Skip to content

Dispose the ACME client and signer when context creation fails #1222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shibayan merged 2 commits into from
Jul 26, 2026
Merged

Dispose the ACME client and signer when context creation fails #1222

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
211a5a8
Dispose the ACME client and signer when context creation fails
shibayan Jul 26, 2026
cfd0ce5
Match AcmeClientContext dispose order on the failure path
shibayan Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 52 additions & 34 deletions src/Acmebot.App/Acme/AcmeClientFactory.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,53 +63,71 @@ private async Task<AcmeClientContext> CreateClientCoreAsync()
}

var signer = accountKey.GenerateSigner();
var client = new AcmeClient(
_options.Endpoint,
new AcmeClientOptions
{
UserAgent = $"Acmebot/{Constants.ApplicationVersion}"
});
var directory = await client.GetDirectoryAsync();
AcmeAccountHandle accountHandle;
AcmeClient? client = null;

if (account is null)
// The client owns an HttpClient, and both it and the signer are only handed to the caller once
// the context has been fully built. Anything that fails in between (a directory fetch against an
// unreachable ACME endpoint, missing EAB credentials, a state store write) would otherwise leak
// them on every retry.
try
{
var externalAccountBinding = CreateExternalAccountBinding();
client = new AcmeClient(
_options.Endpoint,
new AcmeClientOptions
{
UserAgent = $"Acmebot/{Constants.ApplicationVersion}"
});

if (externalAccountBinding is null && (directory.Metadata?.ExternalAccountRequired ?? false))
var directory = await client.GetDirectoryAsync();
AcmeAccountHandle accountHandle;

if (account is null)
{
throw new PreconditionException("This ACME endpoint requires External Account Binding (EAB). Configure EAB credentials and try again.");
}
var externalAccountBinding = CreateExternalAccountBinding();

accountHandle = await client.CreateAccountAsync(
signer,
new AcmeNewAccountRequest
if (externalAccountBinding is null && (directory.Metadata?.ExternalAccountRequired ?? false))
{
throw new PreconditionException("This ACME endpoint requires External Account Binding (EAB). Configure EAB credentials and try again.");
}

accountHandle = await client.CreateAccountAsync(
signer,
new AcmeNewAccountRequest
{
Contact = contacts,
TermsOfServiceAgreed = true
},
externalAccountBinding);
account = AccountDetails.FromAccountHandle(accountHandle, directory.Metadata?.TermsOfService);

if (isNewAccountKey)
{
Contact = contacts,
TermsOfServiceAgreed = true
},
externalAccountBinding);
account = AccountDetails.FromAccountHandle(accountHandle, directory.Metadata?.TermsOfService);
await stateStore.SaveAsync(accountKey, "account_key.json");
}

if (isNewAccountKey)
await stateStore.SaveAsync(account, "account.json");
}
else
{
await stateStore.SaveAsync(accountKey, "account_key.json");
accountHandle = account.ToAccountHandle(signer);
}

await stateStore.SaveAsync(account, "account.json");
return new AcmeClientContext
{
Client = client,
Directory = directory,
Signer = signer,
Account = accountHandle
};
}
else
catch
{
accountHandle = account.ToAccountHandle(signer);
}
// Same order as AcmeClientContext.Dispose(), which owns these once the context exists.
signer.Dispose();
client?.Dispose();

return new AcmeClientContext
{
Client = client,
Directory = directory,
Signer = signer,
Account = accountHandle
};
throw;
}
}

private AcmeExternalAccountBindingOptions? CreateExternalAccountBinding()
Expand Down