来自 boto.get_certificate

如何解决来自 boto.get_certificate

我昨天向亚马逊证书管理器“ACM”服务申请了公开签名的 SSL 证书。证书应由 boto 库方法请求/提取，以最终在我们的网络服务器上使用。这是正在使用的代码：

import logging

import boto3
from botocore.exceptions import ClientError
logger = logging.getLogger(__name__)
boto = boto3.client('acm')

domain = 'ourdomain.com'
sub_domains = None  # We are using DNS validation with `*.ourdomain.com`

def request_validation(domain,alternate_domains,method):
  try:
      kwargs = {
          'DomainName': domain }
      response = boto.request_certificate(**kwargs)
      certificate_arn = response['CertificateArn']
      logger.info(
          "Requested %s validation for domain %s. Certificate ARN is %s.",method,domain,certificate_arn)
  except ClientError:
      logger.exception(
          "Request for %s validation of domain %s failed.",domain)
      raise
  else:
      return certificate_arn


certificate_arn = request_validation(domain,sub_domains,'DNS')
print(f"Started validation,got certificate ARN: {certificate_arn}.")

response = None
try:
    response = boto.get_certificate(CertificateArn=certificate_arn)
    logger.info("Got certificate %s and its chain.",certificate_arn)
except ClientError:
    logger.exception("Couldn't get certificate %s.",certificate_arn)
    raise

print(response)

运行上面的代码时（将我们的实际域替换为“ourdomain”后）出现以下错误：

botocore.errorfactory.RequestInProgressException: 调用 GetCertificate 操作时发生错误 (RequestInProgressException)：Certificate arn:aws:acm:us-east-2:234323424:certificate/xxxxx in account 22342424尚未颁发

这是完整的回复：

Started validation,got certificate ARN: arn:aws:acm:us-east-2:1234234:certificate/4a2xxxx-4xxx-xxx-xxx-xxxx.
Couldn't get certificate arn:aws:acm:us-east-2:1234343:certificate/4axxxxx4-4082-xxx-xxx-xxxxx.
Traceback (most recent call last):
  File "/Users/steve/git/ciderd/keys_server/experiments/aws-certs.py",line 45,in <module>
    response = boto.get_certificate(CertificateArn=certificate_arn)
  File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py",line 357,in _api_call
    return self._make_api_call(operation_name,kwargs)
  File "/Users/steve/miniconda3/lib/python3.7/site-packages/botocore/client.py",line 661,in _make_api_call
    raise error_class(parsed_response,operation_name)
botocore.errorfactory.RequestInProgressException: An error occurred (RequestInProgressException) when calling the GetCertificate operation: Certificate arn:aws:acm:us-east-2:12343234:certificate/xxxxxxafff87aa3 in account 123423423 not yet issued
Traceback (most recent call last):
  File "/Users/steve/git/ciderd/keys_server/experiments/aws-certs.py",operation_name)
botocore.errorfactory.RequestInProgressException: An error occurred (RequestInProgressException) when calling the GetCertificate operation: Certificate arn:aws:acm:us-east-2:234323424:certificate/xxxxx  in account 22342424 not yet issued

有几种可能性：

• 一切都很好，但只需要等待 - 就像错误所说的那样
• python 代码不正确，因此“等待”将永远存在
• 证书本身有问题 - 所以等待可能是永远的

有没有办法确定这些可能性中的哪一种是这里的实际情况？

• 那个 python/boto 代码看起来正确吗？
• 为 ACM 请求的 mydomain.com 形式的证书发送 *.mydomain.com 是否正确？

谢谢。