NAS-137796 / 26.04 / Encode CSR before sending to OpenSSL

[creatorcary]

We ultimately need this to be in bytes form for the ACME package (see ticket).

This is part of the fallout from upgrading to trixie, specifically from acme upgrading from 2.11.0 to 4.0.0. This significantly changed the behavior of acme.client.ClientV2.new_order.

2.11.0 executed this helpful statement in the OpenSSL package:

    if isinstance(buffer, str):
        buffer = buffer.encode("ascii")

whereas 4.0.0 passes csr_pem directly to the cryptography module instead:

        csr = x509.load_pem_x509_csr(csr_pem)

However, even 2.11.0 specified that a bytes argument should have been passed instead of a string.

This will require changes in two other repositories:

• NAS-137796 / 26.04 / Pass CSR as bytes to create_cert middleware#17313
• NAS-137796 / 26.04 / Pass CSR as bytes to issue_certificate truenas_connect_utils#12

[bugclerk]

Jira URL: https://ixsystems.atlassian.net/browse/NAS-137796

[creatorcary]

Highlighting the main change for easier review

[sonicaj]

@creatorcary why cannot we just do the following ?

diff --git a/truenas_acme_utils/issue_cert.py b/truenas_acme_utils/issue_cert.py
index 664974d..f584284 100644
--- a/truenas_acme_utils/issue_cert.py
+++ b/truenas_acme_utils/issue_cert.py
@@ -21,7 +21,7 @@ def issue_certificate(
     acme_client, key = get_acme_client_and_key(acme_client_key_payload)
     try:
         # perform operations and have a cert issued
-        order = acme_client.new_order(csr)
+        order = acme_client.new_order(csr.encode())
     except messages.Error as e:
         raise CallError(f'Failed to issue a new order for Certificate : {e}')

[bugclerk]

This PR has been merged and conversations have been locked.
If you would like to discuss more about this issue please use our forums or raise a Jira ticket.