Small ACME client written with process isolation and minimal privileges in mind http://git.guilhem.org/lacme/atom?h=debian%2Fbullseye 2021-02-22T02:19:57Z 2021-02-22T02:19:57Z Guilhem Moulin guilhem@fripost.org 2021-02-22T02:19:57Z urn:sha1:3eba02ef820a393bd5781be9f8fcda1611ae7c3d 2021-02-22T00:05:06Z Guilhem Moulin guilhem@fripost.org 2021-02-22T00:04:58Z urn:sha1:ed85b6a6740028ce9ce821975a534f696eabd8ed 2021-02-21T23:14:51Z Guilhem Moulin guilhem@fripost.org 2021-02-21T17:49:14Z urn:sha1:9898b1877ce2973bbc336921969bd7f16d3698fa This saves a round trip and provides a safeguard against malicious clients. 2021-02-21T18:41:40Z Guilhem Moulin guilhem@fripost.org 2021-02-21T13:27:50Z urn:sha1:ba6addf54cef0b1536dc87c42a41b4dc207ac884 Passing the JWA to the ACME client is required if we want to support account keys other than RSA. As of 0.7 both lacme-accountd(1) and lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1). Passing the JWK thumbprint is handy as it gives more flexibility if RFC 8555 sec. 8.1 were to be updated with another digest algorithm (it's currently hardcoded to SHA-256). A single lacme-account(1) instance might be used to sign requests from many clients, and it's easier to upgrade a single ‘lacme-accountd’ than many ‘lacme’. Moreover, in some restricted environments lacme-accountd might hide the JWK from the client to prevent ‘newAccount’ requests (such as contact updates); passing its thumbprint is enough for ‘newOrder’ requests. 2021-02-20T23:19:51Z Guilhem Moulin guilhem@fripost.org 2021-02-20T21:05:18Z urn:sha1:74c0a11722cf1e01b9a9834e89a07b55eaf01080 Prefixed with a timestamp. 2021-02-20T23:03:59Z Guilhem Moulin guilhem@fripost.org 2021-02-15T23:00:40Z urn:sha1:cf3d42c066d2f54d4a57aa38907a7c6c7d06aeb6 Before printing them to the standard error. 2021-02-20T21:13:46Z Guilhem Moulin guilhem@fripost.org 2021-02-20T18:56:15Z urn:sha1:8e612e071b8c0fc99ebf91673f53ca5f0d6bdd11 It's an internal flag, but can be useful for authorized_keys(5) restrictions. 2021-02-20T21:13:41Z Guilhem Moulin guilhem@fripost.org 2021-02-18T20:07:01Z urn:sha1:0ef94d85e58497dcb2c4c954cadcac918032467a lacme(8): for --config=, --socket=, --config-certs= (and ‘socket’/ ‘config-certs’/‘challenge-directory’ configuration options *before* privilege drop; and for the [accountd] section ‘command’/‘config’ configuration options *after* privilege drop). lacme-accountd(1): for --config=, --socket= and --privkey= (and ‘socket’/‘privkey’ configuration options). This also changes the default configuration file location. lacme(8) and lacme-accountd(1) now respectively use /etc/lacme/lacme.conf resp. /etc/lacme/lacme-accountd.conf when running as root, and $XDG_CONFIG_HOME/lacme/lacme.conf resp. $XDG_CONFIG_HOME/lacme/lacme-accountd.conf when running as a normal user. There is no fallback to /etc anymore. 2021-02-20T19:16:34Z Guilhem Moulin guilhem@fripost.org 2021-02-19T17:31:20Z urn:sha1:8de74ffb4a2008a61c05e9a24c8fa9b14858d2be 2021-02-20T19:16:34Z Guilhem Moulin guilhem@fripost.org 2021-02-18T00:14:23Z urn:sha1:ad1856777bf108826008b60a1e70c1e3fbb94ec7 One need to use the lacme-accountd(1) configuration file for that instead.