svn commit: r1923148 - in /httpd/httpd/trunk: changes-entries/md_v2.4.31.txt modules/md/md_acme_drive.c modules/md/md_acmev2_drive.c modules/md/md_version.h

[ic...@apache.org]

Author: icing
Date: Wed Jan 15 12:48:52 2025
New Revision: 1923148

URL: http://svn.apache.org/viewvc?rev=1923148&view=rev
Log:
  *) mod_md: update to version 2.4.31
     - Improved error reporting when waiting for ACME server to verify domains
       or finalizing the order fails, e.g. times out.
     - Increasing the timeouts to wait for ACME server to verify domain names
       and issue the certificate from 30 seconds to 5 minutes.
     - Change a log level from error to debug when Stapling is enabled but a
       certificate carries no OCSP responder URL.


Added:
    httpd/httpd/trunk/changes-entries/md_v2.4.31.txt
Modified:
    httpd/httpd/trunk/modules/md/md_acme_drive.c
    httpd/httpd/trunk/modules/md/md_acmev2_drive.c
    httpd/httpd/trunk/modules/md/md_version.h

Added: httpd/httpd/trunk/changes-entries/md_v2.4.31.txt
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/changes-entries/md_v2.4.31.txt?rev=1923148&view=auto
==============================================================================
--- httpd/httpd/trunk/changes-entries/md_v2.4.31.txt (added)
+++ httpd/httpd/trunk/changes-entries/md_v2.4.31.txt Wed Jan 15 12:48:52 2025
@@ -0,0 +1,7 @@
+  *) mod_md: update to version 2.4.31
+     - Improved error reporting when waiting for ACME server to verify domains
+       or finalizing the order fails, e.g. times out.
+     - Increasing the timeouts to wait for ACME server to verify domain names
+       and issue the certificate from 30 seconds to 5 minutes.
+     - Change a log level from error to debug when Stapling is enabled but a
+       certificate carries no OCSP responder URL.

Modified: httpd/httpd/trunk/modules/md/md_acme_drive.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/md/md_acme_drive.c?rev=1923148&r1=1923147&r2=1923148&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/md/md_acme_drive.c (original)
+++ httpd/httpd/trunk/modules/md/md_acme_drive.c Wed Jan 15 12:48:52 2025
@@ -515,8 +515,8 @@ static apr_status_t acme_driver_preload_
     d->baton = ad;
     
     ad->driver = d;
-    ad->authz_monitor_timeout = apr_time_from_sec(30);
-    ad->cert_poll_timeout = apr_time_from_sec(30);
+    ad->authz_monitor_timeout = apr_time_from_sec(300);
+    ad->cert_poll_timeout = apr_time_from_sec(300);
     ad->ca_challenges = apr_array_make(d->p, 3, sizeof(const char*));
     
     /* We want to obtain credentials (key+certificate) for every key spec in this MD */

Modified: httpd/httpd/trunk/modules/md/md_acmev2_drive.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/md/md_acmev2_drive.c?rev=1923148&r1=1923147&r2=1923148&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/md/md_acmev2_drive.c (original)
+++ httpd/httpd/trunk/modules/md/md_acmev2_drive.c Wed Jan 15 12:48:52 2025
@@ -152,11 +152,17 @@ retry:
     
     rv = md_acme_order_monitor_authzs(ad->order, ad->acme, d->md,
                                       ad->authz_monitor_timeout, result, d->p);
-    if (APR_SUCCESS != rv) goto leave;
+    if (APR_SUCCESS != rv) {
+      md_result_set(result, rv, "Error waiting on domain names to be validated");
+      goto leave;
+    }
 
     rv = md_acme_order_await_ready(ad->order, ad->acme, d->md,
                                    ad->authz_monitor_timeout, result, d->p);
-    if (APR_SUCCESS != rv) goto leave;
+    if (APR_SUCCESS != rv) {
+      md_result_set(result, rv, "Error waiting for order to become ready");
+      goto leave;
+    }
 
     if (MD_ACME_ORDER_ST_READY == ad->order->status) {
         rv = md_acme_drive_setup_cred_chain(d, result);
@@ -166,7 +172,10 @@ retry:
 
     rv = md_acme_order_await_valid(ad->order, ad->acme, d->md, 
                                    ad->authz_monitor_timeout, result, d->p);
-    if (APR_SUCCESS != rv) goto leave;
+    if (APR_SUCCESS != rv) {
+      md_result_set(result, rv, "Error waiting for order to become valid.");
+      goto leave;
+    }
     
     if (!ad->order->certificate) {
         md_result_set(result, APR_EINVAL, "Order valid, but certificate url is missing.");

Modified: httpd/httpd/trunk/modules/md/md_version.h
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/md/md_version.h?rev=1923148&r1=1923147&r2=1923148&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/md/md_version.h (original)
+++ httpd/httpd/trunk/modules/md/md_version.h Wed Jan 15 12:48:52 2025
@@ -27,7 +27,7 @@
  * @macro
  * Version number of the md module as c string
  */
-#define MOD_MD_VERSION "2.4.30"
+#define MOD_MD_VERSION "2.4.31"
 
 /**
  * @macro
@@ -35,7 +35,7 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define MOD_MD_VERSION_NUM 0x02041e
+#define MOD_MD_VERSION_NUM 0x02041f
 
 #define MD_ACME_DEF_URL         "https://acme-v02.api.letsencrypt.org/directory"
 #define MD_TAILSCALE_DEF_URL    "file://localhost/var/run/tailscale/tailscaled.sock"