lacme/tests, branch debian/latest

Fix test suite.

2024-06-13T15:38:40+00:00

Since we don't pin staging intermediate certificates anymore we drop the
test where the CA bundle contains only intermediates.

Fix post-issuance validation logic.

2024-06-13T14:48:05+00:00

Rather than adding intermediates in the certificate bundle we now
validate the leaf certificate with intermediates as untrusted (used for
chain building only).  Only the root certificates are used as trust
anchor.

Not pining intermediate certificates anymore is in line with Let's
Encrypt's latest recommendations:

    Rotating the set of intermediates we issue from helps keep the
    Internet agile and more secure.  It encourages automation and
    efficiency, and discourages outdated practices like key pinning.
    “Key Pinning” is a practice in which clients — either ACME clients
    getting certificates for their site, or apps connecting to their own
    backend servers — decide to trust only a single issuing intermediate
    certificate rather than delegating trust to the system trust store.
    Updating pinned keys is a manual process, which leads to an
    increased risk of errors and potential business continuity failures.
    — https://letsencrypt.org/2024/03/19/new-intermediate-certificates:

Pass `-in /dev/stdin` option to openssl(1) to avoid warning with recent versions.

2024-06-13T13:41:12+00:00

OpenSSL 3.2 from Debian sid spews

    Warning: Reading certificate from stdin since no -in or -new option is given

without an explicit `-in /dev/stdin`.

t/cert-extensions: Fix tr(1) range syntax.

2024-06-13T13:41:12+00:00

t/cert-install: Ensure the subjectName is lowercase.

2024-06-13T13:40:56+00:00

Domain names are case insensitive so it shouldn't matter, but Let's
Encrypt (staging) ACME server fails with

        400 Bad Request (Invalid identifiers requested :: Cannot issue for "YXJCTT7S6K2RQLVO.lacme-test.guilhem.org": Domain name contains an invalid character)

if the sub-domain part of the subjectName is left all-caps.

tests/account-encrypted-*: Set TERM="linux".

2023-04-26T15:41:24+00:00

tests: Point stretch's archive URL to archive.d.o.

2023-04-25T09:59:39+00:00

See https://lists.debian.org/msgid-search/87tty79lwo.fsf@43-1.org .

Adjust test suite against current Let's Encrypt staging environment.

2023-01-25T02:23:45+00:00

lacme: pass a temporary JSON file with the client configuration to the internal client.

2021-02-25T09:30:22+00:00

So it doesn't have to parse the INI file again.  Also, while lacme.conf
is world-readable by default, one might restrict permissions and add
private information in there, not realizing that everything, including
comments, will be readable by the client.

lacme: Add 'owner' resp. 'mode' as (prefered) alias for 'chown' resp. 'chmod'.

2021-02-24T20:32:06+00:00