Fixed bug with HTTP-01 Challenge

Cargo.lock

@@ -130,7 +130,7 @@ checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "aralez"
-version = "0.94.2"
+version = "0.94.3"
 dependencies = [
  "ahash",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "aralez"
-version = "0.94.2"
+version = "0.94.3"
 edition = "2024"
 license = "Apache-2.0"
 description = "Reverse proxy built on top of Cloudflare's Pingora"

src/tls/acme/order.rs

@@ -13,8 +13,6 @@ use std::fs;
 use std::time::Duration;
 use x509_parser::prelude::*;
 
-static DNS: bool = true;
-
 pub async fn refresh_order(certs_dir: String, autoconf_dir: String, provider: Option<String>) {
     let credsfile = autoconf_dir + "/acme_credentials.json";
     loop {
@@ -25,15 +23,12 @@ pub async fn refresh_order(certs_dir: String, autoconf_dir: String, provider: Op
     }
 }
 pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: Option<String>) -> Result<String, Box<dyn std::error::Error>> {
-    let crt = certs_dir.clone() + "/" + domain + ".crt";
+    let crt = format!("{}/{}.crt", certs_dir, domain);
-    let key = certs_dir.clone() + "/" + domain + ".key";
+    let key = format!("{}/{}.key", certs_dir, domain);
 
     if DOMAINS.get(domain).is_none() {
         DOMAINS.insert(domain.to_string(), true);
-        let mut newlist: Vec<String> = Vec::new();
+        let newlist: Vec<String> = DOMAINS.iter().map(|item| item.key().to_string()).collect();
-        for item in DOMAINS.iter() {
-            newlist.push(item.key().to_string());
-        }
         if let Ok(json_content) = serde_json::to_string_pretty(&newlist) {
             let autocfg_file = credsfile.replace("/acme_credentials.json", "/domains.json");
             if let Err(err) = std::fs::write(&autocfg_file, json_content) {
@@ -42,10 +37,10 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: O
             }
         }
     }
+
     if let Ok(expiry) = cert_expiry(crt.as_str()) {
         let now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_secs();
         if expiry > now + 30 * 24 * 3600 {
-            // println!("Fresh certificate exists. Not renewing !");
             return Ok("Fresh certificate exists. Not renewing ! \n".to_string());
         }
     };
@@ -57,17 +52,21 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: O
 
     while let Some(auth) = authorizations.next().await {
         let mut auth = auth?;
-        let domain = auth.identifier().to_string();
+        let domain_name = auth.identifier().to_string();
-        let challenge_type = if DNS { ChallengeType::Dns01 } else { ChallengeType::Http01 };
+        let (challenge_type, is_dns) = match &provider {
+            Some(_) => (ChallengeType::Dns01, true),
+            None => (ChallengeType::Http01, false),
+        };
 
-        let mut challenge_handle = auth.challenge(challenge_type).ok_or("No challenge found")?;
+        let mut challenge_handle = auth.challenge(challenge_type).ok_or("Requested challenge type not offered by ACME server")?;
         let key_auth = challenge_handle.key_authorization();
         let key_auth_str = key_auth.as_str().to_string();
 
-        if let Some(prov) = provider.clone() {
+        if is_dns {
+            let prov = provider.as_ref().unwrap();
             let dns_provider = get_provider(prov.clone());
             let dns_value = calculate_dns_value(&key_auth_str);
-            let clean_domain = domain.trim_start_matches("*.").to_string();
+            let clean_domain = domain_name.trim_start_matches("*.").to_string();
             let record_name = format!("_acme-challenge.{}", clean_domain);
 
             match dns_provider.create_txt_record(&clean_domain, &record_name, &dns_value).await {
@@ -82,8 +81,9 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: O
                 }
             }
         } else {
-            let token = key_auth_str.split('.').next().ok_or("invalid key authorization")?.to_string();
+            let token = key_auth_str.split('.').next().ok_or("Invalid key authorization")?.to_string();
             CHALLENGES.write().unwrap().insert(token, key_auth_str);
+            tokio::time::sleep(std::time::Duration::from_millis(100)).await;
             challenge_handle.set_ready().await?;
         }
     }
@@ -97,12 +97,9 @@ pub async fn order(domain: &str, credsfile: &str, certs_dir: String, provider: O
     let signing_request = params.serialize_request(&private_key)?;
     let csr_der = signing_request.der();
     order.finalize_csr(csr_der).await?;
-
-    // poll for certificate
     let cert_chain_pem = order.poll_certificate(&RetryPolicy::default()).await?;
     CHALLENGES.write().unwrap().clear();
     let private_key_pem = private_key.serialize_pem();
-
     fs::write(crt, cert_chain_pem)?;
     fs::write(key, private_key_pem)?;
     Ok("Certificate is successfully generated \n".to_string())