31 Commits (master)

Author	SHA1	Message	Date
Mariano Cano	5fa5a63de8	Verify provisioner with id if available ... This commit allows verifying the account provisioner with the request provisioner using the ID instead of the name. When the provisioner are stored in the DB, the provisioner ID is not mutable but the name is.	7 days ago
Mariano Cano	b20af51f32	Upgrade go.step.sm/crypto to use go-jose/v3	5 months ago
Herman Slatman	26a3bb3c11	Make the Apple JWS fix more robust and catch more cases.	6 months ago
Herman Slatman	06f4cbbcda	Add (temporary) fix for missing null bytes in Apple JWS signatures ... Apparently the Apple macOS (and iOS?) ACME client seems to omit leading null bytes from JWS signatures. The base64-url encoded bytes decode to a shorter byte slice than what the JOSE library expects (e.g. 63 bytes instead of 64 bytes for ES256), and then results in a `jose.ErrCryptoFailure`. This commit retries verification of the JWS in case the first verification fails with `jose.ErrCryptoFailure`. The signatures are checked to be of the correct length, and if not, null bytes are prepended to the signature. Then verification is retried, which might fail again, but for other reasons. On success, the payload is returned. Apple should fix this in their ACME client, but in the meantime this commit prevents some "bad request" error cases from happening.	6 months ago
Max	116ff8ed65	bump go.mod to go1.20 and associated linter fixes (#1518)	9 months ago
Max	7731edd816	Store and verify Acme account location (#1386) ... * Store and verify account location on acme requests Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com> Co-authored-by: Mariano Cano <mariano@smallstep.com>	12 months ago
max furman	8b256f0351	address linter warning for go 1.19	1 year ago
Herman Slatman	60a9e41c1c	Remove `Identifier` from top level ACME `Errors`	1 year ago
max furman	ab0d2503ae	Standardize linting file and fix or ignore lots of linting errors	2 years ago
Mariano Cano	1938b1bb34	Merge branch 'master' into herman/fix-template-validation	2 years ago
Mariano Cano	ba499eeb2a	Fix acme/api tests.	2 years ago
Mariano Cano	6f9d847bc6	Fix panic in acme/api tests.	2 years ago
Mariano Cano	bb8d85a201	Fix unit tests - work in progress	2 years ago
Herman Slatman	b6f6bd879c	Fix PR comment and add tests for ACME prerequisites checker	2 years ago
Herman Slatman	bae1d256ee	Improve tests for JWK vs. KID revoke auth flow ... The logic for both test cases is fairly similar, but with some small differences. Made those clearer by means of some comments. Also added some comments to the middleware logic that decided whether to extract JWK or lookup by KID.	3 years ago
Herman Slatman	ed295ca15d	Fix linting issue	3 years ago
Herman Slatman	2d50c96d99	Merge branch 'master' into hs/acme-revocation	3 years ago
Herman Slatman	e7a988b2cd	Pin golangci-lint to v1.43.0 and fix issues	3 years ago
Herman Slatman	c7a9c13060	Add tests for extractOrLookupJWK middleware	3 years ago
max furman	933b40a02a	Introduce gocritic linter and address warnings	3 years ago
max furman	93c3c2bf2e	Error handle non existent provisioner downstream and disable debug route logging	3 years ago
max furman	672e3f976e	Few ACME fixes ... ... - always URL escape linker output - validateJWS should accept RSAPSS - GetUpdateAccount -> GetOrUpdateAccount	3 years ago
max furman	80c8567d99	change errnotfound type for getAccount ... - more generalized NotFound type rather than the nosql one we were using - if the error is not recognized then the logic in create account will break.	3 years ago
max furman	f71e27e787	[acme db interface] unit test progress	3 years ago
max furman	bb8d54e596	[acme db interface] unit tests compiling	3 years ago
max furman	f20fcae80e	[acme db interface] wip unit test fixing	3 years ago
Mariano Cano	ba918100d0	Use go.step.sm/crypto/jose ... Replace use of github.com/smallstep/cli/crypto with the new package go.step.sm/crypto/jose.	4 years ago
max furman	e1409349f3	Allow relative URL for all links in ACME api ... ... * Pass the request context all the way down the ACME stack. * Save baseURL in context and use when generating ACME urls.	4 years ago
max furman	c255274572	Should be returning status code 400 for ACME Account Not Found. ... Issue #173	4 years ago
max furman	d368791606	Add x5c provisioner capabilities	5 years ago
max furman	e3826dd1c3	Add ACME CA capabilities	5 years ago