Herman Slatman
84e7d468f2
Improve handling of ACME revocation
3 years ago
Herman Slatman
d53bcaf830
Add base logic for ACME revoke-cert
3 years ago
Herman Slatman
8e4a4ecc1f
Refactor tests for sans
3 years ago
Herman Slatman
87b72afa25
Fix IP equality check and add more tests
3 years ago
Herman Slatman
a6d33b7d06
Add tests for sans()
3 years ago
Herman Slatman
64c15fde7e
Add tests for canonicalize function
3 years ago
Herman Slatman
c514a187b2
Fix Fail() -_-b
3 years ago
Herman Slatman
135e912ac8
Improve coverage for TLS-ALPN-01 challenge
3 years ago
Herman Slatman
218a2adb9f
Add tests for IP Order validations
3 years ago
Herman Slatman
523ae96749
Change identifier and challenge types to consts
3 years ago
Herman Slatman
84ea8bd67a
Fix PR comments
3 years ago
Herman Slatman
af4803b8b8
Fix tests
3 years ago
Herman Slatman
0c79914d0d
Improve check for single IP in TLS-ALPN-01 challenge
3 years ago
Herman Slatman
a6405e98a9
Remove fmt.
3 years ago
Herman Slatman
2f40011da8
Add support for TLS-ALPN-01 challenge
3 years ago
Herman Slatman
76dcf542d4
Fix mixed DNS and IP SANs in Order
3 years ago
Herman Slatman
af615db6b5
Support DNS and IPs as SANs in single Order
3 years ago
Herman Slatman
a0e92f8e99
Verify IP identifier contains valid IP
3 years ago
Herman Slatman
6486e6016b
Make logic for which challenge types to use clearer
3 years ago
Herman Slatman
3e36522329
Add preliminary support for TLS-ALPN-01 challenge for IP identifiers
3 years ago
Herman Slatman
6d9710c88d
Add initial support for ACME IP validation
3 years ago
max furman
7b5d6968a5
first commit
3 years ago
Joe Julian
0369151bfa
use InsecureSkipVerify for validation
...
The server will not yet have a valid certificate so we need to disable
certificate validation in the HTTPGetter.
4 years ago
Mariano Cano
2e1524ec2f
Remove the creation on nonce on get acme directory.
...
According to RFC 8555, the replay nonces are only required in POST
requests. And of course in the new-nonce request.
4 years ago
max furman
93c3c2bf2e
Error handle non existent provisioner downstream and disable debug route logging
4 years ago
max furman
497ec0c79b
Fix linter issues
4 years ago
max furman
b1888fd34d
Use different method for unescpaed paths for the router
4 years ago
max furman
6cfb9b790c
Remove check of deprecated value
...
- NegotiatedProtocolIsMutual is always true: Deprecated according to
golang docs
4 years ago
max furman
63ec2e35b0
Change Clock to empty struct in nosql/nosql | truncate > round
...
- saves space
-
4 years ago
max furman
672e3f976e
Few ACME fixes ...
...
- always URL escape linker output
- validateJWS should accept RSAPSS
- GetUpdateAccount -> GetOrUpdateAccount
4 years ago
max furman
2e0e62bc4c
add WriteError method for acme api
4 years ago
max furman
9aef84b9af
remove unused nonce.clone method
4 years ago
max furman
440678cb62
Add markInvalid arg to storeError for invalidating challenge
4 years ago
max furman
6b8585c702
PR review fixes / updates
4 years ago
max furman
bdace1e53f
Add failure scenarios to db.CreateOrder unit tests
4 years ago
max furman
fd447c5b54
Fix small nbf->naf bug in db.CreateOrder
...
- still needs unit test
4 years ago
max furman
a785131d09
Fix lint issues
4 years ago
max furman
80c8567d99
change errnotfound type for getAccount
...
- more generalized NotFound type rather than the nosql
one we were using
- if the error is not recognized then the logic in create account will
break.
4 years ago
max furman
1831920363
Finish order unit tests and remove unused mocklinker
4 years ago
max furman
b6ebc0fd25
more unit tests
4 years ago
max furman
df05340521
fixing broken unit tests
4 years ago
max furman
bdf4c0f836
add acme order unit tests
4 years ago
max furman
c0a9f24798
add authorization and order unit tests
4 years ago
max furman
a58466589f
add tls-alpn-01 validate unit tests
4 years ago
max furman
a8e4bbf715
start Validate unit tests
4 years ago
max furman
1fb0f1d7d9
add storeError unit tests
4 years ago
max furman
8b4a5a6d8b
add unit tests for dns01 validate
4 years ago
max furman
3612a0b990
gethttp01 validate unit tests working
4 years ago
max furman
7f9ffbd514
adding more acme nosql unit tests
4 years ago
max furman
88e6f00347
nosql account db unit tests
4 years ago
max furman
ce13d09dcb
add `at` to time attributes in dbAccount
4 years ago
max furman
f72b2ff2c2
[acme db interface] nosql authz unit tests
4 years ago
max furman
206909b12e
[acme db interface] unit tests for challenge nosql db
4 years ago
max furman
4b1dda5bb6
[acme db interface] tests
4 years ago
max furman
074ab7b221
[acme db interface] add linker tests
4 years ago
max furman
8d2ebcfd49
[acme db interface] more unit tests
4 years ago
max furman
20b9785d20
[acme db interface] continuing unit test work
4 years ago
max furman
291fd5d45a
[acme db interface] more unit tests
4 years ago
max furman
f71e27e787
[acme db interface] unit test progress
4 years ago
max furman
bb8d54e596
[acme db interface] unit tests compiling
4 years ago
max furman
f20fcae80e
[acme db interface] wip unit test fixing
4 years ago
max furman
fc395f4d69
[acme db interface] compiles!
4 years ago
max furman
116869ebc5
[acme db interface] wip
4 years ago
max furman
80a6640103
[acme db interface] wip
4 years ago
max furman
491c188a5e
[acme db interface] wip
4 years ago
max furman
1135ae04fc
[acme db interface] wip
4 years ago
max furman
03ba229bcb
[acme db interface] wip more errors
4 years ago
max furman
2ae43ef2dc
[acme db interface] wip errors
4 years ago
max furman
121cc34cca
[acme db interface] wip
4 years ago
max furman
461bad3fef
[acme db interface] wip
4 years ago
max furman
0368957e79
[acmedb] (wip)
4 years ago
max furman
31ad7f2e9b
[acme] Continued work on acme db interface (wip)
4 years ago
max furman
34859551ef
Add new directory structure
4 years ago
max furman
088432150d
Beginnings of acmeDB interface
4 years ago
max furman
265d49dbf8
Remove debug statement
4 years ago
max furman
1f9aa65d66
Add test case
4 years ago
max furman
20f8d950c4
Fix broken ValidateChallenge test
4 years ago
max furman
4c48048615
Use sync.Mutex as value
4 years ago
max furman
272cce522e
Fix test and change method name
4 years ago
max furman
f34fb80eb6
[acme] Use lock for ordersByAccID and type to house methods
4 years ago
Mariano Cano
c94a1c51be
Merge branch 'master' into ssh-cert-templates
4 years ago
Mariano Cano
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
4 years ago
Mariano Cano
d30a95236d
Use always go.step.sm/crypto
4 years ago
Mariano Cano
aaaa7e9b4e
Merge branch 'master' into cert-templates
4 years ago
max furman
55bf5a4526
Add cert logging for acme/certificate api
4 years ago
Mariano Cano
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
4 years ago
Mariano Cano
c8d225a763
Use x509util from go.step.sm/crypto/x509util
4 years ago
Mariano Cano
f1773489fc
Fix comment.
4 years ago
Mariano Cano
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
4 years ago
Mariano Cano
0c8376a7f6
Fix existing unit tests.
4 years ago
Mariano Cano
a7fe0104c4
Remove ACME restrictions and add proper template support.
4 years ago
max furman
d25e7f64c2
wip
4 years ago
max furman
1951669e13
wip
4 years ago
max furman
41a1a053d8
Always convert empty list to nil when saving orderIDs index.
4 years ago
max furman
704a510a2a
Remove non-pending orders from the acme_orders_by_account index ...
...
- Each acme account has an index in this table. Before this change, the
index would grow unchecked as orders accumulate. This change removes
orders that have moved out of the 'PENDING' state.
4 years ago
David Cowden
a26b5f322d
acme/api: Brush up documentation on key-change
...
Add more specific wording describing what a 501 means and add more color
explaining how official vs unofficial error types should be handled.
4 years ago
David Cowden
b26e6e42b3
acme: Return 501 for the key-change route
...
RFC 8555 § 7.3.5 is not listed as optional but we do not currently
support it. Rather than 404, return a 501 to inform clients that this
functionality is not yet implemented.
The notImplmented error type is not an official error registered in the
ietf:params:acme:error namespace, so prefix if with step:acme:error. An
ACME server is allowed to return other errors and clients should display
the message detail to users.
Fixes: https://github.com/smallstep/certificates/issues/209
4 years ago
max furman
6e69f99310
Always set nbf and naf for new ACME orders ...
...
- Use the default value from the ACME provisioner if values are not
defined in the request.
4 years ago
Max
ba91f4ed13
Merge pull request #260 from anxolerd/feat-force-cn-if-empty
...
[Feature] Force CommonName for certificates from ACME provisioner
4 years ago
Oleksandr Kovalchuk
893a53793a
Modify existing tests to accept forceCNOption modifier
...
Modify existing tests to pass with changes introduced in commit
322200b7db
. This is safe to do as
tests assert exact length of modifiers, which has changed.
4 years ago
Oleksandr Kovalchuk
322200b7db
Implement modifier to set CommonName
...
Implement modifier which sets CommonName to the certificate if
CommonName is empty and forceCN is set in the config. Replace previous
implementation introduced in 0218018cee
with new modifier.
Closes https://github.com/smallstep/certificates/issues/259
Ref: https://github.com/smallstep/certificates/pull/260#issuecomment-628961322
4 years ago
max furman
e1409349f3
Allow relative URL for all links in ACME api ...
...
* Pass the request context all the way down the ACME stack.
* Save baseURL in context and use when generating ACME urls.
4 years ago
Oleksandr Kovalchuk
0218018cee
Generate Subject if `forceCN` and Subject is empty
...
When `forceCN` is set in provisioner configuration and
Subject.CommonName is empty, set Subject.CommonName to the first SAN
from the CSR to follow the letsencrypt's boulder behavior. This is done
in order to support system which require certificate's Subject field to
be non-empty.
N.B. certbot does not send Subject in its certificate request and relies
on similar behavior of letsencrypt.
Closes https://github.com/smallstep/certificates/issues/259
4 years ago
Clive Jevons
639993bd09
Read host and protocol information from request for links
...
When constructing links we want to read the required host and protocol
information in a dynamic manner from the request for constructing ACME
links such as the directory information. This way, if the server is
running behind a proxy, and we don't know what the exposed URL should
be at runtime, we can construct the required information from the
host, tls and X-Forwarded-Proto fields in the HTTP request.
Inspired by the LetsEncrypt Boulder project (web/relative.go).
5 years ago
max furman
4cb777bdc1
ACME accountUpdate ignore fields not recognized by the server.
5 years ago
Ivan Bertona
cb46a8b741
Small test fixes.
5 years ago
Ivan Bertona
10bc548c6e
Remove leftover file.
5 years ago
Ivan Bertona
200cfd2433
Add test for missing TLS certificates in response.
5 years ago
Ivan Bertona
157686e338
Tiny finishes.
5 years ago
Ivan Bertona
6843408d42
Reject obsolete id-pe-acmeIdentifier.
5 years ago
Ivan Bertona
6b5a2b17b5
Add challenge unmarshal test cases.
5 years ago
Ivan Bertona
b8208ec401
Add test case for failed came-tls/1 protocol negotiation.
5 years ago
Ivan Bertona
4b473732d9
Add support for TLS-ALPN-01 challenge.
5 years ago
max furman
c255274572
Should be returning status code 400 for ACME Account Not Found.
...
Issue #173
5 years ago
Mariano Cano
0a890a5c16
Add the commonName as a DNSName to match RFC.
...
Normalize names and remove the use of reflection.
5 years ago
max furman
432ed0090f
Use _'s in table names.
5 years ago
max furman
967e86a48b
Simplify trimming *. prefix of domain in acme dns validation.
5 years ago
Oleksandr Kovalchuk
ec8ff0bced
Add testcase which ensures we pass correct domain to lookupTxt
...
Make sure we do not pass domains with asterisk (wildcard) in the middle,
like _acme-challenge.*.example.com to lookupTxt function, but preprocess
domain and remove leading wildcard so we lookup for
_acme-challenge.example.com.
5 years ago
Oleksandr Kovalchuk
46832bb9b3
Remove superflurous Printf statement
...
The statement was used for debug purposes and should not be included in
the final build
5 years ago
Oleksandr Kovalchuk
a995cca418
Perform domain normalization for wildcard domains
...
Perform domain normalization for wildcard domains, so we do query
TXT records for _acme-challenge.example.domain instead of
_acme-challenge.*.example.domain when performing DNS-01 challenge. In
this way the behavior is consistent with letsencrypt and records queried
are in sync with the ones that are shown in certbot manual mode.
5 years ago
Max
0a96062b76
Merge pull request #128 from jkralik/returnCertChain
...
Change api of functions Authority.Sign, Authority.Renew
5 years ago
max furman
d368791606
Add x5c provisioner capabilities
5 years ago
max furman
7aec7c2612
Create ACME database tables when initializing ACME autority.
5 years ago
Jozef Kralik
bc6074f596
Change api of functions Authority.Sign, Authority.Renew
...
Returns certificate chain instead of 2 members.
Implements #126
5 years ago
max furman
e92dfb2516
Fix authz shadow declarations
5 years ago
max furman
fe7973c060
wip
5 years ago
max furman
e3826dd1c3
Add ACME CA capabilities
5 years ago