Herman Slatman
3eae04928f
Add tests for ACME Meta object
2 years ago
Herman Slatman
02d679e160
Merge branch 'master' into herman/ignore-empty-acme-meta
2 years ago
Mariano Cano
e27c6c529b
Add support for custom acme ports
...
This change adds the flags --acme-http-port, --acme-tls-port, that
combined with --insecure can be used to set custom ports for ACME
http-01 and tls-alpn-01 challenges. These flags should only be used
for testing purposes.
Fixes #1015
2 years ago
Herman Slatman
b9f238ad4d
Add additional ACME `meta` properties to provisioner configuration
2 years ago
Herman Slatman
c9793561ff
Make `meta` object optional in ACME directory response
...
Harware appliances from Kemp seem to validate the contents of the
`meta` object, even if none of the properties in the `meta` object
is set. According to the RFC, the `meta` object, as well as its
properties are optional, so technically this should be fixed by
the manufacturer.
This commit is to see if we validation of the `meta` object is
skipped if it's not available in the response.
2 years ago
Mariano Cano
a7e597450a
Update acme/challenge_test.go
...
Co-authored-by: Herman Slatman <hslatman@users.noreply.github.com>
2 years ago
Mariano Cano
7a78c76199
Add test simulating YubiKey v5.2.4
...
There are YubiKeys v5.2.4 where the attestation intermediate (f9)
does not have a basic constraint extension, so that certificate
is not marked as a CA. The test and CA in this commit imitates
that use case. Currently the test case returns an error as we
don't support it. But if we change the verification to support
this use case, the test should change accordingly.
2 years ago
Mariano Cano
21666ba887
Revert "Set timestamp when marking an acme challenge invalid"
...
This reverts commit 5f130895f3
.
2 years ago
Mariano Cano
8538ff06b7
Add missing error case.
2 years ago
Mariano Cano
5f130895f3
Set timestamp when marking an acme challenge invalid
2 years ago
Andrew Reed
7101fbb0ee
Provisioner webhooks ( #1001 )
2 years ago
max furman
f3d1863ec6
A few more linter errors
2 years ago
Mariano Cano
99299faeeb
Add AuthorizeChallenge unit tests
2 years ago
Mariano Cano
f0a24bd8ca
Add acme property to enable challenges
...
Fixes #1027
2 years ago
Mariano Cano
191d9e8629
Use go.step.sm/crypto to set the permanent identifier
2 years ago
Mariano Cano
2b3b2c283a
Add attestation certificate validation for Apple devices
2 years ago
Brandon Weeks
5f5315260a
iOS 16 beta 1 support
2 years ago
Brandon Weeks
de5b0ef5c2
Verify key authorization is contained within the TPM quote extraData field
2 years ago
Brandon Weeks
6f2b4d3042
Add ACME permanent-identifier identifier type
2 years ago
max furman
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
Mariano Cano
7dc2067cb2
Update acme/errors.go
...
Co-authored-by: Max <mx.furman@gmail.com>
2 years ago
Mariano Cano
226d36f66f
Fix unit tests
2 years ago
Mariano Cano
8cf6675ce4
Return the internal error instead of the ACME error
...
For ACME errors, return the internal error string instead of the
ACME one on the "Error() string" function. This way the logs will
have more information about the cause of an error.
Fixes #1057
2 years ago
Mariano Cano
34c6c65671
Pass attestation information to the Sign method
...
Attestation information might be useful in authorizing webhooks
2 years ago
Mariano Cano
498549c95c
Extract common function used in tests
2 years ago
Mariano Cano
829530ae90
Fix linter errors
2 years ago
Mariano Cano
6b73a020e3
Add unit tests for apple and step attestations
2 years ago
Mariano Cano
0f651799d0
Reject not enabled attestation formats
2 years ago
Mariano Cano
fd4e96d1f4
Rename method to IsChallengeEnabled
2 years ago
Mariano Cano
c77b4ff9c5
Fix linter errors
2 years ago
Mariano Cano
59c5219a07
Use a type for acme challenges
2 years ago
Mariano Cano
a89bea701d
Format comment
2 years ago
Mariano Cano
5df9434286
Fix old comment, device-attest-01 uses the acme payload
2 years ago
Mariano Cano
c5d3714a63
Fix acme error map
2 years ago
Mariano Cano
08815c5e90
Reneame attestation statement error
2 years ago
Mariano Cano
3cd72ac72a
Remove debug statements
2 years ago
Mariano Cano
e75e7e7cd6
Fix linter warnings
2 years ago
Mariano Cano
54d92095ac
Validate proof of possession signature
...
On the step format, validate proof of possession of the private
key validating the signature in the attestation statement.
2 years ago
Mariano Cano
59b7603d1e
Use a clientAuth only cert for device-attest-01
2 years ago
Mariano Cano
ca412e77cc
Return error on attestation validation
...
The method storeError returns a nil error
2 years ago
Mariano Cano
ab5f916bd3
Define ErrorBadAttestationStatement
2 years ago
Mariano Cano
735c9d49b0
Add support for yubikey attestation
2 years ago
Mariano Cano
df96b126dc
Add AuthorizeChallenge unit tests
2 years ago
Mariano Cano
bca311b05e
Add acme property to enable challenges
...
Fixes #1027
2 years ago
Mariano Cano
ae8d4d8757
Fix unit test
2 years ago
Mariano Cano
693dc39481
Merge branch 'master' into device-attestation
2 years ago
Mariano Cano
23b8f45b37
Address gosec warnings
...
Most if not all false positives
2 years ago
max furman
c040e4b459
Add unit tests
2 years ago
max furman
b7c2f6c482
Check for DNS name validity
2 years ago
Mariano Cano
b62f4d1000
Add lgtm comments on some security warnings
2 years ago