Add support for TLS Feature extension from RFC 7633.

This is mostly useful for OCSP Must-Staple.

1 files changed, 3 insertions, 2 deletions

diff --git a/lacme b/lacme
index bd4bd73..045c5b4 100755
--- a/lacme
+++ b/lacme
@@ -159,6 +159,7 @@ sub gen_csr(%) {
     );
     $config->print("keyUsage = critical, $args{keyUsage}\n")   if defined $args{keyUsage};
     $config->print("subjectAltName = $args{subjectAltName}\n") if defined $args{subjectAltName};
+    $config->print("tlsfeature = $args{tlsfeature}\n") if defined $args{tlsfeature};
     $config->close() or die "Can't close: $!";
 
     my @args = (qw/-new -batch -key/, $args{'certificate-key'});
@@ -703,7 +704,7 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
             my $def = delete $h->{_} // {};
             $defaults{$_} = $def->{$_} foreach keys %$def;
             my @valid = qw/certificate certificate-chain certificate-key min-days CAfile
-                           hash keyUsage subject subjectAltName chown chmod notify/;
+                           hash keyUsage subject subjectAltName tlsfeature chown chmod notify/;
             foreach my $s (keys %$h) {
                 $conf->{$s} = { map { $_ => delete $h->{$s}->{$_} } @valid };
                 die "Unknown option(s) in [$s]: ".join(', ', keys %{$h->{$s}})."\n" if %{$h->{$s}};
@@ -744,7 +745,7 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
         }
 
         # generate the CSR
-        my $csr = gen_csr(map {$_ => $conf->{$_}} qw/certificate-key subject subjectAltName keyUsage hash/) // do {
+        my $csr = gen_csr(map {$_ => $conf->{$_}} qw/certificate-key keyUsage subject subjectAltName tlsfeature hash/) // do {
             print STDERR "[$s] Warning: Couldn't generate CSR, skipping\n";
             $rv = 1;
             next;