fb81407d6f
Fix ACME policy comments
2 years ago
7f9034d22a
Add additional policy options
2 years ago
a9f033ece5
Fix JSON property name for ACME policy
2 years ago
256fe113f7
Improve tests for ACME account policy
2 years ago
034b7943fe
Merge branch 'master' into herman/allow-deny
2 years ago
7df52dbb76
Add ACME EAB policy
2 years ago
479c6d2bf5
Fix ACME IPv6 HTTP-01 challenges
...
Fixes #890
2 years ago
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny
2 years ago
00634fb648
api/render, api/log: initial implementation of the packages ( #860 )
...
* api/render: initial implementation of the package
* acme/api: refactored to support api/render
* authority/admin: refactored to support api/render
* ca: refactored to support api/render
* api: refactored to support api/render
* api/render: implemented Error
* api: refactored to support api/render.Error
* acme/api: refactored to support api/render.Error
* authority/admin: refactored to support api/render.Error
* ca: refactored to support api/render.Error
* ca: fixed broken tests
* api/render, api/log: moved error logging to this package
* acme: refactored Error so that it implements render.RenderableError
* authority/admin: refactored Error so that it implements render.RenderableError
* api/render: implemented RenderableError
* api/render: added test coverage for Error
* api/render: implemented statusCodeFromError
* api: refactored RootsPEM to work with render.Error
* acme, authority/admin: fixed pointer receiver name for consistency
* api/render, errs: moved StatusCoder & StackTracer to the render package
2 years ago
b49307f326
Fix ACME order tests with mock ACME CA
2 years ago
9e0edc7b50
Add early authority policy evaluation to ACME order API
2 years ago
101ca6a2d3
Check admin subjects before changing policy
2 years ago
3ec9a7310c
Fix ACME order identifier allow/deny check
2 years ago
af53a17bb4
Merge branch 'master' into herman/allow-deny
2 years ago
b6f6bd879c
Fix PR comment and add tests for ACME prerequisites checker
2 years ago
e47dd0a666
Add ACME configuration prerequisites check
2 years ago
c3c6f3da72
Merge branch 'master' into herman/allow-deny
2 years ago
bfa2245abb
Merge branch 'master' into herman/normalize-ipv6-dns-names
2 years ago
1fe7362bee
Normalize IPv6 addresses in ACME linker
2 years ago
c1424036bf
Merge branch 'master' into herman/allow-deny
2 years ago
bf21319e76
Fix PR comments and issue with empty string slices
2 years ago
fd9845e9c7
Add cursor and limit to ACME EAB DB interface
2 years ago
c3f2fd8ef0
Add RW locks to prevent concurrent updates to the DB
...
Although this may slow certain API calls down and may not be, strictly
necessary, I think it's best to put all the ACME EAB operations behind
RW locks to prevent concurrent updates to the DB and guarantee
consistent result sets.
2 years ago
868cc4ad7f
Increase test coverage for additional indexes
2 years ago
c0eb420806
Remove special case for empty slices
2 years ago
6440870a80
Clean up, improve test cases and coverage
2 years ago
ef16febf40
Refactor ACME EAB queries
...
The ACME EAB keys are now also indexed by the provisioner. This
solves part of the issue in which too many EAB keys may be in
memory at a given time.
2 years ago
30859d3c83
Remove server-side paging logic for ExternalAccountKeys
2 years ago
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
2 years ago
11a7f01177
Simplify lookup cursor logic for ExternalAccountKeys
2 years ago
22ff90f655
Merge branch 'master' into hs/acme-eab
2 years ago
a5f2f004e3
Change name of IP Common Name test for clarity
2 years ago
f9ae875f9d
Use short if-style statements
2 years ago
80bebda69c
Fix code style issue
2 years ago
bc0875bd7b
Disallow email address and URLs in the CSR
...
Before this commit `step` would allow email addresses and URLs
in the CSR. This doesn't fit nicely with the rest of ACME, in which
identifiers need to be authorized before a certificate is issued.
2 years ago
13a31fd862
Merge branch 'master' into herman/ip-sans-improvements
2 years ago
ca707cbe05
Fix linting
2 years ago
a5d33512fe
Fix test
2 years ago
a2c9b5cd7e
Allow IP identifiers in subject, including authorization enforcement
...
To support IPs in the subject using `step-cli`, this PR ensures that
Subject Common Names that can be parsed as an IP are also checked
to have been authorized before.
The PR for `step-cli` is here: github.com/smallstep/cli/pull/576.
2 years ago
d799359917
Merge branch 'master' into hs/acme-eab
2 years ago
63371a8fb6
Add additional tests for ACME EAB Admin
2 years ago
0524122191
Remove authorization flow for different Account private keys
...
As discussed in https://github.com/smallstep/certificates/issues/767 ,
we opted for not including this authorization flow to prevent users
from getting OOMs. We can add the functionality back when the
underlying data store can provide access to a long list of
Authorizations more efficiently, for example when a callback is
implemented.
2 years ago
2215a05c28
Add tests for ACME EAB Admin
...
Refactored some of the existing bits for testing the Authority
API by creation of a new LinkedAuthority interface and changing
visibility of the MockAuthority to be usable by other packages.
At this time, not all of the functions of MockAuthority it usable
yet. Will refactor when needed or requested.
2 years ago
9885d42711
Fix linting issues
2 years ago
6e11657204
Refactor creation of (raw) EAB JWS contents
2 years ago
23898e9b76
Improve EAB JWS validation and increase test coverage
2 years ago
d0c23973cc
Merge branch 'master' into hs/acme-eab
2 years ago
004fc054d5
Fix PR comments
2 years ago
06bb97c91e
Add logic for Account authorizations and improve tests
2 years ago
bae1d256ee
Improve tests for JWK vs. KID revoke auth flow
...
The logic for both test cases is fairly similar, but with some
small differences. Made those clearer by means of some comments.
Also added some comments to the middleware logic that decided
whether to extract JWK or lookup by KID.
2 years ago
a7fbbc4748
Add tests for GetCertificateBySerial
2 years ago
4d01cf8135
Increase test code coverage
2 years ago
2d357da99b
Add tests for ACME revocation
2 years ago
ed295ca15d
Fix linting issue
2 years ago
2d50c96d99
Merge branch 'master' into hs/acme-revocation
3 years ago
e7a988b2cd
Pin golangci-lint to v1.43.0 and fix issues
3 years ago
29f9730485
Satisfy golangci-lint
3 years ago
c7a9c13060
Add tests for extractOrLookupJWK middleware
3 years ago
3151255a25
Merge branch 'master' into hs/acme-revocation
3 years ago
4d726d6b4c
Add pagination to ACME EAB credentials endpoint
3 years ago
d354d55e7f
Improve handling duplicate ACME EAB references
3 years ago
dd4b4b0435
Fix remaining gocritic remarks
3 years ago
a4660f73fa
Fix some of the gocritic remarks
3 years ago
e0b495e4c8
Merge branch 'master' into hs/acme-eab
3 years ago
c26041f835
Add ACME EAB nosql tests
3 years ago
933b40a02a
Introduce gocritic linter and address warnings
3 years ago
0afea2e957
Improve tests for already bound EAB keys
3 years ago
c2bc1351c6
Add provisioner to remove endpoint and clear reference index on delete
3 years ago
746c5c9fd9
Disallow creation of EAB keys with non-unique references
3 years ago
9c0020352b
Add lookup by reference and make reference optional
3 years ago
02cd3b6b3b
Fix PR comments
3 years ago
f11c0cdc0c
Add endpoint for listing ACME EAB keys
3 years ago
a1afbce50c
Check EAB key exists before deleting it
3 years ago
9d09f5e575
Add support for deleting ACME EAB keys
3 years ago
a98fe03e80
Merge branch 'master' into hs/acme-eab
3 years ago
1dba8698e3
Use LinkedCA.EABKey type in ACME EAB API
3 years ago
470b546d59
Merge pull request #557 from joejulian/http01-isv
...
use InsecureSkipVerify for validation
3 years ago
a3028bbc0e
Add test for updateAddOrderIDs
3 years ago
dc5205cc72
Extract the tls error code and fail accordingly.
3 years ago
ae58a0ee4e
Make tests compatible with Go 1.17.
...
With Go 1.17 tls.Dial will fail if the client and server configured
protocols do not overlap. See https://golang.org/doc/go1.17#ALPN
3 years ago
f31ca4f6a4
Add tests for validateExternalAccountBinding
3 years ago
492256f2d7
Add first test cases for EAB and make provisioner unique per EAB
...
Before this commit, EAB keys could be used CA-wide, meaning that
an EAB credential could be used at any ACME provisioner. This
commit changes that behavior, so that EAB credentials are now
intended to be used with a specific ACME provisioner. I think
that makes sense, because from the perspective of an ACME client
the provisioner is like a distinct CA.
Besides that this commit also includes the first tests for EAB.
The logic for creating the EAB JWS as a client has been taken
from github.com/mholt/acmez. This logic may be moved or otherwise
sourced (i.e. from a vendor) as soon as the step client also
(needs to) support(s) EAB with ACME.
3 years ago
c6bfc6eac2
Fix PR comments
3 years ago
d669f3cb14
Fix misspelling
3 years ago
540d5fbbdc
Fix marshaling -> marshalling
3 years ago
2110c7722f
Fix JWK payload key equality check
3 years ago
d44cd18b96
Add External Accounting Binding key "BoundAt" marking
3 years ago
f81d49d963
Add first working version of External Account Binding
3 years ago
258efca0fa
Improve revocation authorization
3 years ago
97165f1844
Fix test mocking for CreateCertificate
3 years ago
2b15230aa4
Add Serial to Cert ID ACME table and lookup
3 years ago
8f7e700f09
Merge branch 'master' into hs/acme-revocation
3 years ago
857a50434c
Merge branch 'master' into max/cert-mgr-crud
3 years ago
9fdef64709
Admin level API for provisioner mgmt v1
3 years ago
16fe07d4dc
Fix mockSignAuth
3 years ago
0e56932e76
Add support for revocation using JWK
3 years ago
84e7d468f2
Improve handling of ACME revocation
3 years ago
d53bcaf830
Add base logic for ACME revoke-cert
3 years ago
8e4a4ecc1f
Refactor tests for sans
3 years ago
87b72afa25
Fix IP equality check and add more tests
3 years ago
a6d33b7d06
Add tests for sans()
3 years ago
64c15fde7e
Add tests for canonicalize function
3 years ago
c514a187b2
Fix Fail() -_-b
3 years ago
135e912ac8
Improve coverage for TLS-ALPN-01 challenge
3 years ago
218a2adb9f
Add tests for IP Order validations
3 years ago
523ae96749
Change identifier and challenge types to consts
3 years ago
84ea8bd67a
Fix PR comments
3 years ago
af4803b8b8
Fix tests
3 years ago
0c79914d0d
Improve check for single IP in TLS-ALPN-01 challenge
3 years ago
a6405e98a9
Remove fmt.
3 years ago
2f40011da8
Add support for TLS-ALPN-01 challenge
3 years ago
76dcf542d4
Fix mixed DNS and IP SANs in Order
3 years ago
af615db6b5
Support DNS and IPs as SANs in single Order
3 years ago
a0e92f8e99
Verify IP identifier contains valid IP
3 years ago
6486e6016b
Make logic for which challenge types to use clearer
3 years ago
3e36522329
Add preliminary support for TLS-ALPN-01 challenge for IP identifiers
3 years ago
6d9710c88d
Add initial support for ACME IP validation
3 years ago
7b5d6968a5
first commit
3 years ago
0369151bfa
use InsecureSkipVerify for validation
...
The server will not yet have a valid certificate so we need to disable
certificate validation in the HTTPGetter.
3 years ago
2e1524ec2f
Remove the creation on nonce on get acme directory.
...
According to RFC 8555, the replay nonces are only required in POST
requests. And of course in the new-nonce request.
3 years ago
93c3c2bf2e
Error handle non existent provisioner downstream and disable debug route logging
3 years ago
497ec0c79b
Fix linter issues
3 years ago
b1888fd34d
Use different method for unescpaed paths for the router
3 years ago
6cfb9b790c
Remove check of deprecated value
...
- NegotiatedProtocolIsMutual is always true: Deprecated according to
golang docs
3 years ago
63ec2e35b0
Change Clock to empty struct in nosql/nosql | truncate > round
...
- saves space
-
3 years ago
672e3f976e
Few ACME fixes ...
...
- always URL escape linker output
- validateJWS should accept RSAPSS
- GetUpdateAccount -> GetOrUpdateAccount
3 years ago
2e0e62bc4c
add WriteError method for acme api
3 years ago
9aef84b9af
remove unused nonce.clone method
3 years ago
440678cb62
Add markInvalid arg to storeError for invalidating challenge
3 years ago
6b8585c702
PR review fixes / updates
3 years ago
bdace1e53f
Add failure scenarios to db.CreateOrder unit tests
3 years ago
fd447c5b54
Fix small nbf->naf bug in db.CreateOrder
...
- still needs unit test
3 years ago
a785131d09
Fix lint issues
3 years ago
80c8567d99
change errnotfound type for getAccount
...
- more generalized NotFound type rather than the nosql
one we were using
- if the error is not recognized then the logic in create account will
break.
3 years ago
1831920363
Finish order unit tests and remove unused mocklinker
3 years ago
b6ebc0fd25
more unit tests
3 years ago
df05340521
fixing broken unit tests
3 years ago
bdf4c0f836
add acme order unit tests
3 years ago
c0a9f24798
add authorization and order unit tests
3 years ago
a58466589f
add tls-alpn-01 validate unit tests
3 years ago
a8e4bbf715
start Validate unit tests
3 years ago
1fb0f1d7d9
add storeError unit tests
3 years ago
8b4a5a6d8b
add unit tests for dns01 validate
3 years ago
3612a0b990
gethttp01 validate unit tests working
3 years ago
7f9ffbd514
adding more acme nosql unit tests
3 years ago
88e6f00347
nosql account db unit tests
3 years ago
ce13d09dcb
add `at` to time attributes in dbAccount
3 years ago
f72b2ff2c2
[acme db interface] nosql authz unit tests
3 years ago
206909b12e
[acme db interface] unit tests for challenge nosql db
3 years ago
4b1dda5bb6
[acme db interface] tests
3 years ago
074ab7b221
[acme db interface] add linker tests
3 years ago
8d2ebcfd49
[acme db interface] more unit tests
3 years ago
20b9785d20
[acme db interface] continuing unit test work
3 years ago
291fd5d45a
[acme db interface] more unit tests
3 years ago
f71e27e787
[acme db interface] unit test progress
3 years ago
bb8d54e596
[acme db interface] unit tests compiling
3 years ago
f20fcae80e
[acme db interface] wip unit test fixing
3 years ago
fc395f4d69
[acme db interface] compiles!
3 years ago
116869ebc5
[acme db interface] wip
3 years ago
80a6640103
[acme db interface] wip
3 years ago
491c188a5e
[acme db interface] wip
3 years ago
1135ae04fc
[acme db interface] wip
3 years ago
03ba229bcb
[acme db interface] wip more errors
3 years ago
2ae43ef2dc
[acme db interface] wip errors
3 years ago
121cc34cca
[acme db interface] wip
3 years ago
461bad3fef
[acme db interface] wip
3 years ago
0368957e79
[acmedb] (wip)
3 years ago
31ad7f2e9b
[acme] Continued work on acme db interface (wip)
3 years ago
34859551ef
Add new directory structure
3 years ago
088432150d
Beginnings of acmeDB interface
3 years ago
265d49dbf8
Remove debug statement
3 years ago
1f9aa65d66
Add test case
3 years ago
20f8d950c4
Fix broken ValidateChallenge test
3 years ago
4c48048615
Use sync.Mutex as value
4 years ago
272cce522e
Fix test and change method name
4 years ago
f34fb80eb6
[acme] Use lock for ordersByAccID and type to house methods
4 years ago
c94a1c51be
Merge branch 'master' into ssh-cert-templates
4 years ago
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
4 years ago
d30a95236d
Use always go.step.sm/crypto
4 years ago
aaaa7e9b4e
Merge branch 'master' into cert-templates
4 years ago
55bf5a4526
Add cert logging for acme/certificate api
4 years ago
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
4 years ago
c8d225a763
Use x509util from go.step.sm/crypto/x509util
4 years ago
f1773489fc
Fix comment.
4 years ago
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
4 years ago
0c8376a7f6
Fix existing unit tests.
4 years ago
a7fe0104c4
Remove ACME restrictions and add proper template support.
4 years ago
d25e7f64c2
wip
4 years ago
1951669e13
wip
4 years ago
41a1a053d8
Always convert empty list to nil when saving orderIDs index.
4 years ago
704a510a2a
Remove non-pending orders from the acme_orders_by_account index ...
...
- Each acme account has an index in this table. Before this change, the
index would grow unchecked as orders accumulate. This change removes
orders that have moved out of the 'PENDING' state.
4 years ago
a26b5f322d
acme/api: Brush up documentation on key-change
...
Add more specific wording describing what a 501 means and add more color
explaining how official vs unofficial error types should be handled.
4 years ago
b26e6e42b3
acme: Return 501 for the key-change route
...
RFC 8555 § 7.3.5 is not listed as optional but we do not currently
support it. Rather than 404, return a 501 to inform clients that this
functionality is not yet implemented.
The notImplmented error type is not an official error registered in the
ietf:params:acme:error namespace, so prefix if with step:acme:error. An
ACME server is allowed to return other errors and clients should display
the message detail to users.
Fixes: https://github.com/smallstep/certificates/issues/209
4 years ago
6e69f99310
Always set nbf and naf for new ACME orders ...
...
- Use the default value from the ACME provisioner if values are not
defined in the request.
4 years ago
ba91f4ed13
Merge pull request #260 from anxolerd/feat-force-cn-if-empty
...
[Feature] Force CommonName for certificates from ACME provisioner
4 years ago
893a53793a
Modify existing tests to accept forceCNOption modifier
...
Modify existing tests to pass with changes introduced in commit
322200b7db
4 years ago
322200b7db
Implement modifier to set CommonName
...
Implement modifier which sets CommonName to the certificate if
CommonName is empty and forceCN is set in the config. Replace previous
implementation introduced in 0218018ceehttps://github.com/smallstep/certificates/issues/259
Ref: https://github.com/smallstep/certificates/pull/260#issuecomment-628961322
4 years ago
e1409349f3
Allow relative URL for all links in ACME api ...
...
* Pass the request context all the way down the ACME stack.
* Save baseURL in context and use when generating ACME urls.
4 years ago
0218018cee
Generate Subject if `forceCN` and Subject is empty
...
When `forceCN` is set in provisioner configuration and
Subject.CommonName is empty, set Subject.CommonName to the first SAN
from the CSR to follow the letsencrypt's boulder behavior. This is done
in order to support system which require certificate's Subject field to
be non-empty.
N.B. certbot does not send Subject in its certificate request and relies
on similar behavior of letsencrypt.
Closes https://github.com/smallstep/certificates/issues/259
4 years ago
639993bd09
Read host and protocol information from request for links
...
When constructing links we want to read the required host and protocol
information in a dynamic manner from the request for constructing ACME
links such as the directory information. This way, if the server is
running behind a proxy, and we don't know what the exposed URL should
be at runtime, we can construct the required information from the
host, tls and X-Forwarded-Proto fields in the HTTP request.
Inspired by the LetsEncrypt Boulder project (web/relative.go).
4 years ago
Herman Slatman
Panagiotis Siatras
max furman
Mariano Cano
Mariano Cano
Joe Julian
David Cowden
Oleksandr Kovalchuk
Clive Jevons