lacme/lacme-accountd, branch debian/bullseye Small ACME client written with process isolation and minimal privileges in mind Prepare new release v0.8.0. 2021-02-22T02:19:57+00:00 Guilhem Moulin guilhem@fripost.org 2021-02-22T02:19:57+00:00 3eba02ef820a393bd5781be9f8fcda1611ae7c3d 






Print error messages only once.
2021-02-22T02:18:50+00:00

Guilhem Moulin
guilhem@debian.org

2021-02-22T02:13:26+00:00

f55a2782db2e86c88ed4780d7ed54b09792d07d6












logfile: treat empty values as unset.
2021-02-21T23:32:26+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T23:28:02+00:00

fef888045bfd03c26822782411ff835c03440d58












lacme-accountd(1): new setting 'keyid'.
2021-02-21T23:14:51+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T17:49:14+00:00

9898b1877ce2973bbc336921969bd7f16d3698fa

This saves a round trip and provides a safeguard against malicious
clients.





This saves a round trip and provides a safeguard against malicious
clients.







accountd: Improve log message for incoming requests.
2021-02-21T18:58:56+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T18:54:25+00:00

1bdaeae835b5c9914f9c2107efda150d643cda12












accountd: Pass JWA and JWK thumbprint via extended greeting data.
2021-02-21T18:41:40+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T13:27:50+00:00

ba6addf54cef0b1536dc87c42a41b4dc207ac884

Passing the JWA to the ACME client is required if we want to support
account keys other than RSA.  As of 0.7 both lacme-accountd(1) and
lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1).

Passing the JWK thumbprint is handy as it gives more flexibility if RFC
8555 sec. 8.1 were to be updated with another digest algorithm (it's
currently hardcoded to SHA-256).  A single lacme-account(1) instance
might be used to sign requests from many clients, and it's easier to
upgrade a single ‘lacme-accountd’ than many ‘lacme’.  Moreover, in some
restricted environments lacme-accountd might hide the JWK from the
client to prevent ‘newAccount’ requests (such as contact updates);
passing its thumbprint is enough for ‘newOrder’ requests.





Passing the JWA to the ACME client is required if we want to support
account keys other than RSA.  As of 0.7 both lacme-accountd(1) and
lacme(8) hardcode “RS256” (SHA256withRSA per RFC 7518 sec. A.1).

Passing the JWK thumbprint is handy as it gives more flexibility if RFC
8555 sec. 8.1 were to be updated with another digest algorithm (it's
currently hardcoded to SHA-256).  A single lacme-account(1) instance
might be used to sign requests from many clients, and it's easier to
upgrade a single ‘lacme-accountd’ than many ‘lacme’.  Moreover, in some
restricted environments lacme-accountd might hide the JWK from the
client to prevent ‘newAccount’ requests (such as contact updates);
passing its thumbprint is enough for ‘newOrder’ requests.







wording
2021-02-21T18:41:37+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T16:34:51+00:00

d56b957dbae6c8214d50ce88d0ea04eb4654b843












wording
2021-02-21T12:03:55+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T12:01:14+00:00

594c32ac58167396980a404261047e94155a83d3












accountd: Fix prototype.
2021-02-21T12:00:31+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-21T12:00:31+00:00

9bc3b5756ef3f36aaa0a1b28db71767c87e9446e












lacme-accountd: new setting 'logfile' to log signature requests.
2021-02-20T23:19:51+00:00

Guilhem Moulin
guilhem@fripost.org

2021-02-20T21:05:18+00:00

74c0a11722cf1e01b9a9834e89a07b55eaf01080

Prefixed with a timestamp.





Prefixed with a timestamp.