More tests

backend/bdd/features/environment.py

@@ -2,6 +2,8 @@ import json
 import os
 
 import pathlib
+import typing
+
 import httpx
 from behave.runner import Context
 from dotenv import load_dotenv
@@ -198,3 +200,8 @@ def before_all(context: Context):
             "AUTH_TOKEN": AUTH_TOKEN,
         }
     context.http_client = httpx.Client(base_url=BASE_URL)
+
+
+def after_feature(context: Context, feature: typing.Any):
+    if hasattr(context, "web_server"):
+        context.web_server.shutdown_and_server_close()

backend/bdd/features/pki/acme/challenge.feature

@@ -93,3 +93,24 @@ Feature: Challenge
       """
     Then the value response.status_code should be equal to 200
     And the value response with jq ".status" should be equal to "pending"
+
+    # finalize should not be allowed when all auths are not valid yet
+    And I memorize response.headers with jq ".["replay-nonce"]" as nonce
+    When I send a raw ACME request to "{order.body.finalize}"
+      """
+      {
+        "protected": {
+          "alg": "RS256",
+          "nonce": "{nonce}",
+          "url": "{order.body.finalize}",
+          "kid": "{acme_account.uri}"
+        },
+        "payload": {
+          "csr": "{csr_pem}"
+        }
+      }
+      """
+    Then the value response.status_code should be equal to 400
+    Then the value response with jq ".status" should be equal to 400
+    Then the value response with jq ".type" should be equal to "urn:ietf:params:acme:error:orderNotReady"
+    Then the value response with jq ".detail" should be equal to "ACME order is not ready"

backend/bdd/features/steps/pki_acme.py

@@ -1,7 +1,6 @@
 import json
 import logging
 import re
-import threading
 import urllib.parse
 
 import acme.client
@@ -632,11 +631,8 @@ def serve_challenge(
     )
     # TODO: make port configurable
     servers = standalone.HTTP01DualNetworkedServers(("0.0.0.0", 8087), {resource})
-    # Start client standalone web server.
+    servers.serve_forever()
-    web_server = threading.Thread(name="web_server", target=servers.serve_forever)
+    context.web_server = servers
-    web_server.daemon = True
-    web_server.start()
-    context.web_server = web_server
 
 
 def notify_challenge_ready(context: Context, challenge: messages.ChallengeBody):

backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts

@@ -107,6 +107,7 @@ export const pkiAcmeChallengeServiceFactory = ({
             if (fetchError.code === "ENOTFOUND" || fetchError.message.includes("ENOTFOUND")) {
               return new AcmeDnsFailureError({ message: "Hostname could not be resolved (DNS failure)" });
             }
+            logger.error(exp, "Unknown error validating ACME challenge response");
             return new AcmeServerInternalError({ message: "Unknown error validating ACME challenge response" });
           }
         } else if (exp instanceof DOMException) {

backend/src/ee/services/pki-acme/pki-acme-errors.ts

@@ -468,7 +468,7 @@ export class AcmeOrderNotReadyError extends AcmeError {
     super({
       type: AcmeErrorType.OrderNotReady,
       message,
-      status: 403,
+      status: 400,
       error
     });
     this.name = "AcmeOrderNotReadyError";