warning if only tls-sni-01 is available
@@ -615,6 +615,7 @@ static apr_status_t acme_driver_init(md_proto_driver_t *d)
{
md_acme_driver_t *ad;
apr_status_t rv = APR_SUCCESS;
+ int challenges_configured = 0;
ad = apr_pcalloc(d->p, sizeof(*ad));
@@ -631,10 +632,12 @@ static apr_status_t acme_driver_init(md_proto_driver_t *d)
if (d->challenge) {
/* we have been told to use this type */
APR_ARRAY_PUSH(ad->ca_challenges, const char*) = apr_pstrdup(d->p, d->challenge);
+ challenges_configured = 1;
}
else if (d->md->ca_challenges && d->md->ca_challenges->nelts > 0) {
/* pre-configured set for this managed domain */
apr_array_cat(ad->ca_challenges, d->md->ca_challenges);
+ challenges_configured = 1;
}
else {
/* free to chose. Add all we support and see what we get offered */
@@ -664,6 +667,14 @@ static apr_status_t acme_driver_init(md_proto_driver_t *d)
" port 443 is needed.", d->md->name);
return APR_EGENERAL;
}
+ else if (ad->ca_challenges->nelts == 1
+ && md_array_str_index(ad->ca_challenges, MD_AUTHZ_TYPE_TLSSNI01, 0, 0) >= 0) {
+ md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, 0, d->p, "%s: only challenge type '%s' "
+ "is available. This method of obtaining certificates will be "
+ "discontinued by Let's Encrypt and other CAs from early 2019 on, "
+ "if it is not already disabled for you.",
+ d->md->name, MD_AUTHZ_TYPE_TLSSNI01);
+ }
md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, 0, d->p, "%s: init driver", d->md->name);
