Change:
Describe the bug causes Lego to fail. To Reproduce Steps to reproduce the behavior: set on an enabled certificate. to this configuration. fail. Lego complains about an unrecognized (really misplaced) flag. Expected behavior The certificate will be successfully fetched, with Must-Staple enabled. Screenshots Additional context I think the problematic code is here: should not be in commonOpts, it should instead be in runOpts and renewOpts. Lego runs successfully when is to and . Notify maintainers (the acme team) Metadata Maintainer information:
Thanks for the report :) It appears that the --must-staple option is common to both "run" and "renew" modes, but is not actually a common option that can be specified before the mode. I'll get a PR ready for this.

Discussion:
"--email" data.email "--key-type" data.keyType ] ++ protocolOpts <del> ++ optionals data.ocspMustStaple [ "--must-staple" ] </del> ++ optionals (acmeServer != null) [ "--server" acmeServer ] ++ concatMap (name: [ "-d" name ]) extraDomains ++ data.extraLegoFlags; <ins> # Although --must-staple is common to both modes, it is not declared as a # mode-agnostic argument in lego and thus must come after the mode. </ins> runOpts = escapeShellArgs ( commonOpts ++ [ "run" ] <ins> ++ optionals data.ocspMustStaple [ "--must-staple" ] </ins> ++ data.extraLegoRunFlags ); renewOpts = escapeShellArgs ( commonOpts ++ [ "renew" "--reuse-key" ] <ins> ++ optionals data.ocspMustStaple [ "--must-staple" ] </ins> ++ data.extraLegoRenewFlags );

}; }; <ins> # Test OCSP Stapling specialisation.ocsp-stapling.configuration = { pkgs, ... }: { security.acme.certs."a.example.test" = { ocspMustStaple = true; }; services.nginx.virtualHosts."a.example.com" = { extraConfig = '' ssl_stapling on; ssl_stapling_verify on; ''; }; }; </ins> # Test using Apache HTTPD specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: { services.nginx.enable = lib.mkForce false;

testScript = {nodes, ...}: let <ins> caDomain = nodes.acme.config.test-support.acme.caDomain; </ins> newServerSystem = nodes.webserver.config.system.build.toplevel; switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test"; in

return check_connection_key_bits(node, domain, bits, retries - 1) <ins> def check_stapling(node, domain, retries=3): assert retries >= 0 # Pebble doesn't provide a full OCSP responder, so just check the URL result = node.succeed( "openssl s_client -CAfile /tmp/ca.crt" f" -servername {domain} -connect {domain}:443 < /dev/null" " | openssl x509 -noout -ocsp_uri" ) print("OCSP Responder URL:", result) if "${caDomain}:4002" not in result.lower(): time.sleep(1) return check_stapling(node, domain, retries - 1) </ins> client.start() dnsserver.start()

client.wait_for_unit("default.target") client.succeed( <del> 'curl --data '{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}' http://${dnsServerIP nodes}:8055/add-a' </del> <ins> 'curl --data '{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}' http://${dnsServerIP nodes}:8055/add-a' </ins> ) acme.start()

acme.wait_for_unit("default.target") acme.wait_for_unit("pebble.service") <del> client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt") client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt") </del> <ins> client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt") client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt") </ins> with subtest("Can request certificate with HTTPS-01 challenge"): webserver.wait_for_unit("acme-finished-a.example.test.target")

check_connection_key_bits(client, "a.example.test", "384") webserver.succeed("grep testing /var/lib/acme/a.example.test/test") <ins> with subtest("Correctly implements OCSP stapling"): switch_to(webserver, "ocsp-stapling") webserver.wait_for_unit("acme-finished-a.example.test.target") check_stapling(client, "a.example.test") </ins> with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"): switch_to(webserver, "slow-startup") webserver.wait_for_unit("acme-finished-slow.example.com.target")

privateKey = testCerts.${domain}.key; httpPort = 80; tlsPort = 443; <del> ocspResponderURL = "http://0.0.0.0:4002"; </del> <ins> ocspResponderURL = "http://${domain}:4002"; </ins> strict = true; };