letsencrypt chain select

acme-cli.gemspec

@@ -19,7 +19,10 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency 'acme-client', '>= 2.0.0'
+  # keep faraday < 1.0.0 to support older ruby
+  spec.add_runtime_dependency 'faraday', '< 1.0.0'
+
+  spec.add_runtime_dependency 'acme-client', '>= 2.0.7'
   spec.add_runtime_dependency 'thor'
   spec.add_runtime_dependency 'colorize'
 

lib/letsencrypt/cli/acme_wrapper.rb

@@ -4,6 +4,15 @@
 require 'colorize'
 require_relative 'support/certificate'
 
+# fix Acme::Client::ChainIdentifier at least 2.0.9
+class Acme::Client
+  class ChainIdentifier
+    def match_name?(name)
+      issuers.last.include?("/CN=#{name}") if issuers.any?
+    end
+  end
+end
+
 class AcmeWrapper
   def initialize(options)
     @options = options
@@ -23,7 +32,7 @@ def log(message, severity=:info)
   end
 
   def client
-    @client ||= Acme::Client.new(private_key: account_key, directory: directory)
+    @client ||= Acme::Client.new(private_key: account_key, directory: directory, connection_options: { ssl: { verify: @options[:ssl_verify] } })
   end
 
   def create_order(domains)
@@ -43,9 +52,9 @@ def authorize(authorization)
 
     challenge.request_validation
 
-    10.times do
+    30.times do
       log "Checking verification...", :debug
-      sleep 1
+      sleep 2
       challenge.reload
       break if challenge.status != 'pending'
     end
@@ -97,7 +106,7 @@ def cert(domains)
       sleep(1)
       order.reload
     end
-    certificate = Certificate.new(order.certificate)
+    certificate = Certificate.new(order.certificate(force_chain: @options[:chain]))
     File.write(@options[:fullchain_path], certificate.fullchain_to_pem)
     File.write(@options[:chain_path], certificate.chain_to_pem)
     File.write(@options[:certificate_path], certificate.to_pem)

lib/letsencrypt/cli/app.rb

@@ -8,7 +8,9 @@ class App < Thor
       class_option :test, desc: "Use staging url of Letsencrypt instead of production server", aliases: "-t", type: :boolean
       class_option :log_level, desc: "Log Level (debug, info, warn, error, fatal)", default: "info"
       class_option :color, desc: "Disable colorize", default: true, type: :boolean
-
+      class_option :ssl_verify, desc: "OpenSSL verify", default: true, type: :boolean
+      class_option :chain, desc: "Certificate chain", default: 'ISRG Root X1'
+
       desc 'register EMAIL', 'Register account'
       method_option :key_length, desc: "Length of generated private key", type: :numeric, default: 4096
       def register(email)

lib/letsencrypt/cli/version.rb

@@ -1,5 +1,5 @@
 module Letsencrypt
   module Cli
-    VERSION = "2.0.0"
+    VERSION = "2.0.1"
   end
 end