bin:$PATH
+RUN /opt/certbot/venv/bin/python /opt/certbot/src/pipstrap.py && \
+    /opt/certbot/venv/bin/pip install \
+    -e /opt/certbot/src/acme \
+    -e /opt/certbot/src \
+    -e /opt/certbot/src/certbot-apache \
+    -e /opt/certbot/src/certbot-nginx
+
+# install in editable mode (-e) to save space: it's not possible to
+# "rm -rf /opt/certbot/src" (it's stays in the underlaying image);
+# this might also help in debugging: you can "docker run --entrypoint
+# bash" and investigate, apply patches, etc.
+
+# set up certbot/letsencrypt wrapper to warn people about Dockerfile changes
+COPY tools/docker-warning.sh /opt/certbot/bin/certbot
+RUN ln -s /opt/certbot/bin/certbot /opt/certbot/bin/letsencrypt
+ENV PATH /opt/certbot/bin:$PATH
+
+ENTRYPOINT [ "certbot" ]

ISSUE_TEMPLATE.md

@@ -1,9 +1,3 @@
-If you're having trouble using Certbot and aren't sure you've found a bug or
-request for a new feature, please first try asking for help at
-https://community.letsencrypt.org/. There is a much larger community there of
-people familiar with the project who will be able to more quickly answer your
-questions.
-
 ## My operating system is (include version):
 
 

MANIFEST.in

@@ -1,5 +1,5 @@
 include README.rst
-include CHANGELOG.md
+include CHANGES.rst
 include CONTRIBUTING.md
 include LICENSE.txt
 include linter_plugin.py

README.rst

@@ -6,7 +6,7 @@ Anyone who has gone through the trouble of setting up a secure website knows wha
 
 How you use Certbot depends on the configuration of your web server. The best way to get started is to use our `interactive guide <https://certbot.eff.org>`_. It generates instructions based on your configuration settings. In most cases, you’ll need `root or administrator access <https://certbot.eff.org/faq/#does-certbot-require-root-administrator-privileges>`_ to your web server to run Certbot.
 
-Certbot is meant to be run directly on your web server, not on your personal computer. If you’re using a hosted service and don’t have direct access to your web server, you might not be able to use Certbot. Check with your hosting provider for documentation about uploading certificates or using certificates issued by Let’s Encrypt.
+If you’re using a hosted service and don’t have direct access to your web server, you might not be able to use Certbot. Check with your hosting provider for documentation about uploading certificates or using certificates issued by Let’s Encrypt.
 
 Certbot is a fully-featured, extensible client for the Let's
 Encrypt CA (or any other CA that speaks the `ACME
@@ -28,19 +28,45 @@ Contributing
 If you'd like to contribute to this project please read `Developer Guide
 <https://certbot.eff.org/docs/contributing.html>`_.
 
-This project is governed by `EFF's Public Projects Code of Conduct <https://www.eff.org/pages/eppcode>`_.
-
 .. _installation:
 
+Installation
+------------
+
+The easiest way to install Certbot is by visiting `certbot.eff.org`_, where you can
+find the correct installation instructions for many web server and OS combinations.
+For more information, see `Get Certbot <https://certbot.eff.org/docs/install.html>`_.
+
+.. _certbot.eff.org: https://certbot.eff.org/
+
 How to run the client
 ---------------------
 
-The easiest way to install and run Certbot is by visiting `certbot.eff.org`_,
-where you can find the correct instructions for many web server and OS
-combinations.  For more information, see `Get Certbot
-<https://certbot.eff.org/docs/install.html>`_.
+In many cases, you can just run ``certbot-auto`` or ``certbot``, and the
+client will guide you through the process of obtaining and installing certs
+interactively.
+
+For full command line help, you can type::
+
+  ./certbot-auto --help all
+
+
+You can also tell it exactly what you want it to do from the command line.
+For instance, if you want to obtain a cert for ``example.com``,
+``www.example.com``, and ``other.example.net``, using the Apache plugin to both
+obtain and install the certs, you could do this::
+
+  ./certbot-auto --apache -d example.com -d www.example.com -d other.example.net
+
+(The first time you run the command, it will make an account, and ask for an
+email and agreement to the Let's Encrypt Subscriber Agreement; you can
+automate those with ``--email`` and ``--agree-tos``)
+
+If you want to use a webserver that doesn't have full plugin support yet, you
+can still use "standalone" or "webroot" plugins to obtain a certificate::
+
+  ./certbot-auto certonly --standalone --email admin@example.com -d example.com -d www.example.com -d other.example.net
 
-.. _certbot.eff.org: https://certbot.eff.org/
 
 Understanding the client in more depth
 --------------------------------------
@@ -65,6 +91,8 @@ Main Website: https://certbot.eff.org
 
 Let's Encrypt Website: https://letsencrypt.org
 
+IRC Channel: #letsencrypt on `Freenode`_
+
 Community: https://community.letsencrypt.org
 
 ACME spec: http://ietf-wg-acme.github.io/acme/
@@ -73,12 +101,14 @@ ACME working area in github: https://github.com/ietf-wg-acme/acme
 
 |build-status| |coverage| |docs| |container|
 
-.. |build-status| image:: https://travis-ci.com/certbot/certbot.svg?branch=master
-   :target: https://travis-ci.com/certbot/certbot
+.. _Freenode: https://webchat.freenode.net?channels=%23letsencrypt
+
+.. |build-status| image:: https://travis-ci.org/certbot/certbot.svg?branch=master
+   :target: https://travis-ci.org/certbot/certbot
    :alt: Travis CI status
 
-.. |coverage| image:: https://codecov.io/gh/certbot/certbot/branch/master/graph/badge.svg
-   :target: https://codecov.io/gh/certbot/certbot
+.. |coverage| image:: https://coveralls.io/repos/certbot/certbot/badge.svg?branch=master
+   :target: https://coveralls.io/r/certbot/certbot
    :alt: Coverage status
 
 .. |docs| image:: https://readthedocs.org/projects/letsencrypt/badge/

acme/MANIFEST.in

@@ -1,6 +1,5 @@
 include LICENSE.txt
 include README.rst
-include pytest.ini
 recursive-include docs *
 recursive-include examples *
 recursive-include acme/testdata *

acme/acme/__init__.py

@@ -1,50 +1,21 @@
 """ACME protocol implementation.
 
-This module is an implementation of the `ACME protocol`_.
+This module is an implementation of the `ACME protocol`_. Latest
+supported version: `draft-ietf-acme-01`_.
+
 
 .. _`ACME protocol`: https://ietf-wg-acme.github.io/acme
 
+.. _`draft-ietf-acme-01`:
+  https://github.com/ietf-wg-acme/acme/tree/draft-ietf-acme-acme-01
+
 """
 import sys
 import warnings
 
-# This code exists to keep backwards compatibility with people using acme.jose
-# before it became the standalone josepy package.
-#
-# It is based on
-# https://github.com/requests/requests/blob/1278ecdf71a312dc2268f3bfc0aabfab3c006dcf/requests/packages.py
-
-import josepy as jose
-
-for mod in list(sys.modules):
-    # This traversal is apparently necessary such that the identities are
-    # preserved (acme.jose.* is josepy.*)
-    if mod == 'josepy' or mod.startswith('josepy.'):
-        sys.modules['acme.' + mod.replace('josepy', 'jose', 1)] = sys.modules[mod]
-
-
-# This class takes a similar approach to the cryptography project to deprecate attributes
-# in public modules. See the _ModuleWithDeprecation class here:
-# https://github.com/pyca/cryptography/blob/91105952739442a74582d3e62b3d2111365b0dc7/src/cryptography/utils.py#L129
-class _TLSSNI01DeprecationModule(object):
-    """
-    Internal class delegating to a module, and displaying warnings when
-    attributes related to TLS-SNI-01 are accessed.
-    """
-    def __init__(self, module):
-        self.__dict__['_module'] = module
-
-    def __getattr__(self, attr):
-        if 'TLSSNI01' in attr:
-            warnings.warn('{0} attribute is deprecated, and will be removed soon.'.format(attr),
-                          DeprecationWarning, stacklevel=2)
-        return getattr(self._module, attr)
-
-    def __setattr__(self, attr, value):  # pragma: no cover
-        setattr(self._module, attr, value)
-
-    def __delattr__(self, attr):  # pragma: no cover
-        delattr(self._module, attr)
-
-    def __dir__(self):  # pragma: no cover
-        return ['_module'] + dir(self._module)
+if sys.version_info[:2] == (3, 3):
+    warnings.warn(
+            "Python 3.3 support will be dropped in the next release of "
+            "acme. Please upgrade your Python version.",
+            PendingDeprecationWarning,
+    ) #pragma: no cover

acme/acme/challenges.py

@@ -4,24 +4,24 @@ import functools
 import hashlib
 import logging
 import socket
-import sys
 
 from cryptography.hazmat.primitives import hashes  # type: ignore
 import josepy as jose
 import OpenSSL
 import requests
-import six
 
 from acme import errors
 from acme import crypto_util
 from acme import fields
-from acme import _TLSSNI01DeprecationModule
 
 logger = logging.getLogger(__name__)
 
 
+# pylint: disable=too-few-public-methods
+
+
 class Challenge(jose.TypedJSONObjectWithFields):
-    # _fields_to_partial_json
+    # _fields_to_partial_json | pylint: disable=abstract-method
     """ACME challenge."""
     TYPES = {}  # type: dict
 
@@ -35,7 +35,7 @@ class Challenge(jose.TypedJSONObjectWithFields):
 
 
 class ChallengeResponse(jose.TypedJSONObjectWithFields):
-    # _fields_to_partial_json
+    # _fields_to_partial_json | pylint: disable=abstract-method
     """ACME challenge response."""
     TYPES = {}  # type: dict
     resource_type = 'challenge'
@@ -94,7 +94,6 @@ class _TokenChallenge(Challenge):
         """
         # TODO: check that path combined with uri does not go above
         # URI_ROOT_PATH!
-        # pylint: disable=unsupported-membership-test
         return b'..' not in self.token and b'/' not in self.token
 
 
@@ -139,21 +138,17 @@ class KeyAuthorizationChallengeResponse(ChallengeResponse):
 
         return True
 
-    def to_partial_json(self):
-        jobj = super(KeyAuthorizationChallengeResponse, self).to_partial_json()
-        jobj.pop('keyAuthorization', None)
-        return jobj
 
-
-@six.add_metaclass(abc.ABCMeta)
 class KeyAuthorizationChallenge(_TokenChallenge):
+    # pylint: disable=abstract-class-little-used,too-many-ancestors
     """Challenge based on Key Authorization.
 
     :param response_cls: Subclass of `KeyAuthorizationChallengeResponse`
         that will be used to generate `response`.
-    :param str typ: type of the challenge
+
     """
-    typ = NotImplemented
+    __metaclass__ = abc.ABCMeta
+
     response_cls = NotImplemented
     thumbprint_hash_function = (
         KeyAuthorizationChallengeResponse.thumbprint_hash_function)
@@ -178,7 +173,7 @@ class KeyAuthorizationChallenge(_TokenChallenge):
         :rtype: KeyAuthorizationChallengeResponse
 
         """
-        return self.response_cls(  # pylint: disable=not-callable
+        return self.response_cls(
             key_authorization=self.key_authorization(account_key))
 
     @abc.abstractmethod
@@ -215,7 +210,7 @@ class DNS01Response(KeyAuthorizationChallengeResponse):
     """ACME dns-01 challenge response."""
     typ = "dns-01"
 
-    def simple_verify(self, chall, domain, account_public_key):  # pylint: disable=unused-argument
+    def simple_verify(self, chall, domain, account_public_key):
         """Simple verify.
 
         This method no longer checks DNS records and is a simple wrapper
@@ -231,6 +226,7 @@ class DNS01Response(KeyAuthorizationChallengeResponse):
         :rtype: bool
 
         """
+        # pylint: disable=unused-argument
         verified = self.verify(chall, account_public_key)
         if not verified:
             logger.debug("Verification of key authorization in response failed")
@@ -435,6 +431,7 @@ class TLSSNI01Response(KeyAuthorizationChallengeResponse):
         kwargs.setdefault("port", self.PORT)
         kwargs["name"] = self.z_domain
         # TODO: try different methods?
+        # pylint: disable=protected-access
         return crypto_util.probe_sni(**kwargs)
 
     def verify_cert(self, cert):
@@ -480,7 +477,7 @@ class TLSSNI01Response(KeyAuthorizationChallengeResponse):
             try:
                 cert = self.probe_cert(domain=domain, **kwargs)
             except errors.Error as error:
-                logger.debug(str(error), exc_info=True)
+                logger.debug(error, exc_info=True)
                 return False
 
         return self.verify_cert(cert)
@@ -509,34 +506,7 @@ class TLSSNI01(KeyAuthorizationChallenge):
         return self.response(account_key).gen_cert(key=kwargs.get('cert_key'))
 
 
-@ChallengeResponse.register
-class TLSALPN01Response(KeyAuthorizationChallengeResponse):
-    """ACME TLS-ALPN-01 challenge response.
-
-    This class only allows initiating a TLS-ALPN-01 challenge returned from the
-    CA. Full support for responding to TLS-ALPN-01 challenges by generating and
-    serving the expected response certificate is not currently provided.
-    """
-    typ = "tls-alpn-01"
-
-
 @Challenge.register  # pylint: disable=too-many-ancestors
-class TLSALPN01(KeyAuthorizationChallenge):
-    """ACME tls-alpn-01 challenge.
-
-    This class simply allows parsing the TLS-ALPN-01 challenge returned from
-    the CA. Full TLS-ALPN-01 support is not currently provided.
-
-    """
-    typ = "tls-alpn-01"
-    response_cls = TLSALPN01Response
-
-    def validation(self, account_key, **kwargs):
-        """Generate validation for the challenge."""
-        raise NotImplementedError()
-
-
-@Challenge.register
 class DNS(_TokenChallenge):
     """ACME "dns" challenge."""
     typ = "dns"
@@ -617,7 +587,3 @@ class DNSResponse(ChallengeResponse):
 
         """
         return chall.check_validation(self.validation, account_public_key)
-
-
-# Patching ourselves to warn about TLS-SNI challenge deprecation and removal.
-sys.modules[__name__] = _TLSSNI01DeprecationModule(sys.modules[__name__])

acme/acme/challenges_test.py

@@ -6,7 +6,7 @@ import mock
 import OpenSSL
 import requests
 
-from six.moves.urllib import parse as urllib_parse  # pylint: disable=relative-import
+from six.moves.urllib import parse as urllib_parse  # pylint: disable=import-error
 
 from acme import errors
 from acme import test_util
@@ -93,8 +93,7 @@ class DNS01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual(self.jmsg, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import DNS01Response
@@ -165,8 +164,7 @@ class HTTP01ResponseTest(unittest.TestCase):
         self.response = self.chall.response(KEY)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
+        self.assertEqual(self.jmsg, self.msg.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import HTTP01Response
@@ -286,8 +284,7 @@ class TLSSNI01ResponseTest(unittest.TestCase):
         self.assertEqual(self.z_domain, self.response.z_domain)
 
     def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.response.to_partial_json())
+        self.assertEqual(self.jmsg, self.response.to_partial_json())
 
     def test_from_json(self):
         from acme.challenges import TLSSNI01Response
@@ -363,13 +360,13 @@ class TLSSNI01ResponseTest(unittest.TestCase):
 class TLSSNI01Test(unittest.TestCase):
 
     def setUp(self):
+        from acme.challenges import TLSSNI01
+        self.msg = TLSSNI01(
+            token=jose.b64decode('a82d5ff8ef740d12881f6d3c2277ab2e'))
         self.jmsg = {
             'type': 'tls-sni-01',
             'token': 'a82d5ff8ef740d12881f6d3c2277ab2e',
         }
-        from acme.challenges import TLSSNI01
-        self.msg = TLSSNI01(
-            token=jose.b64decode('a82d5ff8ef740d12881f6d3c2277ab2e'))
 
     def test_to_partial_json(self):
         self.assertEqual(self.jmsg, self.msg.to_partial_json())
@@ -395,74 +392,6 @@ class TLSSNI01Test(unittest.TestCase):
             KEY, cert_key=mock.sentinel.cert_key))
         mock_gen_cert.assert_called_once_with(key=mock.sentinel.cert_key)
 
-    def test_deprecation_message(self):
-        with mock.patch('acme.warnings.warn') as mock_warn:
-            from acme.challenges import TLSSNI01
-            assert TLSSNI01
-        self.assertEqual(mock_warn.call_count, 1)
-        self.assertTrue('deprecated' in mock_warn.call_args[0][0])
-
-
-class TLSALPN01ResponseTest(unittest.TestCase):
-    # pylint: disable=too-many-instance-attributes
-
-    def setUp(self):
-        from acme.challenges import TLSALPN01Response
-        self.msg = TLSALPN01Response(key_authorization=u'foo')
-        self.jmsg = {
-            'resource': 'challenge',
-            'type': 'tls-alpn-01',
-            'keyAuthorization': u'foo',
-        }
-
-        from acme.challenges import TLSALPN01
-        self.chall = TLSALPN01(token=(b'x' * 16))
-        self.response = self.chall.response(KEY)
-
-    def test_to_partial_json(self):
-        self.assertEqual({k: v for k, v in self.jmsg.items() if k != 'keyAuthorization'},
-                         self.msg.to_partial_json())
-
-    def test_from_json(self):
-        from acme.challenges import TLSALPN01Response
-        self.assertEqual(self.msg, TLSALPN01Response.from_json(self.jmsg))
-
-    def test_from_json_hashable(self):
-        from acme.challenges import TLSALPN01Response
-        hash(TLSALPN01Response.from_json(self.jmsg))
-
-
-class TLSALPN01Test(unittest.TestCase):
-
-    def setUp(self):
-        from acme.challenges import TLSALPN01
-        self.msg = TLSALPN01(
-            token=jose.b64decode('a82d5ff8ef740d12881f6d3c2277ab2e'))
-        self.jmsg = {
-            'type': 'tls-alpn-01',
-            'token': 'a82d5ff8ef740d12881f6d3c2277ab2e',
-        }
-
-    def test_to_partial_json(self):
-        self.assertEqual(self.jmsg, self.msg.to_partial_json())
-
-    def test_from_json(self):
-        from acme.challenges import TLSALPN01
-        self.assertEqual(self.msg, TLSALPN01.from_json(self.jmsg))
-
-    def test_from_json_hashable(self):
-        from acme.challenges import TLSALPN01
-        hash(TLSALPN01.from_json(self.jmsg))
-
-    def test_from_json_invalid_token_length(self):
-        from acme.challenges import TLSALPN01
-        self.jmsg['token'] = jose.encode_b64jose(b'abcd')
-        self.assertRaises(
-            jose.DeserializationError, TLSALPN01.from_json, self.jmsg)
-
-    def test_validation(self):
-        self.assertRaises(NotImplementedError, self.msg.validation, KEY)
-
 
 class DNSTest(unittest.TestCase):
 

acme/acme/client.py

@@ -6,23 +6,19 @@ from email.utils import parsedate_tz
 import heapq
 import logging
 import time
-import re
-import sys
 
 import six
 from six.moves import http_client  # pylint: disable=import-error
+
 import josepy as jose
 import OpenSSL
+import re
 import requests
-from requests.adapters import HTTPAdapter
-from requests_toolbelt.adapters.source import SourceAddressAdapter
+import sys
 
-from acme import crypto_util
 from acme import errors
 from acme import jws
 from acme import messages
-# pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Dict, List, Set, Text
 
 
 logger = logging.getLogger(__name__)
@@ -33,7 +29,6 @@ logger = logging.getLogger(__name__)
 # https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
 if sys.version_info < (2, 7, 9):  # pragma: no cover
     try:
-        # pylint: disable=no-member
         requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  # type: ignore
     except AttributeError:
         import urllib3.contrib.pyopenssl  # pylint: disable=import-error
@@ -44,23 +39,39 @@ DEFAULT_NETWORK_TIMEOUT = 45
 DER_CONTENT_TYPE = 'application/pkix-cert'
 
 
-class ClientBase(object):  # pylint: disable=too-many-instance-attributes
-    """ACME client base object.
+class Client(object):  # pylint: disable=too-many-instance-attributes
+    """ACME client.
+
+    .. todo::
+       Clean up raised error types hierarchy, document, and handle (wrap)
+       instances of `.DeserializationError` raised in `from_json()`.
 
     :ivar messages.Directory directory:
-    :ivar .ClientNetwork net: Client network.
-    :ivar int acme_version: ACME protocol version. 1 or 2.
+    :ivar key: `.JWK` (private)
+    :ivar alg: `.JWASignature`
+    :ivar bool verify_ssl: Verify SSL certificates?
+    :ivar .ClientNetwork net: Client network. Useful for testing. If not
+        supplied, it will be initialized using `key`, `alg` and
+        `verify_ssl`.
+
     """
-    def __init__(self, directory, net, acme_version):
+
+    def __init__(self, directory, key, alg=jose.RS256, verify_ssl=True,
+                 net=None):
         """Initialize.
 
-        :param .messages.Directory directory: Directory Resource
-        :param .ClientNetwork net: Client network.
-        :param int acme_version: ACME protocol version. 1 or 2.
+        :param directory: Directory Resource (`.messages.Directory`) or
+            URI from which the resource will be downloaded.
+
         """
-        self.directory = directory
-        self.net = net
-        self.acme_version = acme_version
+        self.key = key
+        self.net = ClientNetwork(key, alg, verify_ssl) if net is None else net
+
+        if isinstance(directory, six.string_types):
+            self.directory = messages.Directory.from_json(
+                self.net.get(directory).json())
+        else:
+            self.directory = directory
 
     @classmethod
     def _regr_from_response(cls, response, uri=None, terms_of_service=None):
@@ -72,8 +83,28 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
             uri=response.headers.get('Location', uri),
             terms_of_service=terms_of_service)
 
+    def register(self, new_reg=None):
+        """Register.
+
+        :param .NewRegistration new_reg:
+
+        :returns: Registration Resource.
+        :rtype: `.RegistrationResource`
+
+        """
+        new_reg = messages.NewRegistration() if new_reg is None else new_reg
+        assert isinstance(new_reg, messages.NewRegistration)
+
+        response = self.net.post(self.directory[new_reg], new_reg)
+        # TODO: handle errors
+        assert response.status_code == http_client.CREATED
+
+        # "Instance of 'Field' has no key/contact member" bug:
+        # pylint: disable=no-member
+        return self._regr_from_response(response)
+
     def _send_recv_regr(self, regr, body):
-        response = self._post(regr.uri, body)
+        response = self.net.post(regr.uri, body)
 
         # TODO: Boulder returns httplib.ACCEPTED
         #assert response.status_code == httplib.OK
@@ -85,15 +116,6 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
             response, uri=regr.uri,
             terms_of_service=regr.terms_of_service)
 
-    def _post(self, *args, **kwargs):
-        """Wrapper around self.net.post that adds the acme_version.
-
-        """
-        kwargs.setdefault('acme_version', self.acme_version)
-        if hasattr(self.directory, 'newNonce'):
-            kwargs.setdefault('new_nonce_url', getattr(self.directory, 'newNonce'))
-        return self.net.post(*args, **kwargs)
-
     def update_registration(self, regr, update=None):
         """Update registration.
 
@@ -108,7 +130,6 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
         update = regr.body if update is None else update
         body = messages.UpdateRegistration(**dict(update))
         updated_regr = self._send_recv_regr(regr, body=body)
-        self.net.account = updated_regr
         return updated_regr
 
     def deactivate_registration(self, regr):
@@ -123,29 +144,74 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
         """
         return self.update_registration(regr, update={'status': 'deactivated'})
 
-    def deactivate_authorization(self, authzr):
-        # type: (messages.AuthorizationResource) -> messages.AuthorizationResource
-        """Deactivate authorization.
+    def query_registration(self, regr):
+        """Query server about registration.
 
-        :param messages.AuthorizationResource authzr: The Authorization resource
-            to be deactivated.
-
-        :returns: The Authorization resource that was deactivated.
-        :rtype: `.AuthorizationResource`
+        :param messages.RegistrationResource: Existing Registration
+            Resource.
 
         """
-        body = messages.UpdateAuthorization(status='deactivated')
-        response = self._post(authzr.uri, body)
-        return self._authzr_from_response(response)
+        return self._send_recv_regr(regr, messages.UpdateRegistration())
 
-    def _authzr_from_response(self, response, identifier=None, uri=None):
+    def agree_to_tos(self, regr):
+        """Agree to the terms-of-service.
+
+        Agree to the terms-of-service in a Registration Resource.
+
+        :param regr: Registration Resource.
+        :type regr: `.RegistrationResource`
+
+        :returns: Updated Registration Resource.
+        :rtype: `.RegistrationResource`
+
+        """
+        return self.update_registration(
+            regr.update(body=regr.body.update(agreement=regr.terms_of_service)))
+
+    def _authzr_from_response(self, response, identifier, uri=None):
         authzr = messages.AuthorizationResource(
             body=messages.Authorization.from_json(response.json()),
             uri=response.headers.get('Location', uri))
-        if identifier is not None and authzr.body.identifier != identifier:
+        if authzr.body.identifier != identifier:
             raise errors.UnexpectedUpdate(authzr)
         return authzr
 
+    def request_challenges(self, identifier, new_authzr_uri=None):
+        """Request challenges.
+
+        :param .messages.Identifier identifier: Identifier to be challenged.
+        :param str new_authzr_uri: Deprecated. Do not use.
+
+        :returns: Authorization Resource.
+        :rtype: `.AuthorizationResource`
+
+        """
+        if new_authzr_uri is not None:
+            logger.debug("request_challenges with new_authzr_uri deprecated.")
+        new_authz = messages.NewAuthorization(identifier=identifier)
+        response = self.net.post(self.directory.new_authz, new_authz)
+        # TODO: handle errors
+        assert response.status_code == http_client.CREATED
+        return self._authzr_from_response(response, identifier)
+
+    def request_domain_challenges(self, domain, new_authzr_uri=None):
+        """Request challenges for domain names.
+
+        This is simply a convenience function that wraps around
+        `request_challenges`, but works with domain names instead of
+        generic identifiers. See ``request_challenges`` for more
+        documentation.
+
+        :param str domain: Domain name to be challenged.
+        :param str new_authzr_uri: Deprecated. Do not use.
+
+        :returns: Authorization Resource.
+        :rtype: `.AuthorizationResource`
+
+        """
+        return self.request_challenges(messages.Identifier(
+            typ=messages.IDENTIFIER_FQDN, value=domain), new_authzr_uri)
+
     def answer_challenge(self, challb, response):
         """Answer challenge.
 
@@ -161,7 +227,7 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
         :raises .UnexpectedUpdate:
 
         """
-        response = self._post(challb.uri, response)
+        response = self.net.post(challb.uri, response)
         try:
             authzr_uri = response.links['up']['url']
         except KeyError:
@@ -206,151 +272,21 @@ class ClientBase(object):  # pylint: disable=too-many-instance-attributes
 
         return datetime.datetime.now() + datetime.timedelta(seconds=seconds)
 
-    def _revoke(self, cert, rsn, url):
-        """Revoke certificate.
+    def poll(self, authzr):
+        """Poll Authorization Resource for status.
 
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
+        :param authzr: Authorization Resource
+        :type authzr: `.AuthorizationResource`
 
-        :param int rsn: Reason code for certificate revocation.
+        :returns: Updated Authorization Resource and HTTP response.
 
-        :param str url: ACME URL to post to
-
-        :raises .ClientError: If revocation is unsuccessful.
+        :rtype: (`.AuthorizationResource`, `requests.Response`)
 
         """
-        response = self._post(url,
-                              messages.Revocation(
-                                certificate=cert,
-                                reason=rsn))
-        if response.status_code != http_client.OK:
-            raise errors.ClientError(
-                'Successful revocation must return HTTP OK status')
-
-
-class Client(ClientBase):
-    """ACME client for a v1 API.
-
-    .. todo::
-       Clean up raised error types hierarchy, document, and handle (wrap)
-       instances of `.DeserializationError` raised in `from_json()`.
-
-    :ivar messages.Directory directory:
-    :ivar key: `josepy.JWK` (private)
-    :ivar alg: `josepy.JWASignature`
-    :ivar bool verify_ssl: Verify SSL certificates?
-    :ivar .ClientNetwork net: Client network. Useful for testing. If not
-        supplied, it will be initialized using `key`, `alg` and
-        `verify_ssl`.
-
-    """
-
-    def __init__(self, directory, key, alg=jose.RS256, verify_ssl=True,
-                 net=None):
-        """Initialize.
-
-        :param directory: Directory Resource (`.messages.Directory`) or
-            URI from which the resource will be downloaded.
-
-        """
-        # pylint: disable=too-many-arguments
-        self.key = key
-        if net is None:
-            net = ClientNetwork(key, alg=alg, verify_ssl=verify_ssl)
-
-        if isinstance(directory, six.string_types):
-            directory = messages.Directory.from_json(
-                net.get(directory).json())
-        super(Client, self).__init__(directory=directory,
-            net=net, acme_version=1)
-
-    def register(self, new_reg=None):
-        """Register.
-
-        :param .NewRegistration new_reg:
-
-        :returns: Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        new_reg = messages.NewRegistration() if new_reg is None else new_reg
-        response = self._post(self.directory[new_reg], new_reg)
-        # TODO: handle errors
-        assert response.status_code == http_client.CREATED
-
-        # "Instance of 'Field' has no key/contact member" bug:
-        # pylint: disable=no-member
-        return self._regr_from_response(response)
-
-    def query_registration(self, regr):
-        """Query server about registration.
-
-        :param messages.RegistrationResource: Existing Registration
-            Resource.
-
-        """
-        return self._send_recv_regr(regr, messages.UpdateRegistration())
-
-    def agree_to_tos(self, regr):
-        """Agree to the terms-of-service.
-
-        Agree to the terms-of-service in a Registration Resource.
-
-        :param regr: Registration Resource.
-        :type regr: `.RegistrationResource`
-
-        :returns: Updated Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        return self.update_registration(
-            regr.update(body=regr.body.update(agreement=regr.terms_of_service)))
-
-    def request_challenges(self, identifier, new_authzr_uri=None):
-        """Request challenges.
-
-        :param .messages.Identifier identifier: Identifier to be challenged.
-        :param str new_authzr_uri: Deprecated. Do not use.
-
-        :returns: Authorization Resource.
-        :rtype: `.AuthorizationResource`
-
-        :raises errors.WildcardUnsupportedError: if a wildcard is requested
-
-        """
-        if new_authzr_uri is not None:
-            logger.debug("request_challenges with new_authzr_uri deprecated.")
-
-        if identifier.value.startswith("*"):
-            raise errors.WildcardUnsupportedError(
-                "Requesting an authorization for a wildcard name is"
-                " forbidden by this version of the ACME protocol.")
-
-        new_authz = messages.NewAuthorization(identifier=identifier)
-        response = self._post(self.directory.new_authz, new_authz)
-        # TODO: handle errors
-        assert response.status_code == http_client.CREATED
-        return self._authzr_from_response(response, identifier)
-
-    def request_domain_challenges(self, domain, new_authzr_uri=None):
-        """Request challenges for domain names.
-
-        This is simply a convenience function that wraps around
-        `request_challenges`, but works with domain names instead of
-        generic identifiers. See ``request_challenges`` for more
-        documentation.
-
-        :param str domain: Domain name to be challenged.
-        :param str new_authzr_uri: Deprecated. Do not use.
-
-        :returns: Authorization Resource.
-        :rtype: `.AuthorizationResource`
-
-        :raises errors.WildcardUnsupportedError: if a wildcard is requested
-
-        """
-        return self.request_challenges(messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value=domain), new_authzr_uri)
+        response = self.net.get(authzr.uri)
+        updated_authzr = self._authzr_from_response(
+            response, authzr.body.identifier, authzr.uri)
+        return updated_authzr, response
 
     def request_issuance(self, csr, authzrs):
         """Request issuance.
@@ -371,7 +307,7 @@ class Client(ClientBase):
         req = messages.CertificateRequest(csr=csr)
 
         content_type = DER_CONTENT_TYPE  # TODO: add 'cert_type 'argument
-        response = self._post(
+        response = self.net.post(
             self.directory.new_cert,
             req,
             content_type=content_type,
@@ -389,22 +325,6 @@ class Client(ClientBase):
             body=jose.ComparableX509(OpenSSL.crypto.load_certificate(
                 OpenSSL.crypto.FILETYPE_ASN1, response.content)))
 
-    def poll(self, authzr):
-        """Poll Authorization Resource for status.
-
-        :param authzr: Authorization Resource
-        :type authzr: `.AuthorizationResource`
-
-        :returns: Updated Authorization Resource and HTTP response.
-
-        :rtype: (`.AuthorizationResource`, `requests.Response`)
-
-        """
-        response = self.net.get(authzr.uri)
-        updated_authzr = self._authzr_from_response(
-            response, authzr.body.identifier, authzr.uri)
-        return updated_authzr, response
-
     def poll_and_request_issuance(
             self, csr, authzrs, mintime=5, max_attempts=10):
         """Poll and request issuance.
@@ -436,7 +356,7 @@ class Client(ClientBase):
         """
         # pylint: disable=too-many-locals
         assert max_attempts > 0
-        attempts = collections.defaultdict(int) # type: Dict[messages.AuthorizationResource, int]
+        attempts = collections.defaultdict(int)
         exhausted = set()
 
         # priority queue with datetime.datetime (based on Retry-After) as key,
@@ -550,7 +470,7 @@ class Client(ClientBase):
         :rtype: `list` of `OpenSSL.crypto.X509` wrapped in `.ComparableX509`
 
         """
-        chain = [] # type: List[jose.ComparableX509]
+        chain = []
         uri = certr.cert_chain_uri
         while uri is not None and len(chain) < max_length:
             response, cert = self._get_cert(uri)
@@ -572,422 +492,32 @@ class Client(ClientBase):
         :raises .ClientError: If revocation is unsuccessful.
 
         """
-        return self._revoke(cert, rsn, self.directory[messages.Revocation])
-
-
-class ClientV2(ClientBase):
-    """ACME client for a v2 API.
-
-    :ivar messages.Directory directory:
-    :ivar .ClientNetwork net: Client network.
-    """
-
-    def __init__(self, directory, net):
-        """Initialize.
-
-        :param .messages.Directory directory: Directory Resource
-        :param .ClientNetwork net: Client network.
-        """
-        super(ClientV2, self).__init__(directory=directory,
-            net=net, acme_version=2)
-
-    def new_account(self, new_account):
-        """Register.
-
-        :param .NewRegistration new_account:
-
-        :raises .ConflictError: in case the account already exists
-
-        :returns: Registration Resource.
-        :rtype: `.RegistrationResource`
-        """
-        response = self._post(self.directory['newAccount'], new_account)
-        # if account already exists
-        if response.status_code == 200 and 'Location' in response.headers:
-            raise errors.ConflictError(response.headers.get('Location'))
-        # "Instance of 'Field' has no key/contact member" bug:
-        # pylint: disable=no-member
-        regr = self._regr_from_response(response)
-        self.net.account = regr
-        return regr
-
-    def query_registration(self, regr):
-        """Query server about registration.
-
-        :param messages.RegistrationResource: Existing Registration
-            Resource.
-
-        """
-        self.net.account = regr  # See certbot/certbot#6258
-        # ACME v2 requires to use a POST-as-GET request (POST an empty JWS) here.
-        # This is done by passing None instead of an empty UpdateRegistration to _post().
-        response = self._post(regr.uri, None)
-        self.net.account = self._regr_from_response(response, uri=regr.uri,
-                                                    terms_of_service=regr.terms_of_service)
-        return self.net.account
-
-    def update_registration(self, regr, update=None):
-        """Update registration.
-
-        :param messages.RegistrationResource regr: Registration Resource.
-        :param messages.Registration update: Updated body of the
-            resource. If not provided, body will be taken from `regr`.
-
-        :returns: Updated Registration Resource.
-        :rtype: `.RegistrationResource`
-
-        """
-        # https://github.com/certbot/certbot/issues/6155
-        new_regr = self._get_v2_account(regr)
-        return super(ClientV2, self).update_registration(new_regr, update)
-
-    def _get_v2_account(self, regr):
-        self.net.account = None
-        only_existing_reg = regr.body.update(only_return_existing=True)
-        response = self._post(self.directory['newAccount'], only_existing_reg)
-        updated_uri = response.headers['Location']
-        new_regr = regr.update(uri=updated_uri)
-        self.net.account = new_regr
-        return new_regr
-
-    def new_order(self, csr_pem):
-        """Request a new Order object from the server.
-
-        :param str csr_pem: A CSR in PEM format.
-
-        :returns: The newly created order.
-        :rtype: OrderResource
-        """
-        csr = OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-        # pylint: disable=protected-access
-        dnsNames = crypto_util._pyopenssl_cert_or_req_all_names(csr)
-
-        identifiers = []
-        for name in dnsNames:
-            identifiers.append(messages.Identifier(typ=messages.IDENTIFIER_FQDN,
-                value=name))
-        order = messages.NewOrder(identifiers=identifiers)
-        response = self._post(self.directory['newOrder'], order)
-        body = messages.Order.from_json(response.json())
-        authorizations = []
-        for url in body.authorizations:  # pylint: disable=not-an-iterable
-            authorizations.append(self._authzr_from_response(self._post_as_get(url), uri=url))
-        return messages.OrderResource(
-            body=body,
-            uri=response.headers.get('Location'),
-            authorizations=authorizations,
-            csr_pem=csr_pem)
-
-    def poll(self, authzr):
-        """Poll Authorization Resource for status.
-
-        :param authzr: Authorization Resource
-        :type authzr: `.AuthorizationResource`
-
-        :returns: Updated Authorization Resource and HTTP response.
-
-        :rtype: (`.AuthorizationResource`, `requests.Response`)
-
-        """
-        response = self._post_as_get(authzr.uri)
-        updated_authzr = self._authzr_from_response(
-            response, authzr.body.identifier, authzr.uri)
-        return updated_authzr, response
-
-    def poll_and_finalize(self, orderr, deadline=None):
-        """Poll authorizations and finalize the order.
-
-        If no deadline is provided, this method will timeout after 90
-        seconds.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        if deadline is None:
-            deadline = datetime.datetime.now() + datetime.timedelta(seconds=90)
-        orderr = self.poll_authorizations(orderr, deadline)
-        return self.finalize_order(orderr, deadline)
-
-    def poll_authorizations(self, orderr, deadline):
-        """Poll Order Resource for status."""
-        responses = []
-        for url in orderr.body.authorizations:
-            while datetime.datetime.now() < deadline:
-                authzr = self._authzr_from_response(self._post_as_get(url), uri=url)
-                if authzr.body.status != messages.STATUS_PENDING:
-                    responses.append(authzr)
-                    break
-                time.sleep(1)
-        # If we didn't get a response for every authorization, we fell through
-        # the bottom of the loop due to hitting the deadline.
-        if len(responses) < len(orderr.body.authorizations):
-            raise errors.TimeoutError()
-        failed = []
-        for authzr in responses:
-            if authzr.body.status != messages.STATUS_VALID:
-                for chall in authzr.body.challenges:
-                    if chall.error != None:
-                        failed.append(authzr)
-        if failed:
-            raise errors.ValidationError(failed)
-        return orderr.update(authorizations=responses)
-
-    def finalize_order(self, orderr, deadline):
-        """Finalize an order and obtain a certificate.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        csr = OpenSSL.crypto.load_certificate_request(
-            OpenSSL.crypto.FILETYPE_PEM, orderr.csr_pem)
-        wrapped_csr = messages.CertificateRequest(csr=jose.ComparableX509(csr))
-        self._post(orderr.body.finalize, wrapped_csr)
-        while datetime.datetime.now() < deadline:
-            time.sleep(1)
-            response = self._post_as_get(orderr.uri)
-            body = messages.Order.from_json(response.json())
-            if body.error is not None:
-                raise errors.IssuanceError(body.error)
-            if body.certificate is not None:
-                certificate_response = self._post_as_get(body.certificate).text
-                return orderr.update(body=body, fullchain_pem=certificate_response)
-        raise errors.TimeoutError()
-
-    def revoke(self, cert, rsn):
-        """Revoke certificate.
-
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
-
-        :param int rsn: Reason code for certificate revocation.
-
-        :raises .ClientError: If revocation is unsuccessful.
-
-        """
-        return self._revoke(cert, rsn, self.directory['revokeCert'])
-
-    def external_account_required(self):
-        """Checks if ACME server requires External Account Binding authentication."""
-        return hasattr(self.directory, 'meta') and self.directory.meta.external_account_required
-
-    def _post_as_get(self, *args, **kwargs):
-        """
-        Send GET request using the POST-as-GET protocol if needed.
-        The request will be first issued using POST-as-GET for ACME v2. If the ACME CA servers do
-        not support this yet and return an error, request will be retried using GET.
-        For ACME v1, only GET request will be tried, as POST-as-GET is not supported.
-        :param args:
-        :param kwargs:
-        :return:
-        """
-        if self.acme_version >= 2:
-            # We add an empty payload for POST-as-GET requests
-            new_args = args[:1] + (None,) + args[1:]
-            try:
-                return self._post(*new_args, **kwargs)
-            except messages.Error as error:
-                if error.code == 'malformed':
-                    logger.debug('Error during a POST-as-GET request, '
-                                 'your ACME CA server may not support it:\n%s', error)
-                    logger.debug('Retrying request with GET.')
-                else:  # pragma: no cover
-                    raise
-
-        # If POST-as-GET is not supported yet, we use a GET instead.
-        return self.net.get(*args, **kwargs)
-
-
-class BackwardsCompatibleClientV2(object):
-    """ACME client wrapper that tends towards V2-style calls, but
-    supports V1 servers.
-
-    .. note:: While this class handles the majority of the differences
-        between versions of the ACME protocol, if you need to support an
-        ACME server based on version 3 or older of the IETF ACME draft
-        that uses combinations in authorizations (or lack thereof) to
-        signal that the client needs to complete something other than
-        any single challenge in the authorization to make it valid, the
-        user of this class needs to understand and handle these
-        differences themselves.  This does not apply to either of Let's
-        Encrypt's endpoints where successfully completing any challenge
-        in an authorization will make it valid.
-
-    :ivar int acme_version: 1 or 2, corresponding to the Let's Encrypt endpoint
-    :ivar .ClientBase client: either Client or ClientV2
-    """
-
-    def __init__(self, net, key, server):
-        directory = messages.Directory.from_json(net.get(server).json())
-        self.acme_version = self._acme_version_from_directory(directory)
-        if self.acme_version == 1:
-            self.client = Client(directory, key=key, net=net)
-        else:
-            self.client = ClientV2(directory, net=net)
-
-    def __getattr__(self, name):
-        return getattr(self.client, name)
-
-    def new_account_and_tos(self, regr, check_tos_cb=None):
-        """Combined register and agree_tos for V1, new_account for V2
-
-        :param .NewRegistration regr:
-        :param callable check_tos_cb: callback that raises an error if
-            the check does not work
-        """
-        def _assess_tos(tos):
-            if check_tos_cb is not None:
-                check_tos_cb(tos)
-        if self.acme_version == 1:
-            regr = self.client.register(regr)
-            if regr.terms_of_service is not None:
-                _assess_tos(regr.terms_of_service)
-                return self.client.agree_to_tos(regr)
-            return regr
-        else:
-            if "terms_of_service" in self.client.directory.meta:
-                _assess_tos(self.client.directory.meta.terms_of_service)
-                regr = regr.update(terms_of_service_agreed=True)
-            return self.client.new_account(regr)
-
-    def new_order(self, csr_pem):
-        """Request a new Order object from the server.
-
-        If using ACMEv1, returns a dummy OrderResource with only
-        the authorizations field filled in.
-
-        :param str csr_pem: A CSR in PEM format.
-
-        :returns: The newly created order.
-        :rtype: OrderResource
-
-        :raises errors.WildcardUnsupportedError: if a wildcard domain is
-            requested but unsupported by the ACME version
-
-        """
-        if self.acme_version == 1:
-            csr = OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-            # pylint: disable=protected-access
-            dnsNames = crypto_util._pyopenssl_cert_or_req_all_names(csr)
-            authorizations = []
-            for domain in dnsNames:
-                authorizations.append(self.client.request_domain_challenges(domain))
-            return messages.OrderResource(authorizations=authorizations, csr_pem=csr_pem)
-        return self.client.new_order(csr_pem)
-
-    def finalize_order(self, orderr, deadline):
-        """Finalize an order and obtain a certificate.
-
-        :param messages.OrderResource orderr: order to finalize
-        :param datetime.datetime deadline: when to stop polling and timeout
-
-        :returns: finalized order
-        :rtype: messages.OrderResource
-
-        """
-        if self.acme_version == 1:
-            csr_pem = orderr.csr_pem
-            certr = self.client.request_issuance(
-                jose.ComparableX509(
-                    OpenSSL.crypto.load_certificate_request(OpenSSL.crypto.FILETYPE_PEM, csr_pem)),
-                    orderr.authorizations)
-
-            chain = None
-            while datetime.datetime.now() < deadline:
-                try:
-                    chain = self.client.fetch_chain(certr)
-                    break
-                except errors.Error:
-                    time.sleep(1)
-
-            if chain is None:
-                raise errors.TimeoutError(
-                    'Failed to fetch chain. You should not deploy the generated '
-                    'certificate, please rerun the command for a new one.')
-
-            cert = OpenSSL.crypto.dump_certificate(
-                    OpenSSL.crypto.FILETYPE_PEM, certr.body.wrapped).decode()
-            chain = crypto_util.dump_pyopenssl_chain(chain).decode()
-
-            return orderr.update(fullchain_pem=(cert + chain))
-        return self.client.finalize_order(orderr, deadline)
-
-    def revoke(self, cert, rsn):
-        """Revoke certificate.
-
-        :param .ComparableX509 cert: `OpenSSL.crypto.X509` wrapped in
-            `.ComparableX509`
-
-        :param int rsn: Reason code for certificate revocation.
-
-        :raises .ClientError: If revocation is unsuccessful.
-
-        """
-        return self.client.revoke(cert, rsn)
-
-    def _acme_version_from_directory(self, directory):
-        if hasattr(directory, 'newNonce'):
-            return 2
-        return 1
-
-    def external_account_required(self):
-        """Checks if the server requires an external account for ACMEv2 servers.
-
-        Always return False for ACMEv1 servers, as it doesn't use External Account Binding."""
-        if self.acme_version == 1:
-            return False
-        return self.client.external_account_required()
+        response = self.net.post(self.directory[messages.Revocation],
+                                 messages.Revocation(
+                                     certificate=cert,
+                                     reason=rsn),
+                                 content_type=None)
+        if response.status_code != http_client.OK:
+            raise errors.ClientError(
+                'Successful revocation must return HTTP OK status')
 
 
 class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
-    """Wrapper around requests that signs POSTs for authentication.
-
-    Also adds user agent, and handles Content-Type.
-    """
+    """Client network."""
     JSON_CONTENT_TYPE = 'application/json'
     JOSE_CONTENT_TYPE = 'application/jose+json'
     JSON_ERROR_CONTENT_TYPE = 'application/problem+json'
     REPLAY_NONCE_HEADER = 'Replay-Nonce'
 
-    """Initialize.
-
-    :param josepy.JWK key: Account private key
-    :param messages.RegistrationResource account: Account object. Required if you are
-            planning to use .post() with acme_version=2 for anything other than
-            creating a new account; may be set later after registering.
-    :param josepy.JWASignature alg: Algoritm to use in signing JWS.
-    :param bool verify_ssl: Whether to verify certificates on SSL connections.
-    :param str user_agent: String to send as User-Agent header.
-    :param float timeout: Timeout for requests.
-    :param source_address: Optional source address to bind to when making requests.
-    :type source_address: str or tuple(str, int)
-    """
-    def __init__(self, key, account=None, alg=jose.RS256, verify_ssl=True,
-                 user_agent='acme-python', timeout=DEFAULT_NETWORK_TIMEOUT,
-                 source_address=None):
-        # pylint: disable=too-many-arguments
+    def __init__(self, key, alg=jose.RS256, verify_ssl=True,
+                 user_agent='acme-python', timeout=DEFAULT_NETWORK_TIMEOUT):
         self.key = key
-        self.account = account
         self.alg = alg
         self.verify_ssl = verify_ssl
-        self._nonces = set() # type: Set[Text]
+        self._nonces = set()
         self.user_agent = user_agent
         self.session = requests.Session()
         self._default_timeout = timeout
-        adapter = HTTPAdapter()
-
-        if source_address is not None:
-            adapter = SourceAddressAdapter(source_address)
-
-        self.session.mount("http://", adapter)
-        self.session.mount("https://", adapter)
 
     def __del__(self):
         # Try to close the session, but don't show exceptions to the
@@ -997,31 +527,21 @@ class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
         except Exception:  # pylint: disable=broad-except
             pass
 
-    def _wrap_in_jws(self, obj, nonce, url, acme_version):
+    def _wrap_in_jws(self, obj, nonce):
         """Wrap `JSONDeSerializable` object in JWS.
 
         .. todo:: Implement ``acmePath``.
 
-        :param josepy.JSONDeSerializable obj:
-        :param str url: The URL to which this object will be POSTed
+        :param .JSONDeSerializable obj:
         :param bytes nonce:
-        :rtype: `josepy.JWS`
+        :rtype: `.JWS`
 
         """
-        jobj = obj.json_dumps(indent=2).encode() if obj else b''
+        jobj = obj.json_dumps(indent=2).encode()
         logger.debug('JWS payload:\n%s', jobj)
-        kwargs = {
-            "alg": self.alg,
-            "nonce": nonce
-        }
-        if acme_version == 2:
-            kwargs["url"] = url
-            # newAccount and revokeCert work without the kid
-            # newAccount must not have kid
-            if self.account is not None:
-                kwargs["kid"] = self.account["uri"]
-        kwargs["key"] = self.key
-        return jws.JWS.sign(jobj, **kwargs).json_dumps(indent=2)
+        return jws.JWS.sign(
+            payload=jobj, key=self.key, alg=self.alg,
+            nonce=nonce).json_dumps(indent=2)
 
     @classmethod
     def _check_response(cls, response, content_type=None):
@@ -1137,7 +657,7 @@ class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
         if response.headers.get("Content-Type") == DER_CONTENT_TYPE:
             debug_content = base64.b64encode(response.content)
         else:
-            debug_content = response.content.decode("utf-8")
+            debug_content = response.content
         logger.debug('Received response:\nHTTP %d\n%s\n\n%s',
                      response.status_code,
                      "\n".join(["{0}: {1}".format(k, v)
@@ -1172,15 +692,10 @@ class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
         else:
             raise errors.MissingNonce(response)
 
-    def _get_nonce(self, url, new_nonce_url):
+    def _get_nonce(self, url):
         if not self._nonces:
             logger.debug('Requesting fresh nonce')
-            if new_nonce_url is None:
-                response = self.head(url)
-            else:
-                # request a new nonce from the acme newNonce endpoint
-                response = self._check_response(self.head(new_nonce_url), content_type=None)
-            self._add_nonce(response)
+            self._add_nonce(self.head(url))
         return self._nonces.pop()
 
     def post(self, *args, **kwargs):
@@ -1199,12 +714,9 @@ class ClientNetwork(object):  # pylint: disable=too-many-instance-attributes
             else:
                 raise
 
-    def _post_once(self, url, obj, content_type=JOSE_CONTENT_TYPE,
-            acme_version=1, **kwargs):
-        new_nonce_url = kwargs.pop('new_nonce_url', None)
-        data = self._wrap_in_jws(obj, self._get_nonce(url, new_nonce_url), url, acme_version)
+    def _post_once(self, url, obj, content_type=JOSE_CONTENT_TYPE, **kwargs):
+        data = self._wrap_in_jws(obj, self._get_nonce(url))
         kwargs.setdefault('headers', {'Content-Type': content_type})
         response = self._send_request('POST', url, data=data, **kwargs)
-        response = self._check_response(response, content_type=content_type)
         self._add_nonce(response)
-        return response
+        return self._check_response(response, content_type=content_type)

acme/acme/client_test.py

@@ -1,6 +1,4 @@
 """Tests for acme.client."""
-# pylint: disable=too-many-lines
-import copy
 import datetime
 import json
 import unittest
@@ -9,7 +7,6 @@ from six.moves import http_client  # pylint: disable=import-error
 
 import josepy as jose
 import mock
-import OpenSSL
 import requests
 
 from acme import challenges
@@ -18,36 +15,16 @@ from acme import jws as acme_jws
 from acme import messages
 from acme import messages_test
 from acme import test_util
-from acme.magic_typing import Dict # pylint: disable=unused-import, no-name-in-module
 
 
 CERT_DER = test_util.load_vector('cert.der')
-CERT_SAN_PEM = test_util.load_vector('cert-san.pem')
-CSR_SAN_PEM = test_util.load_vector('csr-san.pem')
 KEY = jose.JWKRSA.load(test_util.load_vector('rsa512_key.pem'))
 KEY2 = jose.JWKRSA.load(test_util.load_vector('rsa256_key.pem'))
 
-DIRECTORY_V1 = messages.Directory({
-    messages.NewRegistration:
-        'https://www.letsencrypt-demo.org/acme/new-reg',
-    messages.Revocation:
-        'https://www.letsencrypt-demo.org/acme/revoke-cert',
-    messages.NewAuthorization:
-        'https://www.letsencrypt-demo.org/acme/new-authz',
-    messages.CertificateRequest:
-        'https://www.letsencrypt-demo.org/acme/new-cert',
-})
 
-DIRECTORY_V2 = messages.Directory({
-    'newAccount': 'https://www.letsencrypt-demo.org/acme/new-account',
-    'newNonce': 'https://www.letsencrypt-demo.org/acme/new-nonce',
-    'newOrder': 'https://www.letsencrypt-demo.org/acme/new-order',
-    'revokeCert': 'https://www.letsencrypt-demo.org/acme/revoke-cert',
-})
-
-
-class ClientTestBase(unittest.TestCase):
-    """Base for tests in acme.client."""
+class ClientTest(unittest.TestCase):
+    """Tests for  acme.client.Client."""
+    # pylint: disable=too-many-instance-attributes,too-many-public-methods
 
     def setUp(self):
         self.response = mock.MagicMock(
@@ -56,6 +33,21 @@ class ClientTestBase(unittest.TestCase):
         self.net.post.return_value = self.response
         self.net.get.return_value = self.response
 
+        self.directory = messages.Directory({
+            messages.NewRegistration:
+                'https://www.letsencrypt-demo.org/acme/new-reg',
+            messages.Revocation:
+                'https://www.letsencrypt-demo.org/acme/revoke-cert',
+            messages.NewAuthorization:
+                'https://www.letsencrypt-demo.org/acme/new-authz',
+            messages.CertificateRequest:
+                'https://www.letsencrypt-demo.org/acme/new-cert',
+        })
+
+        from acme.client import Client
+        self.client = Client(
+            directory=self.directory, key=KEY, alg=jose.RS256, net=self.net)
+
         self.identifier = messages.Identifier(
             typ=messages.IDENTIFIER_FQDN, value='example.com')
 
@@ -63,10 +55,10 @@ class ClientTestBase(unittest.TestCase):
         self.contact = ('mailto:cert-admin@example.com', 'tel:+12025551212')
         reg = messages.Registration(
             contact=self.contact, key=KEY.public_key())
-        the_arg = dict(reg) # type: Dict
-        self.new_reg = messages.NewRegistration(**the_arg)
+        self.new_reg = messages.NewRegistration(**dict(reg))
         self.regr = messages.RegistrationResource(
-            body=reg, uri='https://www.letsencrypt-demo.org/acme/reg/1')
+            body=reg, uri='https://www.letsencrypt-demo.org/acme/reg/1',
+            terms_of_service='https://www.letsencrypt-demo.org/tos')
 
         # Authorization
         authzr_uri = 'https://www.letsencrypt-demo.org/acme/authz/1'
@@ -83,261 +75,14 @@ class ClientTestBase(unittest.TestCase):
         self.authzr = messages.AuthorizationResource(
             body=self.authz, uri=authzr_uri)
 
-        # Reason code for revocation
-        self.rsn = 1
-
-
-class BackwardsCompatibleClientV2Test(ClientTestBase):
-    """Tests for  acme.client.BackwardsCompatibleClientV2."""
-
-    def setUp(self):
-        super(BackwardsCompatibleClientV2Test, self).setUp()
-        # contains a loaded cert
-        self.certr = messages.CertificateResource(
-            body=messages_test.CERT)
-
-        loaded = OpenSSL.crypto.load_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, CERT_SAN_PEM)
-        wrapped = jose.ComparableX509(loaded)
-        self.chain = [wrapped, wrapped]
-
-        self.cert_pem = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, messages_test.CERT.wrapped).decode()
-
-        single_chain = OpenSSL.crypto.dump_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, loaded).decode()
-        self.chain_pem = single_chain + single_chain
-
-        self.fullchain_pem = self.cert_pem + self.chain_pem
-
-        self.orderr = messages.OrderResource(
-            csr_pem=CSR_SAN_PEM)
-
-    def _init(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        from acme.client import BackwardsCompatibleClientV2
-        return BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-
-    def test_init_downloads_directory(self):
-        uri = 'http://www.letsencrypt-demo.org/directory'
-        from acme.client import BackwardsCompatibleClientV2
-        BackwardsCompatibleClientV2(net=self.net,
-            key=KEY, server=uri)
-        self.net.get.assert_called_once_with(uri)
-
-    def test_init_acme_version(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 1)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.assertEqual(client.acme_version, 2)
-
-    def test_query_registration_client_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        client = self._init()
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, client.query_registration(self.regr))
-
-    def test_forwarding(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        client = self._init()
-        self.assertEqual(client.directory, client.client.directory)
-        self.assertEqual(client.key, KEY)
-        self.assertEqual(client.deactivate_registration, client.client.deactivate_registration)
-        self.assertRaises(AttributeError, client.__getattr__, 'nonexistent')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account_and_tos')
-        self.assertRaises(AttributeError, client.__getattr__, 'new_account')
-
-    def test_new_account_and_tos(self):
-        # v2 no tos
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().new_account.assert_called_with(self.new_reg)
-
-        # v2 tos good
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            client.new_account_and_tos(self.new_reg, lambda x: True)
-            mock_client().new_account.assert_called_with(
-                self.new_reg.update(terms_of_service_agreed=True))
-
-        # v2 tos bad
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            mock_client().directory.meta.__contains__.return_value = True
-            client = self._init()
-            def _tos_cb(tos):
-                raise errors.Error
-            self.assertRaises(errors.Error, client.new_account_and_tos,
-                self.new_reg, _tos_cb)
-            mock_client().new_account.assert_not_called()
-
-        # v1 yes tos
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service="TOS")
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_called_once_with(regr)
-
-        # v1 no tos
-        with mock.patch('acme.client.Client') as mock_client:
-            regr = mock.MagicMock(terms_of_service=None)
-            mock_client().register.return_value = regr
-            client = self._init()
-            client.new_account_and_tos(self.new_reg)
-            mock_client().register.assert_called_once_with(self.new_reg)
-            mock_client().agree_to_tos.assert_not_called()
-
-    @mock.patch('OpenSSL.crypto.load_certificate_request')
-    @mock.patch('acme.crypto_util._pyopenssl_cert_or_req_all_names')
-    def test_new_order_v1(self, mock__pyopenssl_cert_or_req_all_names,
-        unused_mock_load_certificate_request):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        mock__pyopenssl_cert_or_req_all_names.return_value = ['example.com', 'www.example.com']
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.Client') as mock_client:
-            mock_client().request_domain_challenges.return_value = mock.sentinel.auth
-            client = self._init()
-            orderr = client.new_order(mock_csr_pem)
-            self.assertEqual(orderr.authorizations, [mock.sentinel.auth, mock.sentinel.auth])
-
-    def test_new_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_csr_pem = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.new_order(mock_csr_pem)
-            mock_client().new_order.assert_called_once_with(mock_csr_pem)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_success(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        mock_client().fetch_chain.assert_called_once_with(self.certr)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_fetch_chain_error(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-        mock_client().fetch_chain.return_value = self.chain
-        mock_client().fetch_chain.side_effect = [errors.Error, self.chain]
-
-        deadline = datetime.datetime(9999, 9, 9)
-        client = self._init()
-        result = client.finalize_order(self.orderr, deadline)
-        self.assertEqual(result.fullchain_pem, self.fullchain_pem)
-        self.assertEqual(mock_client().fetch_chain.call_count, 2)
-
-    @mock.patch('acme.client.Client')
-    def test_finalize_order_v1_timeout(self, mock_client):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-
-        mock_client().request_issuance.return_value = self.certr
-
-        deadline = deadline = datetime.datetime.now() - datetime.timedelta(seconds=60)
-        client = self._init()
-        self.assertRaises(errors.TimeoutError, client.finalize_order,
-            self.orderr, deadline)
-
-    def test_finalize_order_v2(self):
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        mock_orderr = mock.MagicMock()
-        mock_deadline = mock.MagicMock()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.finalize_order(mock_orderr, mock_deadline)
-            mock_client().finalize_order.assert_called_once_with(mock_orderr, mock_deadline)
-
-    def test_revoke(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-        self.response.json.return_value = DIRECTORY_V2.to_json()
-        with mock.patch('acme.client.ClientV2') as mock_client:
-            client = self._init()
-            client.revoke(messages_test.CERT, self.rsn)
-        mock_client().revoke.assert_called_once_with(messages_test.CERT, self.rsn)
-
-    def test_update_registration(self):
-        self.response.json.return_value = DIRECTORY_V1.to_json()
-        with mock.patch('acme.client.Client') as mock_client:
-            client = self._init()
-            client.update_registration(mock.sentinel.regr, None)
-        mock_client().update_registration.assert_called_once_with(mock.sentinel.regr, None)
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_true(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=True),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertTrue(client.external_account_required())
-
-    # newNonce present means it will pick acme_version 2
-    def test_external_account_required_false(self):
-        self.response.json.return_value = messages.Directory({
-            'newNonce': 'http://letsencrypt-test.com/acme/new-nonce',
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-    def test_external_account_required_false_v1(self):
-        self.response.json.return_value = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=False),
-        }).to_json()
-
-        client = self._init()
-
-        self.assertFalse(client.external_account_required())
-
-
-class ClientTest(ClientTestBase):
-    """Tests for acme.client.Client."""
-    # pylint: disable=too-many-instance-attributes,too-many-public-methods
-
-    def setUp(self):
-        super(ClientTest, self).setUp()
-
-        self.directory = DIRECTORY_V1
-
-        # Registration
-        self.regr = self.regr.update(
-            terms_of_service='https://www.letsencrypt-demo.org/tos')
-
         # Request issuance
         self.certr = messages.CertificateResource(
             body=messages_test.CERT, authzrs=(self.authzr,),
             uri='https://www.letsencrypt-demo.org/acme/cert/1',
             cert_chain_uri='https://www.letsencrypt-demo.org/ca')
 
-        from acme.client import Client
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=jose.RS256, net=self.net)
+        # Reason code for revocation
+        self.rsn = 1
 
     def test_init_downloads_directory(self):
         uri = 'http://www.letsencrypt-demo.org/directory'
@@ -346,18 +91,9 @@ class ClientTest(ClientTestBase):
             directory=uri, key=KEY, alg=jose.RS256, net=self.net)
         self.net.get.assert_called_once_with(uri)
 
-    @mock.patch('acme.client.ClientNetwork')
-    def test_init_without_net(self, mock_net):
-        mock_net.return_value = mock.sentinel.net
-        alg = jose.RS256
-        from acme.client import Client
-        self.client = Client(
-            directory=self.directory, key=KEY, alg=alg)
-        mock_net.called_once_with(KEY, alg=alg, verify_ssl=True)
-        self.assertEqual(self.client.net, mock.sentinel.net)
-
     def test_register(self):
         # "Instance of 'Field' has no to_json/update member" bug:
+        # pylint: disable=no-member
         self.response.status_code = http_client.CREATED
         self.response.json.return_value = self.regr.body.to_json()
         self.response.headers['Location'] = self.regr.uri
@@ -370,6 +106,7 @@ class ClientTest(ClientTestBase):
 
     def test_update_registration(self):
         # "Instance of 'Field' has no to_json/update member" bug:
+        # pylint: disable=no-member
         self.response.headers['Location'] = self.regr.uri
         self.response.json.return_value = self.regr.body.to_json()
         self.assertEqual(self.regr, self.client.update_registration(self.regr))
@@ -405,23 +142,20 @@ class ClientTest(ClientTestBase):
         self.client.request_challenges(self.identifier)
         self.net.post.assert_called_once_with(
             self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
+            messages.NewAuthorization(identifier=self.identifier))
 
     def test_request_challenges_deprecated_arg(self):
         self._prepare_response_for_request_challenges()
         self.client.request_challenges(self.identifier, new_authzr_uri="hi")
         self.net.post.assert_called_once_with(
             self.directory.new_authz,
-            messages.NewAuthorization(identifier=self.identifier),
-            acme_version=1)
+            messages.NewAuthorization(identifier=self.identifier))
 
     def test_request_challenges_custom_uri(self):
         self._prepare_response_for_request_challenges()
         self.client.request_challenges(self.identifier)
         self.net.post.assert_called_once_with(
-            'https://www.letsencrypt-demo.org/acme/new-authz', mock.ANY,
-            acme_version=1)
+            'https://www.letsencrypt-demo.org/acme/new-authz', mock.ANY)
 
     def test_request_challenges_unexpected_update(self):
         self._prepare_response_for_request_challenges()
@@ -431,13 +165,6 @@ class ClientTest(ClientTestBase):
             errors.UnexpectedUpdate, self.client.request_challenges,
             self.identifier)
 
-    def test_request_challenges_wildcard(self):
-        wildcard_identifier = messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value='*.example.org')
-        self.assertRaises(
-            errors.WildcardUnsupportedError, self.client.request_challenges,
-            wildcard_identifier)
-
     def test_request_domain_challenges(self):
         self.client.request_challenges = mock.MagicMock()
         self.assertEqual(
@@ -637,14 +364,6 @@ class ClientTest(ClientTestBase):
             errors.PollError, self.client.poll_and_request_issuance,
             csr, authzrs, mintime=mintime, max_attempts=2)
 
-    def test_deactivate_authorization(self):
-        authzb = self.authzr.body.update(status=messages.STATUS_DEACTIVATED)
-        self.response.json.return_value = authzb.to_json()
-        authzr = self.client.deactivate_authorization(self.authzr)
-        self.assertEqual(authzb, authzr.body)
-        self.assertEqual(self.client.net.post.call_count, 1)
-        self.assertTrue(self.authzr.uri in self.net.post.call_args_list[0][0])
-
     def test_check_cert(self):
         self.response.headers['Location'] = self.certr.uri
         self.response.content = CERT_DER
@@ -698,12 +417,12 @@ class ClientTest(ClientTestBase):
     def test_revoke(self):
         self.client.revoke(self.certr.body, self.rsn)
         self.net.post.assert_called_once_with(
-            self.directory[messages.Revocation], mock.ANY, acme_version=1)
+            self.directory[messages.Revocation], mock.ANY, content_type=None)
 
     def test_revocation_payload(self):
         obj = messages.Revocation(certificate=self.certr.body, reason=self.rsn)
         self.assertTrue('reason' in obj.to_partial_json().keys())
-        self.assertEqual(self.rsn, obj.to_partial_json()['reason'])
+        self.assertEquals(self.rsn, obj.to_partial_json()['reason'])
 
     def test_revoke_bad_status_raises_error(self):
         self.response.status_code = http_client.METHOD_NOT_ALLOWED
@@ -714,210 +433,8 @@ class ClientTest(ClientTestBase):
             self.rsn)
 
 
-class ClientV2Test(ClientTestBase):
-    """Tests for acme.client.ClientV2."""
-
-    def setUp(self):
-        super(ClientV2Test, self).setUp()
-
-        self.directory = DIRECTORY_V2
-
-        from acme.client import ClientV2
-        self.client = ClientV2(self.directory, self.net)
-
-        self.new_reg = self.new_reg.update(terms_of_service_agreed=True)
-
-        self.authzr_uri2 = 'https://www.letsencrypt-demo.org/acme/authz/2'
-        self.authz2 = self.authz.update(identifier=messages.Identifier(
-            typ=messages.IDENTIFIER_FQDN, value='www.example.com'),
-            status=messages.STATUS_PENDING)
-        self.authzr2 = messages.AuthorizationResource(
-            body=self.authz2, uri=self.authzr_uri2)
-
-        self.order = messages.Order(
-            identifiers=(self.authz.identifier, self.authz2.identifier),
-            status=messages.STATUS_PENDING,
-            authorizations=(self.authzr.uri, self.authzr_uri2),
-            finalize='https://www.letsencrypt-demo.org/acme/acct/1/order/1/finalize')
-        self.orderr = messages.OrderResource(
-            body=self.order,
-            uri='https://www.letsencrypt-demo.org/acme/acct/1/order/1',
-            authorizations=[self.authzr, self.authzr2], csr_pem=CSR_SAN_PEM)
-
-    def test_new_account(self):
-        self.response.status_code = http_client.CREATED
-        self.response.json.return_value = self.regr.body.to_json()
-        self.response.headers['Location'] = self.regr.uri
-
-        self.assertEqual(self.regr, self.client.new_account(self.new_reg))
-
-    def test_new_account_conflict(self):
-        self.response.status_code = http_client.OK
-        self.response.headers['Location'] = self.regr.uri
-        self.assertRaises(errors.ConflictError, self.client.new_account, self.new_reg)
-
-    def test_new_order(self):
-        order_response = copy.deepcopy(self.response)
-        order_response.status_code = http_client.CREATED
-        order_response.json.return_value = self.order.to_json()
-        order_response.headers['Location'] = self.orderr.uri
-        self.net.post.return_value = order_response
-
-        authz_response = copy.deepcopy(self.response)
-        authz_response.json.return_value = self.authz.to_json()
-        authz_response.headers['Location'] = self.authzr.uri
-        authz_response2 = self.response
-        authz_response2.json.return_value = self.authz2.to_json()
-        authz_response2.headers['Location'] = self.authzr2.uri
-
-        with mock.patch('acme.client.ClientV2._post_as_get') as mock_post_as_get:
-            mock_post_as_get.side_effect = (authz_response, authz_response2)
-            self.assertEqual(self.client.new_order(CSR_SAN_PEM), self.orderr)
-
-    @mock.patch('acme.client.datetime')
-    def test_poll_and_finalize(self, mock_datetime):
-        mock_datetime.datetime.now.return_value = datetime.datetime(2018, 2, 15)
-        mock_datetime.timedelta = datetime.timedelta
-        expected_deadline = mock_datetime.datetime.now() + datetime.timedelta(seconds=90)
-
-        self.client.poll_authorizations = mock.Mock(return_value=self.orderr)
-        self.client.finalize_order = mock.Mock(return_value=self.orderr)
-
-        self.assertEqual(self.client.poll_and_finalize(self.orderr), self.orderr)
-        self.client.poll_authorizations.assert_called_once_with(self.orderr, expected_deadline)
-        self.client.finalize_order.assert_called_once_with(self.orderr, expected_deadline)
-
-    @mock.patch('acme.client.datetime')
-    def test_poll_authorizations_timeout(self, mock_datetime):
-        now_side_effect = [datetime.datetime(2018, 2, 15),
-                           datetime.datetime(2018, 2, 16),
-                           datetime.datetime(2018, 2, 17)]
-        mock_datetime.datetime.now.side_effect = now_side_effect
-        self.response.json.side_effect = [
-            self.authz.to_json(), self.authz2.to_json(), self.authz2.to_json()]
-
-        self.assertRaises(
-            errors.TimeoutError, self.client.poll_authorizations, self.orderr, now_side_effect[1])
-
-    def test_poll_authorizations_failure(self):
-        deadline = datetime.datetime(9999, 9, 9)
-        challb = self.challr.body.update(status=messages.STATUS_INVALID,
-                                         error=messages.Error.with_code('unauthorized'))
-        authz = self.authz.update(status=messages.STATUS_INVALID, challenges=(challb,))
-        self.response.json.return_value = authz.to_json()
-
-        self.assertRaises(
-            errors.ValidationError, self.client.poll_authorizations, self.orderr, deadline)
-
-    def test_poll_authorizations_success(self):
-        deadline = datetime.datetime(9999, 9, 9)
-        updated_authz2 = self.authz2.update(status=messages.STATUS_VALID)
-        updated_authzr2 = messages.AuthorizationResource(
-            body=updated_authz2, uri=self.authzr_uri2)
-        updated_orderr = self.orderr.update(authorizations=[self.authzr, updated_authzr2])
-
-        self.response.json.side_effect = (
-            self.authz.to_json(), self.authz2.to_json(), updated_authz2.to_json())
-        self.assertEqual(self.client.poll_authorizations(self.orderr, deadline), updated_orderr)
-
-    def test_finalize_order_success(self):
-        updated_order = self.order.update(
-            certificate='https://www.letsencrypt-demo.org/acme/cert/')
-        updated_orderr = self.orderr.update(body=updated_order, fullchain_pem=CERT_SAN_PEM)
-
-        self.response.json.return_value = updated_order.to_json()
-        self.response.text = CERT_SAN_PEM
-
-        deadline = datetime.datetime(9999, 9, 9)
-        self.assertEqual(self.client.finalize_order(self.orderr, deadline), updated_orderr)
-
-    def test_finalize_order_error(self):
-        updated_order = self.order.update(error=messages.Error.with_code('unauthorized'))
-        self.response.json.return_value = updated_order.to_json()
-
-        deadline = datetime.datetime(9999, 9, 9)
-        self.assertRaises(errors.IssuanceError, self.client.finalize_order, self.orderr, deadline)
-
-    def test_finalize_order_timeout(self):
-        deadline = datetime.datetime.now() - datetime.timedelta(seconds=60)
-        self.assertRaises(errors.TimeoutError, self.client.finalize_order, self.orderr, deadline)
-
-    def test_revoke(self):
-        self.client.revoke(messages_test.CERT, self.rsn)
-        self.net.post.assert_called_once_with(
-            self.directory["revokeCert"], mock.ANY, acme_version=2,
-            new_nonce_url=DIRECTORY_V2['newNonce'])
-
-    def test_update_registration(self):
-        # "Instance of 'Field' has no to_json/update member" bug:
-        self.response.headers['Location'] = self.regr.uri
-        self.response.json.return_value = self.regr.body.to_json()
-        self.assertEqual(self.regr, self.client.update_registration(self.regr))
-        self.assertNotEqual(self.client.net.account, None)
-        self.assertEqual(self.client.net.post.call_count, 2)
-        self.assertTrue(DIRECTORY_V2.newAccount in self.net.post.call_args_list[0][0])
-
-        self.response.json.return_value = self.regr.body.update(
-            contact=()).to_json()
-
-    def test_external_account_required_true(self):
-        self.client.directory = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=True)
-        })
-
-        self.assertTrue(self.client.external_account_required())
-
-    def test_external_account_required_false(self):
-        self.client.directory = messages.Directory({
-            'meta': messages.Directory.Meta(external_account_required=False)
-        })
-
-        self.assertFalse(self.client.external_account_required())
-
-    def test_external_account_required_default(self):
-        self.assertFalse(self.client.external_account_required())
-
-    def test_post_as_get(self):
-        with mock.patch('acme.client.ClientV2._authzr_from_response') as mock_client:
-            mock_client.return_value = self.authzr2
-
-            self.client.poll(self.authzr2)  # pylint: disable=protected-access
-
-            self.client.net.post.assert_called_once_with(
-                self.authzr2.uri, None, acme_version=2,
-                new_nonce_url='https://www.letsencrypt-demo.org/acme/new-nonce')
-            self.client.net.get.assert_not_called()
-
-            class FakeError(messages.Error):  # pylint: disable=too-many-ancestors
-                """Fake error to reproduce a malformed request ACME error"""
-                def __init__(self):  # pylint: disable=super-init-not-called
-                    pass
-                @property
-                def code(self):
-                    return 'malformed'
-            self.client.net.post.side_effect = FakeError()
-
-            self.client.poll(self.authzr2)  # pylint: disable=protected-access
-
-            self.client.net.get.assert_called_once_with(self.authzr2.uri)
-
-
-class MockJSONDeSerializable(jose.JSONDeSerializable):
-    # pylint: disable=missing-docstring
-    def __init__(self, value):
-        self.value = value
-
-    def to_partial_json(self):
-        return {'foo': self.value}
-
-    @classmethod
-    def from_json(cls, jobj):
-        pass  # pragma: no cover
-
-
 class ClientNetworkTest(unittest.TestCase):
     """Tests for acme.client.ClientNetwork."""
-    # pylint: disable=too-many-public-methods
 
     def setUp(self):
         self.verify_ssl = mock.MagicMock()
@@ -936,25 +453,24 @@ class ClientNetworkTest(unittest.TestCase):
         self.assertTrue(self.net.verify_ssl is self.verify_ssl)
 
     def test_wrap_in_jws(self):
-        # pylint: disable=protected-access
-        jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=1)
-        jws = acme_jws.JWS.json_loads(jws_dump)
-        self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
-        self.assertEqual(jws.signature.combined.nonce, b'Tg')
+        class MockJSONDeSerializable(jose.JSONDeSerializable):
+            # pylint: disable=missing-docstring
+            def __init__(self, value):
+                self.value = value
+
+            def to_partial_json(self):
+                return {'foo': self.value}
+
+            @classmethod
+            def from_json(cls, value):
+                pass  # pragma: no cover
 
-    def test_wrap_in_jws_v2(self):
-        self.net.account = {'uri': 'acct-uri'}
         # pylint: disable=protected-access
         jws_dump = self.net._wrap_in_jws(
-            MockJSONDeSerializable('foo'), nonce=b'Tg', url="url",
-            acme_version=2)
+            MockJSONDeSerializable('foo'), nonce=b'Tg')
         jws = acme_jws.JWS.json_loads(jws_dump)
         self.assertEqual(json.loads(jws.payload.decode()), {'foo': 'foo'})
         self.assertEqual(jws.signature.combined.nonce, b'Tg')
-        self.assertEqual(jws.signature.combined.kid, u'acct-uri')
-        self.assertEqual(jws.signature.combined.url, u'url')
 
     def test_check_response_not_ok_jobj_no_error(self):
         self.response.ok = False
@@ -1118,8 +634,8 @@ class ClientNetworkTest(unittest.TestCase):
 
         # Requests Library Exceptions
         except requests.exceptions.ConnectionError as z: #pragma: no cover
-            self.assertTrue("'Connection aborted.'" in str(z) or "[WinError 10061]" in str(z))
-
+            self.assertEqual("('Connection aborted.', "
+                             "error(111, 'Connection refused'))", str(z))
 
 class ClientNetworkWithMockedResponseTest(unittest.TestCase):
     """Tests for acme.client.ClientNetwork which mock out response."""
@@ -1132,10 +648,7 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         self.response = mock.MagicMock(ok=True, status_code=http_client.OK)
         self.response.headers = {}
         self.response.links = {}
-        self.response.checked = False
-        self.acmev1_nonce_response = mock.MagicMock(ok=False,
-            status_code=http_client.METHOD_NOT_ALLOWED)
-        self.acmev1_nonce_response.headers = {}
+        self.checked_response = mock.MagicMock()
         self.obj = mock.MagicMock()
         self.wrapped_obj = mock.MagicMock()
         self.content_type = mock.sentinel.content_type
@@ -1147,21 +660,13 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
 
         def send_request(*args, **kwargs):
             # pylint: disable=unused-argument,missing-docstring
-            self.assertFalse("new_nonce_url" in kwargs)
-            method = args[0]
-            uri = args[1]
-            if method == 'HEAD' and uri != "new_nonce_uri":
-                response = self.acmev1_nonce_response
-            else:
-                response = self.response
-
             if self.available_nonces:
-                response.headers = {
+                self.response.headers = {
                     self.net.REPLAY_NONCE_HEADER:
                     self.available_nonces.pop().decode()}
             else:
-                response.headers = {}
-            return response
+                self.response.headers = {}
+            return self.response
 
         # pylint: disable=protected-access
         self.net._send_request = self.send_request = mock.MagicMock(
@@ -1173,47 +678,36 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         # pylint: disable=missing-docstring
         self.assertEqual(self.response, response)
         self.assertEqual(self.content_type, content_type)
-        self.assertTrue(self.response.ok)
-        self.response.checked = True
-        return self.response
+        return self.checked_response
 
     def test_head(self):
-        self.assertEqual(self.acmev1_nonce_response, self.net.head(
+        self.assertEqual(self.response, self.net.head(
             'http://example.com/', 'foo', bar='baz'))
         self.send_request.assert_called_once_with(
             'HEAD', 'http://example.com/', 'foo', bar='baz')
 
-    def test_head_v2(self):
-        self.assertEqual(self.response, self.net.head(
-            'new_nonce_uri', 'foo', bar='baz'))
-        self.send_request.assert_called_once_with(
-            'HEAD', 'new_nonce_uri', 'foo', bar='baz')
-
     def test_get(self):
-        self.assertEqual(self.response, self.net.get(
+        self.assertEqual(self.checked_response, self.net.get(
             'http://example.com/', content_type=self.content_type, bar='baz'))
-        self.assertTrue(self.response.checked)
         self.send_request.assert_called_once_with(
             'GET', 'http://example.com/', bar='baz')
 
     def test_post_no_content_type(self):
         self.content_type = self.net.JOSE_CONTENT_TYPE
-        self.assertEqual(self.response, self.net.post('uri', self.obj))
-        self.assertTrue(self.response.checked)
+        self.assertEqual(self.checked_response, self.net.post('uri', self.obj))
 
     def test_post(self):
         # pylint: disable=protected-access
-        self.assertEqual(self.response, self.net.post(
+        self.assertEqual(self.checked_response, self.net.post(
             'uri', self.obj, content_type=self.content_type))
-        self.assertTrue(self.response.checked)
         self.net._wrap_in_jws.assert_called_once_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()))
 
         self.available_nonces = []
         self.assertRaises(errors.MissingNonce, self.net.post,
                           'uri', self.obj, content_type=self.content_type)
         self.net._wrap_in_jws.assert_called_with(
-            self.obj, jose.b64decode(self.all_nonces.pop()), "uri", 1)
+            self.obj, jose.b64decode(self.all_nonces.pop()))
 
     def test_post_wrong_initial_nonce(self):  # HEAD
         self.available_nonces = [b'f', jose.b64encode(b'good')]
@@ -1237,7 +731,7 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
     def test_post_not_retried(self):
         check_response = mock.MagicMock()
         check_response.side_effect = [messages.Error.with_code('malformed'),
-                                      self.response]
+                                      self.checked_response]
 
         # pylint: disable=protected-access
         self.net._check_response = check_response
@@ -1245,12 +739,13 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
                           self.obj, content_type=self.content_type)
 
     def test_post_successful_retry(self):
-        post_once = mock.MagicMock()
-        post_once.side_effect = [messages.Error.with_code('badNonce'),
-                                      self.response]
+        check_response = mock.MagicMock()
+        check_response.side_effect = [messages.Error.with_code('badNonce'),
+                                      self.checked_response]
 
         # pylint: disable=protected-access
-        self.assertEqual(self.response, self.net.post(
+        self.net._check_response = check_response
+        self.assertEqual(self.checked_response, self.net.post(
             'uri', self.obj, content_type=self.content_type))
 
     def test_head_get_post_error_passthrough(self):
@@ -1261,51 +756,6 @@ class ClientNetworkWithMockedResponseTest(unittest.TestCase):
         self.assertRaises(requests.exceptions.RequestException,
                           self.net.post, 'uri', obj=self.obj)
 
-    def test_post_bad_nonce_head(self):
-        # pylint: disable=protected-access
-        # regression test for https://github.com/certbot/certbot/issues/6092
-        bad_response = mock.MagicMock(ok=False, status_code=http_client.SERVICE_UNAVAILABLE)
-        self.net._send_request = mock.MagicMock()
-        self.net._send_request.return_value = bad_response
-        self.content_type = None
-        check_response = mock.MagicMock()
-        self.net._check_response = check_response
-        self.assertRaises(errors.ClientError, self.net.post, 'uri',
-                          self.obj, content_type=self.content_type, acme_version=2,
-                          new_nonce_url='new_nonce_uri')
-        self.assertEqual(check_response.call_count, 1)
-
-    def test_new_nonce_uri_removed(self):
-        self.content_type = None
-        self.net.post('uri', self.obj, content_type=None,
-            acme_version=2, new_nonce_url='new_nonce_uri')
-
-
-class ClientNetworkSourceAddressBindingTest(unittest.TestCase):
-    """Tests that if ClientNetwork has a source IP set manually, the underlying library has
-    used the provided source address."""
-
-    def setUp(self):
-        self.source_address = "8.8.8.8"
-
-    def test_source_address_set(self):
-        from acme.client import ClientNetwork
-        net = ClientNetwork(key=None, alg=None, source_address=self.source_address)
-        for adapter in net.session.adapters.values():
-            self.assertTrue(self.source_address in adapter.source_address)
-
-    def test_behavior_assumption(self):
-        """This is a test that guardrails the HTTPAdapter behavior so that if the default for
-        a Session() changes, the assumptions here aren't violated silently."""
-        from acme.client import ClientNetwork
-        # Source address not specified, so the default adapter type should be bound -- this
-        # test should fail if the default adapter type is changed by requests
-        net = ClientNetwork(key=None, alg=None)
-        session = requests.Session()
-        for scheme in session.adapters.keys():
-            client_network_adapter = net.session.adapters.get(scheme)
-            default_adapter = session.adapters.get(scheme)
-            self.assertEqual(client_network_adapter.__class__, default_adapter.__class__)
 
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/crypto_util.py

@@ -5,27 +5,26 @@ import logging
 import os
 import re
 import socket
+import sys
 
-from OpenSSL import crypto
-from OpenSSL import SSL # type: ignore # https://github.com/python/typeshed/issues/2052
-import josepy as jose
+import OpenSSL
 
 from acme import errors
-# pylint: disable=unused-import, no-name-in-module
-from acme.magic_typing import Callable, Union, Tuple, Optional
-# pylint: enable=unused-import, no-name-in-module
 
 
 logger = logging.getLogger(__name__)
 
-# Default SSL method selected here is the most compatible, while secure
-# SSL method: TLSv1_METHOD is only compatible with
+# TLSSNI01 certificate serving and probing is not affected by SSL
+# vulnerabilities: prober needs to check certificate for expected
+# contents anyway. Working SNI is the only thing that's necessary for
+# the challenge and thus scoping down SSL/TLS method (version) would
+# cause interoperability issues: TLSv1_METHOD is only compatible with
 # TLSv1_METHOD, while SSLv23_METHOD is compatible with all other
 # methods, including TLSv2_METHOD (read more at
 # https://www.openssl.org/docs/ssl/SSLv23_method.html). _serve_sni
 # should be changed to use "set_options" to disable SSLv2 and SSLv3,
 # in case it's used for things other than probing/serving!
-_DEFAULT_SSL_METHOD = SSL.SSLv23_METHOD  # type: ignore
+_DEFAULT_TLSSNI01_SSL_METHOD = OpenSSL.SSL.SSLv23_METHOD  # type: ignore
 
 
 class SSLSocket(object):  # pylint: disable=too-few-public-methods
@@ -37,7 +36,7 @@ class SSLSocket(object):  # pylint: disable=too-few-public-methods
     :ivar method: See `OpenSSL.SSL.Context` for allowed values.
 
     """
-    def __init__(self, sock, certs, method=_DEFAULT_SSL_METHOD):
+    def __init__(self, sock, certs, method=_DEFAULT_TLSSNI01_SSL_METHOD):
         self.sock = sock
         self.certs = certs
         self.method = method
@@ -64,9 +63,9 @@ class SSLSocket(object):  # pylint: disable=too-few-public-methods
             logger.debug("Server name (%s) not recognized, dropping SSL",
                          server_name)
             return
-        new_context = SSL.Context(self.method)
-        new_context.set_options(SSL.OP_NO_SSLv2)
-        new_context.set_options(SSL.OP_NO_SSLv3)
+        new_context = OpenSSL.SSL.Context(self.method)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        new_context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         new_context.use_privatekey(key)
         new_context.use_certificate(cert)
         connection.set_context(new_context)
@@ -89,18 +88,18 @@ class SSLSocket(object):  # pylint: disable=too-few-public-methods
     def accept(self):  # pylint: disable=missing-docstring
         sock, addr = self.sock.accept()
 
-        context = SSL.Context(self.method)
-        context.set_options(SSL.OP_NO_SSLv2)
-        context.set_options(SSL.OP_NO_SSLv3)
+        context = OpenSSL.SSL.Context(self.method)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv2)
+        context.set_options(OpenSSL.SSL.OP_NO_SSLv3)
         context.set_tlsext_servername_callback(self._pick_certificate_cb)
 
-        ssl_sock = self.FakeConnection(SSL.Connection(context, sock))
+        ssl_sock = self.FakeConnection(OpenSSL.SSL.Connection(context, sock))
         ssl_sock.set_accept_state()
 
         logger.debug("Performing handshake with %s", addr)
         try:
             ssl_sock.do_handshake()
-        except SSL.Error as error:
+        except OpenSSL.SSL.Error as error:
             # _pick_certificate_cb might have returned without
             # creating SSL context (wrong server name)
             raise socket.error(error)
@@ -109,7 +108,7 @@ class SSLSocket(object):  # pylint: disable=too-few-public-methods
 
 
 def probe_sni(name, host, port=443, timeout=300,
-              method=_DEFAULT_SSL_METHOD, source_address=('', 0)):
+              method=_DEFAULT_TLSSNI01_SSL_METHOD, source_address=('', 0)):
     """Probe SNI server for SSL certificate.
 
     :param bytes name: Byte string to send as the server name in the
@@ -128,32 +127,31 @@ def probe_sni(name, host, port=443, timeout=300,
     :rtype: OpenSSL.crypto.X509
 
     """
-    context = SSL.Context(method)
+    context = OpenSSL.SSL.Context(method)
     context.set_timeout(timeout)
 
-    socket_kwargs = {'source_address': source_address}
+    socket_kwargs = {} if sys.version_info < (2, 7) else {
+        'source_address': source_address}
+
+    host_protocol_agnostic = None if host == '::' or host == '0' else host
 
     try:
-        logger.debug(
-            "Attempting to connect to %s:%d%s.", host, port,
-            " from {0}:{1}".format(
-                source_address[0],
-                source_address[1]
-            ) if socket_kwargs else ""
-        )
-        socket_tuple = (host, port)  # type: Tuple[str, int]
-        sock = socket.create_connection(socket_tuple, **socket_kwargs)  # type: ignore
+        # pylint: disable=star-args
+        logger.debug("Attempting to connect to %s:%d%s.", host_protocol_agnostic, port,
+            " from {0}:{1}".format(source_address[0], source_address[1]) if \
+            socket_kwargs else "")
+        sock = socket.create_connection((host_protocol_agnostic, port), **socket_kwargs)
     except socket.error as error:
         raise errors.Error(error)
 
     with contextlib.closing(sock) as client:
-        client_ssl = SSL.Connection(context, client)
+        client_ssl = OpenSSL.SSL.Connection(context, client)
         client_ssl.set_connect_state()
         client_ssl.set_tlsext_host_name(name)  # pyOpenSSL>=0.13
         try:
             client_ssl.do_handshake()
             client_ssl.shutdown()
-        except SSL.Error as error:
+        except OpenSSL.SSL.Error as error:
             raise errors.Error(error)
     return client_ssl.get_peer_certificate()
 
@@ -166,18 +164,18 @@ def make_csr(private_key_pem, domains, must_staple=False):
         OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
     :returns: buffer PEM-encoded Certificate Signing Request.
     """
-    private_key = crypto.load_privatekey(
-        crypto.FILETYPE_PEM, private_key_pem)
-    csr = crypto.X509Req()
+    private_key = OpenSSL.crypto.load_privatekey(
+        OpenSSL.crypto.FILETYPE_PEM, private_key_pem)
+    csr = OpenSSL.crypto.X509Req()
     extensions = [
-        crypto.X509Extension(
+        OpenSSL.crypto.X509Extension(
             b'subjectAltName',
             critical=False,
             value=', '.join('DNS:' + d for d in domains).encode('ascii')
         ),
     ]
     if must_staple:
-        extensions.append(crypto.X509Extension(
+        extensions.append(OpenSSL.crypto.X509Extension(
             b"1.3.6.1.5.5.7.1.24",
             critical=False,
             value=b"DER:30:03:02:01:05"))
@@ -185,16 +183,8 @@ def make_csr(private_key_pem, domains, must_staple=False):
     csr.set_pubkey(private_key)
     csr.set_version(2)
     csr.sign(private_key, 'sha256')
-    return crypto.dump_certificate_request(
-        crypto.FILETYPE_PEM, csr)
-
-def _pyopenssl_cert_or_req_all_names(loaded_cert_or_req):
-    common_name = loaded_cert_or_req.get_subject().CN
-    sans = _pyopenssl_cert_or_req_san(loaded_cert_or_req)
-
-    if common_name is None:
-        return sans
-    return [common_name] + [d for d in sans if d != common_name]
+    return OpenSSL.crypto.dump_certificate_request(
+        OpenSSL.crypto.FILETYPE_PEM, csr)
 
 def _pyopenssl_cert_or_req_san(cert_or_req):
     """Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
@@ -222,12 +212,11 @@ def _pyopenssl_cert_or_req_san(cert_or_req):
     parts_separator = ", "
     prefix = "DNS" + part_separator
 
-    if isinstance(cert_or_req, crypto.X509):
-        # pylint: disable=line-too-long
-        func = crypto.dump_certificate # type: Union[Callable[[int, crypto.X509Req], bytes], Callable[[int, crypto.X509], bytes]]
+    if isinstance(cert_or_req, OpenSSL.crypto.X509):
+        func = OpenSSL.crypto.dump_certificate
     else:
-        func = crypto.dump_certificate_request
-    text = func(crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
+        func = OpenSSL.crypto.dump_certificate_request
+    text = func(OpenSSL.crypto.FILETYPE_TEXT, cert_or_req).decode("utf-8")
     # WARNING: this function does not support multiple SANs extensions.
     # Multiple X509v3 extensions of the same type is disallowed by RFC 5280.
     match = re.search(r"X509v3 Subject Alternative Name:(?: critical)?\s*(.*)", text)
@@ -254,12 +243,12 @@ def gen_ss_cert(key, domains, not_before=None,
 
     """
     assert domains, "Must provide one or more hostnames for the cert."
-    cert = crypto.X509()
+    cert = OpenSSL.crypto.X509()
     cert.set_serial_number(int(binascii.hexlify(os.urandom(16)), 16))
     cert.set_version(2)
 
     extensions = [
-        crypto.X509Extension(
+        OpenSSL.crypto.X509Extension(
             b"basicConstraints", True, b"CA:TRUE, pathlen:0"),
     ]
 
@@ -268,7 +257,7 @@ def gen_ss_cert(key, domains, not_before=None,
     cert.set_issuer(cert.get_subject())
 
     if force_san or len(domains) > 1:
-        extensions.append(crypto.X509Extension(
+        extensions.append(OpenSSL.crypto.X509Extension(
             b"subjectAltName",
             critical=False,
             value=b", ".join(b"DNS:" + d.encode() for d in domains)
@@ -282,26 +271,3 @@ def gen_ss_cert(key, domains, not_before=None,
     cert.set_pubkey(key)
     cert.sign(key, "sha256")
     return cert
-
-def dump_pyopenssl_chain(chain, filetype=crypto.FILETYPE_PEM):
-    """Dump certificate chain into a bundle.
-
-    :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
-        :class:`josepy.util.ComparableX509`).
-
-    :returns: certificate chain bundle
-    :rtype: bytes
-
-    """
-    # XXX: returns empty string when no chain is available, which
-    # shuts up RenewableCert, but might not be the best solution...
-
-    def _dump_cert(cert):
-        if isinstance(cert, jose.ComparableX509):
-            # pylint: disable=protected-access
-            cert = cert.wrapped
-        return crypto.dump_certificate(filetype, cert)
-
-    # assumes that OpenSSL.crypto.dump_certificate includes ending
-    # newline character
-    return b"".join(_dump_cert(cert) for cert in chain)

acme/acme/crypto_util_test.py

@@ -13,7 +13,6 @@ import OpenSSL
 
 from acme import errors
 from acme import test_util
-from acme.magic_typing import List # pylint: disable=unused-import, no-name-in-module
 
 
 class SSLSocketAndProbeSNITest(unittest.TestCase):
@@ -42,62 +41,28 @@ class SSLSocketAndProbeSNITest(unittest.TestCase):
         self.server_thread = threading.Thread(
             # pylint: disable=no-member
             target=self.server.handle_request)
+        self.server_thread.start()
+        time.sleep(1)  # TODO: avoid race conditions in other way
 
     def tearDown(self):
-        if self.server_thread.is_alive():
-            # The thread may have already terminated.
-            self.server_thread.join()  # pragma: no cover
+        self.server_thread.join()
 
     def _probe(self, name):
         from acme.crypto_util import probe_sni
         return jose.ComparableX509(probe_sni(
             name, host='127.0.0.1', port=self.port))
 
-    def _start_server(self):
-        self.server_thread.start()
-        time.sleep(1)  # TODO: avoid race conditions in other way
-
     def test_probe_ok(self):
-        self._start_server()
         self.assertEqual(self.cert, self._probe(b'foo'))
 
     def test_probe_not_recognized_name(self):
-        self._start_server()
         self.assertRaises(errors.Error, self._probe, b'bar')
 
-    def test_probe_connection_error(self):
-        # pylint has a hard time with six
-        self.server.server_close()  # pylint: disable=no-member
-        original_timeout = socket.getdefaulttimeout()
-        try:
-            socket.setdefaulttimeout(1)
-            self.assertRaises(errors.Error, self._probe, b'bar')
-        finally:
-            socket.setdefaulttimeout(original_timeout)
-
-
-class PyOpenSSLCertOrReqAllNamesTest(unittest.TestCase):
-    """Test for acme.crypto_util._pyopenssl_cert_or_req_all_names."""
-
-    @classmethod
-    def _call(cls, loader, name):
-        # pylint: disable=protected-access
-        from acme.crypto_util import _pyopenssl_cert_or_req_all_names
-        return _pyopenssl_cert_or_req_all_names(loader(name))
-
-    def _call_cert(self, name):
-        return self._call(test_util.load_cert, name)
-
-    def test_cert_one_san_no_common(self):
-        self.assertEqual(self._call_cert('cert-nocn.der'),
-                         ['no-common-name.badssl.com'])
-
-    def test_cert_no_sans_yes_common(self):
-        self.assertEqual(self._call_cert('cert.pem'), ['example.com'])
-
-    def test_cert_two_sans_yes_common(self):
-        self.assertEqual(self._call_cert('cert-san.pem'),
-                         ['example.com', 'www.example.com'])
+    # TODO: py33/py34 tox hangs forever on do_handshake in second probe
+    #def probe_connection_error(self):
+    #    self._probe(b'foo')
+    #    #time.sleep(1)  # TODO: avoid race conditions in other way
+    #    self.assertRaises(errors.Error, self._probe, b'bar')
 
 
 class PyOpenSSLCertOrReqSANTest(unittest.TestCase):
@@ -176,7 +141,7 @@ class RandomSnTest(unittest.TestCase):
 
     def setUp(self):
         self.cert_count = 5
-        self.serial_num = [] # type: List[int]
+        self.serial_num = []
         self.key = OpenSSL.crypto.PKey()
         self.key.generate_key(OpenSSL.crypto.TYPE_RSA, 2048)
 
@@ -205,12 +170,12 @@ class MakeCSRTest(unittest.TestCase):
         self.assertTrue(b'--END CERTIFICATE REQUEST--' in csr_pem)
         csr = OpenSSL.crypto.load_certificate_request(
             OpenSSL.crypto.FILETYPE_PEM, csr_pem)
-        # In pyopenssl 0.13 (used with TOXENV=py27-oldest), csr objects don't
-        # have a get_extensions() method, so we skip this test if the method
-        # isn't available.
+        # In pyopenssl 0.13 (used with TOXENV=py26-oldest and py27-oldest), csr
+        # objects don't have a get_extensions() method, so we skip this test if
+        # the method isn't available.
         if hasattr(csr, 'get_extensions'):
-            self.assertEqual(len(csr.get_extensions()), 1)
-            self.assertEqual(csr.get_extensions()[0].get_data(),
+            self.assertEquals(len(csr.get_extensions()), 1)
+            self.assertEquals(csr.get_extensions()[0].get_data(),
                 OpenSSL.crypto.X509Extension(
                     b'subjectAltName',
                     critical=False,
@@ -223,11 +188,11 @@ class MakeCSRTest(unittest.TestCase):
         csr = OpenSSL.crypto.load_certificate_request(
             OpenSSL.crypto.FILETYPE_PEM, csr_pem)
 
-        # In pyopenssl 0.13 (used with TOXENV=py27-oldest), csr objects don't
-        # have a get_extensions() method, so we skip this test if the method
-        # isn't available.
+        # In pyopenssl 0.13 (used with TOXENV=py26-oldest and py27-oldest), csr
+        # objects don't have a get_extensions() method, so we skip this test if
+        # the method isn't available.
         if hasattr(csr, 'get_extensions'):
-            self.assertEqual(len(csr.get_extensions()), 2)
+            self.assertEquals(len(csr.get_extensions()), 2)
             # NOTE: Ideally we would filter by the TLS Feature OID, but
             # OpenSSL.crypto.X509Extension doesn't give us the extension's raw OID,
             # and the shortname field is just "UNDEF"
@@ -236,33 +201,5 @@ class MakeCSRTest(unittest.TestCase):
             self.assertEqual(len(must_staple_exts), 1,
                 "Expected exactly one Must Staple extension")
 
-
-class DumpPyopensslChainTest(unittest.TestCase):
-    """Test for dump_pyopenssl_chain."""
-
-    @classmethod
-    def _call(cls, loaded):
-        # pylint: disable=protected-access
-        from acme.crypto_util import dump_pyopenssl_chain
-        return dump_pyopenssl_chain(loaded)
-
-    def test_dump_pyopenssl_chain(self):
-        names = ['cert.pem', 'cert-san.pem', 'cert-idnsans.pem']
-        loaded = [test_util.load_cert(name) for name in names]
-        length = sum(
-            len(OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, cert))
-            for cert in loaded)
-        self.assertEqual(len(self._call(loaded)), length)
-
-    def test_dump_pyopenssl_chain_wrapped(self):
-        names = ['cert.pem', 'cert-san.pem', 'cert-idnsans.pem']
-        loaded = [test_util.load_cert(name) for name in names]
-        wrap_func = jose.ComparableX509
-        wrapped = [wrap_func(cert) for cert in loaded]
-        dump_func = OpenSSL.crypto.dump_certificate
-        length = sum(len(dump_func(OpenSSL.crypto.FILETYPE_PEM, cert)) for cert in loaded)
-        self.assertEqual(len(self._call(wrapped)), length)
-
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/errors.py

@@ -83,40 +83,13 @@ class PollError(ClientError):
         return '{0}(exhausted={1!r}, updated={2!r})'.format(
             self.__class__.__name__, self.exhausted, self.updated)
 
-class ValidationError(Error):
-    """Error for authorization failures. Contains a list of authorization
-    resources, each of which is invalid and should have an error field.
-    """
-    def __init__(self, failed_authzrs):
-        self.failed_authzrs = failed_authzrs
-        super(ValidationError, self).__init__()
-
-class TimeoutError(Error):
-    """Error for when polling an authorization or an order times out."""
-
-class IssuanceError(Error):
-    """Error sent by the server after requesting issuance of a certificate."""
-
-    def __init__(self, error):
-        """Initialize.
-
-        :param messages.Error error: The error provided by the server.
-        """
-        self.error = error
-        super(IssuanceError, self).__init__()
-
 class ConflictError(ClientError):
     """Error for when the server returns a 409 (Conflict) HTTP status.
 
     In the version of ACME implemented by Boulder, this is used to find an
     account if you only have the private key, but don't know the account URL.
-
-    Also used in V2 of the ACME client for the same purpose.
     """
     def __init__(self, location):
         self.location = location
         super(ConflictError, self).__init__()
 
-
-class WildcardUnsupportedError(Error):
-    """Error for when a wildcard is requested but is unsupported by ACME CA."""

acme/acme/jose_test.py

@@ -1,53 +0,0 @@
-"""Tests for acme.jose shim."""
-import importlib
-import unittest
-
-class JoseTest(unittest.TestCase):
-    """Tests for acme.jose shim."""
-
-    def _test_it(self, submodule, attribute):
-        if submodule:
-            acme_jose_path = 'acme.jose.' + submodule
-            josepy_path = 'josepy.' + submodule
-        else:
-            acme_jose_path = 'acme.jose'
-            josepy_path = 'josepy'
-        acme_jose_mod = importlib.import_module(acme_jose_path)
-        josepy_mod = importlib.import_module(josepy_path)
-
-        self.assertIs(acme_jose_mod, josepy_mod)
-        self.assertIs(getattr(acme_jose_mod, attribute), getattr(josepy_mod, attribute))
-
-        # We use the imports below with eval, but pylint doesn't
-        # understand that.
-        # pylint: disable=eval-used,unused-variable
-        import acme
-        import josepy
-        acme_jose_mod = eval(acme_jose_path)
-        josepy_mod = eval(josepy_path)
-        self.assertIs(acme_jose_mod, josepy_mod)
-        self.assertIs(getattr(acme_jose_mod, attribute), getattr(josepy_mod, attribute))
-
-    def test_top_level(self):
-        self._test_it('', 'RS512')
-
-    def test_submodules(self):
-        # This test ensures that the modules in josepy that were
-        # available at the time it was moved into its own package are
-        # available under acme.jose. Backwards compatibility with new
-        # modules or testing code is not maintained.
-        mods_and_attrs = [('b64', 'b64decode',),
-                          ('errors', 'Error',),
-                          ('interfaces', 'JSONDeSerializable',),
-                          ('json_util', 'Field',),
-                          ('jwa', 'HS256',),
-                          ('jwk', 'JWK',),
-                          ('jws', 'JWS',),
-                          ('util', 'ImmutableMap',),]
-
-        for mod, attr in mods_and_attrs:
-            self._test_it(mod, attr)
-
-
-if __name__ == '__main__':
-    unittest.main()  # pragma: no cover

acme/acme/magic_typing.py

@@ -1,16 +0,0 @@
-"""Shim class to not have to depend on typing module in prod."""
-import sys
-
-class TypingClass(object):
-    """Ignore import errors by getting anything"""
-    def __getattr__(self, name):
-        return None
-
-try:
-    # mypy doesn't respect modifying sys.modules
-    from typing import *  # pylint: disable=wildcard-import, unused-wildcard-import
-    # pylint: disable=unused-import
-    from typing import Collection, IO  # type: ignore
-    # pylint: enable=unused-import
-except ImportError:
-    sys.modules[__name__] = TypingClass()

acme/acme/magic_typing_test.py

@@ -1,41 +0,0 @@
-"""Tests for acme.magic_typing."""
-import sys
-import unittest
-
-import mock
-
-
-class MagicTypingTest(unittest.TestCase):
-    """Tests for acme.magic_typing."""
-    def test_import_success(self):
-        try:
-            import typing as temp_typing
-        except ImportError: # pragma: no cover
-            temp_typing = None # pragma: no cover
-        typing_class_mock = mock.MagicMock()
-        text_mock = mock.MagicMock()
-        typing_class_mock.Text = text_mock
-        sys.modules['typing'] = typing_class_mock
-        if 'acme.magic_typing' in sys.modules:
-            del sys.modules['acme.magic_typing'] # pragma: no cover
-        from acme.magic_typing import Text # pylint: disable=no-name-in-module
-        self.assertEqual(Text, text_mock)
-        del sys.modules['acme.magic_typing']
-        sys.modules['typing'] = temp_typing
-
-    def test_import_failure(self):
-        try:
-            import typing as temp_typing
-        except ImportError: # pragma: no cover
-            temp_typing = None # pragma: no cover
-        sys.modules['typing'] = None
-        if 'acme.magic_typing' in sys.modules:
-            del sys.modules['acme.magic_typing'] # pragma: no cover
-        from acme.magic_typing import Text # pylint: disable=no-name-in-module
-        self.assertTrue(Text is None)
-        del sys.modules['acme.magic_typing']
-        sys.modules['typing'] = temp_typing
-
-
-if __name__ == '__main__':
-    unittest.main()  # pragma: no cover

acme/acme/messages.py

@@ -1,10 +1,6 @@
 """ACME protocol messages."""
-import json
+import collections
 import six
-try:
-    from collections.abc import Hashable  # pylint: disable=no-name-in-module
-except ImportError:  # pragma: no cover
-    from collections import Hashable
 
 import josepy as jose
 
@@ -12,42 +8,25 @@ from acme import challenges
 from acme import errors
 from acme import fields
 from acme import util
-from acme import jws
 
 OLD_ERROR_PREFIX = "urn:acme:error:"
 ERROR_PREFIX = "urn:ietf:params:acme:error:"
 
 ERROR_CODES = {
-    'accountDoesNotExist': 'The request specified an account that does not exist',
-    'alreadyRevoked': 'The request specified a certificate to be revoked that has' \
-    ' already been revoked',
     'badCSR': 'The CSR is unacceptable (e.g., due to a short key)',
     'badNonce': 'The client sent an unacceptable anti-replay nonce',
-    'badPublicKey': 'The JWS was signed by a public key the server does not support',
-    'badRevocationReason': 'The revocation reason provided is not allowed by the server',
-    'badSignatureAlgorithm': 'The JWS was signed with an algorithm the server does not support',
-    'caa': 'Certification Authority Authorization (CAA) records forbid the CA from issuing' \
-    ' a certificate',
-    'compound': 'Specific error conditions are indicated in the "subproblems" array',
     'connection': ('The server could not connect to the client to verify the'
                    ' domain'),
-    'dns': 'There was a problem with a DNS query during identifier validation',
     'dnssec': 'The server could not validate a DNSSEC signed domain',
-    'incorrectResponse': 'Response recieved didn\'t match the challenge\'s requirements',
     # deprecate invalidEmail
     'invalidEmail': 'The provided email for a registration was invalid',
     'invalidContact': 'The provided contact URI was invalid',
     'malformed': 'The request message was malformed',
-    'rejectedIdentifier': 'The server will not issue certificates for the identifier',
-    'orderNotReady': 'The request attempted to finalize an order that is not ready to be finalized',
     'rateLimited': 'There were too many requests of a given type',
     'serverInternal': 'The server experienced an internal error',
     'tls': 'The server experienced a TLS error during domain verification',
     'unauthorized': 'The client lacks sufficient authorization',
-    'unsupportedContact': 'A contact URL for an account used an unsupported protocol scheme',
     'unknownHost': 'The server could not resolve a domain name',
-    'unsupportedIdentifier': 'An identifier is of an unsupported type',
-    'externalAccountRequired': 'The server requires external account binding',
 }
 
 ERROR_TYPE_DESCRIPTIONS = dict(
@@ -61,7 +40,8 @@ def is_acme_error(err):
     """Check if argument is an ACME error."""
     if isinstance(err, Error) and (err.typ is not None):
         return (ERROR_PREFIX in err.typ) or (OLD_ERROR_PREFIX in err.typ)
-    return False
+    else:
+        return False
 
 
 @six.python_2_unicode_compatible
@@ -116,7 +96,6 @@ class Error(jose.JSONObjectWithFields, errors.Error):
         code = str(self.typ).split(':')[-1]
         if code in ERROR_CODES:
             return code
-        return None
 
     def __str__(self):
         return b' :: '.join(
@@ -125,25 +104,24 @@ class Error(jose.JSONObjectWithFields, errors.Error):
             if part is not None).decode()
 
 
-class _Constant(jose.JSONDeSerializable, Hashable):  # type: ignore
+class _Constant(jose.JSONDeSerializable, collections.Hashable):  # type: ignore
     """ACME constant."""
     __slots__ = ('name',)
     POSSIBLE_NAMES = NotImplemented
 
     def __init__(self, name):
-        super(_Constant, self).__init__()
-        self.POSSIBLE_NAMES[name] = self  # pylint: disable=unsupported-assignment-operation
+        self.POSSIBLE_NAMES[name] = self
         self.name = name
 
     def to_partial_json(self):
         return self.name
 
     @classmethod
-    def from_json(cls, jobj):
-        if jobj not in cls.POSSIBLE_NAMES:  # pylint: disable=unsupported-membership-test
+    def from_json(cls, value):
+        if value not in cls.POSSIBLE_NAMES:
             raise jose.DeserializationError(
                 '{0} not recognized'.format(cls.__name__))
-        return cls.POSSIBLE_NAMES[jobj]  # pylint: disable=unsubscriptable-object
+        return cls.POSSIBLE_NAMES[value]
 
     def __repr__(self):
         return '{0}({1})'.format(self.__class__.__name__, self.name)
@@ -167,8 +145,6 @@ STATUS_PROCESSING = Status('processing')
 STATUS_VALID = Status('valid')
 STATUS_INVALID = Status('invalid')
 STATUS_REVOKED = Status('revoked')
-STATUS_READY = Status('ready')
-STATUS_DEACTIVATED = Status('deactivated')
 
 
 class IdentifierType(_Constant):
@@ -195,30 +171,9 @@ class Directory(jose.JSONDeSerializable):
 
     class Meta(jose.JSONObjectWithFields):
         """Directory Meta."""
-        _terms_of_service = jose.Field('terms-of-service', omitempty=True)
-        _terms_of_service_v2 = jose.Field('termsOfService', omitempty=True)
+        terms_of_service = jose.Field('terms-of-service', omitempty=True)
         website = jose.Field('website', omitempty=True)
-        caa_identities = jose.Field('caaIdentities', omitempty=True)
-        external_account_required = jose.Field('externalAccountRequired', omitempty=True)
-
-        def __init__(self, **kwargs):
-            kwargs = dict((self._internal_name(k), v) for k, v in kwargs.items())
-            super(Directory.Meta, self).__init__(**kwargs)
-
-        @property
-        def terms_of_service(self):
-            """URL for the CA TOS"""
-            return self._terms_of_service or self._terms_of_service_v2
-
-        def __iter__(self):
-            # When iterating over fields, use the external name 'terms_of_service' instead of
-            # the internal '_terms_of_service'.
-            for name in super(Directory.Meta, self).__iter__():
-                yield name[1:] if name == '_terms_of_service' else name
-
-        def _internal_name(self, name):
-            return '_' + name if name == 'terms_of_service' else name
-
+        caa_identities = jose.Field('caa-identities', omitempty=True)
 
     @classmethod
     def _canon_key(cls, key):
@@ -281,24 +236,6 @@ class ResourceBody(jose.JSONObjectWithFields):
     """ACME Resource Body."""
 
 
-class ExternalAccountBinding(object):
-    """ACME External Account Binding"""
-
-    @classmethod
-    def from_data(cls, account_public_key, kid, hmac_key, directory):
-        """Create External Account Binding Resource from contact details, kid and hmac."""
-
-        key_json = json.dumps(account_public_key.to_partial_json()).encode()
-        decoded_hmac_key = jose.b64.b64decode(hmac_key)
-        url = directory["newAccount"]
-
-        eab = jws.JWS.sign(key_json, jose.jwk.JWKOct(key=decoded_hmac_key),
-                           jose.jwa.HS256, None,
-                           url, kid)
-
-        return eab.to_partial_json()
-
-
 class Registration(ResourceBody):
     """Registration Resource Body.
 
@@ -314,31 +251,24 @@ class Registration(ResourceBody):
     contact = jose.Field('contact', omitempty=True, default=())
     agreement = jose.Field('agreement', omitempty=True)
     status = jose.Field('status', omitempty=True)
-    terms_of_service_agreed = jose.Field('termsOfServiceAgreed', omitempty=True)
-    only_return_existing = jose.Field('onlyReturnExisting', omitempty=True)
-    external_account_binding = jose.Field('externalAccountBinding', omitempty=True)
 
     phone_prefix = 'tel:'
     email_prefix = 'mailto:'
 
     @classmethod
-    def from_data(cls, phone=None, email=None, external_account_binding=None, **kwargs):
+    def from_data(cls, phone=None, email=None, **kwargs):
         """Create registration resource from contact details."""
         details = list(kwargs.pop('contact', ()))
         if phone is not None:
             details.append(cls.phone_prefix + phone)
         if email is not None:
-            details.extend([cls.email_prefix + mail for mail in email.split(',')])
+            details.append(cls.email_prefix + email)
         kwargs['contact'] = tuple(details)
-
-        if external_account_binding:
-            kwargs['external_account_binding'] = external_account_binding
-
         return cls(**kwargs)
 
     def _filter_contact(self, prefix):
         return tuple(
-            detail[len(prefix):] for detail in self.contact  # pylint: disable=not-an-iterable
+            detail[len(prefix):] for detail in self.contact
             if detail.startswith(prefix))
 
     @property
@@ -410,6 +340,7 @@ class ChallengeBody(ResourceBody):
 
     def __init__(self, **kwargs):
         kwargs = dict((self._internal_name(k), v) for k, v in kwargs.items())
+        # pylint: disable=star-args
         super(ChallengeBody, self).__init__(**kwargs)
 
     def encode(self, name):
@@ -472,7 +403,7 @@ class Authorization(ResourceBody):
     :ivar datetime.datetime expires:
 
     """
-    identifier = jose.Field('identifier', decoder=Identifier.from_json, omitempty=True)
+    identifier = jose.Field('identifier', decoder=Identifier.from_json)
     challenges = jose.Field('challenges', omitempty=True)
     combinations = jose.Field('combinations', omitempty=True)
 
@@ -482,7 +413,6 @@ class Authorization(ResourceBody):
     # be absent'... then acme-spec gives example with 'expires'
     # present... That's confusing!
     expires = fields.RFC3339Field('expires', omitempty=True)
-    wildcard = jose.Field('wildcard', omitempty=True)
 
     @challenges.decoder
     def challenges(value):  # pylint: disable=missing-docstring,no-self-argument
@@ -492,7 +422,7 @@ class Authorization(ResourceBody):
     def resolved_combinations(self):
         """Combinations with challenges instead of indices."""
         return tuple(tuple(self.challenges[idx] for idx in combo)
-                     for combo in self.combinations)  # pylint: disable=not-an-iterable
+                     for combo in self.combinations)
 
 
 @Directory.register
@@ -502,12 +432,6 @@ class NewAuthorization(Authorization):
     resource = fields.Resource(resource_type)
 
 
-class UpdateAuthorization(Authorization):
-    """Update authorization."""
-    resource_type = 'authz'
-    resource = fields.Resource(resource_type)
-
-
 class AuthorizationResource(ResourceWithURI):
     """Authorization Resource.
 
@@ -558,49 +482,3 @@ class Revocation(jose.JSONObjectWithFields):
     certificate = jose.Field(
         'certificate', decoder=jose.decode_cert, encoder=jose.encode_cert)
     reason = jose.Field('reason')
-
-
-class Order(ResourceBody):
-    """Order Resource Body.
-
-    :ivar list of .Identifier: List of identifiers for the certificate.
-    :ivar acme.messages.Status status:
-    :ivar list of str authorizations: URLs of authorizations.
-    :ivar str certificate: URL to download certificate as a fullchain PEM.
-    :ivar str finalize: URL to POST to to request issuance once all
-        authorizations have "valid" status.
-    :ivar datetime.datetime expires: When the order expires.
-    :ivar .Error error: Any error that occurred during finalization, if applicable.
-    """
-    identifiers = jose.Field('identifiers', omitempty=True)
-    status = jose.Field('status', decoder=Status.from_json,
-                        omitempty=True)
-    authorizations = jose.Field('authorizations', omitempty=True)
-    certificate = jose.Field('certificate', omitempty=True)
-    finalize = jose.Field('finalize', omitempty=True)
-    expires = fields.RFC3339Field('expires', omitempty=True)
-    error = jose.Field('error', omitempty=True, decoder=Error.from_json)
-
-    @identifiers.decoder
-    def identifiers(value):  # pylint: disable=missing-docstring,no-self-argument
-        return tuple(Identifier.from_json(identifier) for identifier in value)
-
-class OrderResource(ResourceWithURI):
-    """Order Resource.
-
-    :ivar acme.messages.Order body:
-    :ivar str csr_pem: The CSR this Order will be finalized with.
-    :ivar list of acme.messages.AuthorizationResource authorizations:
-        Fully-fetched AuthorizationResource objects.
-    :ivar str fullchain_pem: The fetched contents of the certificate URL
-        produced once the order was finalized, if it's present.
-    """
-    body = jose.Field('body', decoder=Order.from_json)
-    csr_pem = jose.Field('csr_pem', omitempty=True)
-    authorizations = jose.Field('authorizations')
-    fullchain_pem = jose.Field('fullchain_pem', omitempty=True)
-
-@Directory.register
-class NewOrder(Order):
-    """New order."""
-    resource_type = 'new-order'

acme/acme/messages_test.py

@@ -6,7 +6,6 @@ import mock
 
 from acme import challenges
 from acme import test_util
-from acme.magic_typing import Dict # pylint: disable=unused-import, no-name-in-module
 
 
 CERT = test_util.load_comparable_cert('cert.der')
@@ -86,7 +85,7 @@ class ConstantTest(unittest.TestCase):
         from acme.messages import _Constant
 
         class MockConstant(_Constant):  # pylint: disable=missing-docstring
-            POSSIBLE_NAMES = {} # type: Dict
+            POSSIBLE_NAMES = {}
 
         self.MockConstant = MockConstant  # pylint: disable=invalid-name
         self.const_a = MockConstant('a')
@@ -158,7 +157,7 @@ class DirectoryTest(unittest.TestCase):
             'meta': {
                 'terms-of-service': 'https://example.com/acme/terms',
                 'website': 'https://www.example.com/',
-                'caaIdentities': ['example.com'],
+                'caa-identities': ['example.com'],
             },
         })
 
@@ -166,31 +165,6 @@ class DirectoryTest(unittest.TestCase):
         from acme.messages import Directory
         Directory.from_json({'foo': 'bar'})
 
-    def test_iter_meta(self):
-        result = False
-        for k in self.dir.meta:
-            if k == 'terms_of_service':
-                result = self.dir.meta[k] == 'https://example.com/acme/terms'
-        self.assertTrue(result)
-
-
-class ExternalAccountBindingTest(unittest.TestCase):
-    def setUp(self):
-        from acme.messages import Directory
-        self.key = jose.jwk.JWKRSA(key=KEY.public_key())
-        self.kid = "kid-for-testing"
-        self.hmac_key = "hmac-key-for-testing"
-        self.dir = Directory({
-            'newAccount': 'http://url/acme/new-account',
-        })
-
-    def test_from_data(self):
-        from acme.messages import ExternalAccountBinding
-        eab = ExternalAccountBinding.from_data(self.key, self.kid, self.hmac_key, self.dir)
-
-        self.assertEqual(len(eab), 3)
-        self.assertEqual(sorted(eab.keys()), sorted(['protected', 'payload', 'signature']))
-
 
 class RegistrationTest(unittest.TestCase):
     """Tests for acme.messages.Registration."""
@@ -223,22 +197,6 @@ class RegistrationTest(unittest.TestCase):
             'mailto:admin@foo.com',
         ))
 
-    def test_new_registration_from_data_with_eab(self):
-        from acme.messages import NewRegistration, ExternalAccountBinding, Directory
-        key = jose.jwk.JWKRSA(key=KEY.public_key())
-        kid = "kid-for-testing"
-        hmac_key = "hmac-key-for-testing"
-        directory = Directory({
-            'newAccount': 'http://url/acme/new-account',
-        })
-        eab = ExternalAccountBinding.from_data(key, kid, hmac_key, directory)
-        reg = NewRegistration.from_data(email='admin@foo.com', external_account_binding=eab)
-        self.assertEqual(reg.contact, (
-            'mailto:admin@foo.com',
-        ))
-        self.assertEqual(sorted(reg.external_account_binding.keys()),
-                         sorted(['protected', 'payload', 'signature']))
-
     def test_phones(self):
         self.assertEqual(('1234',), self.reg.phones)
 
@@ -443,34 +401,5 @@ class RevocationTest(unittest.TestCase):
         hash(Revocation.from_json(self.rev.to_json()))
 
 
-class OrderResourceTest(unittest.TestCase):
-    """Tests for acme.messages.OrderResource."""
-
-    def setUp(self):
-        from acme.messages import OrderResource
-        self.regr = OrderResource(
-            body=mock.sentinel.body, uri=mock.sentinel.uri)
-
-    def test_to_partial_json(self):
-        self.assertEqual(self.regr.to_json(), {
-            'body': mock.sentinel.body,
-            'uri': mock.sentinel.uri,
-            'authorizations': None,
-        })
-
-class NewOrderTest(unittest.TestCase):
-    """Tests for acme.messages.NewOrder."""
-
-    def setUp(self):
-        from acme.messages import NewOrder
-        self.reg = NewOrder(
-            identifiers=mock.sentinel.identifiers)
-
-    def test_to_partial_json(self):
-        self.assertEqual(self.reg.to_json(), {
-            'identifiers': mock.sentinel.identifiers,
-        })
-
-
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover

acme/acme/standalone.py

@@ -16,8 +16,6 @@ import OpenSSL
 
 from acme import challenges
 from acme import crypto_util
-from acme.magic_typing import List # pylint: disable=unused-import, no-name-in-module
-from acme import _TLSSNI01DeprecationModule
 
 
 logger = logging.getLogger(__name__)
@@ -38,7 +36,7 @@ class TLSServer(socketserver.TCPServer):
         self.certs = kwargs.pop("certs", {})
         self.method = kwargs.pop(
             # pylint: disable=protected-access
-            "method", crypto_util._DEFAULT_SSL_METHOD)
+            "method", crypto_util._DEFAULT_TLSSNI01_SSL_METHOD)
         self.allow_reuse_address = kwargs.pop("allow_reuse_address", True)
         socketserver.TCPServer.__init__(self, *args, **kwargs)
 
@@ -68,8 +66,8 @@ class BaseDualNetworkedServers(object):
 
     def __init__(self, ServerClass, server_address, *remaining_args, **kwargs):
         port = server_address[1]
-        self.threads = [] # type: List[threading.Thread]
-        self.servers = [] # type: List[ACMEServerMixin]
+        self.threads = []
+        self.servers = []
 
         # Must try True first.
         # Ubuntu, for example, will fail to bind to IPv4 if we've already bound
@@ -83,29 +81,16 @@ class BaseDualNetworkedServers(object):
                 kwargs["ipv6"] = ip_version
                 new_address = (server_address[0],) + (port,) + server_address[2:]
                 new_args = (new_address,) + remaining_args
-                server = ServerClass(*new_args, **kwargs)
-                logger.debug(
-                    "Successfully bound to %s:%s using %s", new_address[0],
-                    new_address[1], "IPv6" if ip_version else "IPv4")
+                server = ServerClass(*new_args, **kwargs) # pylint: disable=star-args
             except socket.error:
-                if self.servers:
-                    # Already bound using IPv6.
-                    logger.debug(
-                        "Certbot wasn't able to bind to %s:%s using %s, this "
-                        "is often expected due to the dual stack nature of "
-                        "IPv6 socket implementations.",
-                        new_address[0], new_address[1],
-                        "IPv6" if ip_version else "IPv4")
-                else:
-                    logger.debug(
-                        "Failed to bind to %s:%s using %s", new_address[0],
-                        new_address[1], "IPv6" if ip_version else "IPv4")
+                logger.debug("Failed to bind to %s:%s using %s", new_address[0],
+                    new_address[1], "IPv6" if ip_version else "IPv4")
             else:
                 self.servers.append(server)
                 # If two servers are set up and port 0 was passed in, ensure we always
                 # bind to the same port for both servers.
                 port = server.socket.getsockname()[1]
-        if not self.servers:
+        if len(self.servers) == 0:
             raise socket.error("Could not bind to IPv4 or IPv6.")
 
     def serve_forever(self):
@@ -204,7 +189,7 @@ class HTTP01RequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
 
     def __init__(self, *args, **kwargs):
         self.simple_http_resources = kwargs.pop("simple_http_resources", set())
-        BaseHTTPServer.BaseHTTPRequestHandler.__init__(self, *args, **kwargs)
+        socketserver.BaseRequestHandler.__init__(self, *args, **kwargs)
 
     def log_message(self, format, *args):  # pylint: disable=redefined-builtin
         """Log arbitrary message."""
@@ -277,7 +262,7 @@ def simple_tls_sni_01_server(cli_args, forever=True):
 
     certs = {}
 
-    _, hosts, _ = next(os.walk('.')) # type: ignore # https://github.com/python/mypy/issues/465
+    _, hosts, _ = next(os.walk('.'))
     for host in hosts:
         with open(os.path.join(host, "cert.pem")) as cert_file:
             cert_contents = cert_file.read()
@@ -297,9 +282,5 @@ def simple_tls_sni_01_server(cli_args, forever=True):
         server.handle_request()
 
 
-# Patching ourselves to warn about TLS-SNI challenge deprecation and removal.
-sys.modules[__name__] = _TLSSNI01DeprecationModule(sys.modules[__name__])
-
-
 if __name__ == "__main__":
     sys.exit(simple_tls_sni_01_server(sys.argv))  # pragma: no cover

acme/acme/standalone_test.py

@@ -1,13 +1,11 @@
 """Tests for acme.standalone."""
-import multiprocessing
 import os
 import shutil
 import socket
 import threading
 import tempfile
-import unittest
 import time
-from contextlib import closing
+import unittest
 
 from six.moves import http_client  # pylint: disable=import-error
 from six.moves import socketserver  # type: ignore  # pylint: disable=import-error
@@ -20,7 +18,6 @@ from acme import challenges
 from acme import crypto_util
 from acme import errors
 from acme import test_util
-from acme.magic_typing import Set # pylint: disable=unused-import, no-name-in-module
 
 
 class TLSServerTest(unittest.TestCase):
@@ -31,14 +28,14 @@ class TLSServerTest(unittest.TestCase):
         from acme.standalone import TLSServer
         server = TLSServer(
             ('', 0), socketserver.BaseRequestHandler, bind_and_activate=True)
-        server.server_close()
+        server.server_close()  # pylint: disable=no-member
 
     def test_ipv6(self):
         if socket.has_ipv6:
             from acme.standalone import TLSServer
             server = TLSServer(
                 ('', 0), socketserver.BaseRequestHandler, bind_and_activate=True, ipv6=True)
-            server.server_close()
+            server.server_close()  # pylint: disable=no-member
 
 
 class TLSSNI01ServerTest(unittest.TestCase):
@@ -51,12 +48,13 @@ class TLSSNI01ServerTest(unittest.TestCase):
             test_util.load_cert('rsa2048_cert.pem'),
         )}
         from acme.standalone import TLSSNI01Server
-        self.server = TLSSNI01Server(('localhost', 0), certs=self.certs)
+        self.server = TLSSNI01Server(("", 0), certs=self.certs)
+        # pylint: disable=no-member
         self.thread = threading.Thread(target=self.server.serve_forever)
         self.thread.start()
 
     def tearDown(self):
-        self.server.shutdown()
+        self.server.shutdown()  # pylint: disable=no-member
         self.thread.join()
 
     def test_it(self):
@@ -74,17 +72,18 @@ class HTTP01ServerTest(unittest.TestCase):
     def setUp(self):
         self.account_key = jose.JWK.load(
             test_util.load_vector('rsa1024_key.pem'))
-        self.resources = set() # type: Set
+        self.resources = set()
 
         from acme.standalone import HTTP01Server
         self.server = HTTP01Server(('', 0), resources=self.resources)
 
+        # pylint: disable=no-member
         self.port = self.server.socket.getsockname()[1]
         self.thread = threading.Thread(target=self.server.serve_forever)
         self.thread.start()
 
     def tearDown(self):
-        self.server.shutdown()
+        self.server.shutdown()  # pylint: disable=no-member
         self.thread.join()
 
     def test_index(self):
@@ -134,10 +133,8 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
                 self.address_family = socket.AF_INET
             socketserver.TCPServer.__init__(self, *args, **kwargs)
             if ipv6:
-                # NB: On Windows, socket.IPPROTO_IPV6 constant may be missing.
-                # We use the corresponding value (41) instead.
-                level = getattr(socket, "IPPROTO_IPV6", 41)
-                self.socket.setsockopt(level, socket.IPV6_V6ONLY, 1)
+                # pylint: disable=no-member
+                self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
                 try:
                     self.server_bind()
                     self.server_activate()
@@ -150,15 +147,15 @@ class BaseDualNetworkedServersTest(unittest.TestCase):
         mock_bind.side_effect = socket.error
         from acme.standalone import BaseDualNetworkedServers
         self.assertRaises(socket.error, BaseDualNetworkedServers,
-                          BaseDualNetworkedServersTest.SingleProtocolServer,
-                          ('', 0),
-                          socketserver.BaseRequestHandler)
+            BaseDualNetworkedServersTest.SingleProtocolServer,
+            ("", 0),
+            socketserver.BaseRequestHandler)
 
     def test_ports_equal(self):
         from acme.standalone import BaseDualNetworkedServers
         servers = BaseDualNetworkedServers(
             BaseDualNetworkedServersTest.SingleProtocolServer,
-            ('', 0),
+            ("", 0),
             socketserver.BaseRequestHandler)
         socknames = servers.getsocknames()
         prev_port = None
@@ -180,7 +177,7 @@ class TLSSNI01DualNetworkedServersTest(unittest.TestCase):
             test_util.load_cert('rsa2048_cert.pem'),
         )}
         from acme.standalone import TLSSNI01DualNetworkedServers
-        self.servers = TLSSNI01DualNetworkedServers(('localhost', 0), certs=self.certs)
+        self.servers = TLSSNI01DualNetworkedServers(("", 0), certs=self.certs)
         self.servers.serve_forever()
 
     def tearDown(self):
@@ -204,11 +201,12 @@ class HTTP01DualNetworkedServersTest(unittest.TestCase):
     def setUp(self):
         self.account_key = jose.JWK.load(
             test_util.load_vector('rsa1024_key.pem'))
-        self.resources = set() # type: Set
+        self.resources = set()
 
         from acme.standalone import HTTP01DualNetworkedServers
         self.servers = HTTP01DualNetworkedServers(('', 0), resources=self.resources)
 
+        # pylint: disable=no-member
         self.port = self.servers.getsocknames()[0][1]
         self.servers.serve_forever()
 
@@ -261,45 +259,41 @@ class TestSimpleTLSSNI01Server(unittest.TestCase):
         shutil.copy(test_util.vector_path('rsa2048_key.pem'),
                     os.path.join(localhost_dir, 'key.pem'))
 
-        with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
-            sock.bind(('', 0))
-            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            self.port = sock.getsockname()[1]
-
         from acme.standalone import simple_tls_sni_01_server
-        self.process = multiprocessing.Process(target=simple_tls_sni_01_server,
-                                               args=(['path', '-p', str(self.port)],))
+        self.port = 1234
+        self.thread = threading.Thread(
+            target=simple_tls_sni_01_server, kwargs={
+                'cli_args': ('xxx', '--port', str(self.port)),
+                'forever': False,
+            },
+        )
         self.old_cwd = os.getcwd()
         os.chdir(self.test_cwd)
 
     def tearDown(self):
         os.chdir(self.old_cwd)
-        if self.process.is_alive():
-            self.process.terminate()
-            self.process.join(timeout=5)
-            # Check that we didn't timeout waiting for the process to
-            # terminate.
-            self.assertNotEqual(self.process.exitcode, None)
+        self.thread.join()
         shutil.rmtree(self.test_cwd)
 
-    @mock.patch('acme.standalone.TLSSNI01Server.handle_request')
-    def test_mock(self, handle):
-        from acme.standalone import simple_tls_sni_01_server
-        simple_tls_sni_01_server(cli_args=['path', '-p', str(self.port)], forever=False)
-        self.assertEqual(handle.call_count, 1)
-
-    def test_live(self):
-        self.process.start()
-        cert = None
-        for _ in range(50):
-            time.sleep(0.1)
+    def test_it(self):
+        max_attempts = 5
+        for attempt in range(max_attempts):
             try:
-                cert = crypto_util.probe_sni(b'localhost', b'127.0.0.1', self.port)
+                cert = crypto_util.probe_sni(
+                    b'localhost', b'0.0.0.0', self.port)
+            except errors.Error:
+                self.assertTrue(attempt + 1 < max_attempts, "Timeout!")
+                time.sleep(1)  # wait until thread starts
+            else:
+                self.assertEqual(jose.ComparableX509(cert),
+                                 test_util.load_comparable_cert(
+                                     'rsa2048_cert.pem'))
                 break
-            except errors.Error:  # pragma: no cover
-                pass
-        self.assertEqual(jose.ComparableX509(cert),
-                         test_util.load_comparable_cert('rsa2048_cert.pem'))
+
+            if attempt == 0:
+                # the first attempt is always meant to fail, so we can test
+                # the socket failure code-path for probe_sni, as well
+                self.thread.start()
 
 
 if __name__ == "__main__":

acme/acme/test_util.py

@@ -4,13 +4,13 @@
 
 """
 import os
-import unittest
 import pkg_resources
+import unittest
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 import josepy as jose
-from OpenSSL import crypto
+import OpenSSL
 
 
 def vector_path(*names):
@@ -39,8 +39,8 @@ def _guess_loader(filename, loader_pem, loader_der):
 def load_cert(*names):
     """Load certificate."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_certificate(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_certificate(loader, load_vector(*names))
 
 
 def load_comparable_cert(*names):
@@ -51,8 +51,8 @@ def load_comparable_cert(*names):
 def load_csr(*names):
     """Load certificate request."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_certificate_request(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_certificate_request(loader, load_vector(*names))
 
 
 def load_comparable_csr(*names):
@@ -71,8 +71,8 @@ def load_rsa_private_key(*names):
 def load_pyopenssl_private_key(*names):
     """Load pyOpenSSL private key."""
     loader = _guess_loader(
-        names[-1], crypto.FILETYPE_PEM, crypto.FILETYPE_ASN1)
-    return crypto.load_privatekey(loader, load_vector(*names))
+        names[-1], OpenSSL.crypto.FILETYPE_PEM, OpenSSL.crypto.FILETYPE_ASN1)
+    return OpenSSL.crypto.load_privatekey(loader, load_vector(*names))
 
 
 def skip_unless(condition, reason):  # pragma: no cover
@@ -92,4 +92,5 @@ def skip_unless(condition, reason):  # pragma: no cover
         return unittest.skipUnless(condition, reason)
     elif condition:
         return lambda cls: cls
-    return lambda cls: None
+    else:
+        return lambda cls: None

acme/docs/api/other.rst

@@ -0,0 +1,5 @@
+Other ACME objects
+------------------
+
+.. automodule:: acme.other
+   :members:

acme/docs/index.rst

@@ -16,6 +16,13 @@ Contents:
 .. automodule:: acme
    :members:
 
+
+Example client:
+
+.. include:: ../examples/example_client.py
+   :code: python
+
+
 Indices and tables
 ==================
 

acme/examples/example_client.py

@@ -0,0 +1,47 @@
+"""Example script showing how to use acme client API."""
+import logging
+import os
+import pkg_resources
+
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.asymmetric import rsa
+import josepy as jose
+import OpenSSL
+
+from acme import client
+from acme import messages
+
+
+logging.basicConfig(level=logging.DEBUG)
+
+
+DIRECTORY_URL = 'https://acme-staging.api.letsencrypt.org/directory'
+BITS = 2048  # minimum for Boulder
+DOMAIN = 'example1.com'  # example.com is ignored by Boulder
+
+# generate_private_key requires cryptography>=0.5
+key = jose.JWKRSA(key=rsa.generate_private_key(
+    public_exponent=65537,
+    key_size=BITS,
+    backend=default_backend()))
+acme = client.Client(DIRECTORY_URL, key)
+
+regr = acme.register()
+logging.info('Auto-accepting TOS: %s', regr.terms_of_service)
+acme.agree_to_tos(regr)
+logging.debug(regr)
+
+authzr = acme.request_challenges(
+    identifier=messages.Identifier(typ=messages.IDENTIFIER_FQDN, value=DOMAIN))
+logging.debug(authzr)
+
+authzr, authzr_response = acme.poll(authzr)
+
+csr = OpenSSL.crypto.load_certificate_request(
+    OpenSSL.crypto.FILETYPE_ASN1, pkg_resources.resource_string(
+        'acme', os.path.join('testdata', 'csr.der')))
+try:
+    acme.request_issuance(jose.util.ComparableX509(csr), (authzr,))
+except messages.Error as error:
+    print ("This script is doomed to fail as no authorization "
+           "challenges are ever solved. Error from server: {0}".format(error))

acme/examples/http01_example.py

@@ -1,240 +0,0 @@
-"""Example ACME-V2 API for HTTP-01 challenge.
-
-Brief:
-
-This a complete usage example of the python-acme API.
-
-Limitations of this example:
-    - Works for only one Domain name
-    - Performs only HTTP-01 challenge
-    - Uses ACME-v2
-
-Workflow:
-    (Account creation)
-    - Create account key
-    - Register account and accept TOS
-    (Certificate actions)
-    - Select HTTP-01 within offered challenges by the CA server
-    - Set up http challenge resource
-    - Set up standalone web server
-    - Create domain private key and CSR
-    - Issue certificate
-    - Renew certificate
-    - Revoke certificate
-    (Account update actions)
-    - Change contact information
-    - Deactivate Account
-"""
-from contextlib import contextmanager
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives.asymmetric import rsa
-import OpenSSL
-
-from acme import challenges
-from acme import client
-from acme import crypto_util
-from acme import errors
-from acme import messages
-from acme import standalone
-import josepy as jose
-
-# Constants:
-
-# This is the staging point for ACME-V2 within Let's Encrypt.
-DIRECTORY_URL = 'https://acme-staging-v02.api.letsencrypt.org/directory'
-
-USER_AGENT = 'python-acme-example'
-
-# Account key size
-ACC_KEY_BITS = 2048
-
-# Certificate private key size
-CERT_PKEY_BITS = 2048
-
-# Domain name for the certificate.
-DOMAIN = 'client.example.com'
-
-# If you are running Boulder locally, it is possible to configure any port
-# number to execute the challenge, but real CA servers will always use port
-# 80, as described in the ACME specification.
-PORT = 80
-
-
-# Useful methods and classes:
-
-
-def new_csr_comp(domain_name, pkey_pem=None):
-    """Create certificate signing request."""
-    if pkey_pem is None:
-        # Create private key.
-        pkey = OpenSSL.crypto.PKey()
-        pkey.generate_key(OpenSSL.crypto.TYPE_RSA, CERT_PKEY_BITS)
-        pkey_pem = OpenSSL.crypto.dump_privatekey(OpenSSL.crypto.FILETYPE_PEM,
-                                                  pkey)
-    csr_pem = crypto_util.make_csr(pkey_pem, [domain_name])
-    return pkey_pem, csr_pem
-
-
-def select_http01_chall(orderr):
-    """Extract authorization resource from within order resource."""
-    # Authorization Resource: authz.
-    # This object holds the offered challenges by the server and their status.
-    authz_list = orderr.authorizations
-
-    for authz in authz_list:
-        # Choosing challenge.
-        # authz.body.challenges is a set of ChallengeBody objects.
-        for i in authz.body.challenges:
-            # Find the supported challenge.
-            if isinstance(i.chall, challenges.HTTP01):
-                return i
-
-    raise Exception('HTTP-01 challenge was not offered by the CA server.')
-
-
-@contextmanager
-def challenge_server(http_01_resources):
-    """Manage standalone server set up and shutdown."""
-
-    # Setting up a fake server that binds at PORT and any address.
-    address = ('', PORT)
-    try:
-        servers = standalone.HTTP01DualNetworkedServers(address,
-                                                        http_01_resources)
-        # Start client standalone web server.
-        servers.serve_forever()
-        yield servers
-    finally:
-        # Shutdown client web server and unbind from PORT
-        servers.shutdown_and_server_close()
-
-
-def perform_http01(client_acme, challb, orderr):
-    """Set up standalone webserver and perform HTTP-01 challenge."""
-
-    response, validation = challb.response_and_validation(client_acme.net.key)
-
-    resource = standalone.HTTP01RequestHandler.HTTP01Resource(
-        chall=challb.chall, response=response, validation=validation)
-
-    with challenge_server({resource}):
-        # Let the CA server know that we are ready for the challenge.
-        client_acme.answer_challenge(challb, response)
-
-        # Wait for challenge status and then issue a certificate.
-        # It is possible to set a deadline time.
-        finalized_orderr = client_acme.poll_and_finalize(orderr)
-
-    return finalized_orderr.fullchain_pem
-
-
-# Main examples:
-
-
-def example_http():
-    """This example executes the whole process of fulfilling a HTTP-01
-    challenge for one specific domain.
-
-    The workflow consists of:
-    (Account creation)
-    - Create account key
-    - Register account and accept TOS
-    (Certificate actions)
-    - Select HTTP-01 within offered challenges by the CA server
-    - Set up http challenge resource
-    - Set up standalone web server
-    - Create domain private key and CSR
-    - Issue certificate
-    - Renew certificate
-    - Revoke certificate
-    (Account update actions)
-    - Change contact information
-    - Deactivate Account
-
-    """
-    # Create account key
-
-    acc_key = jose.JWKRSA(
-        key=rsa.generate_private_key(public_exponent=65537,
-                                     key_size=ACC_KEY_BITS,
-                                     backend=default_backend()))
-
-    # Register account and accept TOS
-
-    net = client.ClientNetwork(acc_key, user_agent=USER_AGENT)
-    directory = messages.Directory.from_json(net.get(DIRECTORY_URL).json())
-    client_acme = client.ClientV2(directory, net=net)
-
-    # Terms of Service URL is in client_acme.directory.meta.terms_of_service
-    # Registration Resource: regr
-    # Creates account with contact information.
-    email = ('fake@example.com')
-    regr = client_acme.new_account(
-        messages.NewRegistration.from_data(
-            email=email, terms_of_service_agreed=True))
-
-    # Create domain private key and CSR
-    pkey_pem, csr_pem = new_csr_comp(DOMAIN)
-
-    # Issue certificate
-
-    orderr = client_acme.new_order(csr_pem)
-
-    # Select HTTP-01 within offered challenges by the CA server
-    challb = select_http01_chall(orderr)
-
-    # The certificate is ready to be used in the variable "fullchain_pem".
-    fullchain_pem = perform_http01(client_acme, challb, orderr)
-
-    # Renew certificate
-
-    _, csr_pem = new_csr_comp(DOMAIN, pkey_pem)
-
-    orderr = client_acme.new_order(csr_pem)
-
-    challb = select_http01_chall(orderr)
-
-    # Performing challenge
-    fullchain_pem = perform_http01(client_acme, challb, orderr)
-
-    # Revoke certificate
-
-    fullchain_com = jose.ComparableX509(
-        OpenSSL.crypto.load_certificate(
-            OpenSSL.crypto.FILETYPE_PEM, fullchain_pem))
-
-    try:
-        client_acme.revoke(fullchain_com, 0)  # revocation reason = 0
-    except errors.ConflictError:
-        # Certificate already revoked.
-        pass
-
-    # Query registration status.
-    client_acme.net.account = regr
-    try:
-        regr = client_acme.query_registration(regr)
-    except errors.Error as err:
-        if err.typ == messages.OLD_ERROR_PREFIX + 'unauthorized' \
-                or err.typ == messages.ERROR_PREFIX + 'unauthorized':
-            # Status is deactivated.
-            pass
-        raise
-
-    # Change contact information
-
-    email = 'newfake@example.com'
-    regr = client_acme.update_registration(
-        regr.update(
-            body=regr.body.update(
-                contact=('mailto:' + email,)
-            )
-        )
-    )
-
-    # Deactivate account/registration
-
-    regr = client_acme.deactivate_registration(regr)
-
-
-if __name__ == "__main__":
-    example_http()

acme/pytest.ini

@@ -1,2 +0,0 @@
-[pytest]
-norecursedirs = .* build dist CVS _darcs {arch} *.egg

acme/setup.py

@@ -1,30 +1,37 @@
-from setuptools import setup
-from setuptools import find_packages
-from setuptools.command.test import test as TestCommand
 import sys
 
-version = '0.37.0.dev0'
+from setuptools import setup
+from setuptools import find_packages
+
+
+version = '0.21.0.dev0'
 
 # Please update tox.ini when modifying dependency version requirements
 install_requires = [
     # load_pem_private/public_key (>=0.6)
     # rsa_recover_prime_factors (>=0.8)
-    'cryptography>=1.2.3',
+    'cryptography>=0.8',
     # formerly known as acme.jose:
-    # 1.1.0+ is required to avoid the warnings described at
-    # https://github.com/certbot/josepy/issues/13.
-    'josepy>=1.1.0',
+    'josepy>=1.0.0',
     # Connection.set_tlsext_host_name (>=0.13)
     'mock',
-    'PyOpenSSL>=0.13.1',
+    'PyOpenSSL>=0.13',
     'pyrfc3339',
     'pytz',
-    'requests[security]>=2.6.0',  # security extras added in 2.4.1
-    'requests-toolbelt>=0.3.0',
-    'setuptools',
+    'requests[security]>=2.4.1',  # security extras added in 2.4.1
+    # For pkg_resources. >=1.0 so pip resolves it to a version cryptography
+    # will tolerate; see #2599:
+    'setuptools>=1.0',
     'six>=1.9.0',  # needed for python_2_unicode_compatible
 ]
 
+# env markers cause problems with older pip and setuptools
+if sys.version_info < (2, 7):
+    install_requires.extend([
+        'argparse',
+        'ordereddict',
+    ])
+
 dev_extras = [
     'pytest',
     'pytest-xdist',
@@ -37,21 +44,6 @@ docs_extras = [
 ]
 
 
-class PyTest(TestCommand):
-    user_options = []
-
-    def initialize_options(self):
-        TestCommand.initialize_options(self)
-        self.pytest_args = ''
-
-    def run_tests(self):
-        import shlex
-        # import here, cause outside the eggs aren't loaded
-        import pytest
-        errno = pytest.main(shlex.split(self.pytest_args))
-        sys.exit(errno)
-
-
 setup(
     name='acme',
     version=version,
@@ -60,19 +52,19 @@ setup(
     author="Certbot Project",
     author_email='client-dev@letsencrypt.org',
     license='Apache License 2.0',
-    python_requires='>=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*',
     classifiers=[
-        'Development Status :: 5 - Production/Stable',
+        'Development Status :: 3 - Alpha',
         'Intended Audience :: Developers',
         'License :: OSI Approved :: Apache Software License',
         'Programming Language :: Python',
         'Programming Language :: Python :: 2',
+        'Programming Language :: Python :: 2.6',
         'Programming Language :: Python :: 2.7',
         'Programming Language :: Python :: 3',
+        'Programming Language :: Python :: 3.3',
         'Programming Language :: Python :: 3.4',
         'Programming Language :: Python :: 3.5',
         'Programming Language :: Python :: 3.6',
-        'Programming Language :: Python :: 3.7',
         'Topic :: Internet :: WWW/HTTP',
         'Topic :: Security',
     ],
@@ -85,6 +77,4 @@ setup(
         'docs': docs_extras,
     },
     test_suite='acme',
-    tests_require=["pytest"],
-    cmdclass={"test": PyTest},
 )

appveyor.yml

@@ -1,44 +0,0 @@
-image: Visual Studio 2015
-
-environment:
-  matrix:
-    - TOXENV: py35
-    - TOXENV: py37-cover
-
-branches:
-  only:
-    # apache-parser-v2 is a temporary branch for doing work related to
-    # rewriting the parser in the Apache plugin.
-    - apache-parser-v2
-    - master
-    - /^\d+\.\d+\.x$/ # Version branches like X.X.X
-    - /^test-.*$/
-
-init:
-  # Since master can receive only commits from PR that have already been tested, following
-  # condition avoid to launch all jobs except the coverage one for commits pushed to master.
-  - ps: |
-      if (-Not $Env:APPVEYOR_PULL_REQUEST_NUMBER -And $Env:APPVEYOR_REPO_BRANCH -Eq 'master' `
-          -And -Not ($Env:TOXENV -Like '*-cover'))
-      { $Env:APPVEYOR_SKIP_FINALIZE_ON_EXIT = 'true'; Exit-AppVeyorBuild }
-
-install:
-  # Use Python 3.7 by default
-  - "SET PATH=C:\\Python37;C:\\Python37\\Scripts;%PATH%"
-  # Check env
-  - "python --version"
-  # Upgrade pip to avoid warnings
-  - "python -m pip install --upgrade pip"
-  # Ready to install tox and coverage
-  # tools/pip_install.py is used to pin packages to a known working version.
-  - "python tools\\pip_install.py tox codecov"
-
-build: off
-
-test_script:
-  - set TOX_TESTENV_PASSENV=APPVEYOR
-  # Test env is set by TOXENV env variable
-  - tox
-
-on_success:
-  - if exist .coverage codecov -F windows

certbot-apache/MANIFEST.in

@@ -5,4 +5,3 @@ recursive-include certbot_apache/tests/testdata *
 include certbot_apache/centos-options-ssl-apache.conf
 include certbot_apache/options-ssl-apache.conf
 recursive-include certbot_apache/augeas_lens *.aug
-recursive-include certbot_apache/tls_configs *.conf

certbot-apache/certbot_apache/apache_util.py

@@ -1,11 +1,7 @@
 """ Utility functions for certbot-apache plugin """
-import binascii
-
-import pkg_resources
+import os
 
 from certbot import util
-from certbot.compat import os
-
 
 def get_mod_deps(mod_name):
     """Get known module dependencies.
@@ -102,20 +98,3 @@ def parse_define_file(filepath, varname):
             var_parts = v[2:].partition("=")
             return_vars[var_parts[0]] = var_parts[2]
     return return_vars
-
-
-def unique_id():
-    """ Returns an unique id to be used as a VirtualHost identifier"""
-    return binascii.hexlify(os.urandom(16)).decode("utf-8")
-
-
-def find_ssl_apache_conf(prefix):
-    """
-    Find a TLS Apache config file in the dedicated storage.
-    :param str prefix: prefix of the TLS Apache config file to find
-    :return: the path the TLS Apache config file
-    :rtype: str
-    """
-    return pkg_resources.resource_filename(
-        "certbot_apache",
-        os.path.join("tls_configs", "{0}-options-ssl-apache.conf".format(prefix)))

certbot-apache/certbot_apache/augeas_configurator.py

@@ -0,0 +1,207 @@
+"""Class of Augeas Configurators."""
+import logging
+
+
+from certbot import errors
+from certbot.plugins import common
+
+from certbot_apache import constants
+
+logger = logging.getLogger(__name__)
+
+
+class AugeasConfigurator(common.Installer):
+    """Base Augeas Configurator class.
+
+    :ivar config: Configuration.
+    :type config: :class:`~certbot.interfaces.IConfig`
+
+    :ivar aug: Augeas object
+    :type aug: :class:`augeas.Augeas`
+
+    :ivar str save_notes: Human-readable configuration change notes
+    :ivar reverter: saves and reverts checkpoints
+    :type reverter: :class:`certbot.reverter.Reverter`
+
+    """
+    def __init__(self, *args, **kwargs):
+        super(AugeasConfigurator, self).__init__(*args, **kwargs)
+
+        # Placeholder for augeas
+        self.aug = None
+
+        self.save_notes = ""
+
+
+    def init_augeas(self):
+        """ Initialize the actual Augeas instance """
+        import augeas
+        self.aug = augeas.Augeas(
+            # specify a directory to load our preferred lens from
+            loadpath=constants.AUGEAS_LENS_DIR,
+            # Do not save backup (we do it ourselves), do not load
+            # anything by default
+            flags=(augeas.Augeas.NONE |
+                   augeas.Augeas.NO_MODL_AUTOLOAD |
+                   augeas.Augeas.ENABLE_SPAN))
+        # See if any temporary changes need to be recovered
+        # This needs to occur before VirtualHost objects are setup...
+        # because this will change the underlying configuration and potential
+        # vhosts
+        self.recovery_routine()
+
+    def check_parsing_errors(self, lens):
+        """Verify Augeas can parse all of the lens files.
+
+        :param str lens: lens to check for errors
+
+        :raises .errors.PluginError: If there has been an error in parsing with
+            the specified lens.
+
+        """
+        error_files = self.aug.match("/augeas//error")
+
+        for path in error_files:
+            # Check to see if it was an error resulting from the use of
+            # the httpd lens
+            lens_path = self.aug.get(path + "/lens")
+            # As aug.get may return null
+            if lens_path and lens in lens_path:
+                msg = (
+                    "There has been an error in parsing the file {0} on line {1}: "
+                    "{2}".format(
+                    # Strip off /augeas/files and /error
+                    path[13:len(path) - 6],
+                    self.aug.get(path + "/line"),
+                    self.aug.get(path + "/message")))
+                raise errors.PluginError(msg)
+
+    def ensure_augeas_state(self):
+        """Makes sure that all Augeas dom changes are written to files to avoid
+        loss of configuration directives when doing additional augeas parsing,
+        causing a possible augeas.load() resulting dom reset
+        """
+
+        if self.unsaved_files():
+            self.save_notes += "(autosave)"
+            self.save()
+
+    def unsaved_files(self):
+        """Lists files that have modified Augeas DOM but the changes have not
+        been written to the filesystem yet, used by `self.save()` and
+        ApacheConfigurator to check the file state.
+
+        :raises .errors.PluginError: If there was an error in Augeas, in
+            an attempt to save the configuration, or an error creating a
+            checkpoint
+
+        :returns: `set` of unsaved files
+        """
+        save_state = self.aug.get("/augeas/save")
+        self.aug.set("/augeas/save", "noop")
+        # Existing Errors
+        ex_errs = self.aug.match("/augeas//error")
+        try:
+            # This is a noop save
+            self.aug.save()
+        except (RuntimeError, IOError):
+            self._log_save_errors(ex_errs)
+            # Erase Save Notes
+            self.save_notes = ""
+            raise errors.PluginError(
+                "Error saving files, check logs for more info.")
+
+        # Return the original save method
+        self.aug.set("/augeas/save", save_state)
+
+        # Retrieve list of modified files
+        # Note: Noop saves can cause the file to be listed twice, I used a
+        # set to remove this possibility. This is a known augeas 0.10 error.
+        save_paths = self.aug.match("/augeas/events/saved")
+
+        save_files = set()
+        if save_paths:
+            for path in save_paths:
+                save_files.add(self.aug.get(path)[6:])
+        return save_files
+
+    def save(self, title=None, temporary=False):
+        """Saves all changes to the configuration files.
+
+        This function first checks for save errors, if none are found,
+        all configuration changes made will be saved. According to the
+        function parameters. If an exception is raised, a new checkpoint
+        was not created.
+
+        :param str title: The title of the save. If a title is given, the
+            configuration will be saved as a new checkpoint and put in a
+            timestamped directory.
+
+        :param bool temporary: Indicates whether the changes made will
+            be quickly reversed in the future (ie. challenges)
+
+        """
+        save_files = self.unsaved_files()
+        if save_files:
+            self.add_to_checkpoint(save_files,
+                                   self.save_notes, temporary=temporary)
+
+        self.save_notes = ""
+        self.aug.save()
+
+        # Force reload if files were modified
+        # This is needed to recalculate augeas directive span
+        if save_files:
+            for sf in save_files:
+                self.aug.remove("/files/"+sf)
+            self.aug.load()
+        if title and not temporary:
+            self.finalize_checkpoint(title)
+
+    def _log_save_errors(self, ex_errs):
+        """Log errors due to bad Augeas save.
+
+        :param list ex_errs: Existing errors before save
+
+        """
+        # Check for the root of save problems
+        new_errs = self.aug.match("/augeas//error")
+        # logger.error("During Save - %s", mod_conf)
+        logger.error("Unable to save files: %s. Attempted Save Notes: %s",
+                     ", ".join(err[13:len(err) - 6] for err in new_errs
+                               # Only new errors caused by recent save
+                               if err not in ex_errs), self.save_notes)
+
+    # Wrapper functions for Reverter class
+    def recovery_routine(self):
+        """Revert all previously modified files.
+
+        Reverts all modified files that have not been saved as a checkpoint
+
+        :raises .errors.PluginError: If unable to recover the configuration
+
+        """
+        super(AugeasConfigurator, self).recovery_routine()
+        # Need to reload configuration after these changes take effect
+        self.aug.load()
+
+    def revert_challenge_config(self):
+        """Used to cleanup challenge configurations.
+
+        :raises .errors.PluginError: If unable to revert the challenge config.
+
+        """
+        self.revert_temporary_config()
+        self.aug.load()
+
+    def rollback_checkpoints(self, rollback=1):
+        """Rollback saved checkpoints.
+
+        :param int rollback: Number of checkpoints to revert
+
+        :raises .errors.PluginError: If there is a problem with the input or
+            the function is unable to correctly revert the configuration
+
+        """
+        super(AugeasConfigurator, self).rollback_checkpoints(rollback)
+        self.aug.load()

certbot-apache/certbot_apache/augeas_lens/httpd.aug

@@ -44,134 +44,67 @@ autoload xfm
  *****************************************************************)
 let dels (s:string)     = del s s
 
-(* The continuation sequence that indicates that we should consider the
- * next line part of the current line *)
-let cont = /\\\\\r?\n/
-
-(* Whitespace within a line: space, tab, and the continuation sequence *)
-let ws = /[ \t]/ | cont
-
-(* Any possible character - '.' does not match \n *)
-let any = /(.|\n)/
-
-(* Any character preceded by a backslash *)
-let esc_any = /\\\\(.|\n)/
-
-(* Newline sequence - both for Unix and DOS newlines *)
-let nl = /\r?\n/
-
-(* Whitespace at the end of a line *)
-let eol = del (ws* . nl) "\n"
-
 (* deal with continuation lines *)
-let sep_spc             = del ws+ " "
-let sep_osp             = del ws* ""
-let sep_eq              = del (ws* . "=" . ws*) "="
+let sep_spc             = del /([ \t]+|[ \t]*\\\\\r?\n[ \t]*)+/ " "
+let sep_osp             = del /([ \t]*|[ \t]*\\\\\r?\n[ \t]*)*/ ""
+let sep_eq              = del /[ \t]*=[ \t]*/ "="
 
 let nmtoken             = /[a-zA-Z:_][a-zA-Z0-9:_.-]*/
 let word                = /[a-z][a-z0-9._-]*/i
 
-(* A complete line that is either just whitespace or a comment that only
- * contains whitespace *)
-let empty = [ del (ws* . /#?/ . ws* . nl) "\n" ]
-
+let eol                 = Util.doseol
+let empty               = Util.empty_dos
 let indent              = Util.indent
 
-(* A comment that is not just whitespace. We define it in terms of the
- * things that are not allowed as part of such a comment:
- *   1) Starts with whitespace
- *   2) Ends with whitespace, a backslash or \r
- *   3) Unescaped newlines
- *)
-let comment =
-  let comment_start = del (ws* . "#" . ws* ) "# " in
-  let unesc_eol = /[^\]?/ . nl in
-  let w = /[^\t\n\r \\]/ in
-  let r = /[\r\\]/ in
-  let s = /[\t\r ]/ in
-  (*
-   * we'd like to write
-   * let b = /\\\\/ in
-   * let t = /[\t\n\r ]/ in
-   * let x = b . (t? . (s|w)* ) in
-   * but the definition of b depends on commit 244c0edd in 1.9.0 and
-   * would make the lens unusable with versions before 1.9.0. So we write
-   * x out which works in older versions, too
-   *)
-  let x = /\\\\[\t\n\r ]?[^\n\\]*/ in
-  let line = ((r . s* . w|w|r) . (s|w)* . x*|(r.s* )?).w.(s*.w)* in
-  [ label "#comment" . comment_start . store line . eol ]
+let comment_val_re      = /([^ \t\r\n](.|\\\\\r?\n)*[^ \\\t\r\n]|[^ \t\r\n])/
+let comment             = [ label "#comment" . del /[ \t]*#[ \t]*/ "# "
+                          . store comment_val_re . eol ]
 
 (* borrowed from shellvars.aug *)
+let char_arg_dir  = /([^\\ '"{\t\r\n]|[^ '"{\t\r\n]+[^\\ \t\r\n])|\\\\"|\\\\'|\\\\ /
 let char_arg_sec  = /([^\\ '"\t\r\n>]|[^ '"\t\r\n>]+[^\\ \t\r\n>])|\\\\"|\\\\'|\\\\ /
 let char_arg_wl   = /([^\\ '"},\t\r\n]|[^ '"},\t\r\n]+[^\\ '"},\t\r\n])/
 
+let cdot = /\\\\./
+let cl = /\\\\\n/
 let dquot =
      let no_dquot = /[^"\\\r\n]/
-  in /"/ . (no_dquot|esc_any)* . /"/
+  in /"/ . (no_dquot|cdot|cl)* . /"/
 let dquot_msg =
      let no_dquot = /([^ \t"\\\r\n]|[^"\\\r\n]+[^ \t"\\\r\n])/
-  in /"/ . (no_dquot|esc_any)* . no_dquot
-
+  in /"/ . (no_dquot|cdot|cl)*
 let squot =
      let no_squot = /[^'\\\r\n]/
-  in /'/ . (no_squot|esc_any)* . /'/
+  in /'/ . (no_squot|cdot|cl)* . /'/
 let comp = /[<>=]?=/
 
 (******************************************************************
  *                            Attributes
  *****************************************************************)
 
-(* The arguments for a directive come in two flavors: quoted with single or
- * double quotes, or bare. Bare arguments may not start with a single or
- * double quote; since we also treat "word lists" special, i.e. lists
- * enclosed in curly braces, bare arguments may not start with those,
- * either.
- *
- * Bare arguments may not contain unescaped spaces, but we allow escaping
- * with '\\'. Quoted arguments can contain anything, though the quote must
- * be escaped with '\\'.
- *)
-let bare = /([^{"' \t\n\r]|\\\\.)([^ \t\n\r]|\\\\.)*[^ \t\n\r\\]|[^{"' \t\n\r\\]/
-
-let arg_quoted = [ label "arg" . store (dquot|squot) ]
-let arg_bare = [ label "arg" . store bare ]
-
+let arg_dir = [ label "arg" . store (char_arg_dir+|dquot|squot) ]
 (* message argument starts with " but ends at EOL *)
 let arg_dir_msg = [ label "arg" . store dquot_msg ]
+let arg_sec = [ label "arg" . store (char_arg_sec+|comp|dquot|squot) ]
 let arg_wl  = [ label "arg" . store (char_arg_wl+|dquot|squot) ]
 
 (* comma-separated wordlist as permitted in the SSLRequire directive *)
 let arg_wordlist =
-     let wl_start = dels "{" in
-     let wl_end   = dels "}" in
+     let wl_start = Util.del_str "{" in
+     let wl_end   = Util.del_str "}" in
      let wl_sep   = del /[ \t]*,[ \t]*/ ", "
   in [ label "wordlist" . wl_start . arg_wl . (wl_sep . arg_wl)* . wl_end ]
 
 let argv (l:lens) = l . (sep_spc . l)*
 
-(* the arguments of a directive. We use this once we have parsed the name
- * of the directive, and the space right after it. When dir_args is used,
- * we also know that we have at least one argument. We need to be careful
- * with the spacing between arguments: quoted arguments and word lists do
- * not need to have space between them, but bare arguments do.
- *
- * Apache apparently is also happy if the last argument starts with a double
- * quote, but has no corresponding closing duoble quote, which is what
- * arg_dir_msg handles
- *)
-let dir_args =
-  let arg_nospc = arg_quoted|arg_wordlist in
-  (arg_bare . sep_spc | arg_nospc . sep_osp)* . (arg_bare|arg_nospc|arg_dir_msg)
-
 let directive =
-  [ indent . label "directive" . store word .  (sep_spc . dir_args)? . eol ]
-
-let arg_sec = [ label "arg" . store (char_arg_sec+|comp|dquot|squot) ]
+    (* arg_dir_msg may be the last or only argument *)
+     let dir_args = (argv (arg_dir|arg_wordlist) . (sep_spc . arg_dir_msg)?) | arg_dir_msg
+  in [ indent . label "directive" . store word .  (sep_spc . dir_args)? . eol ]
 
 let section (body:lens) =
     (* opt_eol includes empty lines *)
-    let opt_eol = del /([ \t]*#?[ \t]*\r?\n)*/ "\n" in
+    let opt_eol = del /([ \t]*#?\r?\n)*/ "\n" in
     let inner = (sep_spc . argv arg_sec)? . sep_osp .
              dels ">" . opt_eol . ((body|comment) . (body|empty|comment)*)? .
              indent . dels "</" in
@@ -200,7 +133,6 @@ let filter = (incl "/etc/apache2/apache2.conf") .
              (incl "/etc/httpd/conf.d/*.conf") .
              (incl "/etc/httpd/httpd.conf") .
              (incl "/etc/httpd/conf/httpd.conf") .
-             (incl "/etc/httpd/conf.modules.d/*.conf") .
              Util.stdexcl
 
 let xfm = transform lns filter

certbot-apache/certbot_apache/centos-options-ssl-apache.conf

@@ -0,0 +1,25 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file.
+
+SSLEngine on
+
+# Intermediate configuration, tweak to your needs
+SSLProtocol             all -SSLv2 -SSLv3
+SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+SSLHonorCipherOrder     on
+
+SSLOptions +StrictRequire
+
+# Add vhost name to log entries:
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
+LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
+
+#CustomLog /var/log/apache2/access.log vhost_combined
+#LogLevel warn
+#ErrorLog /var/log/apache2/error.log
+
+# Always ensure Cookies have "Secure" set (JAH 2012/1)
+#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"

certbot-apache/certbot_apache/constants.py

@@ -9,7 +9,6 @@ MOD_SSL_CONF_DEST = "options-ssl-apache.conf"
 UPDATED_MOD_SSL_CONF_DIGEST = ".updated-options-ssl-apache-conf-digest.txt"
 """Name of the hash of the updated or informed mod_ssl_conf as saved in `IConfig.config_dir`."""
 
-# NEVER REMOVE A SINGLE HASH FROM THIS LIST UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING!
 ALL_SSL_OPTIONS_HASHES = [
     '2086bca02db48daf93468332543c60ac6acdb6f0b58c7bfdf578a5d47092f82a',
     '4844d36c9a0f587172d9fa10f4f1c9518e3bcfa1947379f155e16a70a728c21a',
@@ -17,12 +16,6 @@ ALL_SSL_OPTIONS_HASHES = [
     '4066b90268c03c9ba0201068eaa39abbc02acf9558bb45a788b630eb85dadf27',
     'f175e2e7c673bd88d0aff8220735f385f916142c44aa83b09f1df88dd4767a88',
     'cfdd7c18d2025836ea3307399f509cfb1ebf2612c87dd600a65da2a8e2f2797b',
-    '80720bd171ccdc2e6b917ded340defae66919e4624962396b992b7218a561791',
-    'c0c022ea6b8a51ecc8f1003d0a04af6c3f2bc1c3ce506b3c2dfc1f11ef931082',
-    '717b0a89f5e4c39b09a42813ac6e747cfbdeb93439499e73f4f70a1fe1473f20',
-    '0fcdc81280cd179a07ec4d29d3595068b9326b455c488de4b09f585d5dafc137',
-    '86cc09ad5415cd6d5f09a947fe2501a9344328b1e8a8b458107ea903e80baa6c',
-    '06675349e457eae856120cdebb564efe546f0b87399f2264baeb41e442c724c7',
 ]
 """SHA256 hashes of the contents of previous versions of all versions of MOD_SSL_CONF_SRC"""
 
@@ -53,16 +46,3 @@ UIR_ARGS = ["always", "set", "Content-Security-Policy",
 
 HEADER_ARGS = {"Strict-Transport-Security": HSTS_ARGS,
                "Upgrade-Insecure-Requests": UIR_ARGS}
-
-AUTOHSTS_STEPS = [60, 300, 900, 3600, 21600, 43200, 86400]
-"""AutoHSTS increase steps: 1min, 5min, 15min, 1h, 6h, 12h, 24h"""
-
-AUTOHSTS_PERMANENT = 31536000
-"""Value for the last max-age of HSTS"""
-
-AUTOHSTS_FREQ = 172800
-"""Minimum time since last increase to perform a new one: 48h"""
-
-MANAGED_COMMENT = "DO NOT REMOVE - Managed by Certbot"
-MANAGED_COMMENT_ID = MANAGED_COMMENT+", VirtualHost id: {0}"
-"""Managed by Certbot comments and the VirtualHost identification template"""

certbot-apache/certbot_apache/display_ops.py

@@ -1,54 +1,22 @@
 """Contains UI methods for Apache operations."""
 import logging
+import os
 
 import zope.component
 
-import certbot.display.util as display_util
 from certbot import errors
 from certbot import interfaces
-from certbot.compat import os
+
+import certbot.display.util as display_util
+
 
 logger = logging.getLogger(__name__)
 
 
-def select_vhost_multiple(vhosts):
-    """Select multiple Vhosts to install the certificate for
-
-    :param vhosts: Available Apache VirtualHosts
-    :type vhosts: :class:`list` of type `~obj.Vhost`
-
-    :returns: List of VirtualHosts
-    :rtype: :class:`list`of type `~obj.Vhost`
-    """
-    if not vhosts:
-        return list()
-    tags_list = [vhost.display_repr()+"\n" for vhost in vhosts]
-    # Remove the extra newline from the last entry
-    if tags_list:
-        tags_list[-1] = tags_list[-1][:-1]
-    code, names = zope.component.getUtility(interfaces.IDisplay).checklist(
-        "Which VirtualHosts would you like to install the wildcard certificate for?",
-        tags=tags_list, force_interactive=True)
-    if code == display_util.OK:
-        return_vhosts = _reversemap_vhosts(names, vhosts)
-        return return_vhosts
-    return []
-
-def _reversemap_vhosts(names, vhosts):
-    """Helper function for select_vhost_multiple for mapping string
-    representations back to actual vhost objects"""
-    return_vhosts = list()
-
-    for selection in names:
-        for vhost in vhosts:
-            if vhost.display_repr().strip() == selection.strip():
-                return_vhosts.append(vhost)
-    return return_vhosts
-
 def select_vhost(domain, vhosts):
     """Select an appropriate Apache Vhost.
 
-    :param vhosts: Available Apache VirtualHosts
+    :param vhosts: Available Apache Virtual Hosts
     :type vhosts: :class:`list` of type `~obj.Vhost`
 
     :returns: VirtualHost or `None`
@@ -57,10 +25,13 @@ def select_vhost(domain, vhosts):
     """
     if not vhosts:
         return None
-    code, tag = _vhost_menu(domain, vhosts)
-    if code == display_util.OK:
-        return vhosts[tag]
-    return None
+    while True:
+        code, tag = _vhost_menu(domain, vhosts)
+        if code == display_util.OK:
+            return vhosts[tag]
+        else:
+            return None
+
 
 def _vhost_menu(domain, vhosts):
     """Select an appropriate Apache Vhost.
@@ -90,7 +61,7 @@ def _vhost_menu(domain, vhosts):
     for vhost in vhosts:
         if len(vhost.get_names()) == 1:
             disp_name = next(iter(vhost.get_names()))
-        elif not vhost.get_names():
+        elif len(vhost.get_names()) == 0:
             disp_name = ""
         else:
             disp_name = "Multiple Names"
@@ -110,7 +81,8 @@ def _vhost_menu(domain, vhosts):
         code, tag = zope.component.getUtility(interfaces.IDisplay).menu(
             "We were unable to find a vhost with a ServerName "
             "or Address of {0}.{1}Which virtual host would you "
-            "like to choose?".format(domain, os.linesep),
+            "like to choose?\n(note: conf files with multiple "
+            "vhosts are not yet supported)".format(domain, os.linesep),
             choices, force_interactive=True)
     except errors.MissingCommandlineFlag:
         msg = (

certbot-apache/certbot_apache/entrypoint.py

@@ -1,13 +1,8 @@
 """ Entry point for Apache Plugin """
-# Pylint does not like disutils.version when running inside a venv.
-# See: https://github.com/PyCQA/pylint/issues/73
-from distutils.version import LooseVersion  # pylint: disable=no-name-in-module,import-error
-
 from certbot import util
 
 from certbot_apache import configurator
 from certbot_apache import override_arch
-from certbot_apache import override_fedora
 from certbot_apache import override_darwin
 from certbot_apache import override_debian
 from certbot_apache import override_centos
@@ -21,9 +16,7 @@ OVERRIDE_CLASSES = {
     "ubuntu": override_debian.DebianConfigurator,
     "centos": override_centos.CentOSConfigurator,
     "centos linux": override_centos.CentOSConfigurator,
-    "fedora_old": override_centos.CentOSConfigurator,
-    "fedora": override_fedora.FedoraConfigurator,
-    "ol": override_centos.CentOSConfigurator,
+    "fedora": override_centos.CentOSConfigurator,
     "red hat enterprise linux server": override_centos.CentOSConfigurator,
     "rhel": override_centos.CentOSConfigurator,
     "amazon": override_centos.CentOSConfigurator,
@@ -33,19 +26,12 @@ OVERRIDE_CLASSES = {
     "suse": override_suse.OpenSUSEConfigurator,
 }
 
-
 def get_configurator():
     """ Get correct configurator class based on the OS fingerprint """
-    os_name, os_version = util.get_os_info()
-    os_name = os_name.lower()
+    os_info = util.get_os_info()
     override_class = None
-
-    # Special case for older Fedora versions
-    if os_name == 'fedora' and LooseVersion(os_version) < LooseVersion('29'):
-        os_name = 'fedora_old'
-
     try:
-        override_class = OVERRIDE_CLASSES[os_name]
+        override_class = OVERRIDE_CLASSES[os_info[0].lower()]
     except KeyError:
         # OS not found in the list
         os_like = util.get_systemd_os_like()
@@ -58,5 +44,4 @@ def get_configurator():
             override_class = configurator.ApacheConfigurator
     return override_class
 
-
 ENTRYPOINT = get_configurator()

certbot-apache/certbot_apache/http_01.py

@@ -1,210 +0,0 @@
-"""A class that performs HTTP-01 challenges for Apache"""
-import logging
-
-from acme.magic_typing import List, Set  # pylint: disable=unused-import, no-name-in-module
-
-from certbot import errors
-from certbot.compat import os
-from certbot.compat import filesystem
-from certbot.plugins import common
-
-from certbot_apache.obj import VirtualHost  # pylint: disable=unused-import
-from certbot_apache.parser import get_aug_path
-
-logger = logging.getLogger(__name__)
-
-
-class ApacheHttp01(common.TLSSNI01):
-    """Class that performs HTTP-01 challenges within the Apache configurator."""
-
-    CONFIG_TEMPLATE22_PRE = """\
-        RewriteEngine on
-        RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [L]
-
-    """
-    CONFIG_TEMPLATE22_POST = """\
-        <Directory {0}>
-            Order Allow,Deny
-            Allow from all
-        </Directory>
-        <Location /.well-known/acme-challenge>
-            Order Allow,Deny
-            Allow from all
-        </Location>
-    """
-
-    CONFIG_TEMPLATE24_PRE = """\
-        RewriteEngine on
-        RewriteRule ^/\\.well-known/acme-challenge/([A-Za-z0-9-_=]+)$ {0}/$1 [END]
-    """
-    CONFIG_TEMPLATE24_POST = """\
-        <Directory {0}>
-            Require all granted
-        </Directory>
-        <Location /.well-known/acme-challenge>
-            Require all granted
-        </Location>
-    """
-
-    def __init__(self, *args, **kwargs):
-        super(ApacheHttp01, self).__init__(*args, **kwargs)
-        self.challenge_conf_pre = os.path.join(
-            self.configurator.conf("challenge-location"),
-            "le_http_01_challenge_pre.conf")
-        self.challenge_conf_post = os.path.join(
-            self.configurator.conf("challenge-location"),
-            "le_http_01_challenge_post.conf")
-        self.challenge_dir = os.path.join(
-            self.configurator.config.work_dir,
-            "http_challenges")
-        self.moded_vhosts = set()  # type: Set[VirtualHost]
-
-    def perform(self):
-        """Perform all HTTP-01 challenges."""
-        if not self.achalls:
-            return []
-        # Save any changes to the configuration as a precaution
-        # About to make temporary changes to the config
-        self.configurator.save("Changes before challenge setup", True)
-
-        self.configurator.ensure_listen(str(
-            self.configurator.config.http01_port))
-        self.prepare_http01_modules()
-
-        responses = self._set_up_challenges()
-
-        self._mod_config()
-        # Save reversible changes
-        self.configurator.save("HTTP Challenge", True)
-
-        return responses
-
-    def prepare_http01_modules(self):
-        """Make sure that we have the needed modules available for http01"""
-
-        if self.configurator.conf("handle-modules"):
-            needed_modules = ["rewrite"]
-            if self.configurator.version < (2, 4):
-                needed_modules.append("authz_host")
-            else:
-                needed_modules.append("authz_core")
-            for mod in needed_modules:
-                if mod + "_module" not in self.configurator.parser.modules:
-                    self.configurator.enable_mod(mod, temp=True)
-
-    def _mod_config(self):
-        selected_vhosts = []  # type: List[VirtualHost]
-        http_port = str(self.configurator.config.http01_port)
-        for chall in self.achalls:
-            # Search for matching VirtualHosts
-            for vh in self._matching_vhosts(chall.domain):
-                selected_vhosts.append(vh)
-
-        # Ensure that we have one or more VirtualHosts that we can continue
-        # with. (one that listens to port configured with --http-01-port)
-        found = False
-        for vhost in selected_vhosts:
-            if any(a.is_wildcard() or a.get_port() == http_port for a in vhost.addrs):
-                found = True
-
-        if not found:
-            for vh in self._relevant_vhosts():
-                selected_vhosts.append(vh)
-
-        # Add the challenge configuration
-        for vh in selected_vhosts:
-            self._set_up_include_directives(vh)
-
-        self.configurator.reverter.register_file_creation(
-            True, self.challenge_conf_pre)
-        self.configurator.reverter.register_file_creation(
-            True, self.challenge_conf_post)
-
-        if self.configurator.version < (2, 4):
-            config_template_pre = self.CONFIG_TEMPLATE22_PRE
-            config_template_post = self.CONFIG_TEMPLATE22_POST
-        else:
-            config_template_pre = self.CONFIG_TEMPLATE24_PRE
-            config_template_post = self.CONFIG_TEMPLATE24_POST
-
-        config_text_pre = config_template_pre.format(self.challenge_dir)
-        config_text_post = config_template_post.format(self.challenge_dir)
-
-        logger.debug("writing a pre config file with text:\n %s", config_text_pre)
-        with open(self.challenge_conf_pre, "w") as new_conf:
-            new_conf.write(config_text_pre)
-        logger.debug("writing a post config file with text:\n %s", config_text_post)
-        with open(self.challenge_conf_post, "w") as new_conf:
-            new_conf.write(config_text_post)
-
-    def _matching_vhosts(self, domain):
-        """Return all VirtualHost objects that have the requested domain name or
-        a wildcard name that would match the domain in ServerName or ServerAlias
-        directive.
-        """
-        matching_vhosts = []
-        for vhost in self.configurator.vhosts:
-            if self.configurator.domain_in_names(vhost.get_names(), domain):
-                # domain_in_names also matches the exact names, so no need
-                # to check "domain in vhost.get_names()" explicitly here
-                matching_vhosts.append(vhost)
-
-        return matching_vhosts
-
-    def _relevant_vhosts(self):
-        http01_port = str(self.configurator.config.http01_port)
-        relevant_vhosts = []
-        for vhost in self.configurator.vhosts:
-            if any(a.is_wildcard() or a.get_port() == http01_port for a in vhost.addrs):
-                if not vhost.ssl:
-                    relevant_vhosts.append(vhost)
-        if not relevant_vhosts:
-            raise errors.PluginError(
-                "Unable to find a virtual host listening on port {0} which is"
-                " currently needed for Certbot to prove to the CA that you"
-                " control your domain. Please add a virtual host for port"
-                " {0}.".format(http01_port))
-
-        return relevant_vhosts
-
-    def _set_up_challenges(self):
-        if not os.path.isdir(self.challenge_dir):
-            filesystem.makedirs(self.challenge_dir, 0o755)
-
-        responses = []
-        for achall in self.achalls:
-            responses.append(self._set_up_challenge(achall))
-
-        return responses
-
-    def _set_up_challenge(self, achall):
-        response, validation = achall.response_and_validation()
-
-        name = os.path.join(self.challenge_dir, achall.chall.encode("token"))
-
-        self.configurator.reverter.register_file_creation(True, name)
-        with open(name, 'wb') as f:
-            f.write(validation.encode())
-        filesystem.chmod(name, 0o644)
-
-        return response
-
-    def _set_up_include_directives(self, vhost):
-        """Includes override configuration to the beginning and to the end of
-        VirtualHost. Note that this include isn't added to Augeas search tree"""
-
-        if vhost not in self.moded_vhosts:
-            logger.debug(
-                "Adding a temporary challenge validation Include for name: %s " +
-                "in: %s", vhost.name, vhost.filep)
-            self.configurator.parser.add_dir_beginning(
-                vhost.path, "Include", self.challenge_conf_pre)
-            self.configurator.parser.add_dir(
-                vhost.path, "Include", self.challenge_conf_post)
-
-            if not vhost.enabled:
-                self.configurator.parser.add_dir(
-                    get_aug_path(self.configurator.parser.loc["default"]),
-                    "Include", vhost.filep)
-
-            self.moded_vhosts.add(vhost)

certbot-apache/certbot_apache/obj.py

@@ -1,7 +1,6 @@
 """Module contains classes used by the Apache Configurator."""
 import re
 
-from acme.magic_typing import Set # pylint: disable=unused-import, no-name-in-module
 from certbot.plugins import common
 
 
@@ -26,7 +25,7 @@ class Addr(common.Addr):
     def __repr__(self):
         return "certbot_apache.obj.Addr(" + repr(self.tup) + ")"
 
-    def __hash__(self):  # pylint: disable=useless-super-delegation
+    def __hash__(self):
         # Python 3 requires explicit overridden for __hash__ if __eq__ or
         # __cmp__ is overridden. See https://bugs.python.org/issue2235
         return super(Addr, self).__hash__()
@@ -47,7 +46,8 @@ class Addr(common.Addr):
             return 0
         elif self.get_addr() == "*":
             return 1
-        return 2
+        else:
+            return 2
 
     def conflicts(self, addr):
         r"""Returns if address could conflict with correct function of self.
@@ -140,7 +140,7 @@ class VirtualHost(object):  # pylint: disable=too-few-public-methods
 
     def get_names(self):
         """Return a set of all names."""
-        all_names = set()  # type: Set[str]
+        all_names = set()
         all_names.update(self.aliases)
         # Strip out any scheme:// and <port> field from servername
         if self.name is not None:
@@ -167,19 +167,6 @@ class VirtualHost(object):  # pylint: disable=too-few-public-methods
                 active="Yes" if self.enabled else "No",
                 modmacro="Yes" if self.modmacro else "No"))
 
-    def display_repr(self):
-        """Return a representation of VHost to be used in dialog"""
-        return (
-            "File: {filename}\n"
-            "Addresses: {addrs}\n"
-            "Names: {names}\n"
-            "HTTPS: {https}\n".format(
-                filename=self.filep,
-                addrs=", ".join(str(addr) for addr in self.addrs),
-                names=", ".join(self.get_names()),
-                https="Yes" if self.ssl else "No"))
-
-
     def __eq__(self, other):
         if isinstance(other, self.__class__):
             return (self.filep == other.filep and self.path == other.path and
@@ -251,7 +238,7 @@ class VirtualHost(object):  # pylint: disable=too-few-public-methods
 
         # already_found acts to keep everything very conservative.
         # Don't allow multiple ip:ports in same set.
-        already_found = set()  # type: Set[str]
+        already_found = set()
 
         for addr in vhost.addrs:
             for local_addr in self.addrs:

certbot-apache/certbot_apache/options-ssl-apache.conf

@@ -0,0 +1,26 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file.
+
+SSLEngine on
+
+# Intermediate configuration, tweak to your needs
+SSLProtocol             all -SSLv2 -SSLv3
+SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+SSLHonorCipherOrder     on
+SSLCompression          off
+
+SSLOptions +StrictRequire
+
+# Add vhost name to log entries:
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
+LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
+
+#CustomLog /var/log/apache2/access.log vhost_combined
+#LogLevel warn
+#ErrorLog /var/log/apache2/error.log
+
+# Always ensure Cookies have "Secure" set (JAH 2012/1)
+#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"

certbot-apache/certbot_apache/override_arch.py

@@ -1,4 +1,6 @@
 """ Distribution specific override class for Arch Linux """
+import pkg_resources
+
 import zope.interface
 
 from certbot import interfaces
@@ -14,14 +16,16 @@ class ArchConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/httpd/conf",
         vhost_files="*.conf",
         logs_root="/var/log/httpd",
-        ctl="apachectl",
         version_cmd=['apachectl', '-v'],
+        apache_cmd="apachectl",
         restart_cmd=['apachectl', 'graceful'],
         conftest_cmd=['apachectl', 'configtest'],
         enmod=None,
         dismod=None,
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
+        handle_mods=False,
         handle_sites=False,
         challenge_location="/etc/httpd/conf",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "options-ssl-apache.conf")
     )

certbot-apache/certbot_apache/override_centos.py

@@ -1,23 +1,14 @@
 """ Distribution specific override class for CentOS family (RHEL, Fedora) """
-import logging
+import pkg_resources
 
 import zope.interface
 
-from certbot import errors
 from certbot import interfaces
-from certbot import util
-from certbot.errors import MisconfigurationError
-
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
 
 from certbot_apache import apache_util
 from certbot_apache import configurator
 from certbot_apache import parser
 
-
-logger = logging.getLogger(__name__)
-
-
 @zope.interface.provider(interfaces.IPluginFactory)
 class CentOSConfigurator(configurator.ApacheConfigurator):
     """CentOS specific ApacheConfigurator override class"""
@@ -27,154 +18,26 @@ class CentOSConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/httpd/conf.d",
         vhost_files="*.conf",
         logs_root="/var/log/httpd",
-        ctl="apachectl",
         version_cmd=['apachectl', '-v'],
+        apache_cmd="apachectl",
         restart_cmd=['apachectl', 'graceful'],
-        restart_cmd_alt=['apachectl', 'restart'],
         conftest_cmd=['apachectl', 'configtest'],
         enmod=None,
         dismod=None,
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
+        handle_mods=False,
         handle_sites=False,
         challenge_location="/etc/httpd/conf.d",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "centos-options-ssl-apache.conf")
     )
 
-    def config_test(self):
-        """
-        Override config_test to mitigate configtest error in vanilla installation
-        of mod_ssl in Fedora. The error is caused by non-existent self-signed
-        certificates referenced by the configuration, that would be autogenerated
-        during the first (re)start of httpd.
-        """
-
-        os_info = util.get_os_info()
-        fedora = os_info[0].lower() == "fedora"
-
-        try:
-            super(CentOSConfigurator, self).config_test()
-        except errors.MisconfigurationError:
-            if fedora:
-                self._try_restart_fedora()
-            else:
-                raise
-
-    def _try_restart_fedora(self):
-        """
-        Tries to restart httpd using systemctl to generate the self signed keypair.
-        """
-
-        try:
-            util.run_script(['systemctl', 'restart', 'httpd'])
-        except errors.SubprocessError as err:
-            raise errors.MisconfigurationError(str(err))
-
-        # Finish with actual config check to see if systemctl restart helped
-        super(CentOSConfigurator, self).config_test()
-
-    def pick_apache_config(self):
-        """
-        Pick the appropriate TLS Apache configuration file for current version of Apache and OS.
-        :return: the path to the TLS Apache configuration file to use
-        :rtype: str
-        """
-        # Disabling TLS session tickets is supported by Apache 2.4.11+.
-        # So for old versions of Apache we pick a configuration without this option.
-        if self.version < (2, 4, 11):
-            return apache_util.find_ssl_apache_conf("centos-old")
-        return apache_util.find_ssl_apache_conf("centos-current")
-
-    def _prepare_options(self):
-        """
-        Override the options dictionary initialization in order to support
-        alternative restart cmd used in CentOS.
-        """
-        super(CentOSConfigurator, self)._prepare_options()
-        self.options["restart_cmd_alt"][0] = self.option("ctl")
-
     def get_parser(self):
         """Initializes the ApacheParser"""
         return CentOSParser(
-            self.option("server_root"), self.option("vhost_root"),
+            self.aug, self.conf("server-root"), self.conf("vhost-root"),
             self.version, configurator=self)
 
-    def _deploy_cert(self, *args, **kwargs):  # pylint: disable=arguments-differ
-        """
-        Override _deploy_cert in order to ensure that the Apache configuration
-        has "LoadModule ssl_module..." before parsing the VirtualHost configuration
-        that was created by Certbot
-        """
-        super(CentOSConfigurator, self)._deploy_cert(*args, **kwargs)
-        if self.version < (2, 4, 0):
-            self._deploy_loadmodule_ssl_if_needed()
-
-    def _deploy_loadmodule_ssl_if_needed(self):
-        """
-        Add "LoadModule ssl_module <pre-existing path>" to main httpd.conf if
-        it doesn't exist there already.
-        """
-
-        loadmods = self.parser.find_dir("LoadModule", "ssl_module", exclude=False)
-
-        correct_ifmods = []  # type: List[str]
-        loadmod_args = []  # type: List[str]
-        loadmod_paths = []  # type: List[str]
-        for m in loadmods:
-            noarg_path = m.rpartition("/")[0]
-            path_args = self.parser.get_all_args(noarg_path)
-            if loadmod_args:
-                if loadmod_args != path_args:
-                    msg = ("Certbot encountered multiple LoadModule directives "
-                           "for LoadModule ssl_module with differing library paths. "
-                           "Please remove or comment out the one(s) that are not in "
-                           "use, and run Certbot again.")
-                    raise MisconfigurationError(msg)
-            else:
-                loadmod_args = path_args
-
-            if self.parser.not_modssl_ifmodule(noarg_path):  # pylint: disable=no-member
-                if self.parser.loc["default"] in noarg_path:
-                    # LoadModule already in the main configuration file
-                    if ("ifmodule/" in noarg_path.lower() or
-                        "ifmodule[1]" in noarg_path.lower()):
-                        # It's the first or only IfModule in the file
-                        return
-                # Populate the list of known !mod_ssl.c IfModules
-                nodir_path = noarg_path.rpartition("/directive")[0]
-                correct_ifmods.append(nodir_path)
-            else:
-                loadmod_paths.append(noarg_path)
-
-        if not loadmod_args:
-            # Do not try to enable mod_ssl
-            return
-
-        # Force creation as the directive wasn't found from the beginning of
-        # httpd.conf
-        rootconf_ifmod = self.parser.create_ifmod(
-            parser.get_aug_path(self.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        # parser.get_ifmod returns a path postfixed with "/", remove that
-        self.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", loadmod_args)
-        correct_ifmods.append(rootconf_ifmod[:-1])
-        self.save_notes += "Added LoadModule ssl_module to main configuration.\n"
-
-        # Wrap LoadModule mod_ssl inside of <IfModule !mod_ssl.c> if it's not
-        # configured like this already.
-        for loadmod_path in loadmod_paths:
-            nodir_path = loadmod_path.split("/directive")[0]
-            # Remove the old LoadModule directive
-            self.parser.aug.remove(loadmod_path)
-
-            # Create a new IfModule !mod_ssl.c if not already found on path
-            ssl_ifmod = self.parser.get_ifmod(nodir_path, "!mod_ssl.c",
-                                            beginning=True)[:-1]
-            if ssl_ifmod not in correct_ifmods:
-                self.parser.add_dir(ssl_ifmod, "LoadModule", loadmod_args)
-                correct_ifmods.append(ssl_ifmod)
-                self.save_notes += ("Wrapped pre-existing LoadModule ssl_module "
-                                    "inside of <IfModule !mod_ssl> block.\n")
-
 
 class CentOSParser(parser.ApacheParser):
     """CentOS specific ApacheParser override class"""
@@ -183,44 +46,14 @@ class CentOSParser(parser.ApacheParser):
         self.sysconfig_filep = "/etc/sysconfig/httpd"
         super(CentOSParser, self).__init__(*args, **kwargs)
 
-    def update_runtime_variables(self):
+    def update_runtime_variables(self, *args, **kwargs):
         """ Override for update_runtime_variables for custom parsing """
         # Opportunistic, works if SELinux not enforced
-        super(CentOSParser, self).update_runtime_variables()
+        super(CentOSParser, self).update_runtime_variables(*args, **kwargs)
         self.parse_sysconfig_var()
 
     def parse_sysconfig_var(self):
         """ Parses Apache CLI options from CentOS configuration file """
         defines = apache_util.parse_define_file(self.sysconfig_filep, "OPTIONS")
-        for k in defines:
+        for k in defines.keys():
             self.variables[k] = defines[k]
-
-    def not_modssl_ifmodule(self, path):
-        """Checks if the provided Augeas path has argument !mod_ssl"""
-
-        if "ifmodule" not in path.lower():
-            return False
-
-        # Trim the path to the last ifmodule
-        workpath = path.lower()
-        while workpath:
-            # Get path to the last IfModule (ignore the tail)
-            parts = workpath.rpartition("ifmodule")
-
-            if not parts[0]:
-                # IfModule not found
-                break
-            ifmod_path = parts[0] + parts[1]
-            # Check if ifmodule had an index
-            if parts[2].startswith("["):
-                # Append the index from tail
-                ifmod_path += parts[2].partition("/")[0]
-            # Get the original path trimmed to correct length
-            # This is required to preserve cases
-            ifmod_real_path = path[0:len(ifmod_path)]
-            if "!mod_ssl.c" in self.get_all_args(ifmod_real_path):
-                return True
-            # Set the workpath to the heading part
-            workpath = parts[0]
-
-        return False

certbot-apache/certbot_apache/override_darwin.py

@@ -1,4 +1,6 @@
 """ Distribution specific override class for macOS """
+import pkg_resources
+
 import zope.interface
 
 from certbot import interfaces
@@ -14,14 +16,16 @@ class DarwinConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/apache2/other",
         vhost_files="*.conf",
         logs_root="/var/log/apache2",
-        ctl="apachectl",
-        version_cmd=['apachectl', '-v'],
+        version_cmd=['/usr/sbin/httpd', '-v'],
+        apache_cmd="/usr/sbin/httpd",
         restart_cmd=['apachectl', 'graceful'],
         conftest_cmd=['apachectl', 'configtest'],
         enmod=None,
         dismod=None,
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
+        handle_mods=False,
         handle_sites=False,
         challenge_location="/etc/apache2/other",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "options-ssl-apache.conf")
     )

certbot-apache/certbot_apache/override_debian.py

@@ -1,20 +1,19 @@
 """ Distribution specific override class for Debian family (Ubuntu/Debian) """
 import logging
+import os
+import pkg_resources
 
 import zope.interface
 
 from certbot import errors
 from certbot import interfaces
 from certbot import util
-from certbot.compat import filesystem
-from certbot.compat import os
 
 from certbot_apache import apache_util
 from certbot_apache import configurator
 
 logger = logging.getLogger(__name__)
 
-
 @zope.interface.provider(interfaces.IPluginFactory)
 class DebianConfigurator(configurator.ApacheConfigurator):
     """Debian specific ApacheConfigurator override class"""
@@ -24,16 +23,18 @@ class DebianConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/apache2/sites-available",
         vhost_files="*",
         logs_root="/var/log/apache2",
-        ctl="apache2ctl",
         version_cmd=['apache2ctl', '-v'],
+        apache_cmd="apache2ctl",
         restart_cmd=['apache2ctl', 'graceful'],
         conftest_cmd=['apache2ctl', 'configtest'],
         enmod="a2enmod",
         dismod="a2dismod",
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=True,
+        handle_mods=True,
         handle_sites=True,
         challenge_location="/etc/apache2",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "options-ssl-apache.conf")
     )
 
     def enable_site(self, vhost):
@@ -50,7 +51,7 @@ class DebianConfigurator(configurator.ApacheConfigurator):
 
         """
         if vhost.enabled:
-            return None
+            return
 
         enabled_path = ("%s/sites-enabled/%s" %
                         (self.parser.root,
@@ -63,11 +64,11 @@ class DebianConfigurator(configurator.ApacheConfigurator):
         try:
             os.symlink(vhost.filep, enabled_path)
         except OSError as err:
-            if os.path.islink(enabled_path) and filesystem.realpath(
+            if os.path.islink(enabled_path) and os.path.realpath(
                enabled_path) == vhost.filep:
                 # Already in shape
                 vhost.enabled = True
-                return None
+                return
             else:
                 logger.warning(
                     "Could not symlink %s to %s, got error: %s", enabled_path,
@@ -80,9 +81,9 @@ class DebianConfigurator(configurator.ApacheConfigurator):
         vhost.enabled = True
         logger.info("Enabling available site: %s", vhost.filep)
         self.save_notes += "Enabled site %s\n" % vhost.filep
-        return None
 
     def enable_mod(self, mod_name, temp=False):
+        # pylint: disable=unused-argument
         """Enables module in Apache.
 
         Both enables and reloads Apache so module is active.
@@ -133,11 +134,11 @@ class DebianConfigurator(configurator.ApacheConfigurator):
         # Generate reversal command.
         # Try to be safe here... check that we can probably reverse before
         # applying enmod command
-        if not util.exe_exists(self.option("dismod")):
+        if not util.exe_exists(self.conf("dismod")):
             raise errors.MisconfigurationError(
                 "Unable to find a2dismod, please make sure a2enmod and "
                 "a2dismod are configured correctly for certbot.")
 
         self.reverter.register_undo_command(
-            temp, [self.option("dismod"), "-f", mod_name])
-        util.run_script([self.option("enmod"), mod_name])
+            temp, [self.conf("dismod"), mod_name])
+        util.run_script([self.conf("enmod"), mod_name])

certbot-apache/certbot_apache/override_fedora.py

@@ -1,94 +0,0 @@
-""" Distribution specific override class for Fedora 29+ """
-import zope.interface
-
-from certbot import errors
-from certbot import interfaces
-from certbot import util
-
-from certbot_apache import apache_util
-from certbot_apache import configurator
-from certbot_apache import parser
-
-
-@zope.interface.provider(interfaces.IPluginFactory)
-class FedoraConfigurator(configurator.ApacheConfigurator):
-    """Fedora 29+ specific ApacheConfigurator override class"""
-
-    OS_DEFAULTS = dict(
-        server_root="/etc/httpd",
-        vhost_root="/etc/httpd/conf.d",
-        vhost_files="*.conf",
-        logs_root="/var/log/httpd",
-        ctl="httpd",
-        version_cmd=['httpd', '-v'],
-        restart_cmd=['apachectl', 'graceful'],
-        restart_cmd_alt=['apachectl', 'restart'],
-        conftest_cmd=['apachectl', 'configtest'],
-        enmod=None,
-        dismod=None,
-        le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
-        handle_sites=False,
-        challenge_location="/etc/httpd/conf.d",
-    )
-
-    def config_test(self):
-        """
-        Override config_test to mitigate configtest error in vanilla installation
-        of mod_ssl in Fedora. The error is caused by non-existent self-signed
-        certificates referenced by the configuration, that would be autogenerated
-        during the first (re)start of httpd.
-        """
-        try:
-            super(FedoraConfigurator, self).config_test()
-        except errors.MisconfigurationError:
-            self._try_restart_fedora()
-
-    def get_parser(self):
-        """Initializes the ApacheParser"""
-        return FedoraParser(
-            self.option("server_root"), self.option("vhost_root"),
-            self.version, configurator=self)
-
-    def _try_restart_fedora(self):
-        """
-        Tries to restart httpd using systemctl to generate the self signed keypair.
-        """
-        try:
-            util.run_script(['systemctl', 'restart', 'httpd'])
-        except errors.SubprocessError as err:
-            raise errors.MisconfigurationError(str(err))
-
-        # Finish with actual config check to see if systemctl restart helped
-        super(FedoraConfigurator, self).config_test()
-
-    def _prepare_options(self):
-        """
-        Override the options dictionary initialization to keep using apachectl
-        instead of httpd and so take advantages of this new bash script in newer versions
-        of Fedora to restart httpd.
-        """
-        super(FedoraConfigurator, self)._prepare_options()
-        self.options["restart_cmd"][0] = 'apachectl'
-        self.options["restart_cmd_alt"][0] = 'apachectl'
-        self.options["conftest_cmd"][0] = 'apachectl'
-
-
-class FedoraParser(parser.ApacheParser):
-    """Fedora 29+ specific ApacheParser override class"""
-    def __init__(self, *args, **kwargs):
-        # Fedora 29+ specific configuration file for Apache
-        self.sysconfig_filep = "/etc/sysconfig/httpd"
-        super(FedoraParser, self).__init__(*args, **kwargs)
-
-    def update_runtime_variables(self):
-        """ Override for update_runtime_variables for custom parsing """
-        # Opportunistic, works if SELinux not enforced
-        super(FedoraParser, self).update_runtime_variables()
-        self._parse_sysconfig_var()
-
-    def _parse_sysconfig_var(self):
-        """ Parses Apache CLI options from Fedora configuration file """
-        defines = apache_util.parse_define_file(self.sysconfig_filep, "OPTIONS")
-        for k in defines:
-            self.variables[k] = defines[k]

certbot-apache/certbot_apache/override_gentoo.py

@@ -1,4 +1,6 @@
 """ Distribution specific override class for Gentoo Linux """
+import pkg_resources
+
 import zope.interface
 
 from certbot import interfaces
@@ -16,31 +18,24 @@ class GentooConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/apache2/vhosts.d",
         vhost_files="*.conf",
         logs_root="/var/log/apache2",
-        ctl="apache2ctl",
-        version_cmd=['apache2ctl', '-v'],
+        version_cmd=['/usr/sbin/apache2', '-v'],
+        apache_cmd="apache2ctl",
         restart_cmd=['apache2ctl', 'graceful'],
-        restart_cmd_alt=['apache2ctl', 'restart'],
         conftest_cmd=['apache2ctl', 'configtest'],
         enmod=None,
         dismod=None,
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
+        handle_mods=False,
         handle_sites=False,
         challenge_location="/etc/apache2/vhosts.d",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "options-ssl-apache.conf")
     )
 
-    def _prepare_options(self):
-        """
-        Override the options dictionary initialization in order to support
-        alternative restart cmd used in Gentoo.
-        """
-        super(GentooConfigurator, self)._prepare_options()
-        self.options["restart_cmd_alt"][0] = self.option("ctl")
-
     def get_parser(self):
         """Initializes the ApacheParser"""
         return GentooParser(
-            self.option("server_root"), self.option("vhost_root"),
+            self.aug, self.conf("server-root"), self.conf("vhost-root"),
             self.version, configurator=self)
 
 
@@ -60,12 +55,12 @@ class GentooParser(parser.ApacheParser):
         """ Parses Apache CLI options from Gentoo configuration file """
         defines = apache_util.parse_define_file(self.apacheconfig_filep,
                                                 "APACHE2_OPTS")
-        for k in defines:
+        for k in defines.keys():
             self.variables[k] = defines[k]
 
     def update_modules(self):
         """Get loaded modules from httpd process, and add them to DOM"""
-        mod_cmd = [self.configurator.option("ctl"), "modules"]
+        mod_cmd = [self.configurator.constant("apache_cmd"), "modules"]
         matches = self.parse_from_subprocess(mod_cmd, r"(.*)_module")
         for mod in matches:
             self.add_mod(mod.strip())

certbot-apache/certbot_apache/override_suse.py

@@ -1,4 +1,6 @@
 """ Distribution specific override class for OpenSUSE """
+import pkg_resources
+
 import zope.interface
 
 from certbot import interfaces
@@ -14,14 +16,16 @@ class OpenSUSEConfigurator(configurator.ApacheConfigurator):
         vhost_root="/etc/apache2/vhosts.d",
         vhost_files="*.conf",
         logs_root="/var/log/apache2",
-        ctl="apache2ctl",
         version_cmd=['apache2ctl', '-v'],
+        apache_cmd="apache2ctl",
         restart_cmd=['apache2ctl', 'graceful'],
         conftest_cmd=['apache2ctl', 'configtest'],
         enmod="a2enmod",
         dismod="a2dismod",
         le_vhost_ext="-le-ssl.conf",
-        handle_modules=False,
+        handle_mods=False,
         handle_sites=False,
         challenge_location="/etc/apache2/vhosts.d",
+        MOD_SSL_CONF_SRC=pkg_resources.resource_filename(
+            "certbot_apache", "options-ssl-apache.conf")
     )

certbot-apache/certbot_apache/parser.py

@@ -2,24 +2,19 @@
 import copy
 import fnmatch
 import logging
+import os
 import re
 import subprocess
 import sys
 
 import six
 
-from acme.magic_typing import Dict, List, Set  # pylint: disable=unused-import, no-name-in-module
-
 from certbot import errors
-from certbot.compat import os
-
-from certbot_apache import constants
 
 logger = logging.getLogger(__name__)
 
 
 class ApacheParser(object):
-    # pylint: disable=too-many-public-methods
     """Class handles the fine details of parsing the Apache Configuration.
 
     .. todo:: Make parsing general... remove sites-available etc...
@@ -34,7 +29,7 @@ class ApacheParser(object):
     arg_var_interpreter = re.compile(r"\$\{[^ \}]*}")
     fnmatch_chars = set(["*", "?", "\\", "[", "]"])
 
-    def __init__(self, root, vhostroot=None, version=(2, 4),
+    def __init__(self, aug, root, vhostroot=None, version=(2, 4),
                  configurator=None):
         # Note: Order is important here.
 
@@ -43,20 +38,11 @@ class ApacheParser(object):
         # issues with aug.load() after adding new files / defines to parse tree
         self.configurator = configurator
 
-        # Initialize augeas
-        self.aug = None
-        self.init_augeas()
-
-        if not self.check_aug_version():
-            raise errors.NotSupportedError(
-                "Apache plugin support requires libaugeas0 and augeas-lenses "
-                "version 1.2.0 or higher, please make sure you have you have "
-                "those installed.")
-
-        self.modules = set()  # type: Set[str]
-        self.parser_paths = {}  # type: Dict[str, List[str]]
-        self.variables = {}  # type: Dict[str, str]
+        self.modules = set()
+        self.parser_paths = {}
+        self.variables = {}
 
+        self.aug = aug
         # Find configuration root and make sure augeas can parse it.
         self.root = os.path.abspath(root)
         self.loc = {"root": self._find_config_root()}
@@ -81,153 +67,13 @@ class ApacheParser(object):
         # Must also attempt to parse additional virtual host root
         if vhostroot:
             self.parse_file(os.path.abspath(vhostroot) + "/" +
-                            self.configurator.option("vhost_files"))
+                            self.configurator.constant("vhost_files"))
 
         # check to see if there were unparsed define statements
         if version < (2, 4):
             if self.find_dir("Define", exclude=False):
                 raise errors.PluginError("Error parsing runtime variables")
 
-    def init_augeas(self):
-        """ Initialize the actual Augeas instance """
-
-        try:
-            import augeas
-        except ImportError:  # pragma: no cover
-            raise errors.NoInstallationError("Problem in Augeas installation")
-
-        self.aug = augeas.Augeas(
-            # specify a directory to load our preferred lens from
-            loadpath=constants.AUGEAS_LENS_DIR,
-            # Do not save backup (we do it ourselves), do not load
-            # anything by default
-            flags=(augeas.Augeas.NONE |
-                   augeas.Augeas.NO_MODL_AUTOLOAD |
-                   augeas.Augeas.ENABLE_SPAN))
-
-    def check_parsing_errors(self, lens):
-        """Verify Augeas can parse all of the lens files.
-
-        :param str lens: lens to check for errors
-
-        :raises .errors.PluginError: If there has been an error in parsing with
-            the specified lens.
-
-        """
-        error_files = self.aug.match("/augeas//error")
-
-        for path in error_files:
-            # Check to see if it was an error resulting from the use of
-            # the httpd lens
-            lens_path = self.aug.get(path + "/lens")
-            # As aug.get may return null
-            if lens_path and lens in lens_path:
-                msg = (
-                    "There has been an error in parsing the file {0} on line {1}: "
-                    "{2}".format(
-                    # Strip off /augeas/files and /error
-                    path[13:len(path) - 6],
-                    self.aug.get(path + "/line"),
-                    self.aug.get(path + "/message")))
-                raise errors.PluginError(msg)
-
-    def check_aug_version(self):
-        """ Checks that we have recent enough version of libaugeas.
-        If augeas version is recent enough, it will support case insensitive
-        regexp matching"""
-
-        self.aug.set("/test/path/testing/arg", "aRgUMeNT")
-        try:
-            matches = self.aug.match(
-                "/test//*[self::arg=~regexp('argument', 'i')]")
-        except RuntimeError:
-            self.aug.remove("/test/path")
-            return False
-        self.aug.remove("/test/path")
-        return matches
-
-    def unsaved_files(self):
-        """Lists files that have modified Augeas DOM but the changes have not
-        been written to the filesystem yet, used by `self.save()` and
-        ApacheConfigurator to check the file state.
-
-        :raises .errors.PluginError: If there was an error in Augeas, in
-            an attempt to save the configuration, or an error creating a
-            checkpoint
-
-        :returns: `set` of unsaved files
-        """
-        save_state = self.aug.get("/augeas/save")
-        self.aug.set("/augeas/save", "noop")
-        # Existing Errors
-        ex_errs = self.aug.match("/augeas//error")
-        try:
-            # This is a noop save
-            self.aug.save()
-        except (RuntimeError, IOError):
-            self._log_save_errors(ex_errs)
-            # Erase Save Notes
-            self.configurator.save_notes = ""
-            raise errors.PluginError(
-                "Error saving files, check logs for more info.")
-
-        # Return the original save method
-        self.aug.set("/augeas/save", save_state)
-
-        # Retrieve list of modified files
-        # Note: Noop saves can cause the file to be listed twice, I used a
-        # set to remove this possibility. This is a known augeas 0.10 error.
-        save_paths = self.aug.match("/augeas/events/saved")
-
-        save_files = set()
-        if save_paths:
-            for path in save_paths:
-                save_files.add(self.aug.get(path)[6:])
-        return save_files
-
-    def ensure_augeas_state(self):
-        """Makes sure that all Augeas dom changes are written to files to avoid
-        loss of configuration directives when doing additional augeas parsing,
-        causing a possible augeas.load() resulting dom reset
-        """
-
-        if self.unsaved_files():
-            self.configurator.save_notes += "(autosave)"
-            self.configurator.save()
-
-    def save(self, save_files):
-        """Saves all changes to the configuration files.
-
-        save() is called from ApacheConfigurator to handle the parser specific
-        tasks of saving.
-
-        :param list save_files: list of strings of file paths that we need to save.
-
-        """
-        self.configurator.save_notes = ""
-        self.aug.save()
-
-        # Force reload if files were modified
-        # This is needed to recalculate augeas directive span
-        if save_files:
-            for sf in save_files:
-                self.aug.remove("/files/"+sf)
-            self.aug.load()
-
-    def _log_save_errors(self, ex_errs):
-        """Log errors due to bad Augeas save.
-
-        :param list ex_errs: Existing errors before save
-
-        """
-        # Check for the root of save problems
-        new_errs = self.aug.match("/augeas//error")
-        # logger.error("During Save - %s", mod_conf)
-        logger.error("Unable to save files: %s. Attempted Save Notes: %s",
-                     ", ".join(err[13:len(err) - 6] for err in new_errs
-                               # Only new errors caused by recent save
-                               if err not in ex_errs), self.configurator.save_notes)
-
     def add_include(self, main_config, inc_path):
         """Add Include for a new configuration file if one does not exist
 
@@ -235,7 +81,7 @@ class ApacheParser(object):
         :param str inc_path: path of file to include
 
         """
-        if not self.find_dir(case_i("Include"), inc_path):
+        if len(self.find_dir(case_i("Include"), inc_path)) == 0:
             logger.debug("Adding Include %s to %s",
                          inc_path, get_aug_path(main_config))
             self.add_dir(
@@ -245,7 +91,12 @@ class ApacheParser(object):
             # Add new path to parser paths
             new_dir = os.path.dirname(inc_path)
             new_file = os.path.basename(inc_path)
-            self.existing_paths.setdefault(new_dir, []).append(new_file)
+            if new_dir in self.existing_paths.keys():
+                # Add to existing path
+                self.existing_paths[new_dir].append(new_file)
+            else:
+                # Create a new path
+                self.existing_paths[new_dir] = [new_file]
 
     def add_mod(self, mod_name):
         """Shortcut for updating parser modules."""
@@ -268,7 +119,7 @@ class ApacheParser(object):
             the iteration issue.  Else... parse and enable mods at same time.
 
         """
-        mods = set()  # type: Set[str]
+        mods = set()
         matches = self.find_dir("LoadModule")
         iterator = iter(matches)
         # Make sure prev_size != cur_size for do: while: iteration
@@ -286,7 +137,7 @@ class ApacheParser(object):
                     mods.add(os.path.basename(mod_filename)[:-2] + "c")
                 else:
                     logger.debug("Could not read LoadModule directive from " +
-                                 "Augeas path: %s", match_name[6:])
+                                 "Augeas path: {0}".format(match_name[6:]))
         self.modules.update(mods)
 
     def update_runtime_variables(self):
@@ -299,7 +150,7 @@ class ApacheParser(object):
         """Get Defines from httpd process"""
 
         variables = dict()
-        define_cmd = [self.configurator.option("ctl"), "-t", "-D",
+        define_cmd = [self.configurator.constant("apache_cmd"), "-t", "-D",
                       "DUMP_RUN_CFG"]
         matches = self.parse_from_subprocess(define_cmd, r"Define: ([^ \n]*)")
         try:
@@ -326,7 +177,7 @@ class ApacheParser(object):
         # configuration files
         _ = self.find_dir("Include")
 
-        inc_cmd = [self.configurator.option("ctl"), "-t", "-D",
+        inc_cmd = [self.configurator.constant("apache_cmd"), "-t", "-D",
                    "DUMP_INCLUDES"]
         matches = self.parse_from_subprocess(inc_cmd, r"\(.*\) (.*)")
         if matches:
@@ -337,7 +188,7 @@ class ApacheParser(object):
     def update_modules(self):
         """Get loaded modules from httpd process, and add them to DOM"""
 
-        mod_cmd = [self.configurator.option("ctl"), "-t", "-D",
+        mod_cmd = [self.configurator.constant("apache_cmd"), "-t", "-D",
                        "DUMP_MODULES"]
         matches = self.parse_from_subprocess(mod_cmd, r"(.*)_module")
         for mod in matches:
@@ -376,8 +227,8 @@ class ApacheParser(object):
                 "Error running command %s for runtime parameters!%s",
                 command, os.linesep)
             raise errors.MisconfigurationError(
-                "Error accessing loaded Apache parameters: {0}".format(
-                command))
+                "Error accessing loaded Apache parameters: %s",
+                command)
         # Small errors that do not impede
         if proc.returncode != 0:
             logger.warning("Error in checking parameter list: %s", stderr)
@@ -403,12 +254,12 @@ class ApacheParser(object):
         """
         filtered = []
         if args == 1:
-            for i, match in enumerate(matches):
-                if match.endswith("/arg"):
+            for i in range(len(matches)):
+                if matches[i].endswith("/arg"):
                     filtered.append(matches[i][:-4])
         else:
-            for i, match in enumerate(matches):
-                if match.endswith("/arg[%d]" % args):
+            for i in range(len(matches)):
+                if matches[i].endswith("/arg[%d]" % args):
                     # Make sure we don't cause an IndexError (end of list)
                     # Check to make sure arg + 1 doesn't exist
                     if (i == (len(matches) - 1) or
@@ -433,7 +284,7 @@ class ApacheParser(object):
         """
         # TODO: Add error checking code... does the path given even exist?
         #       Does it throw exceptions?
-        if_mod_path = self.get_ifmod(aug_conf_path, "mod_ssl.c")
+        if_mod_path = self._get_ifmod(aug_conf_path, "mod_ssl.c")
         # IfModule can have only one valid argument, so append after
         self.aug.insert(if_mod_path + "arg", "directive", False)
         nvh_path = if_mod_path + "directive[1]"
@@ -444,54 +295,22 @@ class ApacheParser(object):
             for i, arg in enumerate(args):
                 self.aug.set("%s/arg[%d]" % (nvh_path, i + 1), arg)
 
-    def get_ifmod(self, aug_conf_path, mod, beginning=False):
+    def _get_ifmod(self, aug_conf_path, mod):
         """Returns the path to <IfMod mod> and creates one if it doesn't exist.
 
         :param str aug_conf_path: Augeas configuration path
         :param str mod: module ie. mod_ssl.c
-        :param bool beginning: If the IfModule should be created to the beginning
-            of augeas path DOM tree.
-
-        :returns: Augeas path of the requested IfModule directive that pre-existed
-            or was created during the process. The path may be dynamic,
-            i.e. .../IfModule[last()]
-        :rtype: str
 
         """
         if_mods = self.aug.match(("%s/IfModule/*[self::arg='%s']" %
                                   (aug_conf_path, mod)))
-        if not if_mods:
-            return self.create_ifmod(aug_conf_path, mod, beginning)
-
+        if len(if_mods) == 0:
+            self.aug.set("%s/IfModule[last() + 1]" % aug_conf_path, "")
+            self.aug.set("%s/IfModule[last()]/arg" % aug_conf_path, mod)
+            if_mods = self.aug.match(("%s/IfModule/*[self::arg='%s']" %
+                                      (aug_conf_path, mod)))
         # Strip off "arg" at end of first ifmod path
-        return if_mods[0].rpartition("arg")[0]
-
-    def create_ifmod(self, aug_conf_path, mod, beginning=False):
-        """Creates a new <IfMod mod> and returns its path.
-
-        :param str aug_conf_path: Augeas configuration path
-        :param str mod: module ie. mod_ssl.c
-        :param bool beginning: If the IfModule should be created to the beginning
-            of augeas path DOM tree.
-
-        :returns: Augeas path of the newly created IfModule directive.
-            The path may be dynamic, i.e. .../IfModule[last()]
-        :rtype: str
-
-        """
-        if beginning:
-            c_path_arg = "{}/IfModule[1]/arg".format(aug_conf_path)
-            # Insert IfModule before the first directive
-            self.aug.insert("{}/directive[1]".format(aug_conf_path),
-                            "IfModule", True)
-            retpath = "{}/IfModule[1]/".format(aug_conf_path)
-        else:
-            c_path = "{}/IfModule[last() + 1]".format(aug_conf_path)
-            c_path_arg = "{}/IfModule[last()]/arg".format(aug_conf_path)
-            self.aug.set(c_path, "")
-            retpath = "{}/IfModule[last()]/".format(aug_conf_path)
-        self.aug.set(c_path_arg, mod)
-        return retpath
+        return if_mods[0][:len(if_mods[0]) - 3]
 
     def add_dir(self, aug_conf_path, directive, args):
         """Appends directive to the end fo the file given by aug_conf_path.
@@ -513,54 +332,6 @@ class ApacheParser(object):
         else:
             self.aug.set(aug_conf_path + "/directive[last()]/arg", args)
 
-    def add_dir_beginning(self, aug_conf_path, dirname, args):
-        """Adds the directive to the beginning of defined aug_conf_path.
-
-        :param str aug_conf_path: Augeas configuration path to add directive
-        :param str dirname: Directive to add
-        :param args: Value of the directive. ie. Listen 443, 443 is arg
-        :type args: list or str
-        """
-        first_dir = aug_conf_path + "/directive[1]"
-        self.aug.insert(first_dir, "directive", True)
-        self.aug.set(first_dir, dirname)
-        if isinstance(args, list):
-            for i, value in enumerate(args, 1):
-                self.aug.set(first_dir + "/arg[%d]" % (i), value)
-        else:
-            self.aug.set(first_dir + "/arg", args)
-
-    def add_comment(self, aug_conf_path, comment):
-        """Adds the comment to the augeas path
-
-        :param str aug_conf_path: Augeas configuration path to add directive
-        :param str comment: Comment content
-
-        """
-        self.aug.set(aug_conf_path + "/#comment[last() + 1]", comment)
-
-    def find_comments(self, arg, start=None):
-        """Finds a comment with specified content from the provided DOM path
-
-        :param str arg: Comment content to search
-        :param str start: Beginning Augeas path to begin looking
-
-        :returns: List of augeas paths containing the comment content
-        :rtype: list
-
-        """
-        if not start:
-            start = get_aug_path(self.root)
-
-        comments = self.aug.match("%s//*[label() = '#comment']" % start)
-
-        results = []
-        for comment in comments:
-            c_content = self.aug.get(comment)
-            if c_content and arg in c_content:
-                results.append(comment)
-        return results
-
     def find_dir(self, directive, arg=None, start=None, exclude=True):
         """Finds directive in the configuration.
 
@@ -620,7 +391,7 @@ class ApacheParser(object):
         else:
             arg_suffix = "/*[self::arg=~regexp('%s')]" % case_i(arg)
 
-        ordered_matches = []  # type: List[str]
+        ordered_matches = []
 
         # TODO: Wildcards should be included in alphabetical order
         # https://httpd.apache.org/docs/2.4/mod/core.html#include
@@ -637,20 +408,6 @@ class ApacheParser(object):
 
         return ordered_matches
 
-    def get_all_args(self, match):
-        """
-        Tries to fetch all arguments for a directive. See get_arg.
-
-        Note that if match is an ancestor node, it returns all names of
-        child directives as well as the list of arguments.
-
-        """
-
-        if match[-1] != "/":
-            match = match+"/"
-        allargs = self.aug.match(match + '*')
-        return [self.get_arg(arg) for arg in allargs]
-
     def get_arg(self, match):
         """Uses augeas.get to get argument value and interprets result.
 
@@ -794,8 +551,9 @@ class ApacheParser(object):
         if sys.version_info < (3, 6):
             # This strips off final /Z(?ms)
             return fnmatch.translate(clean_fn_match)[:-7]
-        # Since Python 3.6, it returns a different pattern like (?s:.*\.load)\Z
-        return fnmatch.translate(clean_fn_match)[4:-3]  # pragma: no cover
+        else:  # pragma: no cover
+            # Since Python 3.6, it returns a different pattern like (?s:.*\.load)\Z
+            return fnmatch.translate(clean_fn_match)[4:-3]
 
     def parse_file(self, filepath):
         """Parse file with Augeas
@@ -809,7 +567,8 @@ class ApacheParser(object):
         use_new, remove_old = self._check_path_actions(filepath)
         # Ensure that we have the latest Augeas DOM state on disk before
         # calling aug.load() which reloads the state from disk
-        self.ensure_augeas_state()
+        if self.configurator:
+            self.configurator.ensure_augeas_state()
         # Test if augeas included file for Httpd.lens
         # Note: This works for augeas globs, ie. *.conf
         if use_new:
@@ -876,7 +635,10 @@ class ApacheParser(object):
                 use_new = False
             else:
                 use_new = True
-            remove_old = new_file_match == "*"
+            if new_file_match == "*":
+                remove_old = True
+            else:
+                remove_old = False
         except KeyError:
             use_new = True
             remove_old = False

certbot-apache/certbot_apache/tests/apache-conf-files/apache-conf-test

@@ -3,11 +3,6 @@
 # A hackish script to see if the client is behaving as expected 
 # with each of the "passing" conf files.
 
-if [ -z "$SERVER" ]; then
-    echo "Please set SERVER to the ACME server's directory URL."
-    exit 1
-fi
-
 export EA=/etc/apache2/ 
 TESTDIR="`dirname $0`"
 cd $TESTDIR/passing
@@ -51,7 +46,6 @@ function Cleanup() {
 
 # if our environment asks us to enable modules, do our best!
 if [ "$1" = --debian-modules ] ; then
-    sudo apt-get install -y apache2
     sudo apt-get install -y libapache2-mod-wsgi
     sudo apt-get install -y libapache2-mod-macro
 
@@ -61,16 +55,13 @@ if [ "$1" = --debian-modules ] ; then
     done
 fi
 
-CERTBOT_CMD="sudo $(command -v certbot) --server $SERVER -vvvv"
-CERTBOT_CMD="$CERTBOT_CMD --debug --apache --register-unsafely-without-email"
-CERTBOT_CMD="$CERTBOT_CMD --agree-tos certonly -t --no-verify-ssl"
 
 FAILS=0
 trap CleanupExit INT
 for f in *.conf ; do 
     echo -n  testing "$f"...
     Setup
-    RESULT=`echo c | $CERTBOT_CMD 2>&1`
+    RESULT=`echo c | sudo $(command -v certbot) -vvvv --debug --staging --apache --register-unsafely-without-email --agree-tos certonly -t 2>&1`
     if echo $RESULT | grep -Eq \("Which names would you like"\|"mod_macro is not yet"\) ; then
         echo passed
     else

certbot-apache/certbot_apache/tests/apache-conf-files/apache-conf-test-pebble.py

@@ -1,27 +0,0 @@
-#!/usr/bin/env python
-"""
-This executable script wraps the apache-conf-test bash script, in order to setup a pebble instance
-before its execution. Directory URL is passed through the SERVER environment variable.
-"""
-import os
-import subprocess
-import sys
-
-from certbot_integration_tests.utils import acme_server
-
-SCRIPT_DIRNAME = os.path.dirname(__file__)
-
-
-def main(args=None):
-    if not args:
-        args = sys.argv[1:]
-    with acme_server.ACMEServer('pebble', [], False) as acme_xdist:
-        environ = os.environ.copy()
-        environ['SERVER'] = acme_xdist['directory_url']
-        command = [os.path.join(SCRIPT_DIRNAME, 'apache-conf-test')]
-        command.extend(args)
-        return subprocess.call(command, env=environ)
-
-
-if __name__ == '__main__':
-    sys.exit(main())

certbot-apache/certbot_apache/tests/apache-conf-files/passing/finalize-1243.conf

@@ -1,7 +1,7 @@
 #LoadModule ssl_module modules/mod_ssl.so
 
-Listen 4443
-<VirtualHost *:4443>
+Listen 443
+<VirtualHost *:443>
 	# The ServerName directive sets the request scheme, hostname and port that
 	# the server uses to identify itself. This is used when creating
 	# redirection URLs. In the context of virtual hosts, the ServerName

certbot-apache/certbot_apache/tests/augeas_configurator_test.py

@@ -1,4 +1,5 @@
-"""Test for certbot_apache.configurator implementations of reverter"""
+"""Test for certbot_apache.augeas_configurator."""
+import os
 import shutil
 import unittest
 
@@ -9,12 +10,12 @@ from certbot import errors
 from certbot_apache.tests import util
 
 
-class ConfiguratorReverterTest(util.ApacheTest):
-    """Test for ApacheConfigurator reverter methods"""
+class AugeasConfiguratorTest(util.ApacheTest):
+    """Test for Augeas Configurator base class."""
 
 
     def setUp(self):  # pylint: disable=arguments-differ
-        super(ConfiguratorReverterTest, self).setUp()
+        super(AugeasConfiguratorTest, self).setUp()
 
         self.config = util.get_apache_configurator(
             self.config_path, self.vhost_path, self.config_dir, self.work_dir)
@@ -27,6 +28,20 @@ class ConfiguratorReverterTest(util.ApacheTest):
         shutil.rmtree(self.work_dir)
         shutil.rmtree(self.temp_dir)
 
+    def test_bad_parse(self):
+        # pylint: disable=protected-access
+        self.config.parser.parse_file(os.path.join(
+            self.config.parser.root, "conf-available", "bad_conf_file.conf"))
+        self.assertRaises(
+            errors.PluginError, self.config.check_parsing_errors, "httpd.aug")
+
+    def test_bad_save(self):
+        mock_save = mock.Mock()
+        mock_save.side_effect = IOError
+        self.config.aug.save = mock_save
+
+        self.assertRaises(errors.PluginError, self.config.save)
+
     def test_bad_save_checkpoint(self):
         self.config.reverter.add_to_checkpoint = mock.Mock(
             side_effect=errors.ReverterError)
@@ -48,9 +63,23 @@ class ConfiguratorReverterTest(util.ApacheTest):
 
         self.assertTrue(mock_finalize.is_called)
 
+    def test_recovery_routine(self):
+        mock_load = mock.Mock()
+        self.config.aug.load = mock_load
+
+        self.config.recovery_routine()
+        self.assertEqual(mock_load.call_count, 1)
+
+    def test_recovery_routine_error(self):
+        self.config.reverter.recovery_routine = mock.Mock(
+            side_effect=errors.ReverterError)
+
+        self.assertRaises(
+            errors.PluginError, self.config.recovery_routine)
+
     def test_revert_challenge_config(self):
         mock_load = mock.Mock()
-        self.config.parser.aug.load = mock_load
+        self.config.aug.load = mock_load
 
         self.config.revert_challenge_config()
         self.assertEqual(mock_load.call_count, 1)
@@ -64,7 +93,7 @@ class ConfiguratorReverterTest(util.ApacheTest):
 
     def test_rollback_checkpoints(self):
         mock_load = mock.Mock()
-        self.config.parser.aug.load = mock_load
+        self.config.aug.load = mock_load
 
         self.config.rollback_checkpoints()
         self.assertEqual(mock_load.call_count, 1)
@@ -74,11 +103,13 @@ class ConfiguratorReverterTest(util.ApacheTest):
             side_effect=errors.ReverterError)
         self.assertRaises(errors.PluginError, self.config.rollback_checkpoints)
 
-    def test_recovery_routine_reload(self):
-        mock_load = mock.Mock()
-        self.config.parser.aug.load = mock_load
-        self.config.recovery_routine()
-        self.assertEqual(mock_load.call_count, 1)
+    def test_view_config_changes(self):
+        self.config.view_config_changes()
+
+    def test_view_config_changes_error(self):
+        self.config.reverter.view_config_changes = mock.Mock(
+            side_effect=errors.ReverterError)
+        self.assertRaises(errors.PluginError, self.config.view_config_changes)
 
 
 if __name__ == "__main__":

certbot-apache/certbot_apache/tests/autohsts_test.py

@@ -1,188 +0,0 @@
-# pylint: disable=too-many-public-methods,too-many-lines
-"""Test for certbot_apache.configurator AutoHSTS functionality"""
-import re
-import unittest
-import mock
-# six is used in mock.patch()
-import six  # pylint: disable=unused-import
-
-from certbot import errors
-from certbot_apache import constants
-from certbot_apache.tests import util
-
-
-class AutoHSTSTest(util.ApacheTest):
-    """Tests for AutoHSTS feature"""
-    # pylint: disable=protected-access
-
-    def setUp(self):  # pylint: disable=arguments-differ
-        super(AutoHSTSTest, self).setUp()
-
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir)
-        self.config.parser.modules.add("headers_module")
-        self.config.parser.modules.add("mod_headers.c")
-        self.config.parser.modules.add("ssl_module")
-        self.config.parser.modules.add("mod_ssl.c")
-
-        self.vh_truth = util.get_vh_truth(
-            self.temp_dir, "debian_apache_2_4/multiple_vhosts")
-
-    def get_autohsts_value(self, vh_path):
-        """ Get value from Strict-Transport-Security header """
-        header_path = self.config.parser.find_dir("Header", None, vh_path)
-        if header_path:
-            pat = '(?:[ "]|^)(strict-transport-security)(?:[ "]|$)'
-            for head in header_path:
-                if re.search(pat, self.config.parser.aug.get(head).lower()):
-                    return self.config.parser.aug.get(
-                        head.replace("arg[3]", "arg[4]"))
-        return None  # pragma: no cover
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
-    def test_autohsts_enable_headers_mod(self, mock_enable, _restart):
-        self.config.parser.modules.discard("headers_module")
-        self.config.parser.modules.discard("mod_header.c")
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        self.assertTrue(mock_enable.called)
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    def test_autohsts_deploy_already_exists(self, _restart):
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        self.assertRaises(errors.PluginEnhancementAlreadyPresent,
-                          self.config.enable_autohsts,
-                          mock.MagicMock(), ["ocspvhost.com"])
-
-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.prepare")
-    def test_autohsts_increase(self, mock_prepare, _mock_restart):
-        self.config._prepared = False
-        maxage = "\"max-age={0}\""
-        initial_val = maxage.format(constants.AUTOHSTS_STEPS[0])
-        inc_val = maxage.format(constants.AUTOHSTS_STEPS[1])
-
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        # Verify initial value
-        self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                          initial_val)
-        # Increase
-        self.config.update_autohsts(mock.MagicMock())
-        # Verify increased value
-        self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                          inc_val)
-        self.assertTrue(mock_prepare.called)
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._autohsts_increase")
-    def test_autohsts_increase_noop(self, mock_increase, _restart):
-        maxage = "\"max-age={0}\""
-        initial_val = maxage.format(constants.AUTOHSTS_STEPS[0])
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        # Verify initial value
-        self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                          initial_val)
-
-        self.config.update_autohsts(mock.MagicMock())
-        # Freq not patched, so value shouldn't increase
-        self.assertFalse(mock_increase.called)
-
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
-    def test_autohsts_increase_no_header(self, _restart):
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        # Remove the header
-        dir_locs = self.config.parser.find_dir("Header", None,
-                                              self.vh_truth[7].path)
-        dir_loc = "/".join(dir_locs[0].split("/")[:-1])
-        self.config.parser.aug.remove(dir_loc)
-        self.assertRaises(errors.PluginError,
-                          self.config.update_autohsts,
-                          mock.MagicMock())
-
-    @mock.patch("certbot_apache.constants.AUTOHSTS_FREQ", 0)
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    def test_autohsts_increase_and_make_permanent(self, _mock_restart):
-        maxage = "\"max-age={0}\""
-        max_val = maxage.format(constants.AUTOHSTS_PERMANENT)
-        mock_lineage = mock.MagicMock()
-        mock_lineage.key_path = "/etc/apache2/ssl/key-certbot_15.pem"
-        self.config.enable_autohsts(mock.MagicMock(), ["ocspvhost.com"])
-        for i in range(len(constants.AUTOHSTS_STEPS)-1):
-            # Ensure that value is not made permanent prematurely
-            self.config.deploy_autohsts(mock_lineage)
-            self.assertNotEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                                 max_val)
-            self.config.update_autohsts(mock.MagicMock())
-            # Value should match pre-permanent increment step
-            cur_val = maxage.format(constants.AUTOHSTS_STEPS[i+1])
-            self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                              cur_val)
-        # Ensure that the value is raised to max
-        self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                          maxage.format(constants.AUTOHSTS_STEPS[-1]))
-        # Make permanent
-        self.config.deploy_autohsts(mock_lineage)
-        self.assertEqual(self.get_autohsts_value(self.vh_truth[7].path),
-                          max_val)
-
-    def test_autohsts_update_noop(self):
-        with mock.patch("time.time") as mock_time:
-            # Time mock is used to make sure that the execution does not
-            # continue when no autohsts entries exist in pluginstorage
-            self.config.update_autohsts(mock.MagicMock())
-            self.assertFalse(mock_time.called)
-
-    def test_autohsts_make_permanent_noop(self):
-        self.config.storage.put = mock.MagicMock()
-        self.config.deploy_autohsts(mock.MagicMock())
-        # Make sure that the execution does not continue when no entries in store
-        self.assertFalse(self.config.storage.put.called)
-
-    @mock.patch("certbot_apache.display_ops.select_vhost")
-    def test_autohsts_no_ssl_vhost(self, mock_select):
-        mock_select.return_value = self.vh_truth[0]
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
-            self.assertRaises(errors.PluginError,
-                              self.config.enable_autohsts,
-                              mock.MagicMock(), "invalid.example.com")
-            self.assertTrue(
-                "Certbot was not able to find SSL" in mock_log.call_args[0][0])
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.add_vhost_id")
-    def test_autohsts_dont_enhance_twice(self, mock_id, _restart):
-        mock_id.return_value = "1234567"
-        self.config.enable_autohsts(mock.MagicMock(),
-                                    ["ocspvhost.com", "ocspvhost.com"])
-        self.assertEqual(mock_id.call_count, 1)
-
-    def test_autohsts_remove_orphaned(self):
-        # pylint: disable=protected-access
-        self.config._autohsts_fetch_state()
-        self.config._autohsts["orphan_id"] = {"laststep": 0, "timestamp": 0}
-
-        self.config._autohsts_save_state()
-        self.config.update_autohsts(mock.MagicMock())
-        self.assertFalse("orphan_id" in self.config._autohsts)
-        # Make sure it's removed from the pluginstorage file as well
-        self.config._autohsts = None
-        self.config._autohsts_fetch_state()
-        self.assertFalse(self.config._autohsts)
-
-    def test_autohsts_make_permanent_vhost_not_found(self):
-        # pylint: disable=protected-access
-        self.config._autohsts_fetch_state()
-        self.config._autohsts["orphan_id"] = {"laststep": 999, "timestamp": 0}
-        self.config._autohsts_save_state()
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
-            self.config.deploy_autohsts(mock.MagicMock())
-            self.assertTrue(mock_log.called)
-            self.assertTrue(
-                "VirtualHost with id orphan_id was not" in mock_log.call_args[0][0])
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/centos6_test.py

@@ -1,222 +0,0 @@
-"""Test for certbot_apache.configurator for CentOS 6 overrides"""
-import unittest
-
-from certbot.compat import os
-from certbot.errors import MisconfigurationError
-
-from certbot_apache import obj
-from certbot_apache import override_centos
-from certbot_apache import parser
-from certbot_apache.tests import util
-
-
-def get_vh_truth(temp_dir, config_name):
-    """Return the ground truth for the specified directory."""
-    prefix = os.path.join(
-        temp_dir, config_name, "httpd/conf.d")
-
-    aug_pre = "/files" + prefix
-    vh_truth = [
-        obj.VirtualHost(
-            os.path.join(prefix, "test.example.com.conf"),
-            os.path.join(aug_pre, "test.example.com.conf/VirtualHost"),
-            set([obj.Addr.fromstring("*:80")]),
-            False, True, "test.example.com"),
-        obj.VirtualHost(
-            os.path.join(prefix, "ssl.conf"),
-            os.path.join(aug_pre, "ssl.conf/VirtualHost"),
-            set([obj.Addr.fromstring("_default_:443")]),
-            True, True, None)
-    ]
-    return vh_truth
-
-class CentOS6Tests(util.ApacheTest):
-    """Tests for CentOS 6"""
-
-    def setUp(self):  # pylint: disable=arguments-differ
-        test_dir = "centos6_apache/apache"
-        config_root = "centos6_apache/apache/httpd"
-        vhost_root = "centos6_apache/apache/httpd/conf.d"
-        super(CentOS6Tests, self).setUp(test_dir=test_dir,
-                                        config_root=config_root,
-                                        vhost_root=vhost_root)
-
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
-            version=(2, 2, 15), os_info="centos")
-        self.vh_truth = get_vh_truth(
-            self.temp_dir, "centos6_apache/apache")
-
-    def test_get_parser(self):
-        self.assertTrue(isinstance(self.config.parser,
-                                   override_centos.CentOSParser))
-
-    def test_get_virtual_hosts(self):
-        """Make sure all vhosts are being properly found."""
-        vhs = self.config.get_virtual_hosts()
-        self.assertEqual(len(vhs), 2)
-        found = 0
-
-        for vhost in vhs:
-            for centos_truth in self.vh_truth:
-                if vhost == centos_truth:
-                    found += 1
-                    break
-            else:
-                raise Exception("Missed: %s" % vhost)  # pragma: no cover
-        self.assertEqual(found, 2)
-
-    def test_loadmod_default(self):
-        ssl_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-        self.assertEqual(len(ssl_loadmods), 1)
-        # Make sure the LoadModule ssl_module is in ssl.conf (default)
-        self.assertTrue("ssl.conf" in ssl_loadmods[0])
-        # ...and that it's not inside of <IfModule>
-        self.assertFalse("IfModule" in ssl_loadmods[0])
-
-        # Get the example vhost
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-
-        # We should now have LoadModule ssl_module in root conf and ssl.conf
-        self.assertEqual(len(post_loadmods), 2)
-        for lm in post_loadmods:
-            # lm[:-7] removes "/arg[#]" from the path
-            arguments = self.config.parser.get_all_args(lm[:-7])
-            self.assertEqual(arguments, ["ssl_module", "modules/mod_ssl.so"])
-            # ...and both of them should be wrapped in <IfModule !mod_ssl.c>
-            # lm[:-17] strips off /directive/arg[1] from the path.
-            ifmod_args = self.config.parser.get_all_args(lm[:-17])
-            self.assertTrue("!mod_ssl.c" in ifmod_args)
-
-    def test_loadmod_multiple(self):
-        sslmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        # Adds another LoadModule to main httpd.conf in addtition to ssl.conf
-        self.config.parser.add_dir(self.config.parser.loc["default"], "LoadModule",
-                                   sslmod_args)
-        self.config.save()
-        pre_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-        # LoadModules are not within IfModule blocks
-        self.assertFalse(any(["ifmodule" in m.lower() for m in pre_loadmods]))
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", exclude=False)
-
-        for mod in post_loadmods:
-            self.assertTrue(self.config.parser.not_modssl_ifmodule(mod))  #pylint: disable=no-member
-
-    def test_loadmod_rootconf_exists(self):
-        sslmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        rootconf_ifmod = self.config.parser.get_ifmod(
-            parser.get_aug_path(self.config.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", sslmod_args)
-        self.config.save()
-        # Get the example vhost
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-
-        root_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module",
-            start=parser.get_aug_path(self.config.parser.loc["default"]),
-            exclude=False)
-
-        mods = [lm for lm in root_loadmods if self.config.parser.loc["default"] in lm]
-
-        self.assertEqual(len(mods), 1)
-        # [:-7] removes "/arg[#]" from the path
-        self.assertEqual(
-            self.config.parser.get_all_args(mods[0][:-7]),
-            sslmod_args)
-
-    def test_neg_loadmod_already_on_path(self):
-        loadmod_args = ["ssl_module", "modules/mod_ssl.so"]
-        ifmod = self.config.parser.get_ifmod(
-            self.vh_truth[1].path, "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(ifmod[:-1], "LoadModule", loadmod_args)
-        self.config.parser.add_dir(self.vh_truth[1].path, "LoadModule", loadmod_args)
-        self.config.save()
-        pre_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", start=self.vh_truth[1].path, exclude=False)
-        self.assertEqual(len(pre_loadmods), 2)
-        # The ssl.conf now has two LoadModule directives, one inside of
-        # !mod_ssl.c IfModule
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-        self.config.save()
-        # Ensure that the additional LoadModule wasn't written into the IfModule
-        post_loadmods = self.config.parser.find_dir(
-            "LoadModule", "ssl_module", start=self.vh_truth[1].path, exclude=False)
-        self.assertEqual(len(post_loadmods), 1)
-
-    def test_loadmod_non_duplicate(self):
-        # the modules/mod_ssl.so exists in ssl.conf
-        sslmod_args = ["ssl_module", "modules/mod_somethingelse.so"]
-        rootconf_ifmod = self.config.parser.get_ifmod(
-            parser.get_aug_path(self.config.parser.loc["default"]),
-            "!mod_ssl.c", beginning=True)
-        self.config.parser.add_dir(rootconf_ifmod[:-1], "LoadModule", sslmod_args)
-        self.config.save()
-        self.config.assoc["test.example.com"] = self.vh_truth[0]
-        pre_matches = self.config.parser.find_dir("LoadModule",
-                                                  "ssl_module", exclude=False)
-
-        self.assertRaises(MisconfigurationError, self.config.deploy_cert,
-                "random.demo", "example/cert.pem", "example/key.pem",
-                "example/cert_chain.pem", "example/fullchain.pem")
-
-        post_matches = self.config.parser.find_dir("LoadModule",
-                                                   "ssl_module", exclude=False)
-        # Make sure that none was changed
-        self.assertEqual(pre_matches, post_matches)
-
-    def test_loadmod_not_found(self):
-        # Remove all existing LoadModule ssl_module... directives
-        orig_loadmods = self.config.parser.find_dir("LoadModule",
-                                                    "ssl_module",
-                                                    exclude=False)
-        for mod in orig_loadmods:
-            noarg_path = mod.rpartition("/")[0]
-            self.config.parser.aug.remove(noarg_path)
-        self.config.save()
-        self.config.deploy_cert(
-            "random.demo", "example/cert.pem", "example/key.pem",
-            "example/cert_chain.pem", "example/fullchain.pem")
-
-        post_loadmods = self.config.parser.find_dir("LoadModule",
-                                                    "ssl_module",
-                                                    exclude=False)
-        self.assertFalse(post_loadmods)
-
-    def test_no_ifmod_search_false(self):
-        #pylint: disable=no-member
-
-        self.assertFalse(self.config.parser.not_modssl_ifmodule(
-            "/path/does/not/include/ifmod"
-        ))
-        self.assertFalse(self.config.parser.not_modssl_ifmodule(
-            ""
-        ))
-        self.assertFalse(self.config.parser.not_modssl_ifmodule(
-            "/path/includes/IfModule/but/no/arguments"
-        ))
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/centos_test.py

@@ -1,17 +1,13 @@
 """Test for certbot_apache.configurator for Centos overrides"""
+import os
 import unittest
 
 import mock
 
-from certbot import errors
-from certbot.compat import filesystem
-from certbot.compat import os
-
 from certbot_apache import obj
 from certbot_apache import override_centos
 from certbot_apache.tests import util
 
-
 def get_vh_truth(temp_dir, config_name):
     """Return the ground truth for the specified directory."""
     prefix = os.path.join(
@@ -32,59 +28,6 @@ def get_vh_truth(temp_dir, config_name):
     ]
     return vh_truth
 
-class FedoraRestartTest(util.ApacheTest):
-    """Tests for Fedora specific self-signed certificate override"""
-
-    def setUp(self):  # pylint: disable=arguments-differ
-        test_dir = "centos7_apache/apache"
-        config_root = "centos7_apache/apache/httpd"
-        vhost_root = "centos7_apache/apache/httpd/conf.d"
-        super(FedoraRestartTest, self).setUp(test_dir=test_dir,
-                                             config_root=config_root,
-                                             vhost_root=vhost_root)
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
-            os_info="fedora_old")
-        self.vh_truth = get_vh_truth(
-            self.temp_dir, "centos7_apache/apache")
-
-    def _run_fedora_test(self):
-        self.assertIsInstance(self.config, override_centos.CentOSConfigurator)
-        with mock.patch("certbot.util.get_os_info") as mock_info:
-            mock_info.return_value = ["fedora", "28"]
-            self.config.config_test()
-
-    def test_non_fedora_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
-        with mock.patch(c_test) as mock_test:
-            mock_test.side_effect = errors.MisconfigurationError
-            with mock.patch("certbot.util.get_os_info") as mock_info:
-                mock_info.return_value = ["not_fedora"]
-                self.assertRaises(errors.MisconfigurationError,
-                                  self.config.config_test)
-
-    def test_fedora_restart_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
-        with mock.patch(c_test) as mock_test:
-            # First call raises error, second doesn't
-            mock_test.side_effect = [errors.MisconfigurationError, '']
-            with mock.patch("certbot.util.run_script") as mock_run:
-                mock_run.side_effect = errors.SubprocessError
-                self.assertRaises(errors.MisconfigurationError,
-                                  self._run_fedora_test)
-
-    def test_fedora_restart(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
-        with mock.patch(c_test) as mock_test:
-            with mock.patch("certbot.util.run_script") as mock_run:
-                # First call raises error, second doesn't
-                mock_test.side_effect = [errors.MisconfigurationError, '']
-                self._run_fedora_test()
-                self.assertEqual(mock_test.call_count, 2)
-                self.assertEqual(mock_run.call_args[0][0],
-                                ['systemctl', 'restart', 'httpd'])
-
-
 class MultipleVhostsTestCentOS(util.ApacheTest):
     """Multiple vhost tests for CentOS / RHEL family of distros"""
 
@@ -105,7 +48,8 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
             self.temp_dir, "centos7_apache/apache")
 
     def test_get_parser(self):
-        self.assertIsInstance(self.config.parser, override_centos.CentOSParser)
+        self.assertTrue(isinstance(self.config.parser,
+                                   override_centos.CentOSParser))
 
     @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
     def test_opportunistic_httpd_runtime_parsing(self, mock_get):
@@ -135,9 +79,9 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
             mock_osi.return_value = ("centos", "7")
             self.config.parser.update_runtime_variables()
 
-        self.assertEqual(mock_get.call_count, 3)
-        self.assertEqual(len(self.config.parser.modules), 4)
-        self.assertEqual(len(self.config.parser.variables), 2)
+        self.assertEquals(mock_get.call_count, 3)
+        self.assertEquals(len(self.config.parser.modules), 4)
+        self.assertEquals(len(self.config.parser.variables), 2)
         self.assertTrue("TEST2" in self.config.parser.variables.keys())
         self.assertTrue("mod_another.c" in self.config.parser.modules)
 
@@ -161,7 +105,7 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
         """Make sure we read the sysconfig OPTIONS variable correctly"""
         # Return nothing for the process calls
         mock_cfg.return_value = ""
-        self.config.parser.sysconfig_filep = filesystem.realpath(
+        self.config.parser.sysconfig_filep = os.path.realpath(
             os.path.join(self.config.parser.root, "../sysconfig/httpd"))
         self.config.parser.variables = {}
 
@@ -177,26 +121,5 @@ class MultipleVhostsTestCentOS(util.ApacheTest):
         self.assertTrue("MOCK_NOSEP" in self.config.parser.variables.keys())
         self.assertEqual("NOSEP_VAL", self.config.parser.variables["NOSEP_TWO"])
 
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_alt_restart_works(self, mock_run_script):
-        mock_run_script.side_effect = [None, errors.SubprocessError, None]
-        self.config.restart()
-        self.assertEqual(mock_run_script.call_count, 3)
-
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_alt_restart_errors(self, mock_run_script):
-        mock_run_script.side_effect = [None,
-                                       errors.SubprocessError,
-                                       errors.SubprocessError]
-        self.assertRaises(errors.MisconfigurationError, self.config.restart)
-
-    def test_pick_correct_tls_config(self):
-        self.config.version = (2, 4, 10)
-        self.assertTrue('centos-old' in self.config.pick_apache_config())
-
-        self.config.version = (2, 4, 11)
-        self.assertTrue('centos-current' in self.config.pick_apache_config())
-
-
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/complex_parsing_test.py

@@ -1,9 +1,9 @@
 """Tests for certbot_apache.parser."""
+import os
 import shutil
 import unittest
 
 from certbot import errors
-from certbot.compat import os
 
 from certbot_apache.tests import util
 

certbot-apache/certbot_apache/tests/configurator_test.py

@@ -1,6 +1,6 @@
 # pylint: disable=too-many-public-methods,too-many-lines
 """Test for certbot_apache.configurator."""
-import copy
+import os
 import shutil
 import socket
 import tempfile
@@ -15,21 +15,22 @@ from acme import challenges
 from certbot import achallenges
 from certbot import crypto_util
 from certbot import errors
-from certbot.compat import os
-from certbot.compat import filesystem
+
 from certbot.tests import acme_util
 from certbot.tests import util as certbot_util
 
 from certbot_apache import apache_util
 from certbot_apache import constants
-from certbot_apache import obj
 from certbot_apache import parser
+from certbot_apache import obj
+
 from certbot_apache.tests import util
 
 
 class MultipleVhostsTest(util.ApacheTest):
     """Test two standard well-configured HTTP vhosts."""
 
+
     def setUp(self):  # pylint: disable=arguments-differ
         super(MultipleVhostsTest, self).setUp()
 
@@ -51,14 +52,25 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.deploy_cert = mocked_deploy_cert
         return self.config
 
+    @mock.patch("certbot_apache.configurator.ApacheConfigurator.init_augeas")
     @mock.patch("certbot_apache.configurator.path_surgery")
-    def test_prepare_no_install(self, mock_surgery):
+    def test_prepare_no_install(self, mock_surgery, _init_augeas):
         silly_path = {"PATH": "/tmp/nothingness2342"}
         mock_surgery.return_value = False
         with mock.patch.dict('os.environ', silly_path):
             self.assertRaises(errors.NoInstallationError, self.config.prepare)
             self.assertEqual(mock_surgery.call_count, 1)
 
+    @mock.patch("certbot_apache.augeas_configurator.AugeasConfigurator.init_augeas")
+    def test_prepare_no_augeas(self, mock_init_augeas):
+        """ Test augeas initialization ImportError """
+        def side_effect_error():
+            """ Side effect error for the test """
+            raise ImportError
+        mock_init_augeas.side_effect = side_effect_error
+        self.assertRaises(
+            errors.NoInstallationError, self.config.prepare)
+
     @mock.patch("certbot_apache.parser.ApacheParser")
     @mock.patch("certbot_apache.configurator.util.exe_exists")
     def test_prepare_version(self, mock_exe_exists, _):
@@ -70,6 +82,16 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertRaises(
             errors.NotSupportedError, self.config.prepare)
 
+    @mock.patch("certbot_apache.parser.ApacheParser")
+    @mock.patch("certbot_apache.configurator.util.exe_exists")
+    def test_prepare_old_aug(self, mock_exe_exists, _):
+        mock_exe_exists.return_value = True
+        self.config.config_test = mock.Mock()
+        # pylint: disable=protected-access
+        self.config._check_aug_version = mock.Mock(return_value=False)
+        self.assertRaises(
+            errors.NotSupportedError, self.config.prepare)
+
     def test_prepare_locked(self):
         server_root = self.config.conf("server-root")
         self.config.config_test = mock.Mock()
@@ -93,53 +115,9 @@ class MultipleVhostsTest(util.ApacheTest):
         # Weak test..
         ApacheConfigurator.add_parser_arguments(mock.MagicMock())
 
-    def test_docs_parser_arguments(self):
-        os.environ["CERTBOT_DOCS"] = "1"
-        from certbot_apache.configurator import ApacheConfigurator
-        mock_add = mock.MagicMock()
-        ApacheConfigurator.add_parser_arguments(mock_add)
-        parserargs = ["server_root", "enmod", "dismod", "le_vhost_ext",
-                      "vhost_root", "logs_root", "challenge_location",
-                      "handle_modules", "handle_sites", "ctl"]
-        exp = dict()
-
-        for k in ApacheConfigurator.OS_DEFAULTS:
-            if k in parserargs:
-                exp[k.replace("_", "-")] = ApacheConfigurator.OS_DEFAULTS[k]
-        # Special cases
-        exp["vhost-root"] = None
-        exp["init-script"] = None
-
-        found = set()
-        for call in mock_add.call_args_list:
-            # init-script is a special case: deprecated argument
-            if call[0][0] != "init-script":
-                self.assertEqual(exp[call[0][0]], call[1]['default'])
-            found.add(call[0][0])
-
-        # Make sure that all (and only) the expected values exist
-        self.assertEqual(len(mock_add.call_args_list), len(found))
-        for e in exp:
-            self.assertTrue(e in found)
-
-        del os.environ["CERTBOT_DOCS"]
-
-    def test_add_parser_arguments_all_configurators(self):  # pylint: disable=no-self-use
-        from certbot_apache.entrypoint import OVERRIDE_CLASSES
-        for cls in OVERRIDE_CLASSES.values():
-            cls.add_parser_arguments(mock.MagicMock())
-
-    def test_all_configurators_defaults_defined(self):
-        from certbot_apache.entrypoint import OVERRIDE_CLASSES
-        from certbot_apache.configurator import ApacheConfigurator
-        parameters = set(ApacheConfigurator.OS_DEFAULTS.keys())
-        for cls in OVERRIDE_CLASSES.values():
-            self.assertTrue(parameters.issubset(set(cls.OS_DEFAULTS.keys())))
-
     def test_constant(self):
-        self.assertTrue("debian_apache_2_4/multiple_vhosts/apache" in
-                        self.config.option("server_root"))
-        self.assertEqual(self.config.option("nonexistent"), None)
+        self.assertEqual(self.config.constant("server_root"), "/etc/apache2")
+        self.assertEqual(self.config.constant("nonexistent"), None)
 
     @certbot_util.patch_get_utility()
     def test_get_all_names(self, mock_getutility):
@@ -148,8 +126,7 @@ class MultipleVhostsTest(util.ApacheTest):
         names = self.config.get_all_names()
         self.assertEqual(names, set(
             ["certbot.demo", "ocspvhost.com", "encryption-example.demo",
-             "nonsym.link", "vhost.in.rootconf", "www.certbot.demo",
-             "duplicate.example.com"]
+             "nonsym.link", "vhost.in.rootconf"]
         ))
 
     @certbot_util.patch_get_utility()
@@ -168,7 +145,8 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.vhosts.append(vhost)
 
         names = self.config.get_all_names()
-        self.assertEqual(len(names), 9)
+        # Names get filtered, only 5 are returned
+        self.assertEqual(len(names), 7)
         self.assertTrue("zombo.com" in names)
         self.assertTrue("google.com" in names)
         self.assertTrue("certbot.demo" in names)
@@ -209,7 +187,7 @@ class MultipleVhostsTest(util.ApacheTest):
     def test_get_virtual_hosts(self):
         """Make sure all vhosts are being properly found."""
         vhs = self.config.get_virtual_hosts()
-        self.assertEqual(len(vhs), 12)
+        self.assertEqual(len(vhs), 10)
         found = 0
 
         for vhost in vhs:
@@ -220,7 +198,7 @@ class MultipleVhostsTest(util.ApacheTest):
             else:
                 raise Exception("Missed: %s" % vhost)  # pragma: no cover
 
-        self.assertEqual(found, 12)
+        self.assertEqual(found, 10)
 
         # Handle case of non-debian layout get_virtual_hosts
         with mock.patch(
@@ -228,7 +206,7 @@ class MultipleVhostsTest(util.ApacheTest):
         ) as mock_conf:
             mock_conf.return_value = False
             vhs = self.config.get_virtual_hosts()
-            self.assertEqual(len(vhs), 12)
+            self.assertEqual(len(vhs), 10)
 
     @mock.patch("certbot_apache.display_ops.select_vhost")
     def test_choose_vhost_none_avail(self, mock_select):
@@ -268,7 +246,7 @@ class MultipleVhostsTest(util.ApacheTest):
     @mock.patch("certbot_apache.display_ops.select_vhost")
     def test_choose_vhost_select_vhost_with_temp(self, mock_select):
         mock_select.return_value = self.vh_truth[0]
-        chosen_vhost = self.config.choose_vhost("none.com", create_if_no_ssl=False)
+        chosen_vhost = self.config.choose_vhost("none.com", temp=True)
         self.assertEqual(self.vh_truth[0], chosen_vhost)
 
     @mock.patch("certbot_apache.display_ops.select_vhost")
@@ -282,20 +260,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertRaises(
             errors.PluginError, self.config.choose_vhost, "none.com")
 
-    def test_find_best_http_vhost_default(self):
-        vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr.fromstring("_default_:80")]), False, True)
-        self.config.vhosts = [vh]
-        self.assertEqual(self.config.find_best_http_vhost("foo.bar", False), vh)
-
-    def test_find_best_http_vhost_port(self):
-        port = "8080"
-        vh = obj.VirtualHost(
-            "fp", "ap", set([obj.Addr.fromstring("*:" + port)]),
-            False, True, "encryption-example.demo")
-        self.config.vhosts.append(vh)
-        self.assertEqual(self.config.find_best_http_vhost("foo.bar", False, port), vh)
-
     def test_findbest_continues_on_short_domain(self):
         # pylint: disable=protected-access
         chosen_vhost = self.config._find_best_vhost("purple.com")
@@ -331,7 +295,7 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.vhosts = [
             vh for vh in self.config.vhosts
             if vh.name not in ["certbot.demo", "nonsym.link",
-                "encryption-example.demo", "duplicate.example.com",
+                "encryption-example.demo",
                 "ocspvhost.com", "vhost.in.rootconf"]
             and "*.blue.purple.com" not in vh.aliases
         ]
@@ -341,8 +305,7 @@ class MultipleVhostsTest(util.ApacheTest):
 
     def test_non_default_vhosts(self):
         # pylint: disable=protected-access
-        vhosts = self.config._non_default_vhosts(self.config.vhosts)
-        self.assertEqual(len(vhosts), 10)
+        self.assertEqual(len(self.config._non_default_vhosts()), 8)
 
     def test_deploy_cert_enable_new_vhost(self):
         # Create
@@ -357,31 +320,6 @@ class MultipleVhostsTest(util.ApacheTest):
             "example/cert_chain.pem", "example/fullchain.pem")
         self.assertTrue(ssl_vhost.enabled)
 
-    def test_no_duplicate_include(self):
-        def mock_find_dir(directive, argument, _):
-            """Mock method for parser.find_dir"""
-            if directive == "Include" and argument.endswith("options-ssl-apache.conf"):
-                return ["/path/to/whatever"]
-            return None  # pragma: no cover
-
-        mock_add = mock.MagicMock()
-        self.config.parser.add_dir = mock_add
-        self.config._add_dummy_ssl_directives(self.vh_truth[0])  # pylint: disable=protected-access
-        tried_to_add = False
-        for a in mock_add.call_args_list:
-            if a[0][1] == "Include" and a[0][2] == self.config.mod_ssl_conf:
-                tried_to_add = True
-        # Include should be added, find_dir is not patched, and returns falsy
-        self.assertTrue(tried_to_add)
-
-        self.config.parser.find_dir = mock_find_dir
-        mock_add.reset_mock()
-        self.config._add_dummy_ssl_directives(self.vh_truth[0])  # pylint: disable=protected-access
-        for a in mock_add.call_args_list:
-            if a[0][1] == "Include" and a[0][2] == self.config.mod_ssl_conf:
-                self.fail("Include shouldn't be added, as patched find_dir 'finds' existing one") \
-                    # pragma: no cover
-
     def test_deploy_cert(self):
         self.config.parser.modules.add("ssl_module")
         self.config.parser.modules.add("mod_ssl.c")
@@ -461,36 +399,13 @@ class MultipleVhostsTest(util.ApacheTest):
             self.vh_truth[1].path))
 
     def test_deploy_cert_invalid_vhost(self):
-        """For test cases where the `ApacheConfigurator` class' `_deploy_cert`
-        method is called with an invalid vhost parameter. Currently this tests
-        that a PluginError is appropriately raised when important directives
-        are missing in an SSL module."""
         self.config.parser.modules.add("ssl_module")
-        self.config.parser.modules.add("mod_ssl.c")
-        self.config.parser.modules.add("socache_shmcb_module")
-
-        def side_effect(*args):
-            """Mocks case where an SSLCertificateFile directive can be found
-            but an SSLCertificateKeyFile directive is missing."""
-            if "SSLCertificateFile" in args:
-                return ["example/cert.pem"]
-            return []
-
-        mock_find_dir = mock.MagicMock(return_value=[])
-        mock_find_dir.side_effect = side_effect
-
-        self.config.parser.find_dir = mock_find_dir
+        mock_find = mock.MagicMock()
+        mock_find.return_value = []
+        self.config.parser.find_dir = mock_find
 
         # Get the default 443 vhost
         self.config.assoc["random.demo"] = self.vh_truth[1]
-
-        self.assertRaises(
-            errors.PluginError, self.config.deploy_cert, "random.demo",
-            "example/cert.pem", "example/key.pem", "example/cert_chain.pem")
-
-        # Remove side_effect to mock case where both SSLCertificateFile
-        # and SSLCertificateKeyFile directives are missing
-        self.config.parser.find_dir.side_effect = None
         self.assertRaises(
             errors.PluginError, self.config.deploy_cert, "random.demo",
             "example/cert.pem", "example/key.pem", "example/cert_chain.pem")
@@ -509,47 +424,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertTrue(self.config.parser.find_dir(
             "NameVirtualHost", "*:80"))
 
-    def test_add_listen_80(self):
-        mock_find = mock.Mock()
-        mock_add_dir = mock.Mock()
-        mock_find.return_value = []
-        self.config.parser.find_dir = mock_find
-        self.config.parser.add_dir = mock_add_dir
-        self.config.ensure_listen("80")
-        self.assertTrue(mock_add_dir.called)
-        self.assertTrue(mock_find.called)
-        self.assertEqual(mock_add_dir.call_args[0][1], "Listen")
-        self.assertEqual(mock_add_dir.call_args[0][2], "80")
-
-    def test_add_listen_80_named(self):
-        mock_find = mock.Mock()
-        mock_find.return_value = ["test1", "test2", "test3"]
-        mock_get = mock.Mock()
-        mock_get.side_effect = ["1.2.3.4:80", "[::1]:80", "1.1.1.1:443"]
-        mock_add_dir = mock.Mock()
-
-        self.config.parser.find_dir = mock_find
-        self.config.parser.get_arg = mock_get
-        self.config.parser.add_dir = mock_add_dir
-
-        self.config.ensure_listen("80")
-        self.assertEqual(mock_add_dir.call_count, 0)
-
-        # Reset return lists and inputs
-        mock_add_dir.reset_mock()
-        mock_get.side_effect = ["1.2.3.4:80", "[::1]:80", "1.1.1.1:443"]
-
-        # Test
-        self.config.ensure_listen("8080")
-        self.assertEqual(mock_add_dir.call_count, 3)
-        self.assertTrue(mock_add_dir.called)
-        self.assertEqual(mock_add_dir.call_args[0][1], "Listen")
-        call_found = False
-        for mock_call in mock_add_dir.mock_calls:
-            if mock_call[1][2] == ['1.2.3.4:8080']:
-                call_found = True
-        self.assertTrue(call_found)
-
     def test_prepare_server_https(self):
         mock_enable = mock.Mock()
         self.config.enable_mod = mock_enable
@@ -561,6 +435,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # This will test the Add listen
         self.config.parser.find_dir = mock_find
         self.config.parser.add_dir_to_ifmodssl = mock_add_dir
+
         self.config.prepare_server_https("443")
         # Changing the order these modules are enabled breaks the reverter
         self.assertEqual(mock_enable.call_args_list[0][0][0], "socache_shmcb")
@@ -654,7 +529,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # span excludes the closing </VirtualHost> tag in older versions
         # of Augeas
         return_value = [self.vh_truth[0].filep, 1, 12, 0, 0, 0, 1142]
-        with mock.patch.object(self.config.parser.aug, 'span') as mock_span:
+        with mock.patch.object(self.config.aug, 'span') as mock_span:
             mock_span.return_value = return_value
             self.test_make_vhost_ssl()
 
@@ -662,7 +537,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # span includes the closing </VirtualHost> tag in newer versions
         # of Augeas
         return_value = [self.vh_truth[0].filep, 1, 12, 0, 0, 0, 1157]
-        with mock.patch.object(self.config.parser.aug, 'span') as mock_span:
+        with mock.patch.object(self.config.aug, 'span') as mock_span:
             mock_span.return_value = return_value
             self.test_make_vhost_ssl()
 
@@ -673,9 +548,22 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertEqual(ssl_vhost_slink.name, "nonsym.link")
 
     def test_make_vhost_ssl_nonexistent_vhost_path(self):
-        ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[1])
-        self.assertEqual(os.path.dirname(ssl_vhost.filep),
-                         os.path.dirname(filesystem.realpath(self.vh_truth[1].filep)))
+        def conf_side_effect(arg):
+            """ Mock function for ApacheConfigurator.conf """
+            confvars = {
+                "vhost-root": "/tmp/nonexistent",
+                "le_vhost_ext": "-le-ssl.conf",
+                "handle-sites": True}
+            return confvars[arg]
+
+        with mock.patch(
+                "certbot_apache.configurator.ApacheConfigurator.conf"
+        ) as mock_conf:
+            mock_conf.side_effect = conf_side_effect
+            ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[1])
+            self.assertEqual(os.path.dirname(ssl_vhost.filep),
+                             os.path.dirname(os.path.realpath(
+                                 self.vh_truth[1].filep)))
 
     def test_make_vhost_ssl(self):
         ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[0])
@@ -696,7 +584,7 @@ class MultipleVhostsTest(util.ApacheTest):
         self.assertEqual(self.config.is_name_vhost(self.vh_truth[0]),
                          self.config.is_name_vhost(ssl_vhost))
 
-        self.assertEqual(len(self.config.vhosts), 13)
+        self.assertEqual(len(self.config.vhosts), 11)
 
     def test_clean_vhost_ssl(self):
         # pylint: disable=protected-access
@@ -788,19 +676,22 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config._add_name_vhost_if_necessary(self.vh_truth[0])
         self.assertEqual(self.config.add_name_vhost.call_count, 2)
 
-    @mock.patch("certbot_apache.configurator.http_01.ApacheHttp01.perform")
+    @mock.patch("certbot_apache.configurator.tls_sni_01.ApacheTlsSni01.perform")
     @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
-    def test_perform(self, mock_restart, mock_http_perform):
+    def test_perform(self, mock_restart, mock_perform):
         # Only tests functionality specific to configurator.perform
         # Note: As more challenges are offered this will have to be expanded
-        account_key, achalls = self.get_key_and_achalls()
+        account_key, achall1, achall2 = self.get_achalls()
 
-        expected = [achall.response(account_key) for achall in achalls]
-        mock_http_perform.return_value = expected
+        expected = [
+            achall1.response(account_key),
+            achall2.response(account_key),
+        ]
 
-        responses = self.config.perform(achalls)
+        mock_perform.return_value = expected
+        responses = self.config.perform([achall1, achall2])
 
-        self.assertEqual(mock_http_perform.call_count, 1)
+        self.assertEqual(mock_perform.call_count, 1)
         self.assertEqual(responses, expected)
 
         self.assertEqual(mock_restart.call_count, 1)
@@ -809,32 +700,29 @@ class MultipleVhostsTest(util.ApacheTest):
     @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
     def test_cleanup(self, mock_cfg, mock_restart):
         mock_cfg.return_value = ""
-        _, achalls = self.get_key_and_achalls()
+        _, achall1, achall2 = self.get_achalls()
 
-        for achall in achalls:
-            self.config._chall_out.add(achall)  # pylint: disable=protected-access
+        self.config._chall_out.add(achall1)  # pylint: disable=protected-access
+        self.config._chall_out.add(achall2)  # pylint: disable=protected-access
 
-        for i, achall in enumerate(achalls):
-            self.config.cleanup([achall])
-            if i == len(achalls) - 1:
-                self.assertTrue(mock_restart.called)
-            else:
-                self.assertFalse(mock_restart.called)
+        self.config.cleanup([achall1])
+        self.assertFalse(mock_restart.called)
+
+        self.config.cleanup([achall2])
+        self.assertTrue(mock_restart.called)
 
     @mock.patch("certbot_apache.configurator.ApacheConfigurator.restart")
     @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
     def test_cleanup_no_errors(self, mock_cfg, mock_restart):
         mock_cfg.return_value = ""
-        _, achalls = self.get_key_and_achalls()
-        self.config.http_doer = mock.MagicMock()
+        _, achall1, achall2 = self.get_achalls()
 
-        for achall in achalls:
-            self.config._chall_out.add(achall)  # pylint: disable=protected-access
+        self.config._chall_out.add(achall1)  # pylint: disable=protected-access
 
-        self.config.cleanup([achalls[-1]])
+        self.config.cleanup([achall2])
         self.assertFalse(mock_restart.called)
 
-        self.config.cleanup(achalls)
+        self.config.cleanup([achall1, achall2])
         self.assertTrue(mock_restart.called)
 
     @mock.patch("certbot.util.run_script")
@@ -929,22 +817,6 @@ class MultipleVhostsTest(util.ApacheTest):
             errors.PluginError,
             self.config.enhance, "certbot.demo", "unknown_enhancement")
 
-    def test_enhance_no_ssl_vhost(self):
-        with mock.patch("certbot_apache.configurator.logger.warning") as mock_log:
-            self.assertRaises(errors.PluginError, self.config.enhance,
-                              "certbot.demo", "redirect")
-            # Check that correct logger.warning was printed
-            self.assertTrue("not able to find" in mock_log.call_args[0][0])
-            self.assertTrue("\"redirect\"" in mock_log.call_args[0][0])
-
-            mock_log.reset_mock()
-
-            self.assertRaises(errors.PluginError, self.config.enhance,
-                              "certbot.demo", "ensure-http-header", "Test")
-            # Check that correct logger.warning was printed
-            self.assertTrue("not able to find" in mock_log.call_args[0][0])
-            self.assertTrue("Test" in mock_log.call_args[0][0])
-
     @mock.patch("certbot.util.exe_exists")
     def test_ocsp_stapling(self, mock_exe):
         self.config.parser.update_runtime_variables = mock.Mock()
@@ -954,7 +826,6 @@ class MultipleVhostsTest(util.ApacheTest):
         mock_exe.return_value = True
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "staple-ocsp")
 
         # Get the ssl vhost for certbot.demo
@@ -981,7 +852,6 @@ class MultipleVhostsTest(util.ApacheTest):
         mock_exe.return_value = True
 
         # Checking the case with already enabled ocsp stapling configuration
-        self.config.choose_vhost("ocspvhost.com")
         self.config.enhance("ocspvhost.com", "staple-ocsp")
 
         # Get the ssl vhost for letsencrypt.demo
@@ -1006,7 +876,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.parser.modules.add("mod_ssl.c")
         self.config.parser.modules.add("socache_shmcb_module")
         self.config.get_version = mock.Mock(return_value=(2, 2, 0))
-        self.config.choose_vhost("certbot.demo")
 
         self.assertRaises(errors.PluginError,
                 self.config.enhance, "certbot.demo", "staple-ocsp")
@@ -1021,7 +890,7 @@ class MultipleVhostsTest(util.ApacheTest):
 
         # pylint: disable=protected-access
         http_vh = self.config._get_http_vhost(ssl_vh)
-        self.assertFalse(http_vh.ssl)
+        self.assertTrue(http_vh.ssl == False)
 
     @mock.patch("certbot.util.run_script")
     @mock.patch("certbot.util.exe_exists")
@@ -1032,7 +901,6 @@ class MultipleVhostsTest(util.ApacheTest):
         mock_exe.return_value = True
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "ensure-http-header",
                             "Strict-Transport-Security")
 
@@ -1052,8 +920,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # skip the enable mod
         self.config.parser.modules.add("headers_module")
 
-        # This will create an ssl vhost for encryption-example.demo
-        self.config.choose_vhost("encryption-example.demo")
+        # This will create an ssl vhost for certbot.demo
         self.config.enhance("encryption-example.demo", "ensure-http-header",
                             "Strict-Transport-Security")
 
@@ -1072,7 +939,6 @@ class MultipleVhostsTest(util.ApacheTest):
         mock_exe.return_value = True
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "ensure-http-header",
                             "Upgrade-Insecure-Requests")
 
@@ -1094,8 +960,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # skip the enable mod
         self.config.parser.modules.add("headers_module")
 
-        # This will create an ssl vhost for encryption-example.demo
-        self.config.choose_vhost("encryption-example.demo")
+        # This will create an ssl vhost for certbot.demo
         self.config.enhance("encryption-example.demo", "ensure-http-header",
                             "Upgrade-Insecure-Requests")
 
@@ -1113,7 +978,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.get_version = mock.Mock(return_value=(2, 2))
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "redirect")
 
         # These are not immediately available in find_dir even with save() and
@@ -1164,7 +1028,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.save()
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "redirect")
 
         # These are not immediately available in find_dir even with save() and
@@ -1210,7 +1073,7 @@ class MultipleVhostsTest(util.ApacheTest):
         except errors.PluginEnhancementAlreadyPresent:
             args_paths = self.config.parser.find_dir(
                 "RewriteRule", None, http_vhost.path, False)
-            arg_vals = [self.config.parser.aug.get(x) for x in args_paths]
+            arg_vals = [self.config.aug.get(x) for x in args_paths]
             self.assertEqual(arg_vals, constants.REWRITE_HTTPS_ARGS)
 
 
@@ -1231,9 +1094,6 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.parser.modules.add("rewrite_module")
         self.config.get_version = mock.Mock(return_value=(2, 3, 9))
 
-        # Creates ssl vhost for the domain
-        self.config.choose_vhost("red.blue.purple.com")
-
         self.config.enhance("red.blue.purple.com", "redirect")
         verify_no_redirect = ("certbot_apache.configurator."
                               "ApacheConfigurator._verify_no_certbot_redirect")
@@ -1245,7 +1105,7 @@ class MultipleVhostsTest(util.ApacheTest):
         # Skip the enable mod
         self.config.parser.modules.add("rewrite_module")
         self.config.get_version = mock.Mock(return_value=(2, 3, 9))
-        self.config.choose_vhost("red.blue.purple.com")
+
         self.config.enhance("red.blue.purple.com", "redirect")
         # Clear state about enabling redirect on this run
         # pylint: disable=protected-access
@@ -1264,7 +1124,7 @@ class MultipleVhostsTest(util.ApacheTest):
 
         # pylint: disable=protected-access
         self.config._enable_redirect(self.vh_truth[1], "")
-        self.assertEqual(len(self.config.vhosts), 13)
+        self.assertEqual(len(self.config.vhosts), 11)
 
     def test_create_own_redirect_for_old_apache_version(self):
         self.config.parser.modules.add("rewrite_module")
@@ -1275,7 +1135,7 @@ class MultipleVhostsTest(util.ApacheTest):
 
         # pylint: disable=protected-access
         self.config._enable_redirect(self.vh_truth[1], "")
-        self.assertEqual(len(self.config.vhosts), 13)
+        self.assertEqual(len(self.config.vhosts), 11)
 
     def test_sift_rewrite_rule(self):
         # pylint: disable=protected-access
@@ -1291,7 +1151,7 @@ class MultipleVhostsTest(util.ApacheTest):
         not_rewriterule = "NotRewriteRule ^ ..."
         self.assertFalse(self.config._sift_rewrite_rule(not_rewriterule))
 
-    def get_key_and_achalls(self):
+    def get_achalls(self):
         """Return testing achallenges."""
         account_key = self.rsa512jwk
         achall1 = achallenges.KeyAuthorizationAnnotatedChallenge(
@@ -1306,12 +1166,26 @@ class MultipleVhostsTest(util.ApacheTest):
                     token=b"uqnaPzxtrndteOqtrXb0Asl5gOJfWAnnx6QJyvcmlDU"),
                 "pending"),
             domain="certbot.demo", account_key=account_key)
-        achall3 = achallenges.KeyAuthorizationAnnotatedChallenge(
-            challb=acme_util.chall_to_challb(
-                challenges.HTTP01(token=(b'x' * 16)), "pending"),
-            domain="example.org", account_key=account_key)
 
-        return account_key, (achall1, achall2, achall3)
+        return account_key, achall1, achall2
+
+    def test_make_addrs_sni_ready(self):
+        self.config.version = (2, 2)
+        self.config.make_addrs_sni_ready(
+            set([obj.Addr.fromstring("*:443"), obj.Addr.fromstring("*:80")]))
+        self.assertTrue(self.config.parser.find_dir(
+            "NameVirtualHost", "*:80", exclude=False))
+        self.assertTrue(self.config.parser.find_dir(
+            "NameVirtualHost", "*:443", exclude=False))
+
+    def test_aug_version(self):
+        mock_match = mock.Mock(return_value=["something"])
+        self.config.aug.match = mock_match
+        # pylint: disable=protected-access
+        self.assertEqual(self.config._check_aug_version(),
+                         ["something"])
+        self.config.aug.match.side_effect = RuntimeError
+        self.assertFalse(self.config._check_aug_version())
 
     def test_enable_site_nondebian(self):
         inc_path = "/path/to/wherever"
@@ -1335,8 +1209,8 @@ class MultipleVhostsTest(util.ApacheTest):
         self.config.parser.modules.add("ssl_module")
         self.config.parser.modules.add("mod_ssl.c")
         self.config.parser.modules.add("socache_shmcb_module")
-        tmp_path = filesystem.realpath(tempfile.mkdtemp("vhostroot"))
-        filesystem.chmod(tmp_path, 0o755)
+        tmp_path = os.path.realpath(tempfile.mkdtemp("vhostroot"))
+        os.chmod(tmp_path, 0o755)
         mock_p = "certbot_apache.configurator.ApacheConfigurator._get_ssl_vhost_path"
         mock_a = "certbot_apache.parser.ApacheParser.add_include"
 
@@ -1364,146 +1238,6 @@ class MultipleVhostsTest(util.ApacheTest):
                           self.config.enable_mod,
                           "whatever")
 
-    def test_wildcard_domain(self):
-        # pylint: disable=protected-access
-        cases = {u"*.example.org": True, b"*.x.example.org": True,
-                 u"a.example.org": False, b"a.x.example.org": False}
-        for key in cases:
-            self.assertEqual(self.config._wildcard_domain(key), cases[key])
-
-    def test_choose_vhosts_wildcard(self):
-        # pylint: disable=protected-access
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
-        with mock.patch(mock_path) as mock_select_vhs:
-            mock_select_vhs.return_value = [self.vh_truth[3]]
-            vhs = self.config._choose_vhosts_wildcard("*.certbot.demo",
-                                                     create_ssl=True)
-            # Check that the dialog was called with one vh: certbot.demo
-            self.assertEqual(mock_select_vhs.call_args[0][0][0], self.vh_truth[3])
-            self.assertEqual(len(mock_select_vhs.call_args_list), 1)
-
-            # And the actual returned values
-            self.assertEqual(len(vhs), 1)
-            self.assertTrue(vhs[0].name == "certbot.demo")
-            self.assertTrue(vhs[0].ssl)
-
-            self.assertFalse(vhs[0] == self.vh_truth[3])
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.make_vhost_ssl")
-    def test_choose_vhosts_wildcard_no_ssl(self, mock_makessl):
-        # pylint: disable=protected-access
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
-        with mock.patch(mock_path) as mock_select_vhs:
-            mock_select_vhs.return_value = [self.vh_truth[1]]
-            vhs = self.config._choose_vhosts_wildcard("*.certbot.demo",
-                                                     create_ssl=False)
-            self.assertFalse(mock_makessl.called)
-            self.assertEqual(vhs[0], self.vh_truth[1])
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._vhosts_for_wildcard")
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.make_vhost_ssl")
-    def test_choose_vhosts_wildcard_already_ssl(self, mock_makessl, mock_vh_for_w):
-        # pylint: disable=protected-access
-        # Already SSL vhost
-        mock_vh_for_w.return_value = [self.vh_truth[7]]
-        mock_path = "certbot_apache.display_ops.select_vhost_multiple"
-        with mock.patch(mock_path) as mock_select_vhs:
-            mock_select_vhs.return_value = [self.vh_truth[7]]
-            vhs = self.config._choose_vhosts_wildcard("whatever",
-                                                     create_ssl=True)
-            self.assertEqual(mock_select_vhs.call_args[0][0][0], self.vh_truth[7])
-            self.assertEqual(len(mock_select_vhs.call_args_list), 1)
-            # Ensure that make_vhost_ssl was not called, vhost.ssl == true
-            self.assertFalse(mock_makessl.called)
-
-            # And the actual returned values
-            self.assertEqual(len(vhs), 1)
-            self.assertTrue(vhs[0].ssl)
-            self.assertEqual(vhs[0], self.vh_truth[7])
-
-
-    def test_deploy_cert_wildcard(self):
-        # pylint: disable=protected-access
-        mock_choose_vhosts = mock.MagicMock()
-        mock_choose_vhosts.return_value = [self.vh_truth[7]]
-        self.config._choose_vhosts_wildcard = mock_choose_vhosts
-        mock_d = "certbot_apache.configurator.ApacheConfigurator._deploy_cert"
-        with mock.patch(mock_d) as mock_dep:
-            self.config.deploy_cert("*.wildcard.example.org", "/tmp/path",
-                                    "/tmp/path", "/tmp/path", "/tmp/path")
-            self.assertTrue(mock_dep.called)
-            self.assertEqual(len(mock_dep.call_args_list), 1)
-            self.assertEqual(self.vh_truth[7], mock_dep.call_args_list[0][0][0])
-
-    @mock.patch("certbot_apache.display_ops.select_vhost_multiple")
-    def test_deploy_cert_wildcard_no_vhosts(self, mock_dialog):
-        # pylint: disable=protected-access
-        mock_dialog.return_value = []
-        self.assertRaises(errors.PluginError,
-                          self.config.deploy_cert,
-                          "*.wild.cat", "/tmp/path", "/tmp/path",
-                           "/tmp/path", "/tmp/path")
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._choose_vhosts_wildcard")
-    def test_enhance_wildcard_after_install(self, mock_choose):
-        # pylint: disable=protected-access
-        self.config.parser.modules.add("mod_ssl.c")
-        self.config.parser.modules.add("headers_module")
-        self.vh_truth[3].ssl = True
-        self.config._wildcard_vhosts["*.certbot.demo"] = [self.vh_truth[3]]
-        self.config.enhance("*.certbot.demo", "ensure-http-header",
-                            "Upgrade-Insecure-Requests")
-        self.assertFalse(mock_choose.called)
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator._choose_vhosts_wildcard")
-    def test_enhance_wildcard_no_install(self, mock_choose):
-        self.vh_truth[3].ssl = True
-        mock_choose.return_value = [self.vh_truth[3]]
-        self.config.parser.modules.add("mod_ssl.c")
-        self.config.parser.modules.add("headers_module")
-        self.config.enhance("*.certbot.demo", "ensure-http-header",
-                            "Upgrade-Insecure-Requests")
-        self.assertTrue(mock_choose.called)
-
-    def test_add_vhost_id(self):
-        for vh in [self.vh_truth[0], self.vh_truth[1], self.vh_truth[2]]:
-            vh_id = self.config.add_vhost_id(vh)
-            self.assertEqual(vh, self.config.find_vhost_by_id(vh_id))
-
-    def test_find_vhost_by_id_404(self):
-        self.assertRaises(errors.PluginError,
-                          self.config.find_vhost_by_id,
-                          "nonexistent")
-
-    def test_add_vhost_id_already_exists(self):
-        first_id = self.config.add_vhost_id(self.vh_truth[0])
-        second_id = self.config.add_vhost_id(self.vh_truth[0])
-        self.assertEqual(first_id, second_id)
-
-    def test_realpath_replaces_symlink(self):
-        orig_match = self.config.parser.aug.match
-        mock_vhost = copy.deepcopy(self.vh_truth[0])
-        mock_vhost.filep = mock_vhost.filep.replace('sites-enabled', u'sites-available')
-        mock_vhost.path = mock_vhost.path.replace('sites-enabled', 'sites-available')
-        mock_vhost.enabled = False
-        self.config.parser.parse_file(mock_vhost.filep)
-
-        def mock_match(aug_expr):
-            """Return a mocked match list of VirtualHosts"""
-            if "/mocked/path" in aug_expr:
-                return [self.vh_truth[1].path, self.vh_truth[0].path, mock_vhost.path]
-            return orig_match(aug_expr)
-
-        self.config.parser.parser_paths = ["/mocked/path"]
-        self.config.parser.aug.match = mock_match
-        vhs = self.config.get_virtual_hosts()
-        self.assertEqual(len(vhs), 2)
-        self.assertTrue(vhs[0] == self.vh_truth[1])
-        # mock_vhost should have replaced the vh_truth[0], because its filepath
-        # isn't a symlink
-        self.assertTrue(vhs[1] == mock_vhost)
-
-
 class AugeasVhostsTest(util.ApacheTest):
     """Test vhosts with illegal names dependent on augeas version."""
     # pylint: disable=protected-access
@@ -1521,16 +1255,16 @@ class AugeasVhostsTest(util.ApacheTest):
             self.work_dir)
 
     def test_choosevhost_with_illegal_name(self):
-        self.config.parser.aug = mock.MagicMock()
-        self.config.parser.aug.match.side_effect = RuntimeError
-        path = "debian_apache_2_4/augeas_vhosts/apache2/sites-available/old-and-default.conf"
+        self.config.aug = mock.MagicMock()
+        self.config.aug.match.side_effect = RuntimeError
+        path = "debian_apache_2_4/augeas_vhosts/apache2/sites-available/old,default.conf"
         chosen_vhost = self.config._create_vhost(path)
         self.assertEqual(None, chosen_vhost)
 
     def test_choosevhost_works(self):
-        path = "debian_apache_2_4/augeas_vhosts/apache2/sites-available/old-and-default.conf"
+        path = "debian_apache_2_4/augeas_vhosts/apache2/sites-available/old,default.conf"
         chosen_vhost = self.config._create_vhost(path)
-        self.assertTrue(chosen_vhost is None or chosen_vhost.path == path)
+        self.assertTrue(chosen_vhost == None or chosen_vhost.path == path)
 
     @mock.patch("certbot_apache.configurator.ApacheConfigurator._create_vhost")
     def test_get_vhost_continue(self, mock_vhost):
@@ -1584,7 +1318,7 @@ class AugeasVhostsTest(util.ApacheTest):
                           broken_vhost)
 
 class MultiVhostsTest(util.ApacheTest):
-    """Test configuration with multiple virtualhosts in a single file."""
+    """Test vhosts with illegal names dependent on augeas version."""
     # pylint: disable=protected-access
 
     def setUp(self):  # pylint: disable=arguments-differ
@@ -1651,8 +1385,7 @@ class MultiVhostsTest(util.ApacheTest):
         self.assertTrue(self.config.parser.find_dir(
             "RewriteEngine", "on", ssl_vhost.path, False))
 
-        with open(ssl_vhost.filep) as the_file:
-            conf_text = the_file.read()
+        conf_text = open(ssl_vhost.filep).read()
         commented_rewrite_rule = ("# RewriteRule \"^/secrets/(.+)\" "
                                   "\"https://new.example.com/docs/$1\" [R,L]")
         uncommented_rewrite_rule = ("RewriteRule \"^/docs/(.+)\"  "
@@ -1668,8 +1401,7 @@ class MultiVhostsTest(util.ApacheTest):
 
         ssl_vhost = self.config.make_vhost_ssl(self.vh_truth[3])
 
-        with open(ssl_vhost.filep) as the_file:
-            conf_lines = the_file.readlines()
+        conf_lines = open(ssl_vhost.filep).readlines()
         conf_line_set = [l.strip() for l in conf_lines]
         not_commented_cond1 = ("RewriteCond "
                 "%{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f")
@@ -1706,7 +1438,7 @@ class InstallSslOptionsConfTest(util.ApacheTest):
                                              self.config.updated_mod_ssl_conf_digest)
 
     def _current_ssl_options_hash(self):
-        return crypto_util.sha256sum(self.config.pick_apache_config())
+        return crypto_util.sha256sum(self.config.constant("MOD_SSL_CONF_SRC"))
 
     def _assert_current_file(self):
         self.assertTrue(os.path.isfile(self.config.mod_ssl_conf))
@@ -1742,7 +1474,7 @@ class InstallSslOptionsConfTest(util.ApacheTest):
             self.assertFalse(mock_logger.warning.called)
         self.assertTrue(os.path.isfile(self.config.mod_ssl_conf))
         self.assertEqual(crypto_util.sha256sum(
-            self.config.pick_apache_config()),
+            self.config.constant("MOD_SSL_CONF_SRC")),
             self._current_ssl_options_hash())
         self.assertNotEqual(crypto_util.sha256sum(self.config.mod_ssl_conf),
             self._current_ssl_options_hash())
@@ -1758,31 +1490,18 @@ class InstallSslOptionsConfTest(util.ApacheTest):
                 "%s has been manually modified; updated file "
                 "saved to %s. We recommend updating %s for security purposes.")
         self.assertEqual(crypto_util.sha256sum(
-            self.config.pick_apache_config()),
+            self.config.constant("MOD_SSL_CONF_SRC")),
             self._current_ssl_options_hash())
         # only print warning once
         with mock.patch("certbot.plugins.common.logger") as mock_logger:
             self._call()
             self.assertFalse(mock_logger.warning.called)
 
-    def test_ssl_config_files_hash_in_all_hashes(self):
-        """
-        It is really critical that all TLS Apache config files have their SHA256 hash registered in
-        constants.ALL_SSL_OPTIONS_HASHES. Otherwise Certbot will mistakenly assume that the config
-        file has been manually edited by the user, and will refuse to update it.
-        This test ensures that all necessary hashes are present.
-        """
+    def test_current_file_hash_in_all_hashes(self):
         from certbot_apache.constants import ALL_SSL_OPTIONS_HASHES
-        import pkg_resources
-        tls_configs_dir = pkg_resources.resource_filename("certbot_apache", "tls_configs")
-        all_files = [os.path.join(tls_configs_dir, name) for name in os.listdir(tls_configs_dir)
-                     if name.endswith('options-ssl-apache.conf')]
-        self.assertTrue(all_files)
-        for one_file in all_files:
-            file_hash = crypto_util.sha256sum(one_file)
-            self.assertTrue(file_hash in ALL_SSL_OPTIONS_HASHES,
-                            "Constants.ALL_SSL_OPTIONS_HASHES must be appended with the sha256 "
-                            "hash of {0} when it is updated.".format(one_file))
+        self.assertTrue(self._current_ssl_options_hash() in ALL_SSL_OPTIONS_HASHES,
+            "Constants.ALL_SSL_OPTIONS_HASHES must be appended"
+            " with the sha256 hash of self.config.mod_ssl_conf when it is updated.")
 
 
 if __name__ == "__main__":

certbot-apache/certbot_apache/tests/debian_test.py

@@ -1,11 +1,11 @@
 """Test for certbot_apache.configurator for Debian overrides"""
+import os
 import shutil
 import unittest
 
 import mock
 
 from certbot import errors
-from certbot.compat import os
 
 from certbot_apache import apache_util
 from certbot_apache import obj
@@ -20,7 +20,7 @@ class MultipleVhostsTestDebian(util.ApacheTest):
     def setUp(self):  # pylint: disable=arguments-differ
         super(MultipleVhostsTestDebian, self).setUp()
         self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
+            self.config_path, None, self.config_dir, self.work_dir,
             os_info="debian")
         self.config = self.mock_deploy_cert(self.config)
         self.vh_truth = util.get_vh_truth(self.temp_dir,
@@ -79,9 +79,9 @@ class MultipleVhostsTestDebian(util.ApacheTest):
 
     def test_enable_site_failure(self):
         self.config.parser.root = "/tmp/nonexistent"
-        with mock.patch("certbot.compat.os.path.isdir") as mock_dir:
+        with mock.patch("os.path.isdir") as mock_dir:
             mock_dir.return_value = True
-            with mock.patch("certbot.compat.os.path.islink") as mock_link:
+            with mock.patch("os.path.islink") as mock_link:
                 mock_link.return_value = False
                 self.assertRaises(
                     errors.NotSupportedError,
@@ -161,8 +161,6 @@ class MultipleVhostsTestDebian(util.ApacheTest):
         self.config.parser.modules.add("mod_ssl.c")
         self.config.get_version = mock.Mock(return_value=(2, 4, 7))
         mock_exe.return_value = True
-        # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "staple-ocsp")
         self.assertTrue("socache_shmcb_module" in self.config.parser.modules)
 
@@ -174,7 +172,6 @@ class MultipleVhostsTestDebian(util.ApacheTest):
         mock_exe.return_value = True
 
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "ensure-http-header",
                             "Strict-Transport-Security")
         self.assertTrue("headers_module" in self.config.parser.modules)
@@ -186,7 +183,6 @@ class MultipleVhostsTestDebian(util.ApacheTest):
         mock_exe.return_value = True
         self.config.get_version = mock.Mock(return_value=(2, 2))
         # This will create an ssl vhost for certbot.demo
-        self.config.choose_vhost("certbot.demo")
         self.config.enhance("certbot.demo", "redirect")
         self.assertTrue("rewrite_module" in self.config.parser.modules)
 

certbot-apache/certbot_apache/tests/display_ops_test.py

@@ -11,39 +11,9 @@ from certbot.tests import util as certbot_util
 
 from certbot_apache import obj
 
-from certbot_apache.display_ops import select_vhost_multiple
 from certbot_apache.tests import util
 
 
-class SelectVhostMultiTest(unittest.TestCase):
-    """Tests for certbot_apache.display_ops.select_vhost_multiple."""
-
-    def setUp(self):
-        self.base_dir = "/example_path"
-        self.vhosts = util.get_vh_truth(
-            self.base_dir, "debian_apache_2_4/multiple_vhosts")
-
-    def test_select_no_input(self):
-        self.assertFalse(select_vhost_multiple([]))
-
-    @certbot_util.patch_get_utility()
-    def test_select_correct(self, mock_util):
-        mock_util().checklist.return_value = (
-            display_util.OK, [self.vhosts[3].display_repr(),
-                              self.vhosts[2].display_repr()])
-        vhs = select_vhost_multiple([self.vhosts[3],
-                                     self.vhosts[2],
-                                     self.vhosts[1]])
-        self.assertTrue(self.vhosts[2] in vhs)
-        self.assertTrue(self.vhosts[3] in vhs)
-        self.assertFalse(self.vhosts[1] in vhs)
-
-    @certbot_util.patch_get_utility()
-    def test_select_cancel(self, mock_util):
-        mock_util().checklist.return_value = (display_util.CANCEL, "whatever")
-        vhs = select_vhost_multiple([self.vhosts[2], self.vhosts[3]])
-        self.assertFalse(vhs)
-
 class SelectVhostTest(unittest.TestCase):
     """Tests for certbot_apache.display_ops.select_vhost."""
 

certbot-apache/certbot_apache/tests/entrypoint_test.py

@@ -6,7 +6,6 @@ import mock
 from certbot_apache import configurator
 from certbot_apache import entrypoint
 
-
 class EntryPointTest(unittest.TestCase):
     """Entrypoint tests"""
 
@@ -15,13 +14,8 @@ class EntryPointTest(unittest.TestCase):
     def test_get_configurator(self):
 
         with mock.patch("certbot.util.get_os_info") as mock_info:
-            for distro in entrypoint.OVERRIDE_CLASSES:
-                return_value = (distro, "whatever")
-                if distro == 'fedora_old':
-                    return_value = ('fedora', '28')
-                elif distro == 'fedora':
-                    return_value = ('fedora', '29')
-                mock_info.return_value = return_value
+            for distro in entrypoint.OVERRIDE_CLASSES.keys():
+                mock_info.return_value = (distro, "whatever")
                 self.assertEqual(entrypoint.get_configurator(),
                                  entrypoint.OVERRIDE_CLASSES[distro])
 
@@ -29,7 +23,7 @@ class EntryPointTest(unittest.TestCase):
         with mock.patch("certbot.util.get_os_info") as mock_info:
             mock_info.return_value = ("nonexistent", "irrelevant")
             with mock.patch("certbot.util.get_systemd_os_like") as mock_like:
-                for like in entrypoint.OVERRIDE_CLASSES:
+                for like in entrypoint.OVERRIDE_CLASSES.keys():
                     mock_like.return_value = [like]
                     self.assertEqual(entrypoint.get_configurator(),
                                      entrypoint.OVERRIDE_CLASSES[like])

certbot-apache/certbot_apache/tests/fedora_test.py

@@ -1,195 +0,0 @@
-"""Test for certbot_apache.configurator for Fedora 29+ overrides"""
-import unittest
-
-import mock
-
-from certbot import errors
-from certbot.compat import filesystem
-from certbot.compat import os
-
-from certbot_apache import obj
-from certbot_apache import override_fedora
-from certbot_apache.tests import util
-
-
-def get_vh_truth(temp_dir, config_name):
-    """Return the ground truth for the specified directory."""
-    prefix = os.path.join(
-        temp_dir, config_name, "httpd/conf.d")
-
-    aug_pre = "/files" + prefix
-    # TODO: eventually, these tests should have a dedicated configuration instead
-    #  of reusing the ones from centos_test
-    vh_truth = [
-        obj.VirtualHost(
-            os.path.join(prefix, "centos.example.com.conf"),
-            os.path.join(aug_pre, "centos.example.com.conf/VirtualHost"),
-            {obj.Addr.fromstring("*:80")},
-            False, True, "centos.example.com"),
-        obj.VirtualHost(
-            os.path.join(prefix, "ssl.conf"),
-            os.path.join(aug_pre, "ssl.conf/VirtualHost"),
-            {obj.Addr.fromstring("_default_:443")},
-            True, True, None)
-    ]
-    return vh_truth
-
-
-class FedoraRestartTest(util.ApacheTest):
-    """Tests for Fedora specific self-signed certificate override"""
-
-    # TODO: eventually, these tests should have a dedicated configuration instead
-    #  of reusing the ones from centos_test
-    def setUp(self):  # pylint: disable=arguments-differ
-        test_dir = "centos7_apache/apache"
-        config_root = "centos7_apache/apache/httpd"
-        vhost_root = "centos7_apache/apache/httpd/conf.d"
-        super(FedoraRestartTest, self).setUp(test_dir=test_dir,
-                                             config_root=config_root,
-                                             vhost_root=vhost_root)
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
-            os_info="fedora")
-        self.vh_truth = get_vh_truth(
-            self.temp_dir, "centos7_apache/apache")
-
-    def _run_fedora_test(self):
-        self.assertIsInstance(self.config, override_fedora.FedoraConfigurator)
-        self.config.config_test()
-
-    def test_fedora_restart_error(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
-        with mock.patch(c_test) as mock_test:
-            # First call raises error, second doesn't
-            mock_test.side_effect = [errors.MisconfigurationError, '']
-            with mock.patch("certbot.util.run_script") as mock_run:
-                mock_run.side_effect = errors.SubprocessError
-                self.assertRaises(errors.MisconfigurationError,
-                                  self._run_fedora_test)
-
-    def test_fedora_restart(self):
-        c_test = "certbot_apache.configurator.ApacheConfigurator.config_test"
-        with mock.patch(c_test) as mock_test:
-            with mock.patch("certbot.util.run_script") as mock_run:
-                # First call raises error, second doesn't
-                mock_test.side_effect = [errors.MisconfigurationError, '']
-                self._run_fedora_test()
-                self.assertEqual(mock_test.call_count, 2)
-                self.assertEqual(mock_run.call_args[0][0],
-                                ['systemctl', 'restart', 'httpd'])
-
-
-class MultipleVhostsTestFedora(util.ApacheTest):
-    """Multiple vhost tests for CentOS / RHEL family of distros"""
-
-    _multiprocess_can_split_ = True
-
-    def setUp(self):  # pylint: disable=arguments-differ
-        test_dir = "centos7_apache/apache"
-        config_root = "centos7_apache/apache/httpd"
-        vhost_root = "centos7_apache/apache/httpd/conf.d"
-        super(MultipleVhostsTestFedora, self).setUp(test_dir=test_dir,
-                                                    config_root=config_root,
-                                                    vhost_root=vhost_root)
-
-        self.config = util.get_apache_configurator(
-            self.config_path, self.vhost_path, self.config_dir, self.work_dir,
-            os_info="fedora")
-        self.vh_truth = get_vh_truth(
-            self.temp_dir, "centos7_apache/apache")
-
-    def test_get_parser(self):
-        self.assertIsInstance(self.config.parser, override_fedora.FedoraParser)
-
-    @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
-    def test_opportunistic_httpd_runtime_parsing(self, mock_get):
-        define_val = (
-            'Define: TEST1\n'
-            'Define: TEST2\n'
-            'Define: DUMP_RUN_CFG\n'
-        )
-        mod_val = (
-            'Loaded Modules:\n'
-            ' mock_module (static)\n'
-            ' another_module (static)\n'
-        )
-        def mock_get_cfg(command):
-            """Mock httpd process stdout"""
-            if command == ['httpd', '-t', '-D', 'DUMP_RUN_CFG']:
-                return define_val
-            elif command == ['httpd', '-t', '-D', 'DUMP_MODULES']:
-                return mod_val
-            return ""
-        mock_get.side_effect = mock_get_cfg
-        self.config.parser.modules = set()
-        self.config.parser.variables = {}
-
-        with mock.patch("certbot.util.get_os_info") as mock_osi:
-            # Make sure we have the have the CentOS httpd constants
-            mock_osi.return_value = ("fedora", "29")
-            self.config.parser.update_runtime_variables()
-
-        self.assertEqual(mock_get.call_count, 3)
-        self.assertEqual(len(self.config.parser.modules), 4)
-        self.assertEqual(len(self.config.parser.variables), 2)
-        self.assertTrue("TEST2" in self.config.parser.variables.keys())
-        self.assertTrue("mod_another.c" in self.config.parser.modules)
-
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_get_version(self, mock_run_script):
-        mock_run_script.return_value = ('', None)
-        self.assertRaises(errors.PluginError, self.config.get_version)
-        self.assertEqual(mock_run_script.call_args[0][0][0], 'httpd')
-
-    def test_get_virtual_hosts(self):
-        """Make sure all vhosts are being properly found."""
-        vhs = self.config.get_virtual_hosts()
-        self.assertEqual(len(vhs), 2)
-        found = 0
-
-        for vhost in vhs:
-            for centos_truth in self.vh_truth:
-                if vhost == centos_truth:
-                    found += 1
-                    break
-            else:
-                raise Exception("Missed: %s" % vhost)  # pragma: no cover
-        self.assertEqual(found, 2)
-
-    @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
-    def test_get_sysconfig_vars(self, mock_cfg):
-        """Make sure we read the sysconfig OPTIONS variable correctly"""
-        # Return nothing for the process calls
-        mock_cfg.return_value = ""
-        self.config.parser.sysconfig_filep = filesystem.realpath(
-            os.path.join(self.config.parser.root, "../sysconfig/httpd"))
-        self.config.parser.variables = {}
-
-        with mock.patch("certbot.util.get_os_info") as mock_osi:
-            # Make sure we have the have the CentOS httpd constants
-            mock_osi.return_value = ("fedora", "29")
-            self.config.parser.update_runtime_variables()
-
-        self.assertTrue("mock_define" in self.config.parser.variables.keys())
-        self.assertTrue("mock_define_too" in self.config.parser.variables.keys())
-        self.assertTrue("mock_value" in self.config.parser.variables.keys())
-        self.assertEqual("TRUE", self.config.parser.variables["mock_value"])
-        self.assertTrue("MOCK_NOSEP" in self.config.parser.variables.keys())
-        self.assertEqual("NOSEP_VAL", self.config.parser.variables["NOSEP_TWO"])
-
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_alt_restart_works(self, mock_run_script):
-        mock_run_script.side_effect = [None, errors.SubprocessError, None]
-        self.config.restart()
-        self.assertEqual(mock_run_script.call_count, 3)
-
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_alt_restart_errors(self, mock_run_script):
-        mock_run_script.side_effect = [None,
-                                       errors.SubprocessError,
-                                       errors.SubprocessError]
-        self.assertRaises(errors.MisconfigurationError, self.config.restart)
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/gentoo_test.py

@@ -1,17 +1,13 @@
 """Test for certbot_apache.configurator for Gentoo overrides"""
+import os
 import unittest
 
 import mock
 
-from certbot import errors
-from certbot.compat import filesystem
-from certbot.compat import os
-
-from certbot_apache import obj
 from certbot_apache import override_gentoo
+from certbot_apache import obj
 from certbot_apache.tests import util
 
-
 def get_vh_truth(temp_dir, config_name):
     """Return the ground truth for the specified directory."""
     prefix = os.path.join(
@@ -82,7 +78,7 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
         """Make sure we read the Gentoo APACHE2_OPTS variable correctly"""
         defines = ['DEFAULT_VHOST', 'INFO',
                    'SSL', 'SSL_DEFAULT_VHOST', 'LANGUAGE']
-        self.config.parser.apacheconfig_filep = filesystem.realpath(
+        self.config.parser.apacheconfig_filep = os.path.realpath(
             os.path.join(self.config.parser.root, "../conf.d/apache2"))
         self.config.parser.variables = {}
         with mock.patch("certbot_apache.override_gentoo.GentooParser.update_modules"):
@@ -115,24 +111,17 @@ class MultipleVhostsTestGentoo(util.ApacheTest):
             """Mock httpd process stdout"""
             if command == ['apache2ctl', 'modules']:
                 return mod_val
-            return None  # pragma: no cover
         mock_get.side_effect = mock_get_cfg
         self.config.parser.modules = set()
 
         with mock.patch("certbot.util.get_os_info") as mock_osi:
-            # Make sure we have the have the Gentoo httpd constants
+            # Make sure we have the have the CentOS httpd constants
             mock_osi.return_value = ("gentoo", "123")
             self.config.parser.update_runtime_variables()
 
-        self.assertEqual(mock_get.call_count, 1)
-        self.assertEqual(len(self.config.parser.modules), 4)
+        self.assertEquals(mock_get.call_count, 1)
+        self.assertEquals(len(self.config.parser.modules), 4)
         self.assertTrue("mod_another.c" in self.config.parser.modules)
 
-    @mock.patch("certbot_apache.configurator.util.run_script")
-    def test_alt_restart_works(self, mock_run_script):
-        mock_run_script.side_effect = [None, errors.SubprocessError, None]
-        self.config.restart()
-        self.assertEqual(mock_run_script.call_count, 3)
-
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/http_01_test.py

@@ -1,232 +0,0 @@
-"""Test for certbot_apache.http_01."""
-import unittest
-import mock
-
-from acme import challenges
-from acme.magic_typing import List  # pylint: disable=unused-import, no-name-in-module
-
-from certbot import achallenges
-from certbot import errors
-from certbot.compat import os
-from certbot.tests import acme_util
-
-from certbot_apache.parser import get_aug_path
-from certbot_apache.tests import util
-
-
-NUM_ACHALLS = 3
-
-
-class ApacheHttp01Test(util.ApacheTest):
-    """Test for certbot_apache.http_01.ApacheHttp01."""
-
-    def setUp(self, *args, **kwargs):  # pylint: disable=arguments-differ
-        super(ApacheHttp01Test, self).setUp(*args, **kwargs)
-
-        self.account_key = self.rsa512jwk
-        self.achalls = []  # type: List[achallenges.KeyAuthorizationAnnotatedChallenge]
-        vh_truth = util.get_vh_truth(
-            self.temp_dir, "debian_apache_2_4/multiple_vhosts")
-        # Takes the vhosts for encryption-example.demo, certbot.demo
-        # and vhost.in.rootconf
-        self.vhosts = [vh_truth[0], vh_truth[3], vh_truth[10]]
-
-        for i in range(NUM_ACHALLS):
-            self.achalls.append(
-                achallenges.KeyAuthorizationAnnotatedChallenge(
-                    challb=acme_util.chall_to_challb(
-                        challenges.HTTP01(token=((chr(ord('a') + i).encode() * 16))),
-                        "pending"),
-                    domain=self.vhosts[i].name, account_key=self.account_key))
-
-        modules = ["ssl", "rewrite", "authz_core", "authz_host"]
-        for mod in modules:
-            self.config.parser.modules.add("mod_{0}.c".format(mod))
-            self.config.parser.modules.add(mod + "_module")
-
-        from certbot_apache.http_01 import ApacheHttp01
-        self.http = ApacheHttp01(self.config)
-
-    def test_empty_perform(self):
-        self.assertFalse(self.http.perform())
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
-    def test_enable_modules_apache_2_2(self, mock_enmod):
-        self.config.version = (2, 2)
-        self.config.parser.modules.remove("authz_host_module")
-        self.config.parser.modules.remove("mod_authz_host.c")
-
-        enmod_calls = self.common_enable_modules_test(mock_enmod)
-        self.assertEqual(enmod_calls[0][0][0], "authz_host")
-
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.enable_mod")
-    def test_enable_modules_apache_2_4(self, mock_enmod):
-        self.config.parser.modules.remove("authz_core_module")
-        self.config.parser.modules.remove("mod_authz_core.c")
-
-        enmod_calls = self.common_enable_modules_test(mock_enmod)
-        self.assertEqual(enmod_calls[0][0][0], "authz_core")
-
-    def common_enable_modules_test(self, mock_enmod):
-        """Tests enabling mod_rewrite and other modules."""
-        self.config.parser.modules.remove("rewrite_module")
-        self.config.parser.modules.remove("mod_rewrite.c")
-
-        self.http.prepare_http01_modules()
-
-        self.assertTrue(mock_enmod.called)
-        calls = mock_enmod.call_args_list
-        other_calls = []
-        for call in calls:
-            if call[0][0] != "rewrite":
-                other_calls.append(call)
-
-        # If these lists are equal, we never enabled mod_rewrite
-        self.assertNotEqual(calls, other_calls)
-        return other_calls
-
-    def test_same_vhost(self):
-        vhost = next(v for v in self.config.vhosts if v.name == "certbot.demo")
-        achalls = [
-            achallenges.KeyAuthorizationAnnotatedChallenge(
-                challb=acme_util.chall_to_challb(
-                    challenges.HTTP01(token=((b'a' * 16))),
-                    "pending"),
-                domain=vhost.name, account_key=self.account_key),
-            achallenges.KeyAuthorizationAnnotatedChallenge(
-                challb=acme_util.chall_to_challb(
-                    challenges.HTTP01(token=((b'b' * 16))),
-                    "pending"),
-                domain=next(iter(vhost.aliases)), account_key=self.account_key)
-        ]
-        self.common_perform_test(achalls, [vhost])
-
-    def test_anonymous_vhost(self):
-        vhosts = [v for v in self.config.vhosts if not v.ssl]
-        achalls = [
-            achallenges.KeyAuthorizationAnnotatedChallenge(
-                challb=acme_util.chall_to_challb(
-                    challenges.HTTP01(token=((b'a' * 16))),
-                    "pending"),
-                domain="something.nonexistent", account_key=self.account_key)]
-        self.common_perform_test(achalls, vhosts)
-
-    def test_configure_multiple_vhosts(self):
-        vhosts = [v for v in self.config.vhosts if "duplicate.example.com" in v.get_names()]
-        self.assertEqual(len(vhosts), 2)
-        achalls = [
-            achallenges.KeyAuthorizationAnnotatedChallenge(
-                challb=acme_util.chall_to_challb(
-                    challenges.HTTP01(token=((b'a' * 16))),
-                    "pending"),
-                domain="duplicate.example.com", account_key=self.account_key)]
-        self.common_perform_test(achalls, vhosts)
-
-    def test_no_vhost(self):
-        for achall in self.achalls:
-            self.http.add_chall(achall)
-        self.config.config.http01_port = 12345
-        self.assertRaises(errors.PluginError, self.http.perform)
-
-    def test_perform_1_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=1, minor_version=2)
-
-    def test_perform_1_achall_apache_2_4(self):
-        self.combinations_perform_test(num_achalls=1, minor_version=4)
-
-    def test_perform_2_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=2, minor_version=2)
-
-    def test_perform_2_achall_apache_2_4(self):
-        self.combinations_perform_test(num_achalls=2, minor_version=4)
-
-    def test_perform_3_achall_apache_2_2(self):
-        self.combinations_perform_test(num_achalls=3, minor_version=2)
-
-    def test_perform_3_achall_apache_2_4(self):
-        self.combinations_perform_test(num_achalls=3, minor_version=4)
-
-    def test_activate_disabled_vhost(self):
-        vhosts = [v for v in self.config.vhosts if v.name == "certbot.demo"]
-        achalls = [
-            achallenges.KeyAuthorizationAnnotatedChallenge(
-                challb=acme_util.chall_to_challb(
-                    challenges.HTTP01(token=((b'a' * 16))),
-                    "pending"),
-                domain="certbot.demo", account_key=self.account_key)]
-        vhosts[0].enabled = False
-        self.common_perform_test(achalls, vhosts)
-        matches = self.config.parser.find_dir(
-            "Include", vhosts[0].filep,
-            get_aug_path(self.config.parser.loc["default"]))
-        self.assertEqual(len(matches), 1)
-
-    def combinations_perform_test(self, num_achalls, minor_version):
-        """Test perform with the given achall count and Apache version."""
-        achalls = self.achalls[:num_achalls]
-        vhosts = self.vhosts[:num_achalls]
-        self.config.version = (2, minor_version)
-        self.common_perform_test(achalls, vhosts)
-
-    def common_perform_test(self, achalls, vhosts):
-        """Tests perform with the given achalls."""
-        challenge_dir = self.http.challenge_dir
-        self.assertFalse(os.path.exists(challenge_dir))
-        for achall in achalls:
-            self.http.add_chall(achall)
-
-        expected_response = [
-            achall.response(self.account_key) for achall in achalls]
-        self.assertEqual(self.http.perform(), expected_response)
-
-        self.assertTrue(os.path.isdir(self.http.challenge_dir))
-        self._has_min_permissions(self.http.challenge_dir, 0o755)
-        self._test_challenge_conf()
-
-        for achall in achalls:
-            self._test_challenge_file(achall)
-
-        for vhost in vhosts:
-            matches = self.config.parser.find_dir("Include",
-                                                self.http.challenge_conf_pre,
-                                                vhost.path)
-            self.assertEqual(len(matches), 1)
-            matches = self.config.parser.find_dir("Include",
-                                                self.http.challenge_conf_post,
-                                                vhost.path)
-            self.assertEqual(len(matches), 1)
-
-        self.assertTrue(os.path.exists(challenge_dir))
-
-    def _test_challenge_conf(self):
-        with open(self.http.challenge_conf_pre) as f:
-            pre_conf_contents = f.read()
-
-        with open(self.http.challenge_conf_post) as f:
-            post_conf_contents = f.read()
-
-        self.assertTrue("RewriteEngine on" in pre_conf_contents)
-        self.assertTrue("RewriteRule" in pre_conf_contents)
-
-        self.assertTrue(self.http.challenge_dir in post_conf_contents)
-        if self.config.version < (2, 4):
-            self.assertTrue("Allow from all" in post_conf_contents)
-        else:
-            self.assertTrue("Require all granted" in post_conf_contents)
-
-    def _test_challenge_file(self, achall):
-        name = os.path.join(self.http.challenge_dir, achall.chall.encode("token"))
-        validation = achall.validation(self.account_key)
-
-        self._has_min_permissions(name, 0o644)
-        with open(name, 'rb') as f:
-            self.assertEqual(f.read(), validation.encode())
-
-    def _has_min_permissions(self, path, min_mode):
-        """Tests the given file has at least the permissions in mode."""
-        st_mode = os.stat(path).st_mode
-        self.assertEqual(st_mode, st_mode | min_mode)
-
-
-if __name__ == "__main__":
-    unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/parser_test.py

@@ -1,12 +1,12 @@
-# pylint: disable=too-many-public-methods
 """Tests for certbot_apache.parser."""
+import os
 import shutil
 import unittest
 
+import augeas
 import mock
 
 from certbot import errors
-from certbot.compat import os
 
 from certbot_apache.tests import util
 
@@ -22,27 +22,6 @@ class BasicParserTest(util.ParserTest):
         shutil.rmtree(self.config_dir)
         shutil.rmtree(self.work_dir)
 
-    def test_bad_parse(self):
-        self.parser.parse_file(os.path.join(self.parser.root,
-                                            "conf-available", "bad_conf_file.conf"))
-        self.assertRaises(
-            errors.PluginError, self.parser.check_parsing_errors, "httpd.aug")
-
-    def test_bad_save(self):
-        mock_save = mock.Mock()
-        mock_save.side_effect = IOError
-        self.parser.aug.save = mock_save
-        self.assertRaises(errors.PluginError, self.parser.unsaved_files)
-
-    def test_aug_version(self):
-        mock_match = mock.Mock(return_value=["something"])
-        self.parser.aug.match = mock_match
-        # pylint: disable=protected-access
-        self.assertEqual(self.parser.check_aug_version(),
-                         ["something"])
-        self.parser.aug.match.side_effect = RuntimeError
-        self.assertFalse(self.parser.check_aug_version())
-
     def test_find_config_root_no_root(self):
         # pylint: disable=protected-access
         os.remove(self.parser.loc["root"])
@@ -73,7 +52,7 @@ class BasicParserTest(util.ParserTest):
         test2 = self.parser.find_dir("documentroot")
 
         self.assertEqual(len(test), 1)
-        self.assertEqual(len(test2), 8)
+        self.assertEqual(len(test2), 7)
 
     def test_add_dir(self):
         aug_default = "/files" + self.parser.loc["default"]
@@ -87,25 +66,8 @@ class BasicParserTest(util.ParserTest):
         for i, match in enumerate(matches):
             self.assertEqual(self.parser.aug.get(match), str(i + 1))
 
-    def test_add_dir_beginning(self):
-        aug_default = "/files" + self.parser.loc["default"]
-        self.parser.add_dir_beginning(aug_default,
-                                      "AddDirectiveBeginning",
-                                      "testBegin")
-
-        self.assertTrue(
-            self.parser.find_dir("AddDirectiveBeginning", "testBegin", aug_default))
-
-        self.assertEqual(
-            self.parser.aug.get(aug_default+"/directive[1]"),
-                                "AddDirectiveBeginning")
-        self.parser.add_dir_beginning(aug_default, "AddList", ["1", "2", "3", "4"])
-        matches = self.parser.find_dir("AddList", None, aug_default)
-        for i, match in enumerate(matches):
-            self.assertEqual(self.parser.aug.get(match), str(i + 1))
-
     def test_empty_arg(self):
-        self.assertEqual(None,
+        self.assertEquals(None,
                           self.parser.get_arg("/files/whatever/nonexistent"))
 
     def test_add_dir_to_ifmodssl(self):
@@ -255,7 +217,6 @@ class BasicParserTest(util.ParserTest):
                 return inc_val
             elif cmd[-1] == "DUMP_MODULES":
                 return mod_val
-            return None  # pragma: no cover
 
         mock_cfg.side_effect = mock_get_vars
 
@@ -304,11 +265,11 @@ class BasicParserTest(util.ParserTest):
         self.assertRaises(
             errors.PluginError, self.parser.update_runtime_variables)
 
-    @mock.patch("certbot_apache.configurator.ApacheConfigurator.option")
+    @mock.patch("certbot_apache.configurator.ApacheConfigurator.constant")
     @mock.patch("certbot_apache.parser.subprocess.Popen")
-    def test_update_runtime_vars_bad_ctl(self, mock_popen, mock_opt):
+    def test_update_runtime_vars_bad_ctl(self, mock_popen, mock_const):
         mock_popen.side_effect = OSError
-        mock_opt.return_value = "nonexistent"
+        mock_const.return_value = "nonexistent"
         self.assertRaises(
             errors.MisconfigurationError,
             self.parser.update_runtime_variables)
@@ -321,49 +282,25 @@ class BasicParserTest(util.ParserTest):
             errors.MisconfigurationError,
             self.parser.update_runtime_variables)
 
-    def test_add_comment(self):
-        from certbot_apache.parser import get_aug_path
-        self.parser.add_comment(get_aug_path(self.parser.loc["name"]), "123456")
-        comm = self.parser.find_comments("123456")
-        self.assertEqual(len(comm), 1)
-        self.assertTrue(self.parser.loc["name"] in comm[0])
-
 
 class ParserInitTest(util.ApacheTest):
     def setUp(self):  # pylint: disable=arguments-differ
         super(ParserInitTest, self).setUp()
+        self.aug = augeas.Augeas(
+            flags=augeas.Augeas.NONE | augeas.Augeas.NO_MODL_AUTOLOAD)
 
     def tearDown(self):
         shutil.rmtree(self.temp_dir)
         shutil.rmtree(self.config_dir)
         shutil.rmtree(self.work_dir)
 
-    @mock.patch("certbot_apache.parser.ApacheParser.init_augeas")
-    def test_prepare_no_augeas(self, mock_init_augeas):
-        from certbot_apache.parser import ApacheParser
-        mock_init_augeas.side_effect = errors.NoInstallationError
-        self.config.config_test = mock.Mock()
-        self.assertRaises(
-            errors.NoInstallationError, ApacheParser,
-            os.path.relpath(self.config_path), "/dummy/vhostpath",
-            version=(2, 4, 22), configurator=self.config)
-
-    def test_init_old_aug(self):
-        from certbot_apache.parser import ApacheParser
-        with mock.patch("certbot_apache.parser.ApacheParser.check_aug_version") as mock_c:
-            mock_c.return_value = False
-            self.assertRaises(
-                errors.NotSupportedError,
-                ApacheParser, os.path.relpath(self.config_path),
-                "/dummy/vhostpath", version=(2, 4, 22), configurator=self.config)
-
     @mock.patch("certbot_apache.parser.ApacheParser._get_runtime_cfg")
     def test_unparseable(self, mock_cfg):
         from certbot_apache.parser import ApacheParser
         mock_cfg.return_value = ('Define: TEST')
         self.assertRaises(
             errors.PluginError,
-            ApacheParser, os.path.relpath(self.config_path),
+            ApacheParser, self.aug, os.path.relpath(self.config_path),
             "/dummy/vhostpath", version=(2, 2, 22), configurator=self.config)
 
     def test_root_normalized(self):
@@ -375,7 +312,8 @@ class ParserInitTest(util.ApacheTest):
                 self.temp_dir,
                 "debian_apache_2_4/////multiple_vhosts/../multiple_vhosts/apache2")
 
-            parser = ApacheParser(path, "/dummy/vhostpath", configurator=self.config)
+            parser = ApacheParser(self.aug, path,
+                                  "/dummy/vhostpath", configurator=self.config)
 
         self.assertEqual(parser.root, self.config_path)
 
@@ -384,7 +322,7 @@ class ParserInitTest(util.ApacheTest):
         with mock.patch("certbot_apache.parser.ApacheParser."
                         "update_runtime_variables"):
             parser = ApacheParser(
-                os.path.relpath(self.config_path),
+                self.aug, os.path.relpath(self.config_path),
                 "/dummy/vhostpath", configurator=self.config)
 
         self.assertEqual(parser.root, self.config_path)
@@ -394,7 +332,7 @@ class ParserInitTest(util.ApacheTest):
         with mock.patch("certbot_apache.parser.ApacheParser."
                         "update_runtime_variables"):
             parser = ApacheParser(
-                self.config_path + os.path.sep,
+                self.aug, self.config_path + os.path.sep,
                 "/dummy/vhostpath", configurator=self.config)
         self.assertEqual(parser.root, self.config_path)
 

certbot-apache/certbot_apache/tests/testdata/centos6_apache/apache/httpd/conf.d/README

@@ -1,9 +0,0 @@
-
-This directory holds Apache 2.0 module-specific configuration files;
-any files in this directory which have the ".conf" extension will be
-processed as Apache configuration files.
-
-Files are processed in alphabetical order, so if using configuration
-directives which depend on, say, mod_perl being loaded, ensure that
-these are placed in a filename later in the sort order than "perl.conf".
-

certbot-apache/certbot_apache/tests/testdata/centos6_apache/apache/httpd/conf.d/ssl.conf

@@ -1,222 +0,0 @@
-#
-# This is the Apache server configuration file providing SSL support.
-# It contains the configuration directives to instruct the server how to
-# serve pages over an https connection. For detailing information about these 
-# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
-# 
-# Do NOT simply read the instructions in here without understanding
-# what they do.  They're here only as hints or reminders.  If you are unsure
-# consult the online docs. You have been warned.  
-#
-
-LoadModule ssl_module modules/mod_ssl.so
-
-#
-# When we also provide SSL we have to listen to the 
-# the HTTPS port in addition.
-#
-Listen 443
-
-##
-##  SSL Global Context
-##
-##  All SSL configuration in this context applies both to
-##  the main server and all SSL-enabled virtual hosts.
-##
-
-#   Pass Phrase Dialog:
-#   Configure the pass phrase gathering process.
-#   The filtering dialog program (`builtin' is a internal
-#   terminal dialog) has to provide the pass phrase on stdout.
-SSLPassPhraseDialog  builtin
-
-#   Inter-Process Session Cache:
-#   Configure the SSL Session Cache: First the mechanism 
-#   to use and second the expiring timeout (in seconds).
-SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
-SSLSessionCacheTimeout  300
-
-#   Semaphore:
-#   Configure the path to the mutual exclusion semaphore the
-#   SSL engine uses internally for inter-process synchronization. 
-SSLMutex default
-
-#   Pseudo Random Number Generator (PRNG):
-#   Configure one or more sources to seed the PRNG of the 
-#   SSL library. The seed data should be of good random quality.
-#   WARNING! On some platforms /dev/random blocks if not enough entropy
-#   is available. This means you then cannot use the /dev/random device
-#   because it would lead to very long connection times (as long as
-#   it requires to make more entropy available). But usually those
-#   platforms additionally provide a /dev/urandom device which doesn't
-#   block. So, if available, use this one instead. Read the mod_ssl User
-#   Manual for more details.
-SSLRandomSeed startup file:/dev/urandom  256
-SSLRandomSeed connect builtin
-#SSLRandomSeed startup file:/dev/random  512
-#SSLRandomSeed connect file:/dev/random  512
-#SSLRandomSeed connect file:/dev/urandom 512
-
-#
-# Use "SSLCryptoDevice" to enable any supported hardware
-# accelerators. Use "openssl engine -v" to list supported
-# engine names.  NOTE: If you enable an accelerator and the
-# server does not start, consult the error logs and ensure
-# your accelerator is functioning properly. 
-#
-SSLCryptoDevice builtin
-#SSLCryptoDevice ubsec
-
-##
-## SSL Virtual Host Context
-##
-
-<VirtualHost _default_:443>
-
-# General setup for the virtual host, inherited from global configuration
-#DocumentRoot "/var/www/html"
-#ServerName www.example.com:443
-
-# Use separate log files for the SSL virtual host; note that LogLevel
-# is not inherited from httpd.conf.
-ErrorLog logs/ssl_error_log
-TransferLog logs/ssl_access_log
-LogLevel warn
-
-#   SSL Engine Switch:
-#   Enable/Disable SSL for this virtual host.
-SSLEngine on
-
-#   SSL Protocol support:
-# List the enable protocol levels with which clients will be able to
-# connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
-
-#   SSL Cipher Suite:
-# List the ciphers that the client is permitted to negotiate.
-# See the mod_ssl documentation for a complete list.
-SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
-
-#   Server Certificate:
-# Point SSLCertificateFile at a PEM encoded certificate.  If
-# the certificate is encrypted, then you will be prompted for a
-# pass phrase.  Note that a kill -HUP will prompt again.  A new
-# certificate can be generated using the genkey(1) command.
-SSLCertificateFile /etc/pki/tls/certs/localhost.crt
-
-#   Server Private Key:
-#   If the key is not combined with the certificate, use this
-#   directive to point at the key file.  Keep in mind that if
-#   you've both a RSA and a DSA private key you can configure
-#   both in parallel (to also allow the use of DSA ciphers, etc.)
-SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
-
-#   Server Certificate Chain:
-#   Point SSLCertificateChainFile at a file containing the
-#   concatenation of PEM encoded CA certificates which form the
-#   certificate chain for the server certificate. Alternatively
-#   the referenced file can be the same as SSLCertificateFile
-#   when the CA certificates are directly appended to the server
-#   certificate for convinience.
-#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
-
-#   Certificate Authority (CA):
-#   Set the CA certificate verification path where to find CA
-#   certificates for client authentication or alternatively one
-#   huge file containing all of them (file must be PEM encoded)
-#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
-
-#   Client Authentication (Type):
-#   Client certificate verification type and depth.  Types are
-#   none, optional, require and optional_no_ca.  Depth is a
-#   number which specifies how deeply to verify the certificate
-#   issuer chain before deciding the certificate is not valid.
-#SSLVerifyClient require
-#SSLVerifyDepth  10
-
-#   Access Control:
-#   With SSLRequire you can do per-directory access control based
-#   on arbitrary complex boolean expressions containing server
-#   variable checks and other lookup directives.  The syntax is a
-#   mixture between C and Perl.  See the mod_ssl documentation
-#   for more details.
-#<Location />
-#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
-#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
-#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
-#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
-#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
-#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
-#</Location>
-
-#   SSL Engine Options:
-#   Set various options for the SSL engine.
-#   o FakeBasicAuth:
-#     Translate the client X.509 into a Basic Authorisation.  This means that
-#     the standard Auth/DBMAuth methods can be used for access control.  The
-#     user name is the `one line' version of the client's X.509 certificate.
-#     Note that no password is obtained from the user. Every entry in the user
-#     file needs this password: `xxj31ZMTZzkVA'.
-#   o ExportCertData:
-#     This exports two additional environment variables: SSL_CLIENT_CERT and
-#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
-#     server (always existing) and the client (only existing when client
-#     authentication is used). This can be used to import the certificates
-#     into CGI scripts.
-#   o StdEnvVars:
-#     This exports the standard SSL/TLS related `SSL_*' environment variables.
-#     Per default this exportation is switched off for performance reasons,
-#     because the extraction step is an expensive operation and is usually
-#     useless for serving static content. So one usually enables the
-#     exportation for CGI and SSI requests only.
-#   o StrictRequire:
-#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
-#     under a "Satisfy any" situation, i.e. when it applies access is denied
-#     and no other module can change it.
-#   o OptRenegotiate:
-#     This enables optimized SSL connection renegotiation handling when SSL
-#     directives are used in per-directory context. 
-#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<Files ~ "\.(cgi|shtml|phtml|php3?)$">
-    SSLOptions +StdEnvVars
-</Files>
-<Directory "/var/www/cgi-bin">
-    SSLOptions +StdEnvVars
-</Directory>
-
-#   SSL Protocol Adjustments:
-#   The safe and default but still SSL/TLS standard compliant shutdown
-#   approach is that mod_ssl sends the close notify alert but doesn't wait for
-#   the close notify alert from client. When you need a different shutdown
-#   approach you can use one of the following variables:
-#   o ssl-unclean-shutdown:
-#     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is send or allowed to received.  This violates
-#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
-#     this when you receive I/O errors because of the standard approach where
-#     mod_ssl sends the close notify alert.
-#   o ssl-accurate-shutdown:
-#     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is send and mod_ssl waits for the close notify
-#     alert of the client. This is 100% SSL/TLS standard compliant, but in
-#     practice often causes hanging connections with brain-dead browsers. Use
-#     this only for browsers where you know that their SSL implementation
-#     works correctly. 
-#   Notice: Most problems of broken clients are also related to the HTTP
-#   keep-alive facility, so you usually additionally want to disable
-#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
-#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
-#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
-#   "force-response-1.0" for this.
-SetEnvIf User-Agent ".*MSIE.*" \
-         nokeepalive ssl-unclean-shutdown \
-         downgrade-1.0 force-response-1.0
-
-#   Per-Server Logging:
-#   The home of a custom SSL log file. Use this when you want a
-#   compact non-error SSL logfile on a virtual host basis.
-CustomLog logs/ssl_request_log \
-          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
-
-</VirtualHost>                                  
-

certbot-apache/certbot_apache/tests/testdata/centos6_apache/apache/httpd/conf.d/test.example.com.conf

@@ -1,7 +0,0 @@
-<VirtualHost *:80>
-    ServerName test.example.com
-    ServerAdmin webmaster@dummy-host.example.com
-    DocumentRoot /var/www/htdocs
-    ErrorLog logs/dummy-host.example.com-error_log
-    CustomLog logs/dummy-host.example.com-access_log common
-</VirtualHost>

certbot-apache/certbot_apache/tests/testdata/centos6_apache/apache/httpd/conf.d/welcome.conf

@@ -1,11 +0,0 @@
-# 
-# This configuration file enables the default "Welcome"
-# page if there is no default index page present for
-# the root URL.  To disable the Welcome page, comment
-# out all the lines below.
-#
-<LocationMatch "^/+$">
-    Options -Indexes
-    ErrorDocument 403 /error/noindex.html
-</LocationMatch>
-

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-enabled/old,default.conf

@@ -0,0 +1 @@
+../sites-available/old,default.conf

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/augeas_vhosts/apache2/sites-enabled/old-and-default.conf

@@ -1 +0,0 @@
-../sites-available/old-and-default.conf

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/multiple_vhosts/apache2/sites-available/certbot.conf

@@ -1,6 +1,5 @@
 <VirtualHost *:80>
 ServerName certbot.demo
-ServerAlias www.certbot.demo
 ServerAdmin webmaster@localhost
 
 DocumentRoot /var/www-certbot-reworld/static/

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/multiple_vhosts/apache2/sites-available/duplicatehttp.conf

@@ -1,9 +0,0 @@
-<VirtualHost 10.2.3.4:80>
-	ServerName duplicate.example.com
-
-	ServerAdmin webmaster@certbot.demo
-	DocumentRoot /var/www/html
-
-	ErrorLog ${APACHE_LOG_DIR}/error.log
-	CustomLog ${APACHE_LOG_DIR}/access.log combined
-</VirtualHost>

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/multiple_vhosts/apache2/sites-available/duplicatehttps.conf

@@ -1,14 +0,0 @@
-<IfModule mod_ssl.c>
-<VirtualHost 10.2.3.4:443>
-	ServerName duplicate.example.com
-
-	ServerAdmin webmaster@certbot.demo
-	DocumentRoot /var/www/html
-
-	ErrorLog ${APACHE_LOG_DIR}/error.log
-	CustomLog ${APACHE_LOG_DIR}/access.log combined
-
-SSLCertificateFile	/etc/apache2/certs/certbot-cert_5.pem
-SSLCertificateKeyFile /etc/apache2/ssl/key-certbot_15.pem
-</VirtualHost>
-</IfModule>

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/multiple_vhosts/apache2/sites-enabled/duplicatehttp.conf

@@ -1 +0,0 @@
-../sites-available/duplicatehttp.conf

certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/multiple_vhosts/apache2/sites-enabled/duplicatehttps.conf

@@ -1 +0,0 @@
-../sites-available/duplicatehttps.conf

certbot-apache/certbot_apache/tests/tls_sni_01_test.py

@@ -0,0 +1,151 @@
+"""Test for certbot_apache.tls_sni_01."""
+import unittest
+import shutil
+
+import mock
+
+from certbot import errors
+from certbot.plugins import common_test
+
+from certbot_apache import obj
+from certbot_apache.tests import util
+
+from six.moves import xrange  # pylint: disable=redefined-builtin, import-error
+
+
+class TlsSniPerformTest(util.ApacheTest):
+    """Test the ApacheTlsSni01 challenge."""
+
+    auth_key = common_test.TLSSNI01Test.auth_key
+    achalls = common_test.TLSSNI01Test.achalls
+
+    def setUp(self):  # pylint: disable=arguments-differ
+        super(TlsSniPerformTest, self).setUp()
+
+        config = util.get_apache_configurator(
+            self.config_path, self.vhost_path, self.config_dir,
+            self.work_dir)
+        config.config.tls_sni_01_port = 443
+
+        from certbot_apache import tls_sni_01
+        self.sni = tls_sni_01.ApacheTlsSni01(config)
+
+    def tearDown(self):
+        shutil.rmtree(self.temp_dir)
+        shutil.rmtree(self.config_dir)
+        shutil.rmtree(self.work_dir)
+
+    def test_perform0(self):
+        resp = self.sni.perform()
+        self.assertEqual(len(resp), 0)
+
+    @mock.patch("certbot.util.exe_exists")
+    @mock.patch("certbot.util.run_script")
+    def test_perform1(self, _, mock_exists):
+        self.sni.configurator.parser.modules.add("socache_shmcb_module")
+        self.sni.configurator.parser.modules.add("ssl_module")
+
+        mock_exists.return_value = True
+        self.sni.configurator.parser.update_runtime_variables = mock.Mock()
+
+        achall = self.achalls[0]
+        self.sni.add_chall(achall)
+        response = self.achalls[0].response(self.auth_key)
+        mock_setup_cert = mock.MagicMock(return_value=response)
+        # pylint: disable=protected-access
+        self.sni._setup_challenge_cert = mock_setup_cert
+
+        responses = self.sni.perform()
+        mock_setup_cert.assert_called_once_with(achall)
+
+        # Check to make sure challenge config path is included in apache config
+        self.assertEqual(
+            len(self.sni.configurator.parser.find_dir(
+                "Include", self.sni.challenge_conf)), 1)
+        self.assertEqual(len(responses), 1)
+        self.assertEqual(responses[0], response)
+
+    def test_perform2(self):
+        # Avoid load module
+        self.sni.configurator.parser.modules.add("ssl_module")
+        self.sni.configurator.parser.modules.add("socache_shmcb_module")
+        acme_responses = []
+        for achall in self.achalls:
+            self.sni.add_chall(achall)
+            acme_responses.append(achall.response(self.auth_key))
+
+        mock_setup_cert = mock.MagicMock(side_effect=acme_responses)
+        # pylint: disable=protected-access
+        self.sni._setup_challenge_cert = mock_setup_cert
+
+        with mock.patch(
+            "certbot_apache.override_debian.DebianConfigurator.enable_mod"):
+            sni_responses = self.sni.perform()
+
+        self.assertEqual(mock_setup_cert.call_count, 2)
+
+        # Make sure calls made to mocked function were correct
+        self.assertEqual(
+            mock_setup_cert.call_args_list[0], mock.call(self.achalls[0]))
+        self.assertEqual(
+            mock_setup_cert.call_args_list[1], mock.call(self.achalls[1]))
+
+        self.assertEqual(
+            len(self.sni.configurator.parser.find_dir(
+                "Include", self.sni.challenge_conf)),
+            1)
+        self.assertEqual(len(sni_responses), 2)
+        for i in xrange(2):
+            self.assertEqual(sni_responses[i], acme_responses[i])
+
+    def test_mod_config(self):
+        z_domains = []
+        for achall in self.achalls:
+            self.sni.add_chall(achall)
+            z_domain = achall.response(self.auth_key).z_domain
+            z_domains.append(set([z_domain.decode('ascii')]))
+
+        self.sni._mod_config()  # pylint: disable=protected-access
+        self.sni.configurator.save()
+
+        self.sni.configurator.parser.find_dir(
+            "Include", self.sni.challenge_conf)
+        vh_match = self.sni.configurator.aug.match(
+            "/files" + self.sni.challenge_conf + "//VirtualHost")
+
+        vhs = []
+        for match in vh_match:
+            # pylint: disable=protected-access
+            vhs.append(self.sni.configurator._create_vhost(match))
+        self.assertEqual(len(vhs), 2)
+        for vhost in vhs:
+            self.assertEqual(vhost.addrs, set([obj.Addr.fromstring("*:443")]))
+            names = vhost.get_names()
+            self.assertTrue(names in z_domains)
+
+    def test_get_addrs_default(self):
+        self.sni.configurator.choose_vhost = mock.Mock(
+            return_value=obj.VirtualHost(
+                "path", "aug_path",
+                set([obj.Addr.fromstring("_default_:443")]),
+                False, False)
+        )
+
+        # pylint: disable=protected-access
+        self.assertEqual(
+            set([obj.Addr.fromstring("*:443")]),
+            self.sni._get_addrs(self.achalls[0]))
+
+    def test_get_addrs_no_vhost_found(self):
+        self.sni.configurator.choose_vhost = mock.Mock(
+            side_effect=errors.MissingCommandlineFlag(
+                "Failed to run Apache plugin non-interactively"))
+
+        # pylint: disable=protected-access
+        self.assertEqual(
+            set([obj.Addr.fromstring("*:443")]),
+            self.sni._get_addrs(self.achalls[0]))
+
+
+if __name__ == "__main__":
+    unittest.main()  # pragma: no cover

certbot-apache/certbot_apache/tests/util.py

@@ -1,4 +1,5 @@
 """Common utilities for certbot_apache."""
+import os
 import shutil
 import sys
 import unittest
@@ -8,9 +9,10 @@ import josepy as jose
 import mock
 import zope.component
 
-from certbot.compat import os
 from certbot.display import util as display_util
+
 from certbot.plugins import common
+
 from certbot.tests import util as test_util
 
 from certbot_apache import configurator
@@ -78,12 +80,14 @@ class ParserTest(ApacheTest):
         with mock.patch("certbot_apache.parser.ApacheParser."
                         "update_runtime_variables"):
             self.parser = ApacheParser(
-                self.config_path, self.vhost_path, configurator=self.config)
+                self.aug, self.config_path, self.vhost_path,
+                configurator=self.config)
 
 
 def get_apache_configurator(  # pylint: disable=too-many-arguments, too-many-locals
         config_path, vhost_path,
         config_dir, work_dir, version=(2, 4, 7),
+        conf=None,
         os_info="generic",
         conf_vhost_path=None):
     """Create an Apache Configurator with the specified options.
@@ -94,36 +98,46 @@ def get_apache_configurator(  # pylint: disable=too-many-arguments, too-many-loc
     backups = os.path.join(work_dir, "backups")
     mock_le_config = mock.MagicMock(
         apache_server_root=config_path,
-        apache_vhost_root=None,
+        apache_vhost_root=conf_vhost_path,
         apache_le_vhost_ext="-le-ssl.conf",
         apache_challenge_location=config_path,
-        apache_enmod=None,
         backup_dir=backups,
         config_dir=config_dir,
-        http01_port=80,
         temp_checkpoint_dir=os.path.join(work_dir, "temp_checkpoints"),
         in_progress_dir=os.path.join(backups, "IN_PROGRESS"),
         work_dir=work_dir)
 
-    with mock.patch("certbot_apache.configurator.util.run_script"):
-        with mock.patch("certbot_apache.configurator.util."
-                        "exe_exists") as mock_exe_exists:
-            mock_exe_exists.return_value = True
-            with mock.patch("certbot_apache.parser.ApacheParser."
-                            "update_runtime_variables"):
-                try:
-                    config_class = entrypoint.OVERRIDE_CLASSES[os_info]
-                except KeyError:
-                    config_class = configurator.ApacheConfigurator
-                config = config_class(config=mock_le_config, name="apache",
-                    version=version)
-                if not conf_vhost_path:
-                    config_class.OS_DEFAULTS["vhost_root"] = vhost_path
-                else:
-                    # Custom virtualhost path was requested
-                    config.config.apache_vhost_root = conf_vhost_path
-                config.config.apache_ctl = config_class.OS_DEFAULTS["ctl"]
-                config.prepare()
+    orig_os_constant = configurator.ApacheConfigurator(mock_le_config,
+                                                       name="apache",
+                                                       version=version).constant
+
+    def mock_os_constant(key, vhost_path=vhost_path):
+        """Mock default vhost path"""
+        if key == "vhost_root":
+            return vhost_path
+        else:
+            return orig_os_constant(key)
+
+    with mock.patch("certbot_apache.configurator.ApacheConfigurator.constant") as mock_cons:
+        mock_cons.side_effect = mock_os_constant
+        with mock.patch("certbot_apache.configurator.util.run_script"):
+            with mock.patch("certbot_apache.configurator.util."
+                            "exe_exists") as mock_exe_exists:
+                mock_exe_exists.return_value = True
+                with mock.patch("certbot_apache.parser.ApacheParser."
+                                "update_runtime_variables"):
+                    try:
+                        config_class = entrypoint.OVERRIDE_CLASSES[os_info]
+                    except KeyError:
+                        config_class = configurator.ApacheConfigurator
+                    config = config_class(config=mock_le_config, name="apache",
+                        version=version)
+                    # This allows testing scripts to set it a bit more
+                    # quickly
+                    if conf is not None:
+                        config.conf = conf  # pragma: no cover
+
+                    config.prepare()
     return config
 
 
@@ -155,7 +169,7 @@ def get_vh_truth(temp_dir, config_name):
                 os.path.join(prefix, "certbot.conf"),
                 os.path.join(aug_pre, "certbot.conf/VirtualHost"),
                 set([obj.Addr.fromstring("*:80")]), False, True,
-                "certbot.demo", aliases=["www.certbot.demo"]),
+                "certbot.demo"),
             obj.VirtualHost(
                 os.path.join(prefix, "mod_macro-example.conf"),
                 os.path.join(aug_pre,
@@ -193,17 +207,7 @@ def get_vh_truth(temp_dir, config_name):
                 "/files" + os.path.join(temp_dir, config_name,
                                         "apache2/apache2.conf/VirtualHost"),
                 set([obj.Addr.fromstring("*:80")]), False, True,
-                "vhost.in.rootconf"),
-            obj.VirtualHost(
-                os.path.join(prefix, "duplicatehttp.conf"),
-                os.path.join(aug_pre, "duplicatehttp.conf/VirtualHost"),
-                set([obj.Addr.fromstring("10.2.3.4:80")]), False, True,
-                "duplicate.example.com"),
-            obj.VirtualHost(
-                os.path.join(prefix, "duplicatehttps.conf"),
-                os.path.join(aug_pre, "duplicatehttps.conf/IfModule/VirtualHost"),
-                set([obj.Addr.fromstring("10.2.3.4:443")]), True, True,
-                "duplicate.example.com")]
+                "vhost.in.rootconf")]
         return vh_truth
     if config_name == "debian_apache_2_4/multi_vhosts":
         prefix = os.path.join(

certbot-apache/certbot_apache/tls_configs/centos-current-options-ssl-apache.conf

@@ -1,19 +0,0 @@
-# This file contains important security parameters. If you modify this file
-# manually, Certbot will be unable to automatically provide future security
-# updates. Instead, Certbot will print and log an error message with a path to
-# the up-to-date file that you will need to refer to when manually updating
-# this file.
-
-SSLEngine on
-
-# Intermediate configuration, tweak to your needs
-SSLProtocol             all -SSLv2 -SSLv3
-SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
-SSLHonorCipherOrder     on
-SSLSessionTickets       off
-
-SSLOptions +StrictRequire
-
-# Add vhost name to log entries:
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
-LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

certbot-apache/certbot_apache/tls_configs/centos-old-options-ssl-apache.conf

@@ -1,18 +0,0 @@
-# This file contains important security parameters. If you modify this file
-# manually, Certbot will be unable to automatically provide future security
-# updates. Instead, Certbot will print and log an error message with a path to
-# the up-to-date file that you will need to refer to when manually updating
-# this file.
-
-SSLEngine on
-
-# Intermediate configuration, tweak to your needs
-SSLProtocol             all -SSLv2 -SSLv3
-SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
-SSLHonorCipherOrder     on
-
-SSLOptions +StrictRequire
-
-# Add vhost name to log entries:
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
-LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

certbot-apache/certbot_apache/tls_configs/current-options-ssl-apache.conf

@@ -1,20 +0,0 @@
-# This file contains important security parameters. If you modify this file
-# manually, Certbot will be unable to automatically provide future security
-# updates. Instead, Certbot will print and log an error message with a path to
-# the up-to-date file that you will need to refer to when manually updating
-# this file.
-
-SSLEngine on
-
-# Intermediate configuration, tweak to your needs
-SSLProtocol             all -SSLv2 -SSLv3
-SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
-SSLHonorCipherOrder     on
-SSLCompression          off
-SSLSessionTickets       off
-
-SSLOptions +StrictRequire
-
-# Add vhost name to log entries:
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
-LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

certbot-apache/certbot_apache/tls_configs/old-options-ssl-apache.conf

@@ -1,19 +0,0 @@
-# This file contains important security parameters. If you modify this file
-# manually, Certbot will be unable to automatically provide future security
-# updates. Instead, Certbot will print and log an error message with a path to
-# the up-to-date file that you will need to refer to when manually updating
-# this file.
-
-SSLEngine on
-
-# Intermediate configuration, tweak to your needs
-SSLProtocol             all -SSLv2 -SSLv3
-SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
-SSLHonorCipherOrder     on
-SSLCompression          off
-
-SSLOptions +StrictRequire
-
-# Add vhost name to log entries:
-LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
-LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common