Repository: freedomofpress/securedrop

Issue:
securedrop-admin sdconfig does not set https-related config variables
# Bug

## Description

`securedrop-admin sdconfig` does not set `securedrop_app_https_certificate_key_src`, `securedrop_app_https_certificate_cert_src`, or `securedrop_app_https_certificate_chain_src` as explained in https://docs.securedrop.org/en/stable/https_source_interface.html

## Steps to Reproduce

In Tails:
1. `securedrop-admin sdconfig`
2. At the "Whether HTTPS should be enabled on Source Interface (requires EV cert)" prompt, enter "yes"

## Expected Behavior

I am shown prompts to fill out `securedrop_app_https_certificate_key_src`, `securedrop_app_https_certificate_cert_src`, `securedrop_app_https_certificate_chain_src`.

## Actual Behavior

I am _not_ shown these prompts.

## Comments

As a temporary workaround, admins _can_ fill out `site-specific` manually, though that is a bit tricky for some admins. As such, we should fix this issue in 0.7 if possible.


Discussion:
Instead of asking people for the cert names to set variables. I think should just go with the YES/NO on https enabled. And if yes, require everyone to name their files securedrop_source_onion.crt/key by default and maybe CA.crt and everyone just needs to use those names
Good call @darrow - let's do that - it's easier for users and it's a simpler implementation. 
Given @darrow's suggestion, this strikes me as a docs-issue now. Happy to prepare something quick that should suffice.
Well, I think it's docs + Ansible (or docs + sdconfig) no? Since we also need the three variables above to get set in `site-specific` (or elsewhere)? 
Roger that, I'll take a look and confirm both are covered. If we update the docs to require specific names, then we don't need to write the values via `sdconfig` config. Will shoot for that and fall back to prompting with defaults.

Resolving patch:
diff --git a/admin/securedrop_admin/__init__.py b/admin/securedrop_admin/__init__.py
--- a/admin/securedrop_admin/__init__.py
+++ b/admin/securedrop_admin/__init__.py
@@ -287,15 +287,30 @@ def __init__(self, args):
              u'DNS server specified during installation',
              SiteConfig.ValidateNotEmpty(),
              None],
+            ['securedrop_app_gpg_public_key', 'SecureDrop.asc', str,
+             u'Local filepath to public key for '
+             'SecureDrop Application GPG public key',
+             SiteConfig.ValidatePath(self.args.ansible_path),
+             None],
             ['securedrop_app_https_on_source_interface', False, bool,
              u'Whether HTTPS should be enabled on '
              'Source Interface (requires EV cert)',
              SiteConfig.ValidateYesNo(),
              lambda x: x.lower() == 'yes'],
-            ['securedrop_app_gpg_public_key', 'SecureDrop.asc', str,
-             u'Local filepath to public key for '
-             'SecureDrop Application GPG public key',
-             SiteConfig.ValidatePath(self.args.ansible_path),
+            ['securedrop_app_https_certificate_cert_src', '', str,
+             u'Local filepath to HTTPS certificate '
+             '(optional, only if using HTTPS on source interface)',
+             SiteConfig.ValidateOptionalPath(self.args.ansible_path),
+             None],
+            ['securedrop_app_https_certificate_key_src', '', str,
+             u'Local filepath to HTTPS certificate key '
+             '(optional, only if using HTTPS on source interface)',
+             SiteConfig.ValidateOptionalPath(self.args.ansible_path),
+             None],
+            ['securedrop_app_https_certificate_chain_src', '', str,
+             u'Local filepath to HTTPS certificate chain file '
+             '(optional, only if using HTTPS on source interface)',
+             SiteConfig.ValidateOptionalPath(self.args.ansible_path),
              None],
             ['securedrop_app_gpg_fingerprint', '', str,
              u'Full fingerprint for the SecureDrop Application GPG Key',


Test patch:
diff --git a/admin/tests/files/ca.crt b/admin/tests/files/ca.crt
new file mode 100644
--- /dev/null
+++ b/admin/tests/files/ca.crt
@@ -0,0 +1 @@
+TEST FILE ONLY
diff --git a/admin/tests/files/sd.crt b/admin/tests/files/sd.crt
new file mode 100644
--- /dev/null
+++ b/admin/tests/files/sd.crt
@@ -0,0 +1 @@
+TEST FILE ONLY
diff --git a/admin/tests/files/sd.key b/admin/tests/files/sd.key
new file mode 100644
--- /dev/null
+++ b/admin/tests/files/sd.key
@@ -0,0 +1 @@
+TEST FILE ONLY
diff --git a/admin/tests/test_securedrop-admin.py b/admin/tests/test_securedrop-admin.py
--- a/admin/tests/test_securedrop-admin.py
+++ b/admin/tests/test_securedrop-admin.py
@@ -643,6 +643,12 @@ def verify_prompt_fingerprint(self, site_config, desc):
         verify_desc_consistency_optional)
     verify_prompt_journalist_gpg_fpr = verify_prompt_fingerprint_optional
     verify_prompt_journalist_alert_email = verify_desc_consistency_optional
+    verify_prompt_securedrop_app_https_certificate_chain_src = (
+        verify_desc_consistency_optional)
+    verify_prompt_securedrop_app_https_certificate_key_src = (
+        verify_desc_consistency_optional)
+    verify_prompt_securedrop_app_https_certificate_cert_src = (
+        verify_desc_consistency_optional)
     verify_prompt_smtp_relay = verify_prompt_not_empty
     verify_prompt_smtp_relay_port = verify_desc_consistency
     verify_prompt_daily_reboot_time = verify_desc_consistency