fix(ssl): keep failed and pending Let's Encrypt sites on HTTP, wait for DNS-01 propagation and keep the www redirect

src/helper/SimpleDnsCloudflareSolver.php

@@ -33,6 +33,11 @@ class SimpleDnsCloudflareSolver implements SolverInterface {
 	 */
 	protected $zones;
 
+	/**
+	 * @var array TXT values this solver added, by record name without the trailing dot.
+	 */
+	private $created_records = [];
+
 	/**
 	 * @param DnsDataExtractor $extractor
 	 * @param OutputInterface $output
@@ -71,6 +76,7 @@ public function solve( AuthorizationChallenge $authorizationChallenge ) {
 			try {
 				if ( $this->dns->addRecord( $zoneID, "TXT", $recordName, $recordValue, 0, false ) === true ) {
 					EE::log( "Created DNS record: $recordName with value $recordValue." . PHP_EOL );
+					$this->created_records[ rtrim( $recordName, '.' ) ][] = $recordValue;
 				} else {
 					$manual = true;
 				}
@@ -104,6 +110,15 @@ public function solve( AuthorizationChallenge $authorizationChallenge ) {
 		}
 	}
 
+	/**
+	 * TXT records this solver added through the Cloudflare API.
+	 *
+	 * @return array Expected values by record name.
+	 */
+	public function get_created_records() {
+		return $this->created_records;
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
@@ -116,12 +131,12 @@ public function cleanup( AuthorizationChallenge $authorizationChallenge ) {
 
 		foreach ( $record_ids as $record_id ) {
 			if ( $this->dns->deleteRecord( $zoneID, $record_id ) ) {
-				EE::log( "Cleaned up DNS record: _acme-challenge.$recordName" );
+				EE::log( "Cleaned up DNS record: $recordName" );
 			} else {
 				$this->output->writeln(
 					sprintf(
 						<<<'EOF'
-		You can now cleanup your DNS by removing the domain <comment>_acme-challenge.%s.</comment>
+		You can now cleanup your DNS by removing the domain <comment>%s</comment>
 EOF
 						,
 						$recordName

src/helper/Site_Letsencrypt.php

@@ -210,6 +210,11 @@ class Site_Letsencrypt {
 	private $repository;
 	private $conf_dir;
 
+	/**
+	 * @var array TXT values the last authorize() published through the DNS API, by record name.
+	 */
+	private $published_dns_records = [];
+
 	function __construct() {
 		$this->conf_dir = EE_ROOT_DIR . '/services/nginx-proxy/acme-conf';
 		$this->setRepository();
@@ -324,7 +329,8 @@ public function authorize( Array $domains, $wildcard = false, $preferred_challen
 		} else {
 			$solver = new SimpleHttpSolver();
 		}
-		$solverName = $is_solver_dns ? 'dns-01' : 'http-01';
+		$solverName                  = $is_solver_dns ? 'dns-01' : 'http-01';
+		$this->published_dns_records = [];
 		try {
 			$order = $this->client->requestOrder( $domains );
 		} catch ( \Exception $e ) {
@@ -334,7 +340,6 @@ public function authorize( Array $domains, $wildcard = false, $preferred_challen
 			} else {
 				\EE::warning( 'Let\'s Encrypt order request failed (' . $e->getMessage() . '). It seems you\'re in local environment or using non-public domain, please check logs. Skipping letsencrypt.' );
 			}
-			\EE::log( 'You can fix the issue and re-run: ee site ssl-verify ' . $domains[0] );
 
 			return false;
 		}
@@ -356,7 +361,6 @@ public function authorize( Array $domains, $wildcard = false, $preferred_challen
 			}
 			if ( null === $authorizationChallenge ) {
 				\EE::warning( 'Challenge not supported for domain ' . $domainKey );
-				\EE::log( 'You can fix the issue and re-run: ee site ssl-verify ' . $domainKey );
 
 				return false;
 			}
@@ -389,11 +393,24 @@ public function authorize( Array $domains, $wildcard = false, $preferred_challen
 			}
 		}
 
+		if ( $solver instanceof SimpleDnsCloudflareSolver ) {
+			$this->published_dns_records = $solver->get_created_records();
+		}
+
 		$this->repository->storeCertificateOrder( $domains, $order );
 
 		return true;
 	}
 
+	/**
+	 * TXT records the last authorize() published through the DNS API, to wait for before validation.
+	 *
+	 * @return array Expected values by record name.
+	 */
+	public function getPublishedDnsRecords() {
+		return $this->published_dns_records;
+	}
+
 	public function revokeAuthorizationChallenges( array $domains ) {
 		foreach ( $domains as $domain ) {
 			if ( $this->repository->hasDomainAuthorizationChallenge( $domain ) ) {
@@ -522,6 +539,9 @@ public function check( Array $domains, $wildcard = false, $preferred_challenge =
 
 				return false;
 			}
+			if ( $is_solver_dns ) {
+				\EE\Site\Utils\wait_for_dns_txt_records( $this->published_dns_records );
+			}
 
 			$order = $this->repository->loadCertificateOrder( $domains );
 		}
@@ -561,7 +581,6 @@ public function check( Array $domains, $wildcard = false, $preferred_challenge =
 					\EE::debug( sprintf( 'Testing the challenge for domain %s', $domain ) );
 					if ( ! $validator->isValid( $authorizationChallenge ) ) {
 						\EE::warning( 'Can not validate challenge for domain ' . $domain );
-						\EE::log( 'You can fix the issue and re-run: ee site ssl-verify ' . $domain );
 
 						return false;
 					}
@@ -573,11 +592,6 @@ public function check( Array $domains, $wildcard = false, $preferred_challenge =
 					\EE::debug( $e->getMessage() );
 					\EE::warning( 'Challenge Authorization failed (' . $e->getMessage() . '). Check logs and check if your domain is pointed correctly to this server.' );
 
-					$site_name = $domains[0];
-					$site_name = str_replace( '*.', '', $site_name );
-
-					\EE::log( "Re-run `ee site ssl-verify $site_name` after fixing the issue." );
-
 					return false;
 				}
 			}