Add option --acme-force-renewal-period to simplify renewal tests

Author: cozis

README.md

@@ -293,6 +293,8 @@ If you want to test certificate renewal, you can change the expirations by modif
 }
 ```
 
+You can also instruct BlogTech to renew certificates even though they are not expired using the option `--acme-force-renewal-period=<maximum duration in ms>`.
+
 ## Configuration Files
 
 BlogTech allows you to move any number of command-line arguments to a configuration file.

src/acme.c

@@ -468,6 +468,7 @@ void acme_config_init(ACME_Config *config,
     config->dont_verify_cert = false;
     config->trace_bytes = false;
     config->logger = NULL;
+    config->force_renewal_period = -1;
 
     config->email = email;
     config->country = country;
@@ -584,6 +585,7 @@ int acme_init(ACME *acme, ACME_Config *config)
     acme->dont_verify_cert = config->dont_verify_cert;
     acme->trace_bytes = config->trace_bytes;
     acme->logger = config->logger;
+    acme->force_renewal_period = config->force_renewal_period;
 
     acme->agree_tos = config->agree_tos;
 
@@ -638,14 +640,29 @@ int acme_init(ACME *acme, ACME_Config *config)
             log(acme->logger, S("Certificate file '{}' not found. Continuing without a certificate.\n"), V(config->certificate_file));
         } else {
 
+            Time current_time = get_current_time();
+            if (current_time == INVALID_TIME) {
+                log(acme->logger, S("Couldn't read the time.\n"), V());
+                acme_free(acme);
+                return -1;
+            }
+
             Time certificate_expiry;
             ret = get_chain_expiry(certificate, &certificate_expiry);
             if (ret < 0) {
                 log(acme->logger, S("Couldn't determine expiry of certificate file '{}'.\n"), V(config->certificate_file));
                 acme_free(acme);
                 return -1;
             }
-            log(acme->logger, S("Certificate will expire at {} UNIX time\n"), V(certificate_expiry / 1000));
+            log(acme->logger, S("Certificate will expire in {} seconds\n"), V((certificate_expiry - current_time) / 1000));
+
+            if (acme->force_renewal_period > -1) {
+                Time expiry_limit = current_time + acme->force_renewal_period;
+                if (expiry_limit < certificate_expiry) {
+                    certificate_expiry = expiry_limit;
+                    log(acme->logger, S("Forcing certificate renewal in {} seconds\n"), V(acme->force_renewal_period / 1000));
+                }
+            }
 
             string certificate_key;
             ret = file_read_all(acme->certificate_key_file, &certificate_key);
@@ -937,7 +954,7 @@ static int complete_account_creation_request(ACME *acme, CHTTP_Response *respons
         log(acme->logger, S("ACME account was created. The account key was stored in '{}'\n"), V(acme->account_key_file));
     } else {
         ASSERT(response->status == 200);
-        log(acme->logger, S("Existing ACME account found"), V());
+        log(acme->logger, S("Existing ACME account found\n"), V());
     }
 
     BIO_free(bio);
@@ -1464,13 +1481,27 @@ static int complete_certificate_download_request(ACME *acme, CHTTP_Response *res
     ASSERT(certificate.ptr != NULL);
     ASSERT(certificate.len > 0);
 
+    Time current_time = get_current_time();
+    if (current_time == INVALID_TIME) {
+        log(acme->logger, S("Couldn't read the time.\n"), V());
+        return -1;
+    }
+
     Time certificate_expiry;
     int ret = get_chain_expiry(certificate, &certificate_expiry);
     if (ret < 0) {
         log(acme->logger, S("Couldn't determine expiry of the newly issued certificate.\n"), V());
         return -1;
     }
-    log(acme->logger, S("Certificate will expire {} UNIX time\n"), V(certificate_expiry / 1000));
+    log(acme->logger, S("Certificate will expire in {} seconds\n"), V((certificate_expiry - current_time) / 1000));
+
+    if (acme->force_renewal_period > -1) {
+        Time expiry_limit = current_time + acme->force_renewal_period;
+        if (expiry_limit < certificate_expiry) {
+            certificate_expiry = expiry_limit;
+            log(acme->logger, S("Forcing certificate renewal in {} seconds\n"), V(acme->force_renewal_period / 1000));
+        }
+    }
 
     acme->certificate.ptr = malloc(certificate.len); // TODO: allocstr
     if (acme->certificate.ptr == NULL) {
@@ -1611,6 +1642,9 @@ void acme_process_timeout(ACME *acme, CHTTP_Client *client)
         break;
     case ACME_STATE_WAIT:
         {
+            if (acme->certificate_expiry > current_time)
+                break;
+
             // Free previous order data before starting a new certificate order
             reset_order_data(acme);
             if (send_order_creation_request(acme, acme->client) < 0) {

src/acme.h

@@ -19,6 +19,7 @@ typedef struct {
     b8      dont_verify_cert;
     b8      trace_bytes;
     Logger *logger;
+    int     force_renewal_period;
 
     /////////////////////////////////////////////
     // Information
@@ -154,6 +155,7 @@ typedef struct {
     b8            dont_verify_cert;
     b8            trace_bytes;
     Logger       *logger;
+    int           force_renewal_period;
 
     string account_key_file;
     string certificate_file;

src/main_server.c

@@ -47,6 +47,7 @@ typedef struct {
     string acme_country;
     string acme_org;
     b8     acme_insecure; // TODO: document
+    s32    acme_force_renewal_period; // TODO: document
     string acme_domains[ACME_DOMAIN_LIMIT];
     int    num_acme_domains;
 } ServerConfig;
@@ -250,6 +251,7 @@ static int load_server_config(ConfigReader *reader, ServerConfig *config)
         config->acme_url         = S("https://acme-v02.api.letsencrypt.org/directory");
         config->acme_insecure    = false;
         config->num_acme_domains = 0;
+        config->acme_force_renewal_period = -1;
 
         b8 have_acme_email   = false;
         b8 have_acme_country = false;
@@ -322,6 +324,8 @@ static int load_server_config(ConfigReader *reader, ServerConfig *config)
                 }
             } else if (streq(name, S("acme-insecure"))) {
                 parse_config_value_yn(name, value, &config->acme_insecure, &bad_config);
+            } else if (streq(name, S("acme-force-renewal-period"))) {
+                parse_config_value_time_ms(name, value, &config->acme_force_renewal_period, &bad_config);
             }
         }
 
@@ -614,6 +618,7 @@ int main_server(int argc, char **argv)
         acme_config.certificate_key_file = server_config.cert_key_file;
         acme_config.dont_verify_cert     = server_config.acme_insecure;
         acme_config.trace_bytes          = server_config.trace_bytes;
+        acme_config.force_renewal_period = server_config.acme_force_renewal_period;
 
         if (acme_init(&acme, &acme_config) < 0) {
             fprintf(stderr, "Couldn't setup the ACME client\n");