danielsz / certificaat Goto Github PK

I'm thinking of deploying a simple microservice to Google App Engine which takes a single jar file so I'll have to setup my certificate from within my application.

Hi! I'm trying to automate Salesforce certificate rotation (woe is me). Salesforce generates and holds the private key for you, so I can't upload a private key as I normally would with this tool or something like certbot certonly. They do give you a CSR; which I can use with certbot, but I'd prefer to use this.

It seems like all the machinery should be here, but it's not clear how to wire it together. Do you have an idea?

I'm trying to use this library to set up a cert with Let's Encrypt and running into the following error:

$ certificaat authorize -m google.com -a [email protected] -c http-01 -u acme://letsencrypt.org/staging
Failed to validate "-m google.com": Must be a valid domain

(I'm obviously not trying to get a cert for google.com, but I've used that as the example since it's clearly a valid domain.)

The issue seems to stem from the use of .isReachable in the specs:

(.isReachable (InetAddress/getByName "google.com") 5000)
;;=> false

Not sure why that would be or if it has to do with my environment (I see the same behavior on my Mac and a fresh amazon linux box, both with Java 1.8). Seems I'm not the only one to have issues with INetAddress.isReachable, though. See: https://stackoverflow.com/questions/9922543/why-does-inetaddress-isreachable-return-false-when-i-can-ping-the-ip-address

Anyone else run into this?

If it is actually an issue and not just me, I see a couple easy options to address it:

• Replace that call to INetAddress.isReachable with something else to validate the URL
• Add a command line option to skip that check (I expect leading to issues down the line with the CA if it's actually unreachable, but in my opinion that's better than not even being able to try because of the Spec)

Edit: FYI I do see it work for some sites e.g. -m wikipedia.org