diff --git a/acmeclient.go b/acmeclient.go index a22dc19a..8e80b57d 100644 --- a/acmeclient.go +++ b/acmeclient.go @@ -76,7 +76,7 @@ func (am *ACMEManager) newACMEClientWithAccount(ctx context.Context, useTestCA, } } - // agree to terms + // Prompt to agree to TOS, otherwise use AccountManager's settings if interactive { if !am.Agreed { var termsURL string @@ -94,10 +94,6 @@ func (am *ACMEManager) newACMEClientWithAccount(ctx context.Context, useTestCA, } } } - } else { - // can't prompt a user who isn't there; they should - // have reviewed the terms beforehand - am.Agreed = true } account.TermsOfServiceAgreed = am.Agreed diff --git a/acmemanager.go b/acmemanager.go index 82b6cc12..5e02832a 100644 --- a/acmemanager.go +++ b/acmemanager.go @@ -229,6 +229,37 @@ func (am *ACMEManager) PreCheck(_ context.Context, names []string, interactive b return am.getEmail(interactive) } +func (am *ACMEManager) CheckAccountTOS(ctx context.Context, useTestCA, interactive bool) (bool, string, error) { + agreed := am.Agreed + termsURL := "" + // Make sure the email is retrieved first + err := am.getEmail(interactive) + if err != nil { + return agreed, termsURL, err + } + + // Create the new client if necessary and get a client + client, err := am.newACMEClientWithAccount(ctx, useTestCA, interactive) + if err != nil { + return agreed, termsURL, err + } + agreed = client.account.TermsOfServiceAgreed + // Get the most recent TOS + var dir acme.Directory + dir, err = client.acmeClient.GetDirectory(ctx) + if err != nil { + return agreed, termsURL, err + } + if dir.Meta != nil { + termsURL = dir.Meta.TermsOfService + } + // If no TOS is found, then it should be implied to be accepted + if len(termsURL) == 0 { + agreed = true + } + return agreed, termsURL, nil +} + // Issue implements the Issuer interface. It obtains a certificate for the given csr using // the ACME configuration am. func (am *ACMEManager) Issue(ctx context.Context, csr *x509.CertificateRequest) (*IssuedCertificate, error) { @@ -302,6 +333,9 @@ func (am *ACMEManager) doIssue(ctx context.Context, csr *x509.CertificateRequest if err != nil { return nil, false, err } + if !client.account.TermsOfServiceAgreed { + return nil, false, fmt.Errorf("user must agree to CA terms") + } usingTestCA := client.usingTestCA() nameSet := namesFromCSR(csr)