Some fixes for ARI

README.md

@@ -72,6 +72,7 @@ By default the directory (work_dir) containing the working data (csr,certificate
 | account_key_algorithm   | d,**g**           | Key-algorithm for newly generated account keys (RSA, EC, ED25519, ED448)                                                                     | RSA                                  |
 | account_key_length      | d,**g**           | Key-length for newly generated RSA account keys (in bits) or EC curve (256=P-256, 384=P-384, 521=P-521)                                      | depends on account_key_algorithm     |
 | ttl_days                | d,**g**           | Renew certificate if it has less than this value validity left (in days or if between 0 and 1 as a fraction of total certificate lifetime)   | 0.33333                              |
+| validate_ari            | d,**g**           | Renew certificate if it's RFC9773 ARI window has been reached (if available)                                                                 | true                                 |
 | validate_ocsp           | d,**g**           | Renew certificate if it's OCSP status is REVOKED. Allowed values for this key are: false, sha1, sha224, sha256, sha384, sha512               | sha1 (as mandated by RFC5019)        |
 | cert_dir                | d,**g**           | Directory containing all certificate related data (crt,key,csr)                                                                              | {work_dir}                           |
 | key_algorithm           | d,**g**           | Key-algorithm for newly generated private keys (RSA, ECC, ED25519, ED448)                                                                    | RSA                                  |

acertmgr/__init__.py

@@ -198,7 +198,7 @@ def main():
                     or (str(config.get('validate_ocsp')).lower() != 'false'
                         and issuer and not tools.is_ocsp_valid(cert, issuer, config['validate_ocsp'])
                         )
-                    or (issuer
+                    or (str(config.get('validate_ari')).lower() != 'false' and issuer
                         and cert_check_ari_for_renewal(cert, issuer, domainconfigs, runtimeconfig['fallback_authority'])
                         )
                 ):

acertmgr/authority/acme.py

@@ -38,4 +38,4 @@ def revoke_crt(self, crt, reason=None):
     # @param issuer certificate necessary for correct AKI data
     # @return True if the certificate should be renewed, False otherwise
     def check_ari_for_renewal(self, crt, issuer):
-        raise False  # Do not mark for renewal if this is not implemented properly (use default renewal checks instead)
+        return False  # Do not mark for renewal if this is not implemented properly (use default renewal checks instead)

acertmgr/authority/v2.py

@@ -303,6 +303,8 @@ def revoke_crt(self, crt, reason=None):
     # @param issuer certificate necessary for correct AKI data
     # @return True if the certificate should be renewed, False otherwise
     def check_ari_for_renewal(self, crt, issuer):
+        if 'renewalInfo' not in self.directory:
+            return False
         try:
             sn = tools.get_cert_serialnumber_bytes(crt)
             aki = tools.get_issuer_cert_aki_bytes(issuer)

acertmgr/configuration.py

@@ -19,6 +19,7 @@
 DEFAULT_CONF_DIR = "/etc/acertmgr"
 DEFAULT_CONF_FILENAME = "acertmgr.conf"
 DEFAULT_TTL = 0.33333  # percent of the certificates total lifetime
+DEFAULT_VALIDATE_ARI = "true"
 DEFAULT_VALIDATE_OCSP = "sha1" # mandated by RFC5019
 DEFAULT_API = "v2"
 DEFAULT_AUTHORITY = "https://acme-v02.api.letsencrypt.org"
@@ -112,6 +113,9 @@ def parse_config_entry(entry, globalconfig, runtimeconfig):
     update_config_value(config, 'ttl_days', localconfig, globalconfig, DEFAULT_TTL)
     config['ttl_days'] = float(config['ttl_days'])
 
+    # Validate ARI on certificate verification
+    update_config_value(config, 'validate_ari', localconfig, globalconfig, DEFAULT_VALIDATE_ARI)
+
     # Validate OCSP on certificate verification
     update_config_value(config, 'validate_ocsp', localconfig, globalconfig, DEFAULT_VALIDATE_OCSP)