a `$@sdZddlmZddlZddlZddlZddlZddlZ ddl Z ddl m ZddlmZmZmZmZmZddlZddlmZddlm Z ddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlm Z ddlm!Z!ddlm"Z"ddlm#Z#ddlm$Z$ddlm%Z%ddlm&Z&ddlm'Z'ddl(m)Z*ddl(m+Z,ddl-m.Z.ddl-m/Z/ddl-m0Z0ddl1m2Z3ddl1mZ4ddl5m6Z6dZ7e8e9Z:dd Z;d!d"Zd'd(Z?d)d*Z@d+d,ZAd-d.ZBd/d0ZCd1d2ZDd3d4ZEd5d6ZFdpd7d8ZGdqd9d:ZHd;d<ZId=d>ZJd?d@ZKdAdBZLdCdDZMdEdFZNdrdGdHZOdIdJZPdKdLZQdMdNZRdOdPZSdQdRZTdSdTZUdUdVZVdWdXZWdYdZZXd[d\ZYd]d^ZZd_d`Z[dadbZ\dcddZ]dedfZ^dgdhZ_didjZ`dkdlZadsdmdnZbdS)tzCertbot main entry point.)print_functionN)errors)UnionIterableOptionalListTuple) crypto_util) interfaces)util)account) cert_manager)cli)client) configuration) constants)eff)hooks)log)renewal)reporter) snap_config)storage)updater)disco) selection) filesystem)misc)os)ops) enhancementsz?User chose to cancel the operation and may reinvoke the client.cCs<|jdksJ|jrdStjtj}d}|||jdS)zPotentially suggest a donation to support Certbot. :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None renewNzIf you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le ) verbZstagingzope component getUtilityr IReporter add_messageZ LOW_PRIORITY)config reporter_utilmsgr+8/usr/lib/python3/dist-packages/certbot/_internal/main.py _suggest_donation_if_appropriate2s r-cCs2tjtj}|jdksJ|jd|jdddS)zReports on successful dry run :param config: Configuration object :type config: interfaces.IConfig :returns: `None` :rtype: None r!zThe dry run was successful.F)Zon_crashN)r#r$r%r r&r"r'Z HIGH_PRIORITY)r(r)r+r+r,_report_successful_dry_runFs r.c Cst|z|durRtdj|jr&dndt|p6|dt ||||nj|dus^Jtdj|jrpdndt|d| ||}|durt d |durt |||jWt|n t|0|S) a!Authenticate and enroll certificate. This method finds the relevant lineage, figures out what to do with it, then performs that action. Includes calls to hooks, various reports, checks, and requests for user input. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names to get a certificate. Defaults to `None` :type domains: `list` of `str` :param certname: Name of new certificate. Defaults to `None` :type certname: str :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: the issued certificate or `None` if doing a dry run :rtype: storage.RenewableCert or None :raises errors.Error: if certificate could not be obtained Nz{action} for {domains}z-Simulating renewal of an existing certificatez Renewing an existing certificate)actiondomainsz Simulating a certificate requestzRequesting a certificateFz!Certificate could not be obtained)rZpre_hook display_utilnotifyformatdry_runZsummarize_domain_listnamesr renew_certZobtain_and_enroll_certificaterErrorZ deploy_hooklive_dirZ post_hook) le_clientr(r0certnamelineager+r+r,_get_and_save_certVs6     r<cCsRtdrtdsN|j}|j}||krNd}||j||}t|dS)a| This function ensures that the user will not implicitly migrate an existing key from one type to another in the situation where a certificate for that lineage already exist and they have not provided explicitly --key-type and --cert-name. :param config: Current configuration provided by the client :param cert: Matching certificate that could be renewed key_typer:zAre you trying to change the key type of the certificate named {0} from {1} to {2}? Please provide both --cert-name and --key-type on the command line confirm the change you are trying to make.N) rZ set_by_clir=upperZprivate_key_typer3Z lineagenamerr7)r(certZ new_key_typeZ cur_key_typer*r+r+r,%_handle_unexpected_key_type_migrations   r@c Cst||d|}dj|jj|d|tjd}|js`|j s`t j t jj|dddddrhd |fStd j|tjd d tjd dtjdttdS)aFigure out what to do if a previous cert had a subset of the names now requested :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param cert: Certificate object :type cert: storage.RenewableCert :returns: Tuple of (str action, cert_or_None) as per _find_lineage_for_domains_and_certname action can be: "newcert" | "renew" | "reinstall" :rtype: `tuple` of `str` z, a You have an existing certificate that contains a portion of the domains you requested (ref: {0}){br}{br}It contains these names: {1}{br}{br}You requested these names for the new certificate: {2}.{br}{br}Do you want to expand and replace this existing certificate with the new certificate?brZExpandCancelz--expandTZcli_flagforce_interactiver!zTo obtain a new certificate that contains these names without replacing your existing certificate for {0}, you must use the --duplicate option.{br}{br}For example:{br}{br}{1} --duplicate {2}r N)r@joinr5r3 configfilefilenamerlinesepexpandZrenew_by_defaultr#r$r%r IDisplayyesnor1r2sysargvrr7USER_CANCELLED)r(r0r?existingquestionr+r+r,_handle_subset_cert_requests2   rTcCst|||sd|fSt||r.d|fS|jr       r\cCsX|jr dSt||\}}|dur.|dur.dS|dur@t||S|durTt|||SdS)aDetermine whether there are duplicated names and how to handle them (renew, reinstall, newcert, or raising an error to stop the client run if the user chooses to cancel the operation when prompted). :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or `None` if renewal shouldn't occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. ZnewcertNNNN)Z duplicater Zfind_duplicative_certsr\rT)r(r0Zident_names_certZsubset_names_certr+r+r,_find_lineage_for_domainss  r_cCs.t|||\}}|dkr"td|dk|fS)aWFinds an existing certificate object given domains and/or a certificate name. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple of a boolean that indicates if this function should be followed by a call to fetch a certificate from the server, and either a RenewableCert instance or None. :rtype: `tuple` of `bool` and :class:`storage.RenewableCert` or `None` rUz Keeping the existing certificate)&_find_lineage_for_domains_and_certnameloggerinfo)r(r0r:r/r;r+r+r, _find_cert9s rccCs|st||St||}|rh|r^tt||t|kr^t||t||||d|fSt||S|rpdSt d |dS)aFind appropriate lineage based on given domains and/or certname. :param config: Configuration object :type config: interfaces.IConfig :param domains: List of domain names :type domains: `list` of `str` :param certname: Name of certificate :type certname: str :returns: Two-element tuple containing desired new-certificate behavior as a string token ("reinstall", "renew", or "newcert"), plus either a RenewableCert instance or None if renewal should not occur. :rtype: `tuple` of `str` and :class:`storage.RenewableCert` or `None` :raises errors.Error: If the user would like to rerun the client again. r!r]z}No certificate with name {0} found. Use -d to specify domains, or run certbot certificates to see possible certificate names.N) r_r lineage_for_certnamesetdomains_for_certnamer@_ask_user_to_confirm_new_namesr5r\rConfigurationErrorr3)r(r0r:r;r+r+r,r`Qs"    r`cCs@tt|t|}tt|t|}||||fS)zWGet lists of items removed from `before` and a lists of items added to `after` )listresort)ZafterZbeforeaddedremovedr+r+r,_get_added_removed|s rmcCs(|s d}ndd|}|j|tjdS)z%Format list with given character z {br}(None)z {br}{ch} )ZchrB)rHr3rrK) characterZstringsZ formattedr+r+r, _format_listsrocCsf|jr dSt||\}}dj|td|td|tjd}tjt j }|j |dddd sbt d dS) aAsk user to confirm update cert certname to contain new_domains. :param config: Configuration object :type config: interfaces.IConfig :param new_domains: List of new domain names :type new_domains: `list` of `str` :param certname: Name of certificate :type certname: str :param old_domains: List of old domain names :type old_domains: `list` of `str` :returns: None :rtype: None :raises errors.ConfigurationError: if cert name and domains mismatch NzYou are updating certificate {0} to include new domain(s): {1}{br}{br}You are also removing previously included domain(s): {2}{br}{br}Did you intend to make this change?+-rAzUpdate certificaterCT)rXz2Specified mismatched certificate name and domains.)Zrenew_with_new_domainsrmr3rorrKr#r$r%r rMrNrrh)r(Z new_domainsr:Z old_domainsrkrlr*objr+r+r,rgsrgcCsRd}|j}|jr|j}n|r(t||}|s8t||}|sJ|sJtd||fS)a Retrieve domains and certname from config or user input. :param config: Configuration object :type config: interfaces.IConfig :param installer: Installer object :type installer: interfaces.IInstaller :param `str` question: Overriding default question to ask the user if asked to choose from domain names. :returns: Two-part tuple of domains and certname :rtype: `tuple` of list of `str` and `str` :raises errors.Error: Usage message, if parameters are not used correctly NzPlease specify --domains, or --installer that will help in domain names autodiscovery, or --cert-name for an existing certificate name.)r:r0r rf display_opsZ choose_namesrr7)r( installerrSr0r:r+r+r,_find_domains_or_certnames   ruc Cs|jrt|dS|r|s"Jdt|}tjtj }|j dkrLdnd}|rddj |t j dnd}dj |||tj|t j d}|||jdS) aDReports the creation of a new certificate to the user. :param cert_path: path to certificate :type cert_path: str :param fullchain_path: path to full chain :type fullchain_path: str :param key_path: path to private key, if available :type key_path: str :returns: `None` :rtype: None Nz No certificates saved to report.rVz with the "certonly" optionz+Your key file has been saved at:{br}{0}{br}rAaCongratulations! Your certificate and chain have been saved at:{br}{0}{br}{1}Your certificate will expire on {2}. To obtain a new or tweaked version of this certificate in the future, simply run {3} again{4}. To non-interactively renew *all* of your certificates, run "{3} renew")r4r.r ZnotAfterdater#r$r%r r&r"r3rrKrZ cli_commandr'ZMEDIUM_PRIORITY) r( cert_pathfullchain_pathkey_pathZexpiryr)Z verbswitchZprivkey_statementr*r+r+r,_report_new_certs$ r{csfdd}t}d}jdur2|j}n|}t|dkrRt|}nt|dkrh|d}n~jdurjst _z"t j ||d\}}t dWn@tjyYn,tjytjdd d td Yn0|j_||fS) aDetermine which account to use. If ``config.account`` is ``None``, it will be updated based on the user input. Same for ``config.email``. :param config: Configuration object :type config: interfaces.IConfig :returns: Account and optionally ACME client API (biproduct of new registration). :rtype: tuple of :class:`certbot._internal.account.Account` and :class:`acme.client.Client` :raises errors.Error: If unable to register an account with ACME server csDjr dSd|}tjtj}|j|ddd}|s@t ddS)NTzpPlease read the Terms of Service at {0}. You must agree in order to register with the ACME server. Do you agree?z --agree-tosrDz?Registration cannot proceed without accepting Terms of Service.) Ztosr3r#r$r%r rMrNrr7)Zterms_of_servicer*rrresultr(r+r,_tos_cbsz#_determine_account.._tos_cbNrGr)Ztos_cbzAccount registered.rvT)exc_infoz.Unable to register an account with ACME server)r AccountFileStorageloadfind_alllenrsZchoose_accountemailregister_unsafely_without_email get_emailrregisterr1r2rZMissingCommandlineFlagr7radebugid)r(r~account_storageacmeaccaccountsr+r}r,_determine_account s4          rc stjtj}|j}|dur4d}|j|ddddd}|skz(_delete_if_appropriate..cSs|jSrrrr+r+r,rlrcSs|Srr+rr+r+r,rlrzhNot deleting revoked certificates due to overlapping archive dirs. More than one certificate is using %sz_config.default_archive_dir: {0}, config.live_dir: {1}, archive_dir: {2},original exception: {3})r#r$r%r rMZdelete_after_revokerNrxr:r Zcert_path_to_lineagerZfull_archive_path configobjZ ConfigObjZrenewal_file_for_certnameZmatch_and_check_overlapsrZOverlappingMatchFoundrawarning Exceptionr3Zdefault_archive_dirr8r7delete)r(r[Zattempt_deletionr*er+rr,_delete_if_appropriateFs<      rcCs>|dur"t|\}}td|nd\}}tj|||||dS)axInitialize Let's Encrypt Client :param config: Configuration object :type config: interfaces.IConfig :param authenticator: Acme authentication handler :type authenticator: Optional[interfaces.IAuthenticator] :param installer: Installer object :type installer: interfaces.IInstaller :returns: client: Client object :rtype: client.Client NzPicked account: %rr^r)rrarrClient)r( authenticatorrtrrr+r+r,_init_le_clientzs  rc Cst|}|}|sdStjtjj}d}||dddd}|sFdSt |\}}t j ||dd|d } | j |jt|} | |jtd dS) aDeactivate account on server :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None z.Could not find existing account to deactivate.zCAre you sure you would like to irrevocably deactivate your account?Z DeactivateZAbortT)rrrXzDeactivation aborted.NrzAccount deactivated.)r rrr#r$r%r rMrNrrrrZdeactivate_registrationregrrr1r2) r(unused_pluginsrrrNpromptZwants_deactivaterr cb_clientZ account_filesr+r+r, unregisters$     rcCs&t|}|}|rdSt|dS)a2Create accounts on the server. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating and error :rtype: None or str zmThere is an existing account; registration of a duplicate account with this command is currently unsupported.N)r rrr)r(rrrr+r+r,rs  rc Cst|}|}|sdS|jdur8|js8tjdd|_t|\}}tj ||dd|d}d}|jrxdd|j d D}|j j }|j |j j|j jj|d d |_ |j j|d |_ |||j |jstd nt||td|jdS)a2Modify accounts on the server. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or a string indicating and error :rtype: None or str z-Could not find an existing account to update.NF)Zoptionalrr+cSsg|] }d|qS)zmailto:r+).0rr+r+r, rz"update_account..,)Zcontact)body)urizFAny contact information associated with this account has been removed.z'Your e-mail address was updated to {0}.)r rrrrrsrrrrsplitrrrZupdate_registrationupdaterZ update_regrr1r2rZprepare_subscriptionr3) r(rrrrrrZ acc_contactsZ prev_regr_urir+r+r,update_accounts,      rcCsF|r|n|}|jdusJ|||j|j|j|j|||jdS)aInstall a cert :param config: Configuration object :type config: interfaces.IConfig :param le_client: Client object :type le_client: client.Client :param domains: List of domains :type domains: `list` of `str` :param lineage: Certificate lineage object. Defaults to `None` :type lineage: storage.RenewableCert :returns: `None` :rtype: None N)rxZdeploy_certificaterz chain_pathryenhance_config)r(r9r0r;Z path_providerr+r+r, _install_cert s    rc Cs(zt||d\}}Wn.tjyD}zt|WYd}~Sd}~00|joP|j}|jsx|sxd}tj |dd|dd|_t ||st d|jrt |}nt |rtd|jr|jrt|t||\}}t|d|d }t|||n td t |r$t||j} t | |||dS) aInstall a previously obtained cert in a server. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None installNz,Which certificate would you like to install?FZallow_multipleZ custom_promptrVOne ore more of the requested enhancements are not supported by the selected installerzLOne or more of the requested enhancements require --cert-name to be providedrrtzPath to certificate or key was not defined. If your certificate is managed by Certbot, please use --cert-name to define which certificate you would like to install.)plug_selchoose_configurator_pluginsrPluginSelectionErrorstrrzrxr:r get_certnamesr are_supportedNotSupportedError_populate_from_certname are_requestedrh_check_certificate_and_keyrurrrdenable) r(pluginsrt_rZ custom_certcertname_questionr0r9r;r+r+r,r(s:          rcCsZt||j}|s|S|js&|j|j_|js6|j|j_|jsF|j|j_|jsV|j|j_|S)zfHelper function for install to populate missing config values from lineage defined by --cert-name.)r rdr:rz namespacerxrry)r(r;r+r+r,rcs    rcCsPtjt|js&td|jtjt|j sLtd|j dS)Nz-Error while reading certificate from path {0}z-Error while reading private key from path {0}) rpathisfilerrealpathrxrrhr3rzr}r+r+r,rtsrcCstd|j|jdurgn|j}||}td|tjtjt j j dd}|j sr|j sr|t|dS| |||}td||j s|t|dS| |}td||t|dS)zList server software plugins. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None zExpected interfaces: %sNzFiltered plugins: %rFpausezVerified plugins: %rzPrepared plugins: %s)rarifacesZvisible functoolspartialr#r$r%r rM notificationZinitZpreparerZverify available)r(rrZfilteredr2Zverifiedrr+r+r, plugins_cmd{s,          rc sbgd}tfdd|D}tsL|sLd}t|tjdtdzt |d\}}Wn.tj y}zt |WYd}~Sd}~00t |std d }tjdd |d d_tj} jr| } n d } t| | } | stdtj} js| j_|rBtd|d} | j| jd dtr^t| | |dS)aAdd security enhancements to existing configuration :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None )ZhstsZredirectZuirZstaplec3s|]}t|VqdSr)getattr)rZenhr}r+r, rzenhance..z|Please specify one or more enhancement types to configure. To list the available enhancement types, run: %s --help enhance rz#No enhancements requested, exiting.enhanceNrzFWhich certificate would you like to use to enhance your configuration?FrzJWhich domain names would you like to enable the selected enhancements for?zAUser cancelled the domain selection. No domains defined, exiting.r)Zredirect_default)anyr rrarrOrPrZMisconfigurationErrorrrrrrrr rr:rfnoninteractive_modersZ choose_valuesr7rdrrrr)r(rZsupported_enhancementsZ oldstyle_enhr*rtrrrZ cert_domainsr0Zdomain_questionr;r9r+r}r,rsF       rcCst|j|j||dS)a Rollback server configuration changes made during install. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rrollbackrtZ checkpoints)r(rr+r+r,rs rcCst|dS)aUpdate the certificate file family symlinks Use the information in the config file to make symlinks point to the correct archive directory. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r Zupdate_live_symlinksr(rr+r+r,update_symlinkssrcCst|dS)aORename a certificate Use the information in the config file to rename an existing lineage. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r Zrename_lineagerr+r+r,renamesrcCst|dS)aODelete a certificate Use the information in the config file to delete an existing lineage. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r rrr+r+r,rsrcCst|dS)a#Display information about certs configured with Certbot :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)r certificatesrr+r+r,r#s rc Cs^d|_|_|jdur.|jr.t||j|_n|jr@|jrJ|jrJtd|jdurt d|jd|jdt |jd|jdt j|jd}t||}n0t d|jdt|\}}t||j|j}t |jdd}t d|jz |t ||jt|Wn0tjyH}zt|WYd}~Sd}~00t|jddS)aHRevoke a previously obtained certificate. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` or string indicating error in case of error :rtype: None or str NzCError! Exactly one of --cert-path or --cert-name must be specified!z$Revoking %s using certificate key %srrGzRevoking %s using Account KeyzReason code for revocation: %s)rtrrxr:rZcert_path_for_cert_namerr7rzrarr Zverify_cert_matches_priv_keyjoseZJWKrrZacme_from_config_keyrkeyrZpyopenssl_load_certificatereasonrevokeZComparableX509r acme_errorsZ ClientErrorrrsZsuccess_revocation)r(rrrrrr?rr+r+r,r4s0     rc CsJzt||d\}}Wn.tjyD}zt|WYd}~Sd}~00t||s\tdt|||}t ||\}}t |||\}} | } |rt ||||| } | r| j nd} | r| j nd} | r| jnd} |rt|| | | t|||| t|r | r t| |||| dus|s&t|n t|t|t||jdS)zObtain a certificate and install. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None rVNr)rrrrrr rrrrurcr<rxryrzr{rrrrsZsuccess_installationZsuccess_renewalr-rhandle_subscriptionr )r(rrtrrr9r0r:should_get_certr;Z new_lineagerxryrzr+r+r,rVas8     rVc Csn|j\}}||\}}|jr0td|jdS|||tj |jtj |j tj |j \}}}||fS)aObtain a cert using a user-supplied CSR This works differently in the CSR case (for now) because we don't have the privkey, and therefore can't construct the files for a lineage. So we just save the cert & chain to disk :/ :param config: Configuration object :type config: interfaces.IConfig :param client: Client object :type client: client.Client :returns: `cert_path` and `fullchain_path` as absolute paths to the actual files :rtype: `tuple` of `str` z*Dry run: skipping saving certificate to %sr^) Z actual_csrZobtain_certificate_from_csrr4rarrxZsave_certificaterrnormpathrry)r(r9csrrr?chainrxryr+r+r,_csr_get_and_save_certs  rc Cszt||d\}}Wn4tjyJ}ztd|WYd}~n d}~00t|||}t|||d}tj t j j }|dur|d|jddn.t|||||d|j|jdddS) aRenew & save an existing cert. Do not install it. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :param lineage: Certificate lineage object :type lineage: storage.RenewableCert :returns: `None` :rtype: None :raises errors.PluginSelectionError: MissingCommandlineFlag if supplied parameters do not pass rW'Could not choose appropriate plugin: %sN)r;z9new certificate deployed without reload, fullchain is {0}FrzDnew certificate deployed with reload of {0} server; fullchain is {1})rrrrrarbrr<r#r$r%r rMrr3Z fullchainrZrun_renewal_deployerZrestartrt) r(rr;rtauthrr9Zrenewed_lineager2r+r+r,r6s*  r6c Cs8zt||d\}}Wn4tjyJ}ztd|WYd}~n d}~00t|||}|jrt||\}}t |||t |t ||j dSt||\}} t||| \} } | stjtjj} | ddddSt|||| | } | r| jnd}| r| jnd}| r | jnd} t |||| t |t ||j dS)atAuthenticate & obtain cert, but do not install it. This implements the 'certonly' subcommand. :param config: Configuration object :type config: interfaces.IConfig :param plugins: List of plugins :type plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None :raises errors.Error: If specified plugin could not be used rWrNz5Certificate not yet due for renewal; no action taken.Fr)rrrrrarbrrrr{r-rrr rurcr#r$r%r rMrr<rxryrz)r(rrtrrr9rxryr0r:rr;r2rzr+r+r,rWs2    rWcCs&zt|Wtn t0dS)aRenew previously-obtained certificates. :param config: Configuration object :type config: interfaces.IConfig :param unused_plugins: List of plugins (deprecated) :type unused_plugins: plugins_disco.PluginsRegistry :returns: `None` :rtype: None N)rZhandle_renewal_requestrZrun_saved_post_hooksrr+r+r,r!s  r!cCsVt|jtj|jt|jtj|j|j|j|j f}|D]}tj ||jdqs rcCs|stjdd}ttjddkr4t|}t j }t dtjt dtjdt d|t d |t||}t|}tj|tzt|t|Wn tjy|jtkr҂Yn0t|t !|}tj|t"#|j$|||S) zRun Certbot. :param cli_args: command line to Certbot, defaults to ``sys.argv[1:]`` :type cli_args: `list` of `str` :returns: value for `sys.exit` about the exit status of Certbot :rtype: `str` or `int` or `None` rGNZCERTBOT_SNAPPEDTruezcertbot version: %sz#Location of certbot entry point: %srz Arguments: %rzDiscovered plugins: %r)%rOrPrZpre_arg_parse_setuprenvirongetrZ prepare_env plugins_discoZPluginsRegistryrrarcertbot __version__rZprepare_and_parse_argsrZNamespaceConfigr#r$rrZ+raise_for_non_administrative_windows_rightsZpost_arg_parse_setuprrr7funcrrrZReporterr Zatexit_registerZprint_messages)Zcli_argsrargsr(Zreportr+r+r,mainTs2              r)NNN)N)N)N)N)c__doc__Z __future__rrZlogging.handlersZloggingrOrZjosepyrZzope.componentr#rrrZacme.magic_typingrrrrrrr r r Zcertbot._internalr r rrrrrrrrrrrrZcertbot._internal.pluginsrrrrZcertbot.compatrrrZcertbot.displayrrsr1Zcertbot.pluginsr rQZ getLogger__name__rar-r.r<r@rTr\r_rcr`rmrorgrur{rrrrrrrrrrrrrrrrrrrVrr6rWr!rrrr+r+r+r,s                              ;37(+  & ) *;4(2 ;';-:+4