99299faeeb
Add AuthorizeChallenge unit tests
2 years ago
2b3b2c283a
Add attestation certificate validation for Apple devices
2 years ago
5f5315260a
iOS 16 beta 1 support
2 years ago
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
829530ae90
Fix linter errors
2 years ago
0f651799d0
Reject not enabled attestation formats
2 years ago
fd4e96d1f4
Rename method to IsChallengeEnabled
2 years ago
c77b4ff9c5
Fix linter errors
2 years ago
59c5219a07
Use a type for acme challenges
2 years ago
a89bea701d
Format comment
2 years ago
5df9434286
Fix old comment, device-attest-01 uses the acme payload
2 years ago
3cd72ac72a
Remove debug statements
2 years ago
df96b126dc
Add AuthorizeChallenge unit tests
2 years ago
bca311b05e
Add acme property to enable challenges
...
Fixes #1027
2 years ago
ae8d4d8757
Fix unit test
2 years ago
693dc39481
Merge branch 'master' into device-attestation
2 years ago
c040e4b459
Add unit tests
2 years ago
b7c2f6c482
Check for DNS name validity
2 years ago
66356cff43
Add attestation certificate validation for Apple devices
2 years ago
7e1b0bebd9
iOS 16 beta 1 support
2 years ago
2ac8b69da2
Add ACME permanent-identifier identifier type
2 years ago
aacd6f4cc6
Add device-attest-01 challenge type
2 years ago
fe04f93d7f
all: reformat all go files with the next gofmt (Go 1.19)
...
There are some changes that manually edited, for example using '-' as
default list and grouping imports.
2 years ago
abfbbc8d49
Merge pull request #946 from smallstep/herman/acme-csr-padding
...
Strip base64-url padding from ACME CSR
2 years ago
fd546287ac
Strip base64-url padding from ACME CSR
...
This commit strips the padding from a base64-url encoded CSR
submitted by a client that doesn't use raw base64-url encoding.
2 years ago
e7f4eaf6c4
Remove explicit deprecation notice
...
This will avoid linter errors on other projects for now.
2 years ago
d461918eb0
Merge branch 'master' into context-authority
2 years ago
2ea0c70344
Move acme context middleware to deprecated handler
2 years ago
9147356d8a
Fix linter errors
2 years ago
ba499eeb2a
Fix acme/api tests.
2 years ago
6f9d847bc6
Fix panic in acme/api tests.
2 years ago
d1f75f1720
Refactor ACME api.
2 years ago
fddd6f7d95
Move linker to the acme package.
2 years ago
55b0f72821
Add context methods for the acme linker.
2 years ago
bb8d85a201
Fix unit tests - work in progress
2 years ago
42435ace64
Use scep authority from context
...
This commit also converts all the methods from the handler to
functions.
2 years ago
d13537d426
Use context in the acme handlers.
2 years ago
6e1f8dd7ab
Refactor policy engines into container
2 years ago
2a7620641f
Fix more PR comments
2 years ago
fb81407d6f
Fix ACME policy comments
2 years ago
a9f033ece5
Fix JSON property name for ACME policy
3 years ago
256fe113f7
Improve tests for ACME account policy
3 years ago
7df52dbb76
Add ACME EAB policy
3 years ago
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny
3 years ago
00634fb648
api/render, api/log: initial implementation of the packages ( #860 )
...
* api/render: initial implementation of the package
* acme/api: refactored to support api/render
* authority/admin: refactored to support api/render
* ca: refactored to support api/render
* api: refactored to support api/render
* api/render: implemented Error
* api: refactored to support api/render.Error
* acme/api: refactored to support api/render.Error
* authority/admin: refactored to support api/render.Error
* ca: refactored to support api/render.Error
* ca: fixed broken tests
* api/render, api/log: moved error logging to this package
* acme: refactored Error so that it implements render.RenderableError
* authority/admin: refactored Error so that it implements render.RenderableError
* api/render: implemented RenderableError
* api/render: added test coverage for Error
* api/render: implemented statusCodeFromError
* api: refactored RootsPEM to work with render.Error
* acme, authority/admin: fixed pointer receiver name for consistency
* api/render, errs: moved StatusCoder & StackTracer to the render package
3 years ago
b49307f326
Fix ACME order tests with mock ACME CA
3 years ago
9e0edc7b50
Add early authority policy evaluation to ACME order API
3 years ago
101ca6a2d3
Check admin subjects before changing policy
3 years ago
3ec9a7310c
Fix ACME order identifier allow/deny check
3 years ago
af53a17bb4
Merge branch 'master' into herman/allow-deny
3 years ago
b6f6bd879c
Fix PR comment and add tests for ACME prerequisites checker
3 years ago
e47dd0a666
Add ACME configuration prerequisites check
3 years ago
c3c6f3da72
Merge branch 'master' into herman/allow-deny
3 years ago
bfa2245abb
Merge branch 'master' into herman/normalize-ipv6-dns-names
3 years ago
1fe7362bee
Normalize IPv6 addresses in ACME linker
3 years ago
c1424036bf
Merge branch 'master' into herman/allow-deny
3 years ago
fd9845e9c7
Add cursor and limit to ACME EAB DB interface
3 years ago
6440870a80
Clean up, improve test cases and coverage
3 years ago
ef16febf40
Refactor ACME EAB queries
...
The ACME EAB keys are now also indexed by the provisioner. This
solves part of the issue in which too many EAB keys may be in
memory at a given time.
3 years ago
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
3 years ago
f9ae875f9d
Use short if-style statements
3 years ago
d799359917
Merge branch 'master' into hs/acme-eab
3 years ago
0524122191
Remove authorization flow for different Account private keys
...
As discussed in https://github.com/smallstep/certificates/issues/767 ,
we opted for not including this authorization flow to prevent users
from getting OOMs. We can add the functionality back when the
underlying data store can provide access to a long list of
Authorizations more efficiently, for example when a callback is
implemented.
3 years ago
2215a05c28
Add tests for ACME EAB Admin
...
Refactored some of the existing bits for testing the Authority
API by creation of a new LinkedAuthority interface and changing
visibility of the MockAuthority to be usable by other packages.
At this time, not all of the functions of MockAuthority it usable
yet. Will refactor when needed or requested.
3 years ago
9885d42711
Fix linting issues
3 years ago
6e11657204
Refactor creation of (raw) EAB JWS contents
3 years ago
23898e9b76
Improve EAB JWS validation and increase test coverage
3 years ago
d0c23973cc
Merge branch 'master' into hs/acme-eab
3 years ago
004fc054d5
Fix PR comments
3 years ago
06bb97c91e
Add logic for Account authorizations and improve tests
3 years ago
bae1d256ee
Improve tests for JWK vs. KID revoke auth flow
...
The logic for both test cases is fairly similar, but with some
small differences. Made those clearer by means of some comments.
Also added some comments to the middleware logic that decided
whether to extract JWK or lookup by KID.
3 years ago
a7fbbc4748
Add tests for GetCertificateBySerial
3 years ago
4d01cf8135
Increase test code coverage
3 years ago
2d357da99b
Add tests for ACME revocation
3 years ago
ed295ca15d
Fix linting issue
3 years ago
2d50c96d99
Merge branch 'master' into hs/acme-revocation
3 years ago
e7a988b2cd
Pin golangci-lint to v1.43.0 and fix issues
3 years ago
c7a9c13060
Add tests for extractOrLookupJWK middleware
3 years ago
3151255a25
Merge branch 'master' into hs/acme-revocation
3 years ago
dd4b4b0435
Fix remaining gocritic remarks
3 years ago
e0b495e4c8
Merge branch 'master' into hs/acme-eab
3 years ago
933b40a02a
Introduce gocritic linter and address warnings
3 years ago
0afea2e957
Improve tests for already bound EAB keys
3 years ago
02cd3b6b3b
Fix PR comments
3 years ago
a98fe03e80
Merge branch 'master' into hs/acme-eab
3 years ago
1dba8698e3
Use LinkedCA.EABKey type in ACME EAB API
3 years ago
470b546d59
Merge pull request #557 from joejulian/http01-isv
...
use InsecureSkipVerify for validation
3 years ago
f31ca4f6a4
Add tests for validateExternalAccountBinding
3 years ago
492256f2d7
Add first test cases for EAB and make provisioner unique per EAB
...
Before this commit, EAB keys could be used CA-wide, meaning that
an EAB credential could be used at any ACME provisioner. This
commit changes that behavior, so that EAB credentials are now
intended to be used with a specific ACME provisioner. I think
that makes sense, because from the perspective of an ACME client
the provisioner is like a distinct CA.
Besides that this commit also includes the first tests for EAB.
The logic for creating the EAB JWS as a client has been taken
from github.com/mholt/acmez. This logic may be moved or otherwise
sourced (i.e. from a vendor) as soon as the step client also
(needs to) support(s) EAB with ACME.
3 years ago
c6bfc6eac2
Fix PR comments
3 years ago
d669f3cb14
Fix misspelling
3 years ago
540d5fbbdc
Fix marshaling -> marshalling
3 years ago
2110c7722f
Fix JWK payload key equality check
3 years ago
d44cd18b96
Add External Accounting Binding key "BoundAt" marking
3 years ago
f81d49d963
Add first working version of External Account Binding
3 years ago
258efca0fa
Improve revocation authorization
3 years ago
2b15230aa4
Add Serial to Cert ID ACME table and lookup
3 years ago
8f7e700f09
Merge branch 'master' into hs/acme-revocation
3 years ago
857a50434c
Merge branch 'master' into max/cert-mgr-crud
3 years ago
9fdef64709
Admin level API for provisioner mgmt v1
3 years ago
Mariano Cano
Brandon Weeks
max furman
Shulhan
Herman Slatman
Herman Slatman
Panagiotis Siatras
Mariano Cano