Skip to content

[enh] Variabilize the certification authority #2308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
SveDec wants to merge 10 commits into
base: dev
Choose a base branch
from
Draft

[enh] Variabilize the certification authority #2308

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
4007990
Add invisible cert authority settings in security
SveDec Jun 10, 2026
d903a32
Add the domain in the SAN list of the CSR, as some CA reject an empty…
SveDec Jun 10, 2026
2223dc5
CA name variabilized in certificate.py
SveDec Jun 19, 2026
d336f2e
CA name variabilized in domain.py
SveDec Jun 26, 2026
bbc3edf
Variable name made generic
SveDec Jun 26, 2026
5b29b7f
Merge branch 'YunoHost:dev' into enh-2552-variabilize-cert-authority
SveDec Jul 3, 2026
0182ea8
CA name variabilized in config_domain.toml
SveDec Jul 3, 2026
c3d9f08
DNS CAA value variabilized
SveDec Jul 3, 2026
eece4d7
Comment variabilized
SveDec Jul 3, 2026
eaa1bc2
CA name made generic in the actionsmap
SveDec Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions locales/en.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -490,6 +490,9 @@
"global_settings_setting_backup_compress_tar_archives": "Compress backups",
"global_settings_setting_backup_compress_tar_archives_help": "When creating new backups, compress the archives (.tar.gz) instead of uncompressed archives (.tar). N.B. : enabling this option means create lighter backup archives, but the initial backup procedure will be significantly longer and heavy on CPU.",
"global_settings_setting_backup_name": "Backup",
"global_settings_setting_certauth.certification_authority": "Identifier of the certification authority",
"global_settings_setting_certauth.certification_authority_fullname": "Full name of the certification authority",
"global_settings_setting_certauth.certification_authority_acme_url": "ACME URL of the certification authority",
"global_settings_setting_dns_custom_resolvers_enabled": "Use custom DNS resolvers",
"global_settings_setting_dns_custom_resolvers_enabled_help": "By default, YunoHost uses a list of trustworthy resolvers located in Europe. Advanced users may want to specify custom resolvers instead.",
"global_settings_setting_dns_custom_resolvers_list": "Custom resolvers' addresses",
Expand Down
14 changes: 14 additions & 0 deletions share/config_global.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,20 @@ i18n = "global_settings_setting"
type = "boolean"
default = false

[security.certauth]
visible = false
[security.certauth.certification_authority]
type = "string"
default = "letsencrypt"

[security.certauth.certification_authority_fullname]
type = "string"
default = "Let's Encrypt"

[security.certauth.certification_authority_acme_url]
type = "url"
default = "https://acme-v02.api.letsencrypt.org"

[email]
[email.pop3]
[email.pop3.pop3_enabled]
Expand Down
5 changes: 3 additions & 2 deletions src/certificate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
from .log import OperationLogger
from .regenconf import regen_conf
from .service import _run_service_command
from .settings import settings_get
from .utils.error import YunohostError, YunohostValidationError
from .utils.file_utils import chmod, chown, read_file
from .utils.network import get_public_ip
Expand Down Expand Up @@ -60,7 +61,7 @@
VALIDITY_LIMIT = 15 # days

# For prod
PRODUCTION_CERTIFICATION_AUTHORITY = "https://acme-v02.api.letsencrypt.org"
PRODUCTION_CERTIFICATION_AUTHORITY = settings_get("security.certauth.certification_authority_acme_url")

@zamentur zamentur Jun 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This var is only used one time line 540, we probably should call this function only when we really need it.

@zamentur zamentur Jun 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So here it's a global settings and not a domain settings.

I imagine it's the good solution to choose a global settings for that

@SveDec SveDec Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The function is now called only once, and the settings put into variables.


#
# Front-end stuff #
Expand Down Expand Up @@ -598,7 +599,7 @@ def _prepare_certificate_signing_request(domain, key_file, output_folder):
# Set the domain
csr.get_subject().CN = domain

sanlist = []
sanlist = [domain]
hook_results = hook_callback("cert_alternate_names", env={"domain": domain})
for hook_name, results in hook_results.items():
#
Expand Down
Loading